[PATCH]add regex benchmark

20 files changed, 38504 insertions, 16 deletions

diff --git a/scanner/expr_matcher/adapter_hs/adapter_hs.cpp b/scanner/expr_matcher/adapter_hs/adapter_hs.cpp
index 44846ef..4d57dcf 100644
--- a/scanner/expr_matcher/adapter_hs/adapter_hs.cpp
+++ b/scanner/expr_matcher/adapter_hs/adapter_hs.cpp
@@ -40,6 +40,7 @@ static const char *hs_module_name_str(const char *name)
 #define MODULE_ADAPTER_HS	 hs_module_name_str("maat.adapter_hs")
 
 struct adpt_hs_compile_data {
+    enum expr_pattern_type pat_type;
     unsigned int *ids;
     unsigned int *flags;
     char **patterns;
@@ -198,7 +199,7 @@ static int adpt_hs_build_database(struct adapter_hs_runtime *hs_rt,
     if (regex_cd != NULL) {
         err = hs_compile_multi((const char *const *)regex_cd->patterns,
                                 regex_cd->flags, regex_cd->ids, regex_cd->n_patterns,
-                                HS_MODE_STREAM | HS_MODE_SOM_HORIZON_SMALL,
+                                HS_MODE_STREAM,
                                 NULL, &hs_rt->regex_db, &compile_err);
         if (err != HS_SUCCESS) {
             if (compile_err) {
@@ -213,9 +214,11 @@ static int adpt_hs_build_database(struct adapter_hs_runtime *hs_rt,
     return 0;
 }
 
-static struct adpt_hs_compile_data *adpt_hs_compile_data_new(size_t n_patterns)
+static struct adpt_hs_compile_data *
+adpt_hs_compile_data_new(enum expr_pattern_type pat_type, size_t n_patterns)
 {
     struct adpt_hs_compile_data *hs_cd = ALLOC(struct adpt_hs_compile_data, 1);
+    hs_cd->pat_type = pat_type;
     hs_cd->patterns = ALLOC(char *, n_patterns);
     hs_cd->pattern_lens = ALLOC(size_t, n_patterns);
     hs_cd->n_patterns = n_patterns;
@@ -261,7 +264,10 @@ static void populate_compile_data(struct adpt_hs_compile_data *compile_data,
     compile_data->ids[index] = pattern_id;
 
     /* set flags */
-    compile_data->flags[index] |= HS_FLAG_SOM_LEFTMOST;
+    if (compile_data->pat_type == EXPR_PATTERN_TYPE_STR) {
+        compile_data->flags[index] |= HS_FLAG_SOM_LEFTMOST;
+    }
+    
     if (case_sensitive == EXPR_CASE_INSENSITIVE) {
         compile_data->flags[index] |= HS_FLAG_CASELESS;
     }
@@ -372,11 +378,11 @@ void *adapter_hs_new(struct expr_rule *rules, size_t n_rule,
     struct adpt_hs_compile_data *regex_cd = NULL;
 
     if (n_literal_pattern > 0) {
-        literal_cd = adpt_hs_compile_data_new(n_literal_pattern);
+        literal_cd = adpt_hs_compile_data_new(EXPR_PATTERN_TYPE_STR, n_literal_pattern);
     }
    
     if (n_regex_pattern > 0) {
-        regex_cd = adpt_hs_compile_data_new(n_regex_pattern);
+        regex_cd = adpt_hs_compile_data_new(EXPR_PATTERN_TYPE_REG, n_regex_pattern);
     }
     
     size_t pattern_cnt = n_literal_pattern + n_regex_pattern;
diff --git a/src/json2iris.c b/src/json2iris.c
index 59d93c6..876698b 100644
--- a/src/json2iris.c
+++ b/src/json2iris.c
@@ -821,7 +821,7 @@ static int write_group_rule(cJSON *group_json, int parent_id,
 		if (NULL == region_json && NULL == sub_groups) {
 			log_info(logger, MODULE_JSON2IRIS, 
                      "[%s:%d] A group of compile rule %d has neither regions, "
-                     "sub groups, nor refered another exisited group", 
+                     "sub groups, nor refered another existed group", 
                      __FUNCTION__, __LINE__, tracking_compile_id);
 		}
 	}
diff --git a/src/maat_compile.c b/src/maat_compile.c
index 574b6d2..9ec95ae 100644
--- a/src/maat_compile.c
+++ b/src/maat_compile.c
@@ -1293,7 +1293,7 @@ static int maat_remove_group_from_compile(struct rcu_hash_table *hash_tbl,
         if (NULL == compile) {
             log_error(logger, MODULE_COMPILE,
                       "[%s:%d] Remove group_id:%lld from compile_id:%lld failed, compile"
-                      " is not exisited.", __FUNCTION__, __LINE__, g2c_item->group_id,
+                      " is not existed.", __FUNCTION__, __LINE__, g2c_item->group_id,
                       compile_id);
             return -1;
         } else {
@@ -1349,7 +1349,7 @@ static int maat_remove_group_from_compile(struct rcu_hash_table *hash_tbl,
         } else {
             log_error(logger, MODULE_COMPILE,
                       "[%s:%d] Remove group_id:%lld from compile_id:%lld failed, "
-                      "compile is not exisited.", __FUNCTION__, __LINE__, 
+                      "compile is not existed.", __FUNCTION__, __LINE__, 
                       g2c_item->group_id, compile_id);
             return -1;
         }
diff --git a/src/maat_config_monitor.c b/src/maat_config_monitor.c
index 8fda6f6..1ac467b 100644
--- a/src/maat_config_monitor.c
+++ b/src/maat_config_monitor.c
@@ -55,7 +55,7 @@ static int cm_read_cfg_index_file(const char *path, struct cm_table_info_t *idx,
 
 		ret = stat(idx[i].cfg_path, &file_info);
 		if (ret != 0) {
-			log_error(logger, MODULE_CONFIG_MONITOR, "%s of %s not exisit",
+			log_error(logger, MODULE_CONFIG_MONITOR, "%s of %s not exist",
 					  idx[i].cfg_path, path);
 			fclose(fp);
 			return -1;
diff --git a/src/maat_group.c b/src/maat_group.c
index 5777b7d..db9ec44 100644
--- a/src/maat_group.c
+++ b/src/maat_group.c
@@ -582,7 +582,7 @@ static int group_topology_add_group_to_group(struct maat_group_topology *group_t
     //No duplicated edges between two groups.
     if (edge_id > 0) {
 		log_error(group_topo->logger, MODULE_GROUP,
-                  "[%s:%d] Add group %d to group %d failed, relation already exisited.",
+                  "[%s:%d] Add group %d to group %d failed, relation already existed.",
 				  __FUNCTION__, __LINE__, group->group_id, super_group->group_id);
 		ret = -1;
 	} else {
@@ -608,7 +608,7 @@ static int group_topology_del_group_from_group(struct maat_group_topology *group
 	struct maat_group *group = group_topology_find_group(group_topo, group_id);
 	if (NULL == group) {
 		log_error(group_topo->logger, MODULE_GROUP,
-				  "[%s:%d] Del group %d from group %d failed, group %d not exisited.",
+				  "[%s:%d] Del group %d from group %d failed, group %d not existed.",
 				  __FUNCTION__, __LINE__, group_id, super_group_id, group_id);
 		return -1;	
 	}
@@ -616,7 +616,7 @@ static int group_topology_del_group_from_group(struct maat_group_topology *group
     struct maat_group *super_group = group_topology_find_group(group_topo, super_group_id);
 	if (NULL == super_group) {
 		log_error(group_topo->logger, MODULE_GROUP,
-				  "[%s:%d] Del group %d from group %d failed, superior group %d not exisited.",
+				  "[%s:%d] Del group %d from group %d failed, superior group %d not existed.",
 				  __FUNCTION__, __LINE__, group_id, super_group_id, super_group_id);
 		return -1;	
 	}
diff --git a/src/maat_redis_monitor.c b/src/maat_redis_monitor.c
index b288e07..758721e 100644
--- a/src/maat_redis_monitor.c
+++ b/src/maat_redis_monitor.c
@@ -1138,7 +1138,7 @@ static void exec_serial_rule(redisContext *c,	const char *transaction_list,
 				(*cnt)++;
 				append_cmd_cnt++;
 				
-				//NX: Don't update already exisiting elements. Always add new elements.
+				//NX: Don't update already existing elements. Always add new elements.
 				redisAppendCommand(c, "RPUSH %s DEL,%s,%lld",
 						              transaction_list,
 						              s_rule[i].table_name,
diff --git a/test/benchmark/benchmark_hs_gtest.cpp b/test/benchmark/benchmark_hs_gtest.cpp
index 8aea023..d805b8a 100644
--- a/test/benchmark/benchmark_hs_gtest.cpp
+++ b/test/benchmark/benchmark_hs_gtest.cpp
@@ -165,6 +165,69 @@ void generate_group2compile_sample(const char *table_name, int sample_count)
     fclose(fp);
 }
 
+void *perf_regex_scan_thread(void *arg)
+{
+    struct thread_param *param = (struct thread_param *)arg;
+    struct maat *maat_inst = param->maat_inst;
+    const char *table_name = param->table_name;
+    struct timespec start, end;
+    const char *scan_data = "Maat was the goddness of harmony, justice, and truth in ancient Egyptian."
+                            "Request from User-Agent: Chrome, will go to yyy.abc.net";
+    long long results[ARRAY_SIZE] = {0};
+    int hit_times = 0;
+    size_t n_hit_result = 0;
+    struct maat_state *state = maat_state_new(maat_inst, param->thread_id);
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    
+    clock_gettime(CLOCK_MONOTONIC, &start);
+    for (int i = 0; i < param->test_count; i++) {
+        int ret = maat_scan_string(maat_inst, table_id, scan_data, strlen(scan_data),
+                                   results, ARRAY_SIZE, &n_hit_result, state);
+        if (ret == MAAT_SCAN_HIT) {
+            hit_times++;
+        }
+        maat_state_reset(state);
+    }
+    clock_gettime(CLOCK_MONOTONIC, &end);
+
+    param->time_elapse_ms = (end.tv_sec - start.tv_sec) * 1000 +
+                            (end.tv_nsec - start.tv_nsec) / 1000000;
+    int *is_all_hit = ALLOC(int, 1);
+    *is_all_hit = (hit_times == param->test_count ? 1 : 0);
+    log_info(param->logger, MODULE_BENCHMARK_GTEST, 
+             "thread_id:%d rule_count:%d regex_scan time_elapse:%lldms hit_times:%d", 
+             param->thread_id, param->rule_count, param->time_elapse_ms, hit_times);
+
+    return is_all_hit;
+}
+
+void *perf_regex_update_thread(void *arg)
+{
+    struct thread_param *param = (struct thread_param *)arg;
+    const char *table_name = param->table_name;
+    const int CMD_EXPR_NUM = 10;
+    char keyword_buf[128];
+
+    for (int i = 0; i < CMD_EXPR_NUM; i++) {
+        random_keyword_generate(keyword_buf, sizeof(keyword_buf));
+        FILE *fp = fopen(table_name, "a+");
+        if (NULL == fp) {
+            continue;
+        }
+
+        fprintf(fp, "%d\t%d\t%s\t1\t0\t0\t1\n", 2000001+i, 2000001+i, keyword_buf);
+        fclose(fp);
+
+        sleep(1);
+    }
+
+    int *is_all_hit = ALLOC(int, 1);
+    *is_all_hit = 1;
+    
+    return is_all_hit;
+}
+
 void *perf_literal_scan_thread(void *arg)
 {
     struct thread_param *param = (struct thread_param *)arg;
@@ -463,12 +526,861 @@ void *perf_flag_update_thread(void *arg)
     return is_all_hit;
 }
 
+class Regex100BenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_hs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_100\t100\t./regex_rules/REGEX_100\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_hs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex100BenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex100BenchmarkGTest::logger;
+
+TEST_F(Regex100BenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_100";
+    struct maat *maat_inst = Regex100BenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 100;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex100Scan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
+class Regex200BenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_hs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_200\t200\t./regex_rules/REGEX_200\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_hs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex200BenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex200BenchmarkGTest::logger;
+
+TEST_F(Regex200BenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_200";
+    struct maat *maat_inst = Regex200BenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 200;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex200Scan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
+class Regex300BenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_hs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_300\t300\t./regex_rules/REGEX_300\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_hs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex300BenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex300BenchmarkGTest::logger;
+
+TEST_F(Regex300BenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_300";
+    struct maat *maat_inst = Regex300BenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 300;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex300Scan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
+class Regex500BenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_hs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_500\t500\t./regex_rules/REGEX_500\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_hs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex500BenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex500BenchmarkGTest::logger;
+
+TEST_F(Regex500BenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_500";
+    struct maat *maat_inst = Regex500BenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 500;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex500Scan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
+class Regex1KBenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_hs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_1K\t1000\t./regex_rules/REGEX_1K\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_hs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex1KBenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex1KBenchmarkGTest::logger;
+
+TEST_F(Regex1KBenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_1K";
+    struct maat *maat_inst = Regex1KBenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 1000;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex1KScan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
+class Regex2KBenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_hs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_2K\t2000\t./regex_rules/REGEX_2K\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_hs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex2KBenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex2KBenchmarkGTest::logger;
+
+TEST_F(Regex2KBenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_2K";
+    struct maat *maat_inst = Regex2KBenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 2000;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex2KScan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
+class Regex3KBenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_hs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_3K\t3000\t./regex_rules/REGEX_3K\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_hs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex3KBenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex3KBenchmarkGTest::logger;
+
+TEST_F(Regex3KBenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_3K";
+    struct maat *maat_inst = Regex3KBenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 3000;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex3KScan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
+class Regex5KBenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_hs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_5K\t5000\t./regex_rules/REGEX_5K\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_hs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex5KBenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex5KBenchmarkGTest::logger;
+
+TEST_F(Regex5KBenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_5K";
+    struct maat *maat_inst = Regex5KBenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 5000;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex5KScan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
+class Regex10KBenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_hs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_10K\t10000\t./regex_rules/REGEX_10K\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_hs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex10KBenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex10KBenchmarkGTest::logger;
+
+TEST_F(Regex10KBenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_10K";
+    struct maat *maat_inst = Regex10KBenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 10000;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex10KScan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
+class Regex15KBenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_hs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_15K\t15000\t./regex_rules/REGEX_15K\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_hs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex15KBenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex15KBenchmarkGTest::logger;
+
+TEST_F(Regex15KBenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_15K";
+    struct maat *maat_inst = Regex15KBenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 15000;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex15KScan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
 class Expr1KBenchmarkGTest : public ::testing::Test
 {
 protected:
     static void SetUpTestCase() {
         logger = log_handle_create("./benchmark_hs_gtest.log", 0);
-        ///printf("Start to generate test sample......\n");
         generate_expr_sample("EXPR_LITERAL_1K", 1000);
 
         FILE *fp = fopen("full_config_index.0000001", "w+");
diff --git a/test/benchmark/benchmark_rs_gtest.cpp b/test/benchmark/benchmark_rs_gtest.cpp
index 8f5e3c7..5c8bc00 100644
--- a/test/benchmark/benchmark_rs_gtest.cpp
+++ b/test/benchmark/benchmark_rs_gtest.cpp
@@ -463,12 +463,332 @@ void *perf_flag_update_thread(void *arg)
     return is_all_hit;
 }
 
+void *perf_regex_scan_thread(void *arg)
+{
+    struct thread_param *param = (struct thread_param *)arg;
+    struct maat *maat_inst = param->maat_inst;
+    const char *table_name = param->table_name;
+    struct timespec start, end;
+    const char *scan_data = "Maat was the goddness of harmony, justice, and truth in ancient Egyptian."
+                            "Request from User-Agent: Chrome, will go to yyy.abc.net";
+    long long results[ARRAY_SIZE] = {0};
+    int hit_times = 0;
+    size_t n_hit_result = 0;
+    struct maat_state *state = maat_state_new(maat_inst, param->thread_id);
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    
+    clock_gettime(CLOCK_MONOTONIC, &start);
+    for (int i = 0; i < param->test_count; i++) {
+        int ret = maat_scan_string(maat_inst, table_id, scan_data, strlen(scan_data),
+                                   results, ARRAY_SIZE, &n_hit_result, state);
+        if (ret == MAAT_SCAN_HIT) {
+            hit_times++;
+        }
+        maat_state_reset(state);
+    }
+    clock_gettime(CLOCK_MONOTONIC, &end);
+
+    param->time_elapse_ms = (end.tv_sec - start.tv_sec) * 1000 +
+                            (end.tv_nsec - start.tv_nsec) / 1000000;
+    int *is_all_hit = ALLOC(int, 1);
+    *is_all_hit = (hit_times == param->test_count ? 1 : 0);
+    log_info(param->logger, MODULE_BENCHMARK_GTEST, 
+             "thread_id:%d rule_count:%d regex_scan time_elapse:%lldms hit_times:%d", 
+             param->thread_id, param->rule_count, param->time_elapse_ms, hit_times);
+
+    return is_all_hit;
+}
+
+void *perf_regex_update_thread(void *arg)
+{
+    struct thread_param *param = (struct thread_param *)arg;
+    const char *table_name = param->table_name;
+    const int CMD_EXPR_NUM = 10;
+    char keyword_buf[128];
+
+    for (int i = 0; i < CMD_EXPR_NUM; i++) {
+        random_keyword_generate(keyword_buf, sizeof(keyword_buf));
+        FILE *fp = fopen(table_name, "a+");
+        if (NULL == fp) {
+            continue;
+        }
+
+        fprintf(fp, "%d\t%d\t%s\t1\t0\t0\t1\n", 2000001+i, 2000001+i, keyword_buf);
+        fclose(fp);
+
+        sleep(1);
+    }
+
+    int *is_all_hit = ALLOC(int, 1);
+    *is_all_hit = 1;
+    
+    return is_all_hit;
+}
+
+class Regex100BenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_rs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_100\t100\t./regex_rules/REGEX_100\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_rs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        maat_options_set_expr_engine(opts, MAAT_EXPR_ENGINE_RS);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex100BenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex100BenchmarkGTest::logger;
+
+TEST_F(Regex100BenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_100";
+    struct maat *maat_inst = Regex100BenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 100;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex100Scan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
+class Regex200BenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_rs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_200\t200\t./regex_rules/REGEX_200\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_rs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        maat_options_set_expr_engine(opts, MAAT_EXPR_ENGINE_RS);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex200BenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex200BenchmarkGTest::logger;
+
+TEST_F(Regex200BenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_200";
+    struct maat *maat_inst = Regex200BenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 200;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex200Scan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
+class Regex300BenchmarkGTest : public ::testing::Test
+{
+protected:
+    static void SetUpTestCase() {
+        logger = log_handle_create("./benchmark_rs_gtest.log", 0);
+
+        FILE *fp = fopen("full_config_index.0000001", "w+");
+        if (NULL == fp) {
+            log_error(g_logger, "open file %s failed", "full_config_index.0000001");
+            return;
+        }
+        fprintf(fp, "REGEX_300\t300\t./regex_rules/REGEX_300\n");
+        fprintf(fp, "COMPILE_PERF\t10\t./COMPILE_PERF\n");
+        fprintf(fp, "GROUP2COMPILE_PERF\t10\t./GROUP2COMPILE_PERF\n");
+        fclose(fp);
+
+        struct maat_options *opts = maat_options_new();
+        maat_options_set_logger(opts, "./benchmark_rs_gtest.log", LOG_LEVEL_INFO);
+        maat_options_set_iris(opts, "./", "./");
+        maat_options_set_rule_effect_interval_ms(opts, 1000);
+        maat_options_set_caller_thread_number(opts, PERF_THREAD_NUM);
+        maat_options_set_expr_engine(opts, MAAT_EXPR_ENGINE_RS);
+        _shared_maat_inst = maat_new(opts, table_info_path);
+        maat_options_free(opts);
+    }
+
+    static void TearDownTestCase() {
+        maat_free(_shared_maat_inst);
+        log_handle_destroy(logger);
+    }
+
+    static struct log_handle *logger;
+    static struct maat *_shared_maat_inst;
+};
+
+struct maat *Regex300BenchmarkGTest::_shared_maat_inst;
+struct log_handle *Regex300BenchmarkGTest::logger;
+
+TEST_F(Regex300BenchmarkGTest, LiteralScan) {
+    const char *table_name = "REGEX_300";
+    struct maat *maat_inst = Regex300BenchmarkGTest::_shared_maat_inst;
+
+    int table_id = maat_get_table_id(maat_inst, table_name);
+    ASSERT_GT(table_id, 0);
+
+    pthread_t threads[PERF_THREAD_NUM + 1];
+    struct thread_param thread_params[PERF_THREAD_NUM + 1];
+    int i = 0;
+    int *is_all_hit = NULL;
+
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        thread_params[i].maat_inst = maat_inst;
+        thread_params[i].thread_id = i;
+        thread_params[i].table_name = table_name;
+        thread_params[i].test_count = MAX_SCAN_COUNT;
+        thread_params[i].rule_count = 300;
+        thread_params[i].time_elapse_ms = 0;
+        thread_params[i].logger = logger;
+
+        if (i < PERF_THREAD_NUM) {
+            pthread_create(&threads[i], NULL, perf_regex_scan_thread, thread_params+i);
+        } else {
+            thread_params[i].test_count = 0;
+            pthread_create(&threads[i], NULL, perf_regex_update_thread, thread_params+i);
+        }
+    }
+
+    long long time_elapse_ms = 0;
+    long long scan_count = 0;
+    long long scan_per_second = 0;
+    for (i = 0; i < PERF_THREAD_NUM + 1; i++) {
+        pthread_join(threads[i], (void **)&is_all_hit);
+        time_elapse_ms += thread_params[i].time_elapse_ms;
+		scan_count += thread_params[i].test_count;
+
+		EXPECT_EQ(*is_all_hit, 1);
+		*is_all_hit = 0;
+		free(is_all_hit);
+    }
+    scan_per_second = scan_count * 1000 / time_elapse_ms;
+   
+    log_info(maat_inst->logger, MODULE_BENCHMARK_GTEST,
+             "Regex300Scan match rate on %d-threads speed %lld lookups/s/thread",
+             PERF_THREAD_NUM, scan_per_second);
+}
+
 class Expr1KBenchmarkGTest : public ::testing::Test
 {
 protected:
     static void SetUpTestCase() {
         logger = log_handle_create("./benchmark_rs_gtest.log", 0);
-        ///printf("Start to generate test sample......\n");
         generate_expr_sample("EXPR_LITERAL_1K", 1000);
 
         FILE *fp = fopen("full_config_index.0000001", "w+");
diff --git a/test/benchmark/benchmark_table_info.conf b/test/benchmark/benchmark_table_info.conf
index b01e64b..16630fa 100644
--- a/test/benchmark/benchmark_table_info.conf
+++ b/test/benchmark/benchmark_table_info.conf
@@ -575,5 +575,145 @@
             "virtual_table_name":5,
             "clause_index":6
         }
+    },
+    {
+        "table_id":41,
+        "table_name":"REGEX_100",
+        "table_type":"expr",
+        "valid_column":7,
+        "custom": {
+            "item_id":1,
+            "group_id":2,
+            "keywords":3,
+            "expr_type":4,
+            "match_method":5,
+            "is_hexbin":6
+        }
+    },
+    {
+        "table_id":42,
+        "table_name":"REGEX_200",
+        "table_type":"expr",
+        "valid_column":7,
+        "custom": {
+            "item_id":1,
+            "group_id":2,
+            "keywords":3,
+            "expr_type":4,
+            "match_method":5,
+            "is_hexbin":6
+        }
+    },
+    {
+        "table_id":43,
+        "table_name":"REGEX_300",
+        "table_type":"expr",
+        "valid_column":7,
+        "custom": {
+            "item_id":1,
+            "group_id":2,
+            "keywords":3,
+            "expr_type":4,
+            "match_method":5,
+            "is_hexbin":6
+        }
+    },
+    {
+        "table_id":44,
+        "table_name":"REGEX_500",
+        "table_type":"expr",
+        "valid_column":7,
+        "custom": {
+            "item_id":1,
+            "group_id":2,
+            "keywords":3,
+            "expr_type":4,
+            "match_method":5,
+            "is_hexbin":6
+        }
+    },
+    {
+        "table_id":45,
+        "table_name":"REGEX_1K",
+        "table_type":"expr",
+        "valid_column":7,
+        "custom": {
+            "item_id":1,
+            "group_id":2,
+            "keywords":3,
+            "expr_type":4,
+            "match_method":5,
+            "is_hexbin":6
+        }
+    },
+    {
+        "table_id":46,
+        "table_name":"REGEX_2K",
+        "table_type":"expr",
+        "valid_column":7,
+        "custom": {
+            "item_id":1,
+            "group_id":2,
+            "keywords":3,
+            "expr_type":4,
+            "match_method":5,
+            "is_hexbin":6
+        }
+    },
+    {
+        "table_id":47,
+        "table_name":"REGEX_3K",
+        "table_type":"expr",
+        "valid_column":7,
+        "custom": {
+            "item_id":1,
+            "group_id":2,
+            "keywords":3,
+            "expr_type":4,
+            "match_method":5,
+            "is_hexbin":6
+        }
+    },
+    {
+        "table_id":48,
+        "table_name":"REGEX_5K",
+        "table_type":"expr",
+        "valid_column":7,
+        "custom": {
+            "item_id":1,
+            "group_id":2,
+            "keywords":3,
+            "expr_type":4,
+            "match_method":5,
+            "is_hexbin":6
+        }
+    },
+    {
+        "table_id":49,
+        "table_name":"REGEX_10K",
+        "table_type":"expr",
+        "valid_column":7,
+        "custom": {
+            "item_id":1,
+            "group_id":2,
+            "keywords":3,
+            "expr_type":4,
+            "match_method":5,
+            "is_hexbin":6
+        }
+    },
+    {
+        "table_id":50,
+        "table_name":"REGEX_15K",
+        "table_type":"expr",
+        "valid_column":7,
+        "custom": {
+            "item_id":1,
+            "group_id":2,
+            "keywords":3,
+            "expr_type":4,
+            "match_method":5,
+            "is_hexbin":6
+        }
     }
 ]
\ No newline at end of file
diff --git a/test/benchmark/regex_rules/REGEX_100 b/test/benchmark/regex_rules/REGEX_100
new file mode 100644
index 0000000..ad7ccf0
--- /dev/null
+++ b/test/benchmark/regex_rules/REGEX_100
@@ -0,0 +1,101 @@
+100
+1	1	User-Agent:\s.*.abc.net	2	0	0	1
+2	2	(#\d{1,2}){20}	2	0	0	1
+3	3	(((DestFile|encryptPass)\x3D[^\x26]{50})|((BaseDN|SearchFilter)\x3D[^\x26]{128}))	2	0	0	1
+4	4	(((c|l)pi\x00.{1}(-\d|0)\x21)|(columns\x00.{1}(-\d|0)\x21)|(page-(right|left|top|bottom)\x00.{1}(-\d|0|([3-9]\d{5}|24\d{4}|236\d{3}|23593\d{1}|23592[2-9])\x21)))	2	0	0	1
+5	5	(,\d{1,3}){20}	2	0	0	1
+6	6	(3BFFE033-BF43-11d5-A271-00A024A51325|iNotes6\.iNotes6|E008A543-CEFB-4559-912F-C27C2B89F13B|dwa7\.dwa7)	2	0	0	1
+7	7	(?P<obj>[A-Z\d_]+)\.DataURL\s*=\s*(\x22[^\x22]{128}|\x27[^\x27]{128})	2	0	0	1
+8	8	(Context|Action)\x3D[^\x26\x3b]{1024}	2	0	0	1
+9	9	(DisableSandboxAndDrop|ConfusedClass|FieldAccessVerifierExpl)\.class	2	0	0	1
+10	10	(INSERT|UPDATE)\s*[\s\w]*((mysql\.)?func)[^\r\n]+values\s*\([^\)]+\x2c[\x22\x27][^\x22\x27]*\x2f	2	0	0	1
+11	11	(Image|Doc)	2	0	0	1
+12	12	(OvAcceptLang|Accept-Language)\s*[\x3D\x3A]\s*[^\n]{69}	2	0	0	1
+13	13	(OvJavaScript|OvTitleFrame|OvHelpWindow|OvMap|OvSession|OvJavaLocale|OvOSLocale|OvWebSession)\s*\x3D[^\x3B\x2C]{1024}	2	0	0	1
+14	14	(Set|Check)\x10Properties	2	0	0	1
+15	15	(USER|PASS)[^\x80-\xff]*[\x80-\xff]	2	0	0	1
+16	16	([sp]key|csk)=[^\r\n\x26]+(script|onclick|onload|onmouseover|html|[\x22\x27\x3c\x3e\x28\x29])	2	0	0	1
+17	17	(\x22|\x27)daap\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+18	18	(\x22|\x27)itms\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+19	19	(\x22|\x27)itmss\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+20	20	(\x22|\x27)itpc\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+21	21	(\x22|\x27)pcast\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+22	22	(\x25(n|t|d)\x20){85}	2	0	0	1
+23	23	(\x3F|\x26)[^\x3D]*(\x27|%27)[^\x3D]*(\x3C|%3c)script(\x3E|%3e)	2	0	0	1
+24	24	(\x40\x09.{19}|\x41\x0b.{23})[\xf0-\xff].{8}\x01\x00[\x00\x01\x02\x04\x08\x10\x18\x20]\x00	2	0	0	1
+25	25	(^|&)SelectedID=[^&]+?(\x3B|%3B)	2	0	0	1
+26	26	(^|&)paths(%5b|\x5b)(%5d|\x5d)=[^&]*?(%2e|\x2e){2}(%2f|\x2f)	2	0	0	1
+27	27	(^|&)selectedLocale=[^&]+?([\x22\x27]|%22|%27)	2	0	0	1
+28	28	(^|[\x3b\x7b\x7d]|%3b|%7b|%7d)O(%3a|\x3a)(\x2b|%2b)?[0-9]+?(%3a|\x3a)(%22|\x22)	2	0	0	1
+29	29	(action|setup)=[a-z]{1,4}	2	0	0	1
+30	30	(arg=[^\x26]*?OVwSelection[^\x26]*?\x26.*?sel=[^\s\x26]{1023}|sel=[^\x26]{1023,}\x26.*?arg=[^\s\x26]*?OVwSelection)	2	0	0	1
+31	31	(caption,\x22\x5c\x5c\x5c|\x22\x5cn\x5cn\x5cn\x22\x20\x2b\x20str)	2	0	0	1
+32	32	(data_select1|nameParams|schdParams|text1|schd_select1)=[^\x26]{512}	2	0	0	1
+33	33	(displayWidth[\x2b\x20]\d[^\x2b\s\n]{128})	2	0	0	1
+34	34	(filename|type)=[^\x26]*?\x2E\x2E	2	0	0	1
+35	35	(ora_osb_bgcookie|rbtool)=[^\x20\x26\x3b]{1}	2	0	0	1
+36	36	(sIda\/sId|urua\/uru)[abcd]\.classPK	2	0	0	1
+37	37	.{20}[\x01\x02]\x00\x03\x00.*?\x5c\x00\x5c\x00	2	0	0	1
+38	38	5FDC81917DE08A41A6AC(E9B8ECA1EE.8|.98ECB1EEA8E)	2	0	0	1
+39	39	<FILE>(\x2e\x2e\x5c|%2E%2E%5C){2}[^<]+?</FILE>	2	0	0	1
+40	40	<SelectedID>[^<]+?(\x3B|%3B)	2	0	0	1
+41	41	<[^>]*?style\s*[>=].{1,1024}margin\s*\x3a\s*[^\x3b\x7d]*?-(\d{4}|1[0-9][1-9]|[2-9]\d\d)[ce][mx].*?[\x7b\x3b]	2	0	0	1
+42	42	<\?(php)?.{1,256}define\s*\x28\s*str_repeat\s*\x28\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s*\x2c\s*\x24argv	2	0	0	1
+43	43	<\s*object[^>]*?data\s*\x3A[^,>]*?base64	2	0	0	1
+44	44	<\s*valitem[^>]*\s(value|name)\s*=\s*([\x22\x27])[^\x22\x27]{104}	2	0	0	1
+45	45	<\x21DOCTYPE\s+[^>]*?SYSTEM[^>]*?>.*?\x2EparseError	2	0	0	1
+46	46	<\x21ENTITY[^>]+SYSTEM[^>]+http\x3A\x2F\x2F[^>\s]+http\x3A\x2F\x2F	2	0	0	1
+47	47	<applet[^>]+(archive|src)\s*?=\s*?(\x22|\x27|)\s*?(\d{5}\.jar|[^>]+\/\d{5}\.jar)	2	0	0	1
+48	48	<figure[^>]+?dir\s*?=\s*?[\x22\x27]\s*?rtl\s*?[\x22\x27].*?(&#?x?[a-z\d]{2,4}\x3b){100}	2	0	0	1
+49	49	<iframe[^>]*?height\x3d\s*[\x22\x27]?\s*[0-9]{6}	2	0	0	1
+50	50	<script[^>]*?for\s*=\s*[\x22\x27]?.*?event\s*=\s*[\x22\x27]?onpropertychange[\x22\x27]?[^>]*?>	2	0	0	1
+51	51	<script[^>]*src\s*=\s*[\x22\x27][^\x22\x27]*\.json[\x22\x27][^>]*language=vbs	2	0	0	1
+52	52	<title>CRiMEPACK [\d\.]+</title>	2	0	0	1
+53	53	<treechildren.*?ordinal=.*?<treechildren	2	0	0	1
+54	54	<zombis>\s*<JUNIPER-M3>.*?</JUNIPER-M3>\s*</zombis>	2	0	0	1
+55	55	AdminServlet.*(userid|adminurl)[^\x26\x20\x0a]*<script	2	0	0	1
+56	56	Authorization\s*\x3A\s*Basic\s*[^\n]{437}	2	0	0	1
+57	57	Collab\x2EaddStateModel\s*\x28\s*\x7B.*cName\s*\x3A\s*\x22(\x22|\x5Cx00)	2	0	0	1
+58	58	ComputerName\s*\x3d\s*\x22[^\x22]{256}	2	0	0	1
+59	59	Content-Type\x3A\s*misc/ultravox.+?(\r?\n){2}\x5A.9\x01	2	0	0	1
+60	60	CreationDate\x28[^\x3c\x29]{500}	2	0	0	1
+61	61	DBMS_ASSERT\x2Esimple_sql_name\x28[^\x29\x22]*?\x22	2	0	0	1
+62	62	EnteredAttrName=[^&]{32}	2	0	0	1
+63	63	Entry\x20\x2f[^\x2f]*\x2f[^\x2f]{68}	2	0	0	1
+64	64	ExecWB\s*\x28\s*[^\x2c\x29]*(7|IDM_PRINTPREVIEW)[^\x29]+http\x3a\x2f\x2f	2	0	0	1
+65	65	FILECODE=[^&]{96}	2	0	0	1
+66	66	HEADER[\x20\r]*\n[\x20]*9[\x20\r]*\n\x24[^\n]{92}	2	0	0	1
+67	67	HTTP\/1.[01]\r\nUser\x2dAgent\x3a\x20[ -~]+\r\nHost\x3a\x20[a-z0-9\x2d\x2e]+\.info\r\n	2	0	0	1
+68	68	HostList=([^\r\n\x3B]{,296}\x3B)*[^\r\n\x3B]{297}	2	0	0	1
+69	69	Host\x3A\s*[^\x0D\x0A]{121}	2	0	0	1
+70	70	Hostname\x3D[^\x26\x3F\x3B\x0D\x0A\s]{300}	2	0	0	1
+71	71	ICount\x3D\x2D[^\x26\x3F\x3B\x0D\x0A\s]{300}	2	0	0	1
+72	72	IP=(https?|ftps?)	2	0	0	1
+73	73	InformixServerList=([^\r\n\x3B]{,293}\x3B)*[^\r\n\x3B]{294}	2	0	0	1
+74	74	Libs\/Starter(CmdExec|NetUtils|Rec|ScreenShots|Settings)\.py	2	0	0	1
+75	75	Math\x2efloor([^\x7d]{1,3})?\x7dcatch\x28	2	0	0	1
+76	76	Math\x2eround([^\x7d]{1,3})?\x7dcatch\x28	2	0	0	1
+77	77	MaxAge\x3D[^\x26\x3F\x3B\x0D\x0A]{300}	2	0	0	1
+78	78	Oid\x3D[^\x0D\x0A]{1000}	2	0	0	1
+79	79	OvAcceptLang\s*\x3d\s*[^\x3b\n]{300}	2	0	0	1
+80	80	OvOSLocale\s*\x3d\s*[^\x3b\s]{249}	2	0	0	1
+81	81	Referer\x3a[^\x0d\x0a]*\/world\/	2	0	0	1
+82	82	Referer\x3a\s*?http\x3a\x2f{2}[a-z0-9\x2e\x2d]+\x2fs\x2f\x3fk\x3d	2	0	0	1
+83	83	RegExp?\x23.{0,5}\x28\x3f[^\x29]{0,4}i.*?\x28\x3f\x2d[^\x29]{0,4}i.{0,50}\x7c\x7c	2	0	0	1
+84	84	SET_(SENDFROM|MAILHOST)\x28\x27[^\x27]{256}	2	0	0	1
+85	85	SOAPAction\x3A\s*?\x22[^\x22\x23]+?\x23([^\x22]{2048}|[^\x22]+$)	2	0	0	1
+86	86	SYS\.LT\.FINDRICSET\([^,\)]*\'\'\|\|	2	0	0	1
+87	87	SYS\x2eDBMS\x5fAQADM\x5fSYS\x2eGRANT\x5fTYPE\x5fACCESS\s*\x28\s*\x27[^\x2c\x20\x27]*[\x2c\x20]	2	0	0	1
+88	88	SelectedSubTabId=[^>]*?([\x22\x27]|%22|%27)\s*?>\s*?<[^>]*?script	2	0	0	1
+89	89	SignUrl=[^\x26\s]*[\x22\x27\x28\x29\x3C\x3E]	2	0	0	1
+90	90	SoftwareRegistration\.do.*?updateRegn=[^\x26\r\n]+(script|onclick|onload|onmouseover|html)	2	0	0	1
+91	91	TMlogonEncrypted=(\!|\%21)CRYPT(\!|\%21)[A-Z0-9]{512}	2	0	0	1
+92	92	Template\x3D[^\x0D\x0A]{1000}	2	0	0	1
+93	93	TimerMethod\x3D[^\x26]*[\x3C\x28\x22\x27]	2	0	0	1
+94	94	USER\s*[^\x0d]+\x25\x27	2	0	0	1
+95	95	User-Agent\:[^\x0a\x0d]+?Havij	2	0	0	1
+96	96	User-Agent\x3A\s+?mus[\x0d\x0a]	2	0	0	1
+97	97	User-Agent\x3a[^\x0d\x0a]*Java\/1\.	2	0	0	1
+98	98	User-Agent\x3a\x20Agent\d{5,9}	2	0	0	1
+99	99	User-Agent\x3a\x20[^\n]*?WinHttp\x2eWinHttpRequest.*?\n	2	0	0	1
+100	100	Visio \x28TM\x29 Drawing\r\n\x00{4}([^\x00]|\x00[^\x00]|\x00\x00[^\x01-\x06\x0b]|\x00\x00[\x01-\x06\x0b][^\x00])	2	0	0	1
\ No newline at end of file
diff --git a/test/benchmark/regex_rules/REGEX_10K b/test/benchmark/regex_rules/REGEX_10K
new file mode 100644
index 0000000..8230173
--- /dev/null
+++ b/test/benchmark/regex_rules/REGEX_10K
@@ -0,0 +1,10001 @@
+10000
+1	1	User-Agent:\s.*.abc.net	2	0	0	1
+2	2	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5	2	0	0	1
+3	3	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980	2	0	0	1
+4	4	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E	2	0	0	1
+5	5	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333	2	0	0	1
+6	6	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C	2	0	0	1
+7	7	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E	2	0	0	1
+8	8	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+9	9	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+10	10	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+11	11	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08	2	0	0	1
+12	12	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42	2	0	0	1
+13	13	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4	2	0	0	1
+14	14	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980	2	0	0	1
+15	15	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3	2	0	0	1
+16	16	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980	2	0	0	1
+17	17	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB	2	0	0	1
+18	18	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+19	19	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+20	20	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664	2	0	0	1
+21	21	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C	2	0	0	1
+22	22	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980	2	0	0	1
+23	23	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+24	24	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+25	25	(EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters)	2	0	0	1
+26	26	(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+27	27	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+28	28	(ReadMolFile|SaveasMolFile)	2	0	0	1
+29	29	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+30	30	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+31	31	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C	2	0	0	1
+32	32	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+33	33	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+34	34	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000	2	0	0	1
+35	35	file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+36	36	[0-9]{3,}	2	0	0	1
+37	37	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194	2	0	0	1
+38	38	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2	2	0	0	1
+39	39	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510	2	0	0	1
+40	40	(setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch)	2	0	0	1
+41	41	param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20}	2	0	0	1
+42	42	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C	2	0	0	1
+43	43	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+44	44	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79	2	0	0	1
+45	45	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD	2	0	0	1
+46	46	(Text|EditSelText|EditText|CellFontName|Archive)	2	0	0	1
+47	47	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+48	48	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c	2	0	0	1
+49	49	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B	2	0	0	1
+50	50	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA	2	0	0	1
+51	51	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted)	2	0	0	1
+52	52	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam)	2	0	0	1
+53	53	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+54	54	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8	2	0	0	1
+55	55	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E	2	0	0	1
+56	56	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726	2	0	0	1
+57	57	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598	2	0	0	1
+58	58	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E	2	0	0	1
+59	59	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E	2	0	0	1
+60	60	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E	2	0	0	1
+61	61	(exe|bat|com|dll|ini)	2	0	0	1
+62	62	(exe|bat|com|dll|ini)	2	0	0	1
+63	63	(exe|bat|com|dll|ini)	2	0	0	1
+64	64	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E	2	0	0	1
+65	65	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7	2	0	0	1
+66	66	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91	2	0	0	1
+67	67	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980	2	0	0	1
+68	68	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02	2	0	0	1
+69	69	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3	2	0	0	1
+70	70	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90	2	0	0	1
+71	71	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E	2	0	0	1
+72	72	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E	2	0	0	1
+73	73	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112	2	0	0	1
+74	74	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1	2	0	0	1
+75	75	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6	2	0	0	1
+76	76	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F	2	0	0	1
+77	77	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+78	78	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA	2	0	0	1
+79	79	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258	2	0	0	1
+80	80	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B	2	0	0	1
+81	81	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1	2	0	0	1
+82	82	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7	2	0	0	1
+83	83	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D	2	0	0	1
+84	84	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61	2	0	0	1
+85	85	(Src|Background|PackageXml)	2	0	0	1
+86	86	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters)	2	0	0	1
+87	87	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+88	88	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+89	89	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+90	90	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+91	91	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755	2	0	0	1
+92	92	(Save|SaveLayoutChanges|SaveMenuUsageData)	2	0	0	1
+93	93	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61	2	0	0	1
+94	94	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+95	95	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+96	96	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+97	97	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+98	98	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0	2	0	0	1
+99	99	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3	2	0	0	1
+100	100	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679	2	0	0	1
+101	101	(SaveFile|ExportToXML)	2	0	0	1
+102	102	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE	2	0	0	1
+103	103	(SnapShotToFile|SnapShotX)	2	0	0	1
+104	104	(SnapShotToFile|SnapShotX)	2	0	0	1
+105	105	(SnapShotToFile|SnapShotX)	2	0	0	1
+106	106	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+107	107	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28	2	0	0	1
+108	108	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003	2	0	0	1
+109	109	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+110	110	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+111	111	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+112	112	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+113	113	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE	2	0	0	1
+114	114	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB	2	0	0	1
+115	115	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile)	2	0	0	1
+116	116	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD	2	0	0	1
+117	117	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA	2	0	0	1
+118	118	(Run|SetRegistryValueAsString|PerformUpdateAsync)	2	0	0	1
+119	119	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+120	120	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+121	121	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084	2	0	0	1
+122	122	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6	2	0	0	1
+123	123	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF	2	0	0	1
+124	124	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5	2	0	0	1
+125	125	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C	2	0	0	1
+126	126	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA	2	0	0	1
+127	127	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020	2	0	0	1
+128	128	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020	2	0	0	1
+129	129	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B	2	0	0	1
+130	130	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356	2	0	0	1
+131	131	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520	2	0	0	1
+132	132	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C	2	0	0	1
+133	133	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26	2	0	0	1
+134	134	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0	2	0	0	1
+135	135	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF	2	0	0	1
+136	136	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142	2	0	0	1
+137	137	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB	2	0	0	1
+138	138	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7	2	0	0	1
+139	139	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747	2	0	0	1
+140	140	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456	2	0	0	1
+141	141	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0	2	0	0	1
+142	142	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999	2	0	0	1
+143	143	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899	2	0	0	1
+144	144	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5	2	0	0	1
+145	145	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E	2	0	0	1
+146	146	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F	2	0	0	1
+147	147	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9	2	0	0	1
+148	148	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F	2	0	0	1
+149	149	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448	2	0	0	1
+150	150	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92	2	0	0	1
+151	151	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F	2	0	0	1
+152	152	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED	2	0	0	1
+153	153	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB	2	0	0	1
+154	154	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305	2	0	0	1
+155	155	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7	2	0	0	1
+156	156	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B	2	0	0	1
+157	157	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C	2	0	0	1
+158	158	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627	2	0	0	1
+159	159	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E	2	0	0	1
+160	160	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE	2	0	0	1
+161	161	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496	2	0	0	1
+162	162	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0	2	0	0	1
+163	163	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E	2	0	0	1
+164	164	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C	2	0	0	1
+165	165	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53	2	0	0	1
+166	166	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014	2	0	0	1
+167	167	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+168	168	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+169	169	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741	2	0	0	1
+170	170	(SaveToBMP|SaveToFile)	2	0	0	1
+171	171	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2	2	0	0	1
+172	172	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667	2	0	0	1
+173	173	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+174	174	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+175	175	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+176	176	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D	2	0	0	1
+177	177	(SaveBarCode|SaveEnhWMF)	2	0	0	1
+178	178	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B	2	0	0	1
+179	179	<object\s*[^>]*\s*classid\s*=\s*(.+<q1>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>)	2	0	0	1
+180	180	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000	2	0	0	1
+181	181	(exe|bat|com|dll|ini)	2	0	0	1
+182	182	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E	2	0	0	1
+183	183	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E	2	0	0	1
+184	184	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87	2	0	0	1
+185	185	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+186	186	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+187	187	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+188	188	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+189	189	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+190	190	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E	2	0	0	1
+191	191	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344	2	0	0	1
+192	192	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C	2	0	0	1
+193	193	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30	2	0	0	1
+194	194	(Packagefiles|SaveDna|SetIdentity|AddFile)	2	0	0	1
+195	195	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9	2	0	0	1
+196	196	(_DOWText)|(_MonthText)	2	0	0	1
+197	197	(SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour)	2	0	0	1
+198	198	classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE	2	0	0	1
+199	199	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+200	200	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+201	201	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F	2	0	0	1
+202	202	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5	2	0	0	1
+203	203	[\w\W]{2500,}	2	0	0	1
+204	204	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3	2	0	0	1
+205	205	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8	2	0	0	1
+206	206	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04	2	0	0	1
+207	207	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue)	2	0	0	1
+208	208	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356	2	0	0	1
+209	209	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E	2	0	0	1
+210	210	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574	2	0	0	1
+211	211	(WriteIniFileString|ShellExecute)	2	0	0	1
+212	212	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906	2	0	0	1
+213	213	(txt|ini|com|exe|bat|dll|dat)	2	0	0	1
+214	214	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8	2	0	0	1
+215	215	42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733	2	0	0	1
+216	216	(Save|ExportImage)	2	0	0	1
+217	217	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790	2	0	0	1
+218	218	(DeleteFile|write)	2	0	0	1
+219	219	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+220	220	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+221	221	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+222	222	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+223	223	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967	2	0	0	1
+224	224	WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext)	2	0	0	1
+225	225	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9	2	0	0	1
+226	226	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5	2	0	0	1
+227	227	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6	2	0	0	1
+228	228	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+229	229	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+230	230	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24	2	0	0	1
+231	231	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9	2	0	0	1
+232	232	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA	2	0	0	1
+233	233	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec)	2	0	0	1
+234	234	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5	2	0	0	1
+235	235	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+236	236	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+237	237	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+238	238	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83	2	0	0	1
+239	239	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA	2	0	0	1
+240	240	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566	2	0	0	1
+241	241	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+242	242	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+243	243	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B	2	0	0	1
+244	244	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F	2	0	0	1
+245	245	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+246	246	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+247	247	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED	2	0	0	1
+248	248	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619	2	0	0	1
+249	249	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E	2	0	0	1
+250	250	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258	2	0	0	1
+251	251	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196	2	0	0	1
+252	252	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E	2	0	0	1
+253	253	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD	2	0	0	1
+254	254	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4	2	0	0	1
+255	255	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118	2	0	0	1
+256	256	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616	2	0	0	1
+257	257	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+258	258	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+259	259	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+260	260	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11	2	0	0	1
+261	261	(ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1	2	0	0	1
+262	262	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020	2	0	0	1
+263	263	(PostURL|AddSeperator|AddString|Post)	2	0	0	1
+264	264	(SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF)	2	0	0	1
+265	265	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>)	2	0	0	1
+266	266	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\>	2	0	0	1
+267	267	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\>	2	0	0	1
+268	268	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\>	2	0	0	1
+269	269	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\>	2	0	0	1
+270	270	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+271	271	(Buildpath|GetDriveName|DriveExists|DeleteFile)	2	0	0	1
+272	272	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+273	273	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+274	274	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+275	275	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>)	2	0	0	1
+276	276	\x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission]	2	0	0	1
+277	277	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\>	2	0	0	1
+278	278	000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F	2	0	0	1
+279	279	(javascript|http|ftp|vbscript)	2	0	0	1
+280	280	(SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen)	2	0	0	1
+281	281	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000	2	0	0	1
+282	282	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407	2	0	0	1
+283	283	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414	2	0	0	1
+284	284	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+285	285	(AddAttachment|SubmitToExpress)	2	0	0	1
+286	286	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6	2	0	0	1
+287	287	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0	2	0	0	1
+288	288	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D	2	0	0	1
+289	289	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile)	2	0	0	1
+290	290	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\>	2	0	0	1
+291	291	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\>	2	0	0	1
+292	292	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC	2	0	0	1
+293	293	src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape	2	0	0	1
+294	294	(LogFile|ClearLogFile|SaveToFile)	2	0	0	1
+295	295	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)	2	0	0	1
+296	296	^User-Agent\x3a Downloader \d\.\d\r?$/Hm	2	0	0	1
+297	297	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P	2	0	0	1
+298	298	^((\r?\n\r?\n).)*?\r?\n\r?\nMZ	2	0	0	1
+299	299	instructions\/\d{2}\.xml	2	0	0	1
+300	300	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp	2	0	0	1
+301	301	\/updatestats\/update\d+?\.xml$	2	0	0	1
+302	302	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab	2	0	0	1
+303	303	ctxad-\d+\.sig	2	0	0	1
+304	304	/user\d+/counter\.htm	2	0	0	1
+305	305	(cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr	2	0	0	1
+306	306	(discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe	2	0	0	1
+307	307	loaderadv\d+\.jar	2	0	0	1
+308	308	\/adv\/\d+\/win32\.exe	2	0	0	1
+309	309	\/Message\/\S+\/\S+\.xml	2	0	0	1
+310	310	\/abt\?data=\S{150}	2	0	0	1
+311	311	^User-Agent\x3a.+ZangoToolbar.+\r$/Hmi	2	0	0	1
+312	312	User-Agent\:[^\n]+wbi_v\d/iH	2	0	0	1
+313	313	User-Agent\x3a[^\n]+AskBar/iH	2	0	0	1
+314	314	\/tbrequest\d+\.php	2	0	0	1
+315	315	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+316	316	sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+317	317	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+318	318	cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+319	319	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+320	320	UID=\d	2	0	0	1
+321	321	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+322	322	REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P	2	0	0	1
+323	323	victim\.php\?\d\d\d\d\d	2	0	0	1
+324	324	\/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d	2	0	0	1
+325	325	\/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+	2	0	0	1
+326	326	&ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d	2	0	0	1
+327	327	\/sd\?s=\d+&f=\d&C=\d	2	0	0	1
+328	328	\.txt$	2	0	0	1
+329	329	\.cfg$	2	0	0	1
+330	330	User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H	2	0	0	1
+331	331	^Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r?$/Hi	2	0	0	1
+332	332	\x00[\x02-\x1E][0-9]{2,30}\x02cn\x00	2	0	0	1
+333	333	\x00[\x02-\x1E][0-9]{2,30}\x02ru\x00	2	0	0	1
+334	334	^[A-F0-9]+$	2	0	0	1
+335	335	\/sd\?s=\d+&f=\d	2	0	0	1
+336	336	loadadv\d+\.exe	2	0	0	1
+337	337	\/ms\d\d\dcfg\.jsp	2	0	0	1
+338	338	^0x[0-9a-f]+$	2	0	0	1
+339	339	^[^a-z]*?[0-9]{2,30}\.ru$	2	0	0	1
+340	340	filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe	2	0	0	1
+341	341	^MM \d\.\d+$	2	0	0	1
+342	342	^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4}	2	0	0	1
+343	343	^\w+pcsetup_\w+	2	0	0	1
+344	344	\x2Fv[0-9]{3,4}[\x2F\x3F]	2	0	0	1
+345	345	[a-f0-9]{32}\?v=	2	0	0	1
+346	346	^\/[a-z]{2}\x3Fv\x3D[0-9]$	2	0	0	1
+347	347	^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$	2	0	0	1
+348	348	^\/entrance\?s1=[a-f0-9]{100,}$	2	0	0	1
+349	349	^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=	2	0	0	1
+350	350	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+351	351	^[0-9][a-z]+	2	0	0	1
+352	352	\.php$	2	0	0	1
+353	353	^\/([^\x2f]+\/)*log\/\?[bc]=	2	0	0	1
+354	354	^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/))	2	0	0	1
+355	355	^\/\?pcrc=\d+&v=[\d.]+$	2	0	0	1
+356	356	^\/\?v=[\d.]+&pcrc=\d+$	2	0	0	1
+357	357	\/v\d\/[^.]+\.asp$	2	0	0	1
+358	358	\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$	2	0	0	1
+359	359	\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$	2	0	0	1
+360	360	^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$	2	0	0	1
+361	361	^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$	2	0	0	1
+362	362	\?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})	2	0	0	1
+363	363	^Downloader\s\d+\.\d+$	2	0	0	1
+364	364	^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100}	2	0	0	1
+365	365	\/get_xml\?(file_id|stb)=	2	0	0	1
+366	366	(_[a-z]{2}){1,3}_[a-z]{3}_install\.exe	2	0	0	1
+367	367	\d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows	2	0	0	1
+368	368	^[a-zA-Z0-9_-]+$	2	0	0	1
+369	369	^\/([a-zA-Z0-9]|%2[fb]){400,}$	2	0	0	1
+370	370	User-Agent\:[^\n]+searchengine	2	0	0	1
+371	371	User-Agent\:[^\n]+SurferPlugin	2	0	0	1
+372	372	User-Agent\:[^\n]+THNALL[^\n]+\.EXE	2	0	0	1
+373	373	User-Agent\:[^\n]+XupiterToolbar	2	0	0	1
+374	374	User-Agent\:[^\n]+spywareaxe	2	0	0	1
+375	375	User-Agent\:[^\n]+iMeshBar	2	0	0	1
+376	376	User-Agent\:[^\n]+Oemji	2	0	0	1
+377	377	^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$	2	0	0	1
+378	378	^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$	2	0	0	1
+379	379	^\/(get|install)\/\?q=	2	0	0	1
+380	380	^\/[a-f0-9]{50,}$	2	0	0	1
+381	381	^\/[\w-]{50,}$	2	0	0	1
+382	382	^\/\?pcrc=[0-9]{7,10}$	2	0	0	1
+383	383	^Downloader \d\.\d$	2	0	0	1
+384	384	\/Socks[45]\.txt$	2	0	0	1
+385	385	^Feat[^\r\n]+(Install|Updat)er	2	0	0	1
+386	386	User-Agent\:[^\n]+host(ie|oe|oi|ol)	2	0	0	1
+387	387	User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}	2	0	0	1
+388	388	^BWL(\sToplist|\d_UPDATE)	2	0	0	1
+389	389	^\x2F[A-F0-9]{25,40}$	2	0	0	1
+390	390	^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$	2	0	0	1
+391	391	^\d+\sHTTP/1.1$	2	0	0	1
+392	392	^[a-zA-Z0-9_-]+	2	0	0	1
+393	393	[a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12}	2	0	0	1
+394	394	\/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id=	2	0	0	1
+395	395	\{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\}	2	0	0	1
+396	396	CN=([^\r\n]+?\.)?showmypc\.com(\.)	2	0	0	1
+397	397	^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$	2	0	0	1
+398	398	(SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk)	2	0	0	1
+399	399	(DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog)	2	0	0	1
+400	400	\d{13}$	2	0	0	1
+401	401	^[a-f0-9]{32}	2	0	0	1
+402	402	^[a-f0-9]{32}\"	2	0	0	1
+403	403	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+404	404	^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}	2	0	0	1
+405	405	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+406	406	^[A-F0-9]{12}	2	0	0	1
+407	407	^[A-Z0-9]{9}	2	0	0	1
+408	408	^\d+[^\r\n\s]+	2	0	0	1
+409	409	^ SQL[-_ ]Server	2	0	0	1
+410	410	^ \d+ Driver	2	0	0	1
+411	411	ORA-\d{4}	2	0	0	1
+412	412	Warning.*\Woci_	2	0	0	1
+413	413	Warning.*\Wora_	2	0	0	1
+414	414	CLI Driver.*DB2	2	0	0	1
+415	415	bdb2_\w+\(	2	0	0	1
+416	416	Exception.*Informix	2	0	0	1
+417	417	Warning.*SQLite3::	2	0	0	1
+418	418	SQL error.*POS\([0-9]+\)	2	0	0	1
+419	419	Warning.*maxdb	2	0	0	1
+420	420	i?Warning.*sybase	2	0	0	1
+421	421	Warning.*ingres_	2	0	0	1
+422	422	Warning.*sqlite_	2	0	0	1
+423	423	Ingres\W.*Driver	2	0	0	1
+424	424	Exception (condition )\d+\. Transaction rollback\.	2	0	0	1
+425	425	SQL Server.*?error \x27[0-9a-f]{8}	2	0	0	1
+426	426	^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$	2	0	0	1
+427	427	^(<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll	2	0	0	1
+428	428	^...\x30\x82..\x02\x82...{256,257}	2	0	0	1
+429	429	\/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php	2	0	0	1
+430	430	\/notify\/(single|mass)$	2	0	0	1
+431	431	a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php)	2	0	0	1
+432	432	Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a	2	0	0	1
+433	433	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+434	434	[-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10}	2	0	0	1
+435	435	^\d+(\+|\-|\\|\*)\d+	2	0	0	1
+436	436	^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9	2	0	0	1
+437	437	^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u	2	0	0	1
+438	438	ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b	2	0	0	1
+439	439	^\d{4}[01]	2	0	0	1
+440	440	^\d{4}[01]	2	0	0	1
+441	441	^\d{4}[01]	2	0	0	1
+442	442	^\d{4}[01]	2	0	0	1
+443	443	^\d{4}[01]	2	0	0	1
+444	444	^\d{4}[01]	2	0	0	1
+445	445	^\d{4}[01]	2	0	0	1
+446	446	^\d{4}[01]	2	0	0	1
+447	447	^\d{4}[01]	2	0	0	1
+448	448	^\d{4}[01]	2	0	0	1
+449	449	^\d{4}[01]	2	0	0	1
+450	450	^\d{4}[01]	2	0	0	1
+451	451	^\d{4}[01]	2	0	0	1
+452	452	^\d{4}[01]	2	0	0	1
+453	453	^\d{4}[01]	2	0	0	1
+454	454	^\d{4}[01]	2	0	0	1
+455	455	^\d{4}[01]	2	0	0	1
+456	456	^\d{4}[01]	2	0	0	1
+457	457	^\d{4}[01]	2	0	0	1
+458	458	^\d{4}[01]	2	0	0	1
+459	459	^\d{4}[01]	2	0	0	1
+460	460	^\d{4}[01]	2	0	0	1
+461	461	^\d{4}[01]	2	0	0	1
+462	462	^\d{4}[01]	2	0	0	1
+463	463	^\d{4}[01]	2	0	0	1
+464	464	^\d{4}[01]	2	0	0	1
+465	465	^\d{4}[01]	2	0	0	1
+466	466	^\d{4}[01]	2	0	0	1
+467	467	^\d{4}[01]	2	0	0	1
+468	468	^\d{4}[01]	2	0	0	1
+469	469	^\d{4}[01]	2	0	0	1
+470	470	^\d{4}[01]	2	0	0	1
+471	471	^\d{4}[01]	2	0	0	1
+472	472	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+473	473	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+474	474	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+475	475	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+476	476	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+477	477	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+478	478	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+479	479	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+480	480	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+481	481	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+482	482	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+483	483	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+484	484	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+485	485	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+486	486	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+487	487	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+488	488	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+489	489	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+490	490	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+491	491	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+492	492	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+493	493	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+494	494	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+495	495	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+496	496	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+497	497	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+498	498	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+499	499	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+500	500	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+501	501	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+502	502	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+503	503	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+504	504	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+505	505	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+506	506	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+507	507	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+508	508	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+509	509	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+510	510	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+511	511	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+512	512	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+513	513	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+514	514	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+515	515	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+516	516	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+517	517	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+518	518	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+519	519	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+520	520	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+521	521	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+522	522	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+523	523	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+524	524	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+525	525	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+526	526	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+527	527	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+528	528	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+529	529	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+530	530	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+531	531	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+532	532	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+533	533	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+534	534	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+535	535	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+536	536	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+537	537	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+538	538	^\d{4}[01]	2	0	0	1
+539	539	^\d{4}[01]	2	0	0	1
+540	540	^\d{4}[01]	2	0	0	1
+541	541	^\d{4}[01]	2	0	0	1
+542	542	^\d{4}[01]	2	0	0	1
+543	543	^\d{4}[01]	2	0	0	1
+544	544	^\d{4}[01]	2	0	0	1
+545	545	^\d{4}[01]	2	0	0	1
+546	546	^\d{4}[01]	2	0	0	1
+547	547	^\d{4}[01]	2	0	0	1
+548	548	^\d{4}[01]	2	0	0	1
+549	549	^\d{4}[01]	2	0	0	1
+550	550	^\d{4}[01]	2	0	0	1
+551	551	^\d{4}[01]	2	0	0	1
+552	552	^\d{4}[01]	2	0	0	1
+553	553	^\d{4}[01]	2	0	0	1
+554	554	^\d{4}[01]	2	0	0	1
+555	555	^\d{4}[01]	2	0	0	1
+556	556	^\d{4}[01]	2	0	0	1
+557	557	^\d{4}[01]	2	0	0	1
+558	558	^\d{4}[01]	2	0	0	1
+559	559	^\d{4}[01]	2	0	0	1
+560	560	^\d{4}[01]	2	0	0	1
+561	561	^\d{4}[01]	2	0	0	1
+562	562	^\d{4}[01]	2	0	0	1
+563	563	^\d{4}[01]	2	0	0	1
+564	564	^\d{4}[01]	2	0	0	1
+565	565	^\d{4}[01]	2	0	0	1
+566	566	^\d{4}[01]	2	0	0	1
+567	567	^\d{4}[01]	2	0	0	1
+568	568	^\d{4}[01]	2	0	0	1
+569	569	^\d{4}[01]	2	0	0	1
+570	570	^\d{4}[01]	2	0	0	1
+571	571	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+572	572	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+573	573	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+574	574	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+575	575	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+576	576	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+577	577	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+578	578	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+579	579	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+580	580	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+581	581	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+582	582	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+583	583	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+584	584	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+585	585	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+586	586	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+587	587	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+588	588	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+589	589	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+590	590	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+591	591	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+592	592	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+593	593	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+594	594	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+595	595	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+596	596	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+597	597	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+598	598	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+599	599	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+600	600	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+601	601	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+602	602	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+603	603	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+604	604	^\d{4}[01]	2	0	0	1
+605	605	^\d{4}[01]	2	0	0	1
+606	606	^\d{4}[01]	2	0	0	1
+607	607	^\d{4}[01]	2	0	0	1
+608	608	^\d{4}[01]	2	0	0	1
+609	609	^\d{4}[01]	2	0	0	1
+610	610	^\d{4}[01]	2	0	0	1
+611	611	^\d{4}[01]	2	0	0	1
+612	612	^\d{4}[01]	2	0	0	1
+613	613	^\d{4}[01]	2	0	0	1
+614	614	^\d{4}[01]	2	0	0	1
+615	615	^\d{4}[01]	2	0	0	1
+616	616	^\d{4}[01]	2	0	0	1
+617	617	^\d{4}[01]	2	0	0	1
+618	618	^\d{4}[01]	2	0	0	1
+619	619	^\d{4}[01]	2	0	0	1
+620	620	^\d{4}[01]	2	0	0	1
+621	621	^\d{4}[01]	2	0	0	1
+622	622	^\d{4}[01]	2	0	0	1
+623	623	^\d{4}[01]	2	0	0	1
+624	624	^\d{4}[01]	2	0	0	1
+625	625	^\d{4}[01]	2	0	0	1
+626	626	^\d{4}[01]	2	0	0	1
+627	627	^\d{4}[01]	2	0	0	1
+628	628	^\d{4}[01]	2	0	0	1
+629	629	^\d{4}[01]	2	0	0	1
+630	630	^\d{4}[01]	2	0	0	1
+631	631	^\d{4}[01]	2	0	0	1
+632	632	^\d{4}[01]	2	0	0	1
+633	633	^\d{4}[01]	2	0	0	1
+634	634	^\d{4}[01]	2	0	0	1
+635	635	^\d{4}[01]	2	0	0	1
+636	636	^\d{4}[01]	2	0	0	1
+637	637	^\d{4}[01]	2	0	0	1
+638	638	^\d{4}[01]	2	0	0	1
+639	639	^\d{4}[01]	2	0	0	1
+640	640	^\d{4}[01]	2	0	0	1
+641	641	^\d{4}[01]	2	0	0	1
+642	642	^\d{4}[01]	2	0	0	1
+643	643	^\d{4}[01]	2	0	0	1
+644	644	^\d{4}[01]	2	0	0	1
+645	645	^\d{4}[01]	2	0	0	1
+646	646	^\d{4}[01]	2	0	0	1
+647	647	^\d{4}[01]	2	0	0	1
+648	648	^\d{4}[01]	2	0	0	1
+649	649	^\d{4}[01]	2	0	0	1
+650	650	^\d{4}[01]	2	0	0	1
+651	651	^\d{4}[01]	2	0	0	1
+652	652	^\d{4}[01]	2	0	0	1
+653	653	^\d{4}[01]	2	0	0	1
+654	654	^\d{4}[01]	2	0	0	1
+655	655	^\d{4}[01]	2	0	0	1
+656	656	^\d{4}[01]	2	0	0	1
+657	657	^\d{4}[01]	2	0	0	1
+658	658	^\d{4}[01]	2	0	0	1
+659	659	^\d{4}[01]	2	0	0	1
+660	660	^\d{4}[01]	2	0	0	1
+661	661	^\d{4}[01]	2	0	0	1
+662	662	^\d{4}[01]	2	0	0	1
+663	663	^\d{4}[01]	2	0	0	1
+664	664	^\d{4}[01]	2	0	0	1
+665	665	^\d{4}[01]	2	0	0	1
+666	666	^\d{4}[01]	2	0	0	1
+667	667	^\d{4}[01]	2	0	0	1
+668	668	^\d{4}[01]	2	0	0	1
+669	669	^\d{4}[01]	2	0	0	1
+670	670	^\d{4}[01]	2	0	0	1
+671	671	^\d{4}[01]	2	0	0	1
+672	672	^\d{4}[01]	2	0	0	1
+673	673	^\d{4}[01]	2	0	0	1
+674	674	^\d{4}[01]	2	0	0	1
+675	675	^\d{4}[01]	2	0	0	1
+676	676	^\d{4}[01]	2	0	0	1
+677	677	^\d{4}[01]	2	0	0	1
+678	678	^\d{4}[01]	2	0	0	1
+679	679	^\d{4}[01]	2	0	0	1
+680	680	^\d{4}[01]	2	0	0	1
+681	681	^\d{4}[01]	2	0	0	1
+682	682	^\d{4}[01]	2	0	0	1
+683	683	^\d{4}[01]	2	0	0	1
+684	684	^\d{4}[01]	2	0	0	1
+685	685	^\d{4}[01]	2	0	0	1
+686	686	^\d{4}[01]	2	0	0	1
+687	687	^\d{4}[01]	2	0	0	1
+688	688	^\d{4}[01]	2	0	0	1
+689	689	^\d{4}[01]	2	0	0	1
+690	690	^\d{4}[01]	2	0	0	1
+691	691	^\d{4}[01]	2	0	0	1
+692	692	^\d{4}[01]	2	0	0	1
+693	693	^\d{4}[01]	2	0	0	1
+694	694	^\d{4}[01]	2	0	0	1
+695	695	^\d{4}[01]	2	0	0	1
+696	696	^\d{4}[01]	2	0	0	1
+697	697	^\d{4}[01]	2	0	0	1
+698	698	^\d{4}[01]	2	0	0	1
+699	699	^\d{4}[01]	2	0	0	1
+700	700	^\d{4}[01]	2	0	0	1
+701	701	^\d{4}[01]	2	0	0	1
+702	702	^\d{4}[01]	2	0	0	1
+703	703	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+704	704	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+705	705	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+706	706	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+707	707	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+708	708	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+709	709	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+710	710	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+711	711	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+712	712	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+713	713	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+714	714	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+715	715	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+716	716	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+717	717	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+718	718	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+719	719	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+720	720	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+721	721	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+722	722	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+723	723	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+724	724	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+725	725	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+726	726	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+727	727	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+728	728	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+729	729	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+730	730	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+731	731	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+732	732	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+733	733	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+734	734	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+735	735	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+736	736	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+737	737	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+738	738	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+739	739	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+740	740	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+741	741	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+742	742	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+743	743	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+744	744	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+745	745	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+746	746	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+747	747	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+748	748	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+749	749	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+750	750	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+751	751	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+752	752	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+753	753	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+754	754	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+755	755	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+756	756	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+757	757	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+758	758	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+759	759	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+760	760	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+761	761	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+762	762	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+763	763	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+764	764	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+765	765	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+766	766	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+767	767	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+768	768	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+769	769	^\d{4}[01]	2	0	0	1
+770	770	^\d{4}[01]	2	0	0	1
+771	771	^\d{4}[01]	2	0	0	1
+772	772	^\d{4}[01]	2	0	0	1
+773	773	^\d{4}[01]	2	0	0	1
+774	774	^\d{4}[01]	2	0	0	1
+775	775	^\d{4}[01]	2	0	0	1
+776	776	^\d{4}[01]	2	0	0	1
+777	777	^\d{4}[01]	2	0	0	1
+778	778	^\d{4}[01]	2	0	0	1
+779	779	^\d{4}[01]	2	0	0	1
+780	780	^\d{4}[01]	2	0	0	1
+781	781	^\d{4}[01]	2	0	0	1
+782	782	^\d{4}[01]	2	0	0	1
+783	783	^\d{4}[01]	2	0	0	1
+784	784	^\d{4}[01]	2	0	0	1
+785	785	^\d{4}[01]	2	0	0	1
+786	786	^\d{4}[01]	2	0	0	1
+787	787	^\d{4}[01]	2	0	0	1
+788	788	^\d{4}[01]	2	0	0	1
+789	789	^\d{4}[01]	2	0	0	1
+790	790	^\d{4}[01]	2	0	0	1
+791	791	^\d{4}[01]	2	0	0	1
+792	792	^\d{4}[01]	2	0	0	1
+793	793	^\d{4}[01]	2	0	0	1
+794	794	^\d{4}[01]	2	0	0	1
+795	795	^\d{4}[01]	2	0	0	1
+796	796	^\d{4}[01]	2	0	0	1
+797	797	^\d{4}[01]	2	0	0	1
+798	798	^\d{4}[01]	2	0	0	1
+799	799	^\d{4}[01]	2	0	0	1
+800	800	^\d{4}[01]	2	0	0	1
+801	801	^\d{4}[01]	2	0	0	1
+802	802	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+803	803	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+804	804	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+805	805	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+806	806	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+807	807	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+808	808	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+809	809	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+810	810	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+811	811	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+812	812	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+813	813	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+814	814	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+815	815	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+816	816	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+817	817	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+818	818	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+819	819	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+820	820	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+821	821	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+822	822	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+823	823	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+824	824	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+825	825	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+826	826	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+827	827	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+828	828	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+829	829	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+830	830	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+831	831	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+832	832	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+833	833	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+834	834	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+835	835	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+836	836	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+837	837	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+838	838	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+839	839	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+840	840	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+841	841	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+842	842	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+843	843	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+844	844	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+845	845	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+846	846	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+847	847	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+848	848	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+849	849	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+850	850	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+851	851	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+852	852	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+853	853	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+854	854	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+855	855	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+856	856	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+857	857	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+858	858	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+859	859	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+860	860	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+861	861	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+862	862	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+863	863	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+864	864	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+865	865	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+866	866	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+867	867	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+868	868	^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+869	869	^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+870	870	\x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,}	2	0	0	1
+871	871	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+872	872	appid\x3a\s+2	2	0	0	1
+873	873	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+874	874	\x22mining\x2E(subscribe|authorize)\x22	2	0	0	1
+875	875	^\s*(<var>[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start	2	0	0	1
+876	876	^\/api\/(bit|lite)coin\/balance\/	2	0	0	1
+877	877	miner[^a-z]	2	0	0	1
+878	878	(\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22)	2	0	0	1
+879	879	(\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22)	2	0	0	1
+880	880	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+881	881	\/tmp\/[^\/]+\.swf$	2	0	0	1
+882	882	name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22	2	0	0	1
+883	883	name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22	2	0	0	1
+884	884	=[0-9a-f]{8}\.jar/H	2	0	0	1
+885	885	^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\?	2	0	0	1
+886	886	^\/[a-z0-9]{32}\?s=1$	2	0	0	1
+887	887	^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))	2	0	0	1
+888	888	^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>]	2	0	0	1
+889	889	^(mous)?\.class	2	0	0	1
+890	890	\/chrome\/google_chrome_(update|installer)\.exe$	2	0	0	1
+891	891	^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+892	892	^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P	2	0	0	1
+893	893	findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$	2	0	0	1
+894	894	^[^=]+[^\x22\x27\x3b]*?(<q>[\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m	2	0	0	1
+895	895	\.php\?cashe=\d+$	2	0	0	1
+896	896	\.jar\?m=[1-2]$	2	0	0	1
+897	897	\.pdf\?p=1&s=[1-2]$	2	0	0	1
+898	898	^Host\x3a [^\r\n]+?\.bit\r\n$/Hmi	2	0	0	1
+899	899	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[^\/\.]+$	2	0	0	1
+900	900	\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$	2	0	0	1
+901	901	\/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+902	902	\/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+903	903	\/tds\/[a-f0-9]{32}$	2	0	0	1
+904	904	^[a-f0-9]{32}[\x22\x27]	2	0	0	1
+905	905	Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi	2	0	0	1
+906	906	(\.\.\/)+kboxwww\/tmp\/	2	0	0	1
+907	907	^(<var>.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22	2	0	0	1
+908	908	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+909	909	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+910	910	\/\?[0-9a-f]{60,66}[\;\d\x2c]*$	2	0	0	1
+911	911	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15}	2	0	0	1
+912	912	\/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php	2	0	0	1
+913	913	debugenableplugins=[a-zA-Z0-9]+?\x3b	2	0	0	1
+914	914	^\/[a-z0-9]+\/load\.php$	2	0	0	1
+915	915	^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H	2	0	0	1
+916	916	^\/xteas\/code$	2	0	0	1
+917	917	\/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash=	2	0	0	1
+918	918	=\w{8}\.pdf/Hi	2	0	0	1
+919	919	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[A-Za-z0-9]+$	2	0	0	1
+920	920	^User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$/H	2	0	0	1
+921	921	^Host\x3a\s.+\.in\r?$/Hmi	2	0	0	1
+922	922	name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22	2	0	0	1
+923	923	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+924	924	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+925	925	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+926	926	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+927	927	^Location\x3a\x20[a-f0-9]{32}\/e\.html\r$/Hm	2	0	0	1
+928	928	^\/(v(1\/buckets\/default\/ext-5dkJ19tFufpMZjVJbsWCiqDcclDw\/records|4\/links\/activity-stream|3\/links\/ping-centre)|gp\/(aj\/private\/reviewsGallery\/get-(application-resource|image-gallery-asset)s|cerberus\/gv)|en-us\/(p\/(onerf\/MeSilentPassport|book-2\/8MCPZJJCC98C)|store\/api\/checkproductinwishlist)|wp-(content\/themes\/am43-6\/dist\/records|includes\/js\/script\/indigo-migrate)|api2\/json\/(cluster\/(resource|task)s|access\/ticket))	2	0	0	1
+929	929	^(\/updates|\/license\/eula|\/docs\/office|\/software-activation)	2	0	0	1
+930	930	^GET\s(\/((v(i-assets\/static-asset|[12]\/preference)|idcta\/translation)s|ads\/google))	2	0	0	1
+931	931	^([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9_\/\+\-]{2}==|[a-zA-Z0-9_\/\+\-]{3}=|[a-zA-Z0-9_\/\+\-]{4})\x3b	2	0	0	1
+932	932	^(\/track|\/api\/v1\/survey\/embed|\/svc\/weather\/v2)	2	0	0	1
+933	933	\/api\/v1\/user\/(512|124)\/avatar	2	0	0	1
+934	934	^GET [^\r\n]{0,256}&parent_request_id=([A-Za-z0-9_\/\+\-%]{128,1024})={0,2}[^\r\n]{0,256} HTTP\/1\.[01]	2	0	0	1
+935	935	^\/v1\/(queue|profile|docs\/wsdl|pull)	2	0	0	1
+936	936	^GET\s(\/USAT-GUP\/user\/|\/entertainment\/|\/entertainment\/navdd-q1a2z3Z6TET4gv2PNfXpaJAniOzOajK7M\.min\.json|\/global-q1a2z3C4M2nNlQYzWhCC0oMSEFjQbW1KA\.min\.json|\/life\/|\/news\/weather\/|\/opinion\/|\/sports\/|\/sports\/navdd-q1a2z3JHa8KzCRLOQAnDoVywVWF7UwxJs\.min\.json|\/tangstatic\/js\/main-q1a2z3b37df2b1\.min\.js|\/tangstatic\/js\/pbjsandwich-q1a2z300ab4198\.min\.js|\/tangstatic\/js\/pg-q1a2z3bbc110a4\.min\.js|\/tangsvc\/pg\/3221104001\/|\/tangsvc\/pg\/5059005002\/|\/tangsvc\/pg\/5066496002\/|\/tech\/|\/travel\/)	2	0	0	1
+937	937	^POST\s(\/v4\/links\/check-activity\/check|\/v1\/stats|\/gql|\/api2\/json\/check\/ticket|\/1.5\/95648064\/storage\/history|\/1.5\/95648064\/storage\/tabs|\/u\/0\/_\/og\/botguard\/get|\/ev\/prd001001|\/ev\/ext001001|\/gp\/aw\/ybh\/handlers|\/v3\/links\/ping-beat\/check)	2	0	0	1
+938	938	^[^\n]*[\x00-\x08\x0e-\x1f]	2	0	0	1
+939	939	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+940	940	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+941	941	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+942	942	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+943	943	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+944	944	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(IMCON|IMC)[\s\w,/-]*(//(X1|MR))	2	0	0	1
+945	945	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+946	946	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+947	947	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+948	948	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+949	949	(TOP\s|T)(SECRET|S)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+950	950	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+951	951	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+952	952	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+953	953	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+954	954	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+955	955	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+956	956	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+957	957	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+958	958	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+959	959	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+960	960	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+961	961	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+962	962	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+963	963	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+964	964	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+965	965	\[\[\d{1,3}\,\[\\\"\w\\\"\,\\\"[email protected].+\\\"\,\\\"	2	0	0	1
+966	966	User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER	2	0	0	1
+967	967	\x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20)	2	0	0	1
+968	968	PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20)	2	0	0	1
+969	969	\x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\s*\x29\x3Aend\s+function\x3A	2	0	0	1
+970	970	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000	2	0	0	1
+971	971	filename\s*=\s*"WU_Details_.....\.zip	2	0	0	1
+972	972	filename\s*=\s*MySpace_document_[0-9]{5}\.zip	2	0	0	1
+973	973	filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22	2	0	0	1
+974	974	filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22	2	0	0	1
+975	975	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E	2	0	0	1
+976	976	MyValue=[a-f0-9]{32}	2	0	0	1
+977	977	\x0d\x0aUser-Agent\: 0\:0\:[^\n]{120}	2	0	0	1
+978	978	User-Agent\: 0\:0\:[^\x0a|\x0d]{128}	2	0	0	1
+979	979	01E04581-4EEE-11D0-BFE9-00AA005B4383|AF604EFE-8897-11D1-B944-00A0C90312E1|7849596A-48EA-486E-8937-A2A3009F31A9|FBEB8A05-BEEE-4442-804E-409D6C4515E9|3050F391-98B5-11CF-BB82-00AA00BDCE0B|8EE42293-C315-11D0-8D6F-00A0C9A06E1F|2A6EB050-7F1C-11CE-BE57-00AA0051FE20|510A4910-7F1C-11CE-BE57-00AA0051FE20|6D36CE10-7F1C-11CE-BE57-00AA0051FE20|860D28D0-8BF4-11CE-BE59-00AA0051FE20|9478F640-7F1C-11CE-BE57-00AA0051FE20|B0516FF0-7F1C-11CE-BE57-00AA0051FE20|D99F7670-7F1A-11CE-BE57-00AA0051FE20	2	0	0	1
+980	980	(\.\.\/){1,}	2	0	0	1
+981	981	\/cgi-bin\/pr2\.cgi\?[a-zA-Z0-9]{172}	2	0	0	1
+982	982	03D9F3F2-B0E3-11D2-B081-006008039BF0|860BB310-5D01-11D0-BD3B-00A0C911CE86|E0F158E1-CB04-11D0-BD4E-00A0C911CE86|33D9A761-90C8-11D0-BD43-00A0C911CE86|4EFE2452-168A-11D1-BC76-00C04FB9453B|33D9A760-90C8-11D0-BD43-00A0C911CE86|33D9A762-90C8-11D0-BD43-00A0C911CE86|083863F1-70DE-11D0-BD40-00A0C911CE86|18AB439E-FCF4-40D4-90DA-F79BAA3B0655|31087270-D348-432C-899E-2D2F38FF29A0|D2923B86-15F1-46FF-A19A-DE825F919576|FD78D554-4C6E-11D0-970D-00A0C9191601|52CA3BCF-3B9B-419E-A3D6-5D28C0B0B50C	2	0	0	1
+983	983	4FAAB301-CEF6-477C-9F58-F601039E9B78|6CBE0382-A879-4D2A-8EC3-1F2A43611BA8|F117831B-C052-11D1-B1C0-00C04FC2F3EF|3050F667-98B5-11CF-BB82-00AA00BDCE0B|1AA06BA1-0E88-11D1-8391-00C04FBD7C09|F28D867A-DDB1-11D3-B8E8-00A0C981AEEB|6B7F1602-D44C-11D0-A7D9-AE3D17000000|7007ACCF-3202-11D1-AAD2-00805FC1270E|992CFFA0-F557-101A-88EC-00DD010CCC48|00020420-0000-0000-C000-000000000046|0006F02A-0000-0000-C000-000000000046|ABBA001B-3075-11D6-88A4-00B0D0200F88|CE292861-FC88-11D0-9E69-00C04FD7C15B	2	0	0	1
+984	984	php\?r=\d+&p=	2	0	0	1
+985	985	\/socks\.php\?name=[^&]+&port=\d{1,5}$	2	0	0	1
+986	986	SELECT.+FROM	2	0	0	1
+987	987	UNION\s+SELECT	2	0	0	1
+988	988	INSERT.+INTO	2	0	0	1
+989	989	DELETE.+FROM	2	0	0	1
+990	990	ASCII\(.+SELECT	2	0	0	1
+991	991	UPDATE.+SET	2	0	0	1
+992	992	EEED4C20-7F1B-11CE-BE57-00AA0051FE20|C7B6C04A-CBB5-11D0-BB4C-00C04FC2F410|85BBD920-42A0-1069-A2E4-08002B30309D|E846F0A0-D367-11D1-8286-00A0C9231C29|B4B3AECB-DFD6-11D1-9DAA-00805F85CFE3|ECABB0BF-7F19-11D2-978E-0000F8757E2A|466D66FA-9616-11D2-9342-0000F875AE17|67DCC487-AA48-11D1-8F4F-00C04FB611C7|00022613-0000-0000-C000-000000000046|D2D588B5-D081-11D0-99E0-00C04FC2F8EC|5D08B586-343A-11D0-AD46-00C04FD8FDFF|CC7BFB42-F175-11D1-A392-00E0291F3959|CC7BFB43-F175-11D1-A392-00E0291F3959|3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5	2	0	0	1
+993	993	BC5F1E51-5110-11D1-AFF5-006097C9A284|F27CE930-4CA3-11D1-AFF2-006097C9A284|3BC4F3A7-652A-11D1-B4D4-00C04FC2DB8D|ECABAFC2-7F19-11D2-978E-0000F8757E2A|283807B8-2C60-11D0-A31D-00AA00B92C03|250770F3-6AF2-11CF-A915-008029E31FCD|D24D4453-1F01-11D1-8E63-006097D2DF48|03CB9467-FD9D-42A8-82F9-8615B4223E6E|598EBA02-B49A-11D2-A1C1-00609778EA66|8FE7E181-BB96-11D2-A1CB-00609778EA66|4CFB5280-800B-4367-848F-5A13EBF27F1D|B3E0E785-BD78-4366-9560-B7DABE2723BE|208DD6A3-E12B-4755-9607-2E39EF84CFC5	2	0	0	1
+994	994	6E227101-F799-11CF-9227-00AA00A1EB95|7057E952-BD1B-11D1-8919-00C04FC2C836|7007ACC7-3202-11D1-AAD2-00805FC1270E|4622AD11-FF23-11D0-8D34-00A0C90F2719|98CB4060-D3E7-42A1-8D65-949D34EBFE14|47C6C527-6204-4F91-849D-66E234DEE015|35CEC8A3-2BE6-11D2-8773-92E220524153|730F6CDC-2C86-11D2-8773-92E220524153|2C10A98F-D64F-43B4-BED6-DD0E1BF2074C|6F9F3481-84DD-4B14-B09C-6B4288ECCDE8|8E26BFC1-AFD6-11CF-BFFC-00AA003CFDFC|F0975AFE-5C7F-11D2-8B74-00104B2AFB41	2	0	0	1
+995	995	index\.php\?q=(uggc|jjj|http|www|aHR0c|d3d3)	2	0	0	1
+996	996	(file=\|.+\|)	2	0	0	1
+997	997	SELECT.+FROM	2	0	0	1
+998	998	UNION\s+SELECT	2	0	0	1
+999	999	INSERT.+INTO	2	0	0	1
+1000	1000	DELETE.+FROM	2	0	0	1
+1001	1001	ASCII\(.+SELECT	2	0	0	1
+1002	1002	UPDATE.+SET	2	0	0	1
+1003	1003	SELECT.+FROM	2	0	0	1
+1004	1004	UNION\s+SELECT	2	0	0	1
+1005	1005	INSERT.+INTO	2	0	0	1
+1006	1006	DELETE.+FROM	2	0	0	1
+1007	1007	ASCII\(.+SELECT	2	0	0	1
+1008	1008	UPDATE.+SET	2	0	0	1
+1009	1009	SELECT.+FROM	2	0	0	1
+1010	1010	UNION\s+SELECT	2	0	0	1
+1011	1011	INSERT.+INTO	2	0	0	1
+1012	1012	DELETE.+FROM	2	0	0	1
+1013	1013	ASCII\(.+SELECT	2	0	0	1
+1014	1014	UPDATE.+SET	2	0	0	1
+1015	1015	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+1016	1016	filename=\x22Facebook_(Password|Support|Document)_[A-Z0-9]{4,7}\.zip\x22	2	0	0	1
+1017	1017	\x2FU3D\x2FLength\x20172[0-5][0-9]{2}	2	0	0	1
+1018	1018	\/000[a-z][0-9]{3}\x2Eso	2	0	0	1
+1019	1019	\/000[a-z][0-9]{3}\x2Eexe	2	0	0	1
+1020	1020	UPDATE.+SET	2	0	0	1
+1021	1021	PDF-.+[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F]	2	0	0	1
+1022	1022	^FOLD\s[^\n]{256}	2	0	0	1
+1023	1023	^FOLD\s+\/	2	0	0	1
+1024	1024	^Username\:[^\n]{100}	2	0	0	1
+1025	1025	^http\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1026	1026	^http\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1027	1027	^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\}	2	0	0	1
+1028	1028	^file\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1029	1029	\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JBIG2Decode](J|#4A)(B|#42)(I|#49)(G|#47)(2|#32)(D|#44)(e|#65)(c|#63)(o|#6F)(d|#64)(e|#65)	2	0	0	1
+1030	1030	OS 4_[0-3]_[1-4] like/H	2	0	0	1
+1031	1031	[a-f0-9]{16}$	2	0	0	1
+1032	1032	mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+1033	1033	(/joomla/admin|/joomla/administrator|/joomla/manage|/joomla/administration)	2	0	0	1
+1034	1034	\x3A\x02\x5B(Atk33|Exploiting|Finished|GOOGLE.*|HTTP.{0,8}|PKS-SCAN.{0,20}|Results|RSH|SCAN|TCP.{0,8}|UDP.{0,8}|v6.{0,12}|VERSION)\x5D\x02	2	0	0	1
+1035	1035	\x3A\x02(Alvo dos Pacotes|Conectando-se em|M.dia de envio|Tempo.*|Total .*)\x02	2	0	0	1
+1036	1036	NICK\x20\S+\x0AUSER\x20\S+localhost\x20localhost\x20\x3A	2	0	0	1
+1037	1037	\x3a.4\x7c.12.\x3a.4	2	0	0	1
+1038	1038	(cheguei gazelas|meh que tao|Status|Tempo|Total pacotes|Total bytes|M?dia de envio|portas? aberta)	2	0	0	1
+1039	1039	keepalive([0-9]{4}|\x7c[0-9]{4})	2	0	0	1
+1040	1040	User-Agent\x3a[^\n]+sbu-hb-	2	0	0	1
+1041	1041	User-Agent\:[^\n]+Peer Points/iH	2	0	0	1
+1042	1042	User-Agent\:[^\n]+zbu-hb-/Hi	2	0	0	1
+1043	1043	User-Agent\:[^\n]+HSN/iH	2	0	0	1
+1044	1044	User-Agent\:[^\n]+Wildtangent/iH	2	0	0	1
+1045	1045	^RMD\s+\x2f$	2	0	0	1
+1046	1046	User-Agent\x3A[^\n]+TheWorld/H	2	0	0	1
+1047	1047	^Max-dotdot[\s\r\n]*\d{3,}	2	0	0	1
+1048	1048	^Authorization\x3a Basic\s+=	2	0	0	1
+1049	1049	^Authorization\x3a Basic\s+=	2	0	0	1
+1050	1050	Host\x3a\s[a-z]{16}\.ru/H	2	0	0	1
+1051	1051	CREATE.+ENDPOINT	2	0	0	1
+1052	1052	\/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir=	2	0	0	1
+1053	1053	MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w	2	0	0	1
+1054	1054	MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w	2	0	0	1
+1055	1055	\x00[0-9]{4,7}\x02co\x00	2	0	0	1
+1056	1056	\x2fsogou(config)?\x2f	2	0	0	1
+1057	1057	\/\d{8,}\/\d{4,}\/\d{4,}\.jsp	2	0	0	1
+1058	1058	adv\d+\.php	2	0	0	1
+1059	1059	a=\%[0-9a-fA-F]{2}\&b	2	0	0	1
+1060	1060	\Wcustomer\slist(s)?\W	2	0	0	1
+1061	1061	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1062	1062	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1063	1063	\Wannual\sincome(s)?\W	2	0	0	1
+1064	1064	\Wpayment\shistory\W	2	0	0	1
+1065	1065	\Waccount\sbalance(s)?\W	2	0	0	1
+1066	1066	\Wappraisal(s)?\W	2	0	0	1
+1067	1067	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1068	1068	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1069	1069	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1070	1070	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1071	1071	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1072	1072	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1073	1073	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1074	1074	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1075	1075	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1076	1076	\Winternal\suse\sonly\W	2	0	0	1
+1077	1077	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1078	1078	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1079	1079	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1080	1080	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1081	1081	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1082	1082	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1083	1083	(//)\Wconfidential[^\w/]	2	0	0	1
+1084	1084	(//)\Wrestricted[^\w/]	2	0	0	1
+1085	1085	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1086	1086	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1087	1087	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1088	1088	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1089	1089	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1090	1090	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1091	1091	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1092	1092	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1093	1093	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1094	1094	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1095	1095	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1096	1096	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1097	1097	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1098	1098	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1099	1099	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1100	1100	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1101	1101	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1102	1102	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1103	1103	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1104	1104	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1105	1105	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1106	1106	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1107	1107	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1108	1108	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1109	1109	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1110	1110	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1111	1111	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1112	1112	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1113	1113	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1114	1114	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1115	1115	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1116	1116	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1117	1117	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1118	1118	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1119	1119	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1120	1120	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1121	1121	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1122	1122	(//)\Wrestricted[^\w/]	2	0	0	1
+1123	1123	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1124	1124	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1125	1125	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1126	1126	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1127	1127	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1128	1128	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1129	1129	\Winternal\suse\sonly\W	2	0	0	1
+1130	1130	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1131	1131	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1132	1132	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1133	1133	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1134	1134	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1135	1135	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1136	1136	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1137	1137	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1138	1138	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1139	1139	\Wappraisal(s)?\W	2	0	0	1
+1140	1140	\Waccount\sbalance(s)?\W	2	0	0	1
+1141	1141	\Wannual\sincome(s)?\W	2	0	0	1
+1142	1142	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1143	1143	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1144	1144	\Wcustomer\slist(s)?\W	2	0	0	1
+1145	1145	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1146	1146	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1147	1147	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1148	1148	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1149	1149	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1150	1150	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1151	1151	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1152	1152	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1153	1153	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1154	1154	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1155	1155	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1156	1156	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1157	1157	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1158	1158	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1159	1159	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1160	1160	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1161	1161	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1162	1162	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1163	1163	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1164	1164	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1165	1165	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1166	1166	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1167	1167	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1168	1168	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1169	1169	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1170	1170	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1171	1171	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1172	1172	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1173	1173	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1174	1174	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1175	1175	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1176	1176	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1177	1177	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1178	1178	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1179	1179	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1180	1180	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1181	1181	(//)\Wrestricted[^\w/]	2	0	0	1
+1182	1182	(//)\Wconfidential[^\w/]	2	0	0	1
+1183	1183	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1184	1184	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1185	1185	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1186	1186	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1187	1187	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1188	1188	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1189	1189	\Winternal\suse\sonly\W	2	0	0	1
+1190	1190	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1191	1191	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1192	1192	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1193	1193	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1194	1194	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1195	1195	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1196	1196	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1197	1197	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1198	1198	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1199	1199	\Wappraisal(s)?\W	2	0	0	1
+1200	1200	\Waccount\sbalance(s)?\W	2	0	0	1
+1201	1201	\Wpayment\shistory\W	2	0	0	1
+1202	1202	\Wannual\sincome(s)?\W	2	0	0	1
+1203	1203	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1204	1204	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1205	1205	\Wcustomer\slist(s)?\W	2	0	0	1
+1206	1206	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1207	1207	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1208	1208	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1209	1209	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1210	1210	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1211	1211	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1212	1212	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1213	1213	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1214	1214	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1215	1215	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1216	1216	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1217	1217	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1218	1218	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1219	1219	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1220	1220	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1221	1221	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1222	1222	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1223	1223	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1224	1224	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1225	1225	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1226	1226	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1227	1227	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1228	1228	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1229	1229	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1230	1230	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1231	1231	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1232	1232	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1233	1233	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1234	1234	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1235	1235	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1236	1236	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1237	1237	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1238	1238	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1239	1239	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1240	1240	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1241	1241	User-Agent\x3a \d{6}\x0d\x0a/H	2	0	0	1
+1242	1242	(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/s\/l\/firstping	2	0	0	1
+1243	1243	\.dyndns\.((biz|info|org|tv))\x0d\x0a/iH	2	0	0	1
+1244	1244	\.dyndns-((at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work))\.com\x0d\x0a/iH	2	0	0	1
+1245	1245	\.jpg\?t\x3d\d\.\d	2	0	0	1
+1246	1246	[0-9]{1,16}[a-f]{1,16}[0-9]{1,16}$	2	0	0	1
+1247	1247	^Content-Length\x3a\s*-\d+	2	0	0	1
+1248	1248	\W[0-9]{5}\.jar	2	0	0	1
+1249	1249	machine_id={[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+}	2	0	0	1
+1250	1250	[0-9]{1,8}[a-f]{1,8}[0-9]{1,8}$	2	0	0	1
+1251	1251	^[a-z0-9]{6}..\x00\x00	2	0	0	1
+1252	1252	^[a-z0-9]{7}..\x00\x00	2	0	0	1
+1253	1253	\sLOGIN\s[^\n]*?%	2	0	0	1
+1254	1254	({(\d+}[^\n]*?\sAUTH)|AUTH\s[^\n]*?{(\d+}))	2	0	0	1
+1255	1255	^\/\?[a-f0-9]{32}$	2	0	0	1
+1256	1256	[a-z]{9}[0-9]\.exe/H	2	0	0	1
+1257	1257	\.php\?inst_result=.+&hwid=	2	0	0	1
+1258	1258	^.{1,5}[a-f0-9]{100}	2	0	0	1
+1259	1259	\/scr5\.php\?p=\d+&id=\d	2	0	0	1
+1260	1260	^User-Agent\: App\d/Hmi	2	0	0	1
+1261	1261	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$	2	0	0	1
+1262	1262	\x00\x07[a-z]{7}\x02eu\x00	2	0	0	1
+1263	1263	REGISTER.{400}	2	0	0	1
+1264	1264	\/content\/jav\d?\.jar$	2	0	0	1
+1265	1265	^\/\?[a-f0-9]{32}$	2	0	0	1
+1266	1266	\.php\?[a-z]+=[a-f0-9]{64}&[^\?]+=[a-f0-9]{20}&	2	0	0	1
+1267	1267	^HTTP\x2f1\.[01] 200	2	0	0	1
+1268	1268	\.php\?[a-z]+=(([1-2][a-z]|3[0-9])\x3a){3,}([1-2][a-z]|3[0-9])&	2	0	0	1
+1269	1269	IP\:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+1270	1270	^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$	2	0	0	1
+1271	1271	\.(jpg|png|gif|cgi)\?pr=	2	0	0	1
+1272	1272	^\/\?affid=\d+&promo_type=\d+&promo_opt=\d+$	2	0	0	1
+1273	1273	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1274	1274	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1275	1275	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1276	1276	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1277	1277	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1278	1278	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1279	1279	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1280	1280	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1281	1281	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1282	1282	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1283	1283	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1284	1284	(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/.*perl\/fr\.pl	2	0	0	1
+1285	1285	\x2F[a-z\x2D]{60,120}.+\x2D\x2Ephp$	2	0	0	1
+1286	1286	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1287	1287	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1288	1288	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1289	1289	^\/[a-z0-9A-Z]{25,35}\/(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+(_[e7uxMhp1Kt]+)?|a2\.\.)Z(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+|a2\.\.)\/	2	0	0	1
+1290	1290	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$	2	0	0	1
+1291	1291	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$	2	0	0	1
+1292	1292	applet\/code=[\x22\x27](<val1>[a-zA-Z0-9]+)[a-z]\.(=val1)[a-z][\x22\x27][^\x3e]+\.jar[\x22\x27]	2	0	0	1
+1293	1293	code\x3D\x22[a-z]{4}\x2E[a-z]{4}\x22	2	0	0	1
+1294	1294	\x7B\x22e(v|x22\x2B\x22)(v|x22\x2B\x22|a)(a|v|x22\x2B\x22)[^\x5D]*?l\x22\x5D	2	0	0	1
+1295	1295	\x2Fgo\x2Ephp\x3Dd\x3D[a-f0-9]{16}$	2	0	0	1
+1296	1296	^[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}=	2	0	0	1
+1297	1297	\.php\?\w{2,9}\=(0[0-9a-b]|3[0-9]){5}\&\w{3,9}\=(3[0-9a-f]|4[0-9a-f])\&\w{3,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{3,9}\=(0[0-9a-b]{1,8})00020002$	2	0	0	1
+1298	1298	^\d+?.\x00\x00\x00	2	0	0	1
+1299	1299	\/[0-9a-f]{32}\.jar$	2	0	0	1
+1300	1300	\/[a-f0-9]{5,}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1301	1301	^[^OGHPDTCMLUVRBAS]	2	0	0	1
+1302	1302	&s=\{[A-Z0-9]{8}-([A-Z0-9]{4}-){3}[A-Z0-9]{12}\}&w=(\d{1,2}\.){2}\d{1,2}&b=(32|64)$/Pi	2	0	0	1
+1303	1303	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$	2	0	0	1
+1304	1304	AjaxHandler\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+1305	1305	DELETE.+FROM	2	0	0	1
+1306	1306	UNION.+SELECT	2	0	0	1
+1307	1307	UPDATE.+SET	2	0	0	1
+1308	1308	ASCII\(.+SELECT	2	0	0	1
+1309	1309	DELETE.+FROM	2	0	0	1
+1310	1310	INSERT.+INTO	2	0	0	1
+1311	1311	UNION\s+SELECT	2	0	0	1
+1312	1312	SELECT.+FROM	2	0	0	1
+1313	1313	UPDATE.+SET	2	0	0	1
+1314	1314	ASCII\(.+SELECT	2	0	0	1
+1315	1315	DELETE.+FROM	2	0	0	1
+1316	1316	INSERT.+INTO	2	0	0	1
+1317	1317	SELECT.+FROM	2	0	0	1
+1318	1318	\/\S+\.cab	2	0	0	1
+1319	1319	User-Agent\x3a[^\n]+AskTB/iH	2	0	0	1
+1320	1320	(<p>[0-7]{3})(<d>[0-7]{3})(=p)(=d)([0-7]{3}){10}(<q>[0-7]{3})[0-7]{3}(<dot>[0-7]{3})[0-7]{3}(=dot)[0-7]{3}(=q)	2	0	0	1
+1321	1321	(<p>[0-7]{2,4})(<sep>[^0-7])(<d>((=p))[0-7]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-7]{2,4}(=sep)){10}(<q>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(<dot>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(=dot)(=sep)[0-7]{2,4}(=sep)(=q)	2	0	0	1
+1322	1322	^\/(p(a(rs|g)e|rocess)|(securit|quer)y|(defaul|abou)t|index|login|user)\.jsp\?[a-z]{2}\x3d[a-z0-9]{9}[A-F0-9]{9}$	2	0	0	1
+1323	1323	\/gate\.php\?cmd=urls$	2	0	0	1
+1324	1324	\/gate\.php\?cmd=getexe$	2	0	0	1
+1325	1325	^User-Agent\x3a[^\r\n]*?\sMSIE\s/H	2	0	0	1
+1326	1326	^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email)	2	0	0	1
+1327	1327	[^a-z0-9\-\.][a-z0-9]{32,48}\x02ru\x00\x00	2	0	0	1
+1328	1328	[^a-z0-9\-\.][a-z0-9]{32,48}\x04info\x00\x00	2	0	0	1
+1329	1329	[^a-z0-9\-\.][a-z0-9]{32,48}\x03biz\x00\x00	2	0	0	1
+1330	1330	\x2flogo\x2egif\x3f([0-9a-z]){5}\x3d\d{6,7}	2	0	0	1
+1331	1331	\.php\?label=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1332	1332	\.php\?id=[A-F0-9]+\-[A-F0-9]+&v1=[A-F0-9]+&v2=[A-F0-9]+&q=[A-F0-9]+$	2	0	0	1
+1333	1333	^\/[A-Za-z0-9]{7,8}\/index\.html?$	2	0	0	1
+1334	1334	^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/js\.js$	2	0	0	1
+1335	1335	^Host\x3a\x20www\d+?\.[^\.]+?\.[^\.]+?\.([^\.]+\.)*?[a-z]{2,4}(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1336	1336	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1337	1337	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1338	1338	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1339	1339	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1340	1340	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(refresh_template_name|user_name)[\r\n\s]*=>[\r\n\s]*|(refresh_template_name|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1341	1341	^\/b\/(eve|opt|req)\/[\-f0-9A-F]{24}$	2	0	0	1
+1342	1342	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+1343	1343	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+1344	1344	\/[a-z]{1,6}\.html\?0\.[0-9]+[a-z]?$	2	0	0	1
+1345	1345	^[^\r\n]{15}\x5f[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}	2	0	0	1
+1346	1346	^Host\x3a[^\r\n]+\.passinggas\.net(\x3a\d{1,5})?\r?$/Hmi	2	0	0	1
+1347	1347	Server\: nginx/[a-zA-Z]	2	0	0	1
+1348	1348	^\x23\d\d\d\x2f\x21	2	0	0	1
+1349	1349	XPantivirus20\d{2}_v\d{6}\.exe	2	0	0	1
+1350	1350	\d\d\d\d\d\d\x0a	2	0	0	1
+1351	1351	PASS\s.*?\x0d\x0aNICK\s.*?\x0d\x0aUSER\s.*?\s\d\s\d\s\:\S	2	0	0	1
+1352	1352	[0-9A-Z]{240,}	2	0	0	1
+1353	1353	\x26[\x00-\xff]\x09\x00	2	0	0	1
+1354	1354	\x26[\x00-\xff]\x09\x00	2	0	0	1
+1355	1355	\.php\?id=\d+_[0-9a-f]{8}-[0-9a-f]+-[0-9a-f]{8}&cnt=	2	0	0	1
+1356	1356	OS 4_[0-3]_[1-4] like/H	2	0	0	1
+1357	1357	\.php\?f=\d+$	2	0	0	1
+1358	1358	Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H	2	0	0	1
+1359	1359	User-Agent\x3a We[a-z0-9]{4}\x0d\x0a/H	2	0	0	1
+1360	1360	\.php\?t=\d{2,7}$	2	0	0	1
+1361	1361	filename=.*facebook.*\.(rar|exe|zip)	2	0	0	1
+1362	1362	filename\s*[^\n]*?(UPS|United Parcel Service)[^\n]*?\.(rar|exe|zip)	2	0	0	1
+1363	1363	flash-[A-Z0-9]+-plugin\.[A-Z0-9]+\.exe	2	0	0	1
+1364	1364	\x2Fget\x5Fdr\x2Ephp\x3F(e|ini)\x3D	2	0	0	1
+1365	1365	MalvRem_\d{3,4}\.exe	2	0	0	1
+1366	1366	avdistr_\d{3,4}\.exe	2	0	0	1
+1367	1367	RunAV_\d{3,4}\.exe	2	0	0	1
+1368	1368	installer\.\d{4}\.exe	2	0	0	1
+1369	1369	\/stetement_id\.\d+\/	2	0	0	1
+1370	1370	^\/stream\?\d$	2	0	0	1
+1371	1371	loads2\.php\?r=[0-9]{2}\.[0-9]	2	0	0	1
+1372	1372	^[\x20-\x7e]{5}.{4}\x7c\x01	2	0	0	1
+1373	1373	(\/[a-z-]+)+\.php\?[a-z]+=[0-9]+[^\r\n]+HTTP\/1\.1	2	0	0	1
+1374	1374	&cid=\d+$	2	0	0	1
+1375	1375	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+1376	1376	^Content-Disposition\x3a\x20attachment\x3b\x20filename=[^\r\n]+?\.[a-z]{2,4}\.exe\r?$/Hmi	2	0	0	1
+1377	1377	^\/[a-z0-9A-Z]{15,35}\/((\d+[A-Z]){3}\d+|null)\/	2	0	0	1
+1378	1378	^Content-Length\x3a 2\d{2}\r?$/Hmi	2	0	0	1
+1379	1379	\/[a-z]{2,9}\.php\?([a-z0-9]{2,4}|[cktw])=[a-zA-Z0-9\x2b\x2f\x5c]{43,56}=?$	2	0	0	1
+1380	1380	\.((testdlls|threads|netstatp|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|stats|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\x|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r])	2	0	0	1
+1381	1381	\x2B\x22l\x22(\x3B|\x5D)	2	0	0	1
+1382	1382	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1383	1383	^Referer\x3a[^\r\n]+\.swf/Hmi	2	0	0	1
+1384	1384	\.jpg\?id=\d+$	2	0	0	1
+1385	1385	^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){3,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$	2	0	0	1
+1386	1386	^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$	2	0	0	1
+1387	1387	^\/[a-z]{4}\.html?(\?[h-j]=\d+)?$	2	0	0	1
+1388	1388	^\/h[a-z]{3}\.html?$	2	0	0	1
+1389	1389	^\/[0-9]{8}\.html$	2	0	0	1
+1390	1390	^\/lists\/\d{15}(\d{5})?$	2	0	0	1
+1391	1391	^\/[a-z0-9]{2}\.jar$	2	0	0	1
+1392	1392	^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$	2	0	0	1
+1393	1393	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+1394	1394	^([a-zA-Z]{0,119}[0-9])(<var>[a-zA-Z0-9]{9,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+1395	1395	^\/0[a-z0-9]{13}$	2	0	0	1
+1396	1396	^\/[-a-zA-Z0-9_]{70,75}==?$	2	0	0	1
+1397	1397	^User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)/Hmi	2	0	0	1
+1398	1398	\/[a-f0-9]{32}\.eot$	2	0	0	1
+1399	1399	^\/0[a-z0-9]{13}$	2	0	0	1
+1400	1400	^\/([a-z0-9_-]{0,47}?[A-Z][a-z0-9_-]{0,46}?[A-Z])([A-Z0-9_-]{0,47}?[a-z][A-Z0-9_-]{0,46}?[a-z])([A-Za-z_-]{0,47}?[0-9][A-Za-z_-]{0,46}?[0-9])[A-Za-z0-9_-]{48}\.[a-z]{2,25}\d?\??	2	0	0	1
+1401	1401	^[\x00-\x0c]\x00\x00\x00[a-z0-9]{6,12}\x00	2	0	0	1
+1402	1402	^(\x62|\x1b)	2	0	0	1
+1403	1403	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])3((=sep)|\d)*?$	2	0	0	1
+1404	1404	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])4((=sep)|\d)*?$	2	0	0	1
+1405	1405	^(\x8b|\xf2)	2	0	0	1
+1406	1406	^[a-z0-9\x02-\x50]{100,}\x00\x00\x01\x00\x01$	2	0	0	1
+1407	1407	^Host\x3a\x20[^\r\n]+\.pw\r?$/Hmi	2	0	0	1
+1408	1408	GRANT.{1,5}TO	2	0	0	1
+1409	1409	^\/\?[a-f0-9]{32}$	2	0	0	1
+1410	1410	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])0((=sep)|\d)*?$	2	0	0	1
+1411	1411	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])1((=sep)|\d)*?$	2	0	0	1
+1412	1412	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])2((=sep)|\d)*?$	2	0	0	1
+1413	1413	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])5((=sep)|\d)*?$	2	0	0	1
+1414	1414	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])6((=sep)|\d)*?$	2	0	0	1
+1415	1415	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])7((=sep)|\d)*?$	2	0	0	1
+1416	1416	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])8((=sep)|\d)*?$	2	0	0	1
+1417	1417	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])9((=sep)|\d)*?$	2	0	0	1
+1418	1418	\/\w{1,2}\/\w{1,2}\.class$	2	0	0	1
+1419	1419	User-Agent\:[^\n]+zb-hb-/Hi	2	0	0	1
+1420	1420	^[^\r\n]*\/[0-9a-f]{78}\sHTTP	2	0	0	1
+1421	1421	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20((=refhost))/Hsi	2	0	0	1
+1422	1422	Host\x3a\x20(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1423	1423	^\/index\.php\?[a-z]{8,80}=(\d{10,13}|\d{15,20})$	2	0	0	1
+1424	1424	Host\x3a\x20([0-9]{0,22}[a-z])([a-z]*?[0-9][a-z]{0,22}[0-9])[a-z0-9]{23}\x2e[^\x2e\r\n]+\x2e[^\x2e\r\n]/H	2	0	0	1
+1425	1425	&id=\d+(\x3a([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{10,}\.{0,2})?&catid=\d+&itemid=\d+$	2	0	0	1
+1426	1426	\/pd\.php\?id=[a-f0-9]+$	2	0	0	1
+1427	1427	^\x2Fsearch\x2F\x3F[a-z]{2,5}\x3D	2	0	0	1
+1428	1428	^Referer\x3a\x20http\x3a\/\/[^\x2f]+\/[a-z0-9]{6}\/[a-z0-9]{5}\.html\r?$/Hm	2	0	0	1
+1429	1429	^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text\/vbscript[\x22\x27])	2	0	0	1
+1430	1430	filename=\x22\d+?\x22/P	2	0	0	1
+1431	1431	^\/log\.php\?f=[0-1](\.[a-z]+)?$	2	0	0	1
+1432	1432	(<p>[0-9a-f]{2,4})(<sep>[\x2e\x2c\x3b\x3a])(<d>((=p))[0-9a-f]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-9a-f]{2,4}(=sep)){10}(<q>(((=p)|(=d)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(<dot>(((=p)|(=d)|(=q)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(=dot)(=sep)[0-9a-f]{2,4}(=sep)(=q)	2	0	0	1
+1433	1433	^Host\x3a[^\r\n]+craigslist\.org[^\r\n]{20,}\r\n/Hmi	2	0	0	1
+1434	1434	^Host\x3a[^\r\n]+\r\nConnection\x3a\x20Keep-Alive\r\n(\r\n)?$/H	2	0	0	1
+1435	1435	^Content-Length\x3a[^\r\n]*?\{([^\r\n]*java\.)[^\r\n]*\.ognl[^\r\n]*\}	2	0	0	1
+1436	1436	\/j[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1437	1437	\/j[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1438	1438	\/j[a-z]+?\?f[a-z]+[a-z]+$	2	0	0	1
+1439	1439	\/f[a-z]+?\?f[a-z]+[a-z]+$	2	0	0	1
+1440	1440	\.php$	2	0	0	1
+1441	1441	\.php$	2	0	0	1
+1442	1442	GET\s[^\r\n]*?(<name>\/[^\.\/]+\.html)\?id\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(:?\d{1,5})?\r\n	2	0	0	1
+1443	1443	^\d{4}\r$	2	0	0	1
+1444	1444	^Host\x3a\x20[^\r\n]+\-login\.id\-107sbtd9cbhsbt[^\r]+$/Hmi	2	0	0	1
+1445	1445	\/form\/submit\/$	2	0	0	1
+1446	1446	pch\.php\?f=\d+$	2	0	0	1
+1447	1447	hcp_vbs\.php\?f=\d+&d=\d+$	2	0	0	1
+1448	1448	\.php\?e=\w+&f=\w+$	2	0	0	1
+1449	1449	pch2.php?c=\d+$	2	0	0	1
+1450	1450	\.jar\?t=\d+&h=[^&]+$	2	0	0	1
+1451	1451	\/adp\d\.php\[0-9a-z]{2,6}	2	0	0	1
+1452	1452	attachment\x3b[^\r\n]*?info\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1453	1453	attachment\x3b[^\r\n]*?contacts\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1454	1454	attachment\x3b[^\r\n]*?calc\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1455	1455	attachment\x3b[^\r\n]*?about\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1456	1456	hhcp.php?c=[a-f0-9]{5}$	2	0	0	1
+1457	1457	attachment\x3b[^\r\n]*?readme\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1458	1458	\/content\/jav\d?\.jar$	2	0	0	1
+1459	1459	\.php\?[^&]{1,8}=[a-f0-9]{16}[\x22\x27\x3b\x20\x0a\x0d]	2	0	0	1
+1460	1460	=.*[a-f].*$	2	0	0	1
+1461	1461	<title>[a-f0-9]{10}<\/title>	2	0	0	1
+1462	1462	=[0-9a-f]{8}\.jar/H	2	0	0	1
+1463	1463	\x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}$	2	0	0	1
+1464	1464	\x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}\x3A\x3A[0-9]{1,5}$	2	0	0	1
+1465	1465	display\x3Anone\x3B\x22\x3E[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}[^\r\n]*\x3C\x2Fpre\x3E\x3Cscript\x3E	2	0	0	1
+1466	1466	(\x3D|\x5B\x22])e\x22\x2B\x22va	2	0	0	1
+1467	1467	(\x3D|\x5B\x22])e\x22\x2B\x22v\x22\x2B\x22a	2	0	0	1
+1468	1468	(\x3D|\x5B\x22])ev\x22\x2B\x22a	2	0	0	1
+1469	1469	\x2B\x22al\x22(\x3B|\x5D)	2	0	0	1
+1470	1470	\x2B\x22val\x22(\x3B|\x5D)	2	0	0	1
+1471	1471	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jnlp(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1472	1472	\.php\?[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}=	2	0	0	1
+1473	1473	^.{1,5}[a-f0-9]{100}	2	0	0	1
+1474	1474	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.eot(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1475	1475	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jar(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1476	1476	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.exe(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1477	1477	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.php(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1478	1478	\.php\?\w{2,8}\=(0[0-9a-b]|3[0-9]){5,32}\&\w{2,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{1,8}\=\d{2}\&\w{1,8}\=\w{1,8}\&\w{1,8}\=\w{1,8}$	2	0	0	1
+1479	1479	\/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php$	2	0	0	1
+1480	1480	\/news\/enter\/2012-1[0-2]-([0-2][0-9]|3[0-1])\.php	2	0	0	1
+1481	1481	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.txt(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1482	1482	\/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php	2	0	0	1
+1483	1483	^\/[0-9a-f]{16}\/q\.php$	2	0	0	1
+1484	1484	^\/[0-9a-f]{16}\/q\.php	2	0	0	1
+1485	1485	^\/[0-9a-f]{32}\/ff\.php$	2	0	0	1
+1486	1486	^\/[0-9a-f]{32}\/ff\.php	2	0	0	1
+1487	1487	^\/[0-9a-f]{16}\/ff\.php$	2	0	0	1
+1488	1488	^\/[0-9a-f]{16}\/ff\.php	2	0	0	1
+1489	1489	^\/closest\/(([a-z]{1,16}[-_]){1,4}[a-z]{1,16}|[a-z0-9]{20,})\.php	2	0	0	1
+1490	1490	&jopa=\d+$	2	0	0	1
+1491	1491	\.php\?jnlp=[a-f0-9]{10}(,|$)	2	0	0	1
+1492	1492	\/[0-9a-f]{32}\/a\.php$	2	0	0	1
+1493	1493	\/[0-9a-f]{32}\/a\.php	2	0	0	1
+1494	1494	\/[0-9a-f]{16}\/a\.php$	2	0	0	1
+1495	1495	\/[0-9a-f]{16}\/a\.php	2	0	0	1
+1496	1496	\.php\?[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){5}&[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){10}&	2	0	0	1
+1497	1497	\/([^\/]+?\/[a-z]{2,16}[_-][a-z]{2,16}([_-][a-z]{2,16})*?|[a-z]{16,20}\/[a-z]{16,20}|closest\/[a-z0-9]+)\.php\?[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+&[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+$	2	0	0	1
+1498	1498	^([0-9a-z]{8})?(<p>[0-9a-z]{2})(<d>((=p))[0-9a-z]{2})(=p)(=d)([0-9a-z]{2}){10}(<q>[0-9a-z]{2})[0-9a-z]{2}(<dot>[0-9a-z]{2})[0-9a-z]{2}(=dot)[0-9a-z]{2}(=q)	2	0	0	1
+1499	1499	\.php\?[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){5}&[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){10}&	2	0	0	1
+1500	1500	\.php\?[^=]+=([^&](5[5-9a-e]|8[9a-e])){5}[^=]+=[^&]+&[^=]+=([^&](5[5-9a-f]|8[9a-e])){10}([^&]60[^&]60([^&](5[5-9a-f]|8[9a-e])){10})*?&	2	0	0	1
+1501	1501	\.php\?[^=]+=[^&]{10}&[^=]+=[^&]+&[^=]+=[^&]{20}((<sep>[^&]{2})(=sep)[^&]{20})*?&	2	0	0	1
+1502	1502	^\/[a-z0-9]{6,10}\/\?[0-9]{1,2}$	2	0	0	1
+1503	1503	@\x00i\x00m\x00p\x00o\x00r\x00t\x00\x20.{4,20}[^\x00\w\s.]	2	0	0	1
+1504	1504	^\s*?\(\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27]	2	0	0	1
+1505	1505	^\s*?\(\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27]	2	0	0	1
+1506	1506	^Referer\x3a[^\r\n]+\x3a\d+\/([a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,3}|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3})/Hm	2	0	0	1
+1507	1507	^\s*?value\s*\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27]	2	0	0	1
+1508	1508	^\s*?value\s*\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27]	2	0	0	1
+1509	1509	^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$	2	0	0	1
+1510	1510	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1511	1511	Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=refhost)/Hsi	2	0	0	1
+1512	1512	^Host\x3a[^\r\n]*?\x3a((80(80)|312[89]))\d+\r$/Hm	2	0	0	1
+1513	1513	^(((<\/object>).)*?<param([^>]*?name\s*\s*?\x22bgcolor\x22)[^>]*?value\s*\s*?\x22#ffffff\x22)((<\/object>).)*?<param([^>]*?name\s*\s*?\x22movie\x22)[^>]*?value\s*\s*?\x22([^\x22]+\.[Ss][Ww][Ff])[^\x22]*?\x22	2	0	0	1
+1514	1514	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1515	1515	Host\x3a\x20(<host>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?Referer\x3a\x20http\x3a\x2f\x2f(=host)\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n/Hsi	2	0	0	1
+1516	1516	Referer\x3a\x20http\x3a\x2f\x2f(<host>[^\r\n\x3a\x2f]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=host)(\x3a\d{1,5})?\r\n/Hsi	2	0	0	1
+1517	1517	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1518	1518	^\s*=\s*(<var1>[\x22\x27][a-z]+[\x22\x27]).+?\sid\s*=\s*(=var1)	2	0	0	1
+1519	1519	^([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$	2	0	0	1
+1520	1520	^(\s*var\s[a-z]+\s*=\s*\d+\x3b\s*\n)*\s*<\/script>\s*<object([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$	2	0	0	1
+1521	1521	^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27]	2	0	0	1
+1522	1522	^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|([a-z]*\d+[a-z]+\d)(\d*[a-z]+\d+[a-z])[a-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27]	2	0	0	1
+1523	1523	^\s*=\s*[\x22\x27][a-z]+[\x22\x27]	2	0	0	1
+1524	1524	^\s*=\s*[\x22\x27][a-z]+[\x22\x27]	2	0	0	1
+1525	1525	^\s*=\s*[\x22\x27]\/[^\x22\x27]*\.html\.swf[\x22\x27]	2	0	0	1
+1526	1526	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1527	1527	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1528	1528	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)	2	0	0	1
+1529	1529	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1530	1530	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)	2	0	0	1
+1531	1531	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27]	2	0	0	1
+1532	1532	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)	2	0	0	1
+1533	1533	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)	2	0	0	1
+1534	1534	\/m[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1535	1535	^h[a-z0-9]{0,10}\x3d[a-f0-9]{24}&p[a-z0-9]{0,10}\x3d[a-z0-9]{1,11}&i/P	2	0	0	1
+1536	1536	^p[a-z0-9]{0,20}\x3d[a-z0-9]{1,20}&i[a-z0-9]{0,20}\x3d%[0-9A-F]{2}/P	2	0	0	1
+1537	1537	\x28[\r\n\s]*?(<qa1>[\x22\x27]?)[a-f0-9]{24}(=qa1)[\r\n\s]*?,[\r\n\s]*?(<qa2>[\x22\x27]?)[a-z0-9]{1,20}(=qa2)[\r\n\s]*?	2	0	0	1
+1538	1538	=%25[0-9A-F]{2}%25[0-9A-F]{2}/P	2	0	0	1
+1539	1539	^\/a[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?q[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1540	1540	^\/s[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?d[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1541	1541	^\/k[a-z]{4,13}\?e[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1542	1542	^\/g[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?t[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1543	1543	\/r[a-z]+?\?j[a-z]+[a-z]+$	2	0	0	1
+1544	1544	\/f[a-z]+?\?j[a-z]+[a-z]+$	2	0	0	1
+1545	1545	^\/o[a-z]{4,13}\?h[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1546	1546	\/b[a-z]+?\?n[a-z]+[a-z]+$	2	0	0	1
+1547	1547	\/v[a-z]+?\?n[a-z]+[a-z]+$	2	0	0	1
+1548	1548	^\/[a-z]{5,14}\?[a-z]{5,12}=\d{6,7}$	2	0	0	1
+1549	1549	^\/[a-z]{5,14}\?[a-z]{5,12}=[a-z]{6,11}$	2	0	0	1
+1550	1550	^[\r\n\s]*?\,	2	0	0	1
+1551	1551	\bdig\.dll\b	2	0	0	1
+1552	1552	^\/[a-z]+?\?[a-z]+[a-z]+$	2	0	0	1
+1553	1553	^Host\x3a\x20[^\r\n]+\.(d(yndns\.[a-z]{2,3}|esi)|c(ricket|a?fe?)|(lin|wor)k|s(u|pace)|accountant|t(k|op)|g[aq]|xyz|ml|pw)(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1554	1554	^\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)$	2	0	0	1
+1555	1555	^(<windname>[a-z0-9]+)(<plug1>([sj]|f1))=true.+?window\.(=windname)(<plug2>(((=plug1))([sj]|f1)))=true.+?window\.(=windname)(((=plug1)|(=plug2)))([sj]|f1)=true	2	0	0	1
+1556	1556	^\/1[a-z0-9]{13}$	2	0	0	1
+1557	1557	^GET \/0(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n	2	0	0	1
+1558	1558	^\/1[a-z0-9]{13}$	2	0	0	1
+1559	1559	^GET \/4(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n	2	0	0	1
+1560	1560	^\/3[a-z0-9]{13}$	2	0	0	1
+1561	1561	\/4[a-z0-9]{13}\?&xkey=	2	0	0	1
+1562	1562	^[a-zA-Z0-9\/\+]+?ODAvM[a-zA-Z0-9\/\+]{18}(=|%3D)[\x22\x27]	2	0	0	1
+1563	1563	^[a-zA-Z0-9\/\+]+?4MC8x[a-zA-Z0-9\/\+]{18}(=|%3D){2}[\x22\x27]	2	0	0	1
+1564	1564	^[a-zA-Z0-9\/\+]+?OjgwL[a-zA-Z0-9\/\+]{19}[\x22\x27]	2	0	0	1
+1565	1565	^(\s*?|\/\*((\*\/).)*?\*\/)*?\((\s*?|\/\*((\*\/).)*?\*\/)*?(<vname>[^\s>=]+)(\s*?|\/\*((\*\/).)*?\*\/)*?<(\s*?|\/\*((\*\/).)*?\*\/)*?32\b.{0,200}(=vname)(\s*?|\/\*((\*\/).)*?\*\/)*?\x3d(\s*?|\/\*((\*\/).)*?\*\/)*?63\b.{1,200}\+=.{0,200}\((\s*?|\/\*((\*\/).)*?\*\/)*?(=vname)	2	0	0	1
+1566	1566	^[a-zA-Z0-9]+\*\/	2	0	0	1
+1567	1567	[a-z0-9]+?\*\/	2	0	0	1
+1568	1568	^\s*?<script>\s*?(<func>[A-Za-z0-9]+)\s*?\(\s*?[\x22\x27](<var>[^1\x22\x27]+)1[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)2[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)3[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>	2	0	0	1
+1569	1569	^\s*?\n\s*?(<func>[^\x28\r\n\s]+)\s*?\(\s*?(<var>[^\+\x29]+)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+	2	0	0	1
+1570	1570	^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$	2	0	0	1
+1571	1571	^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$	2	0	0	1
+1572	1572	^Referer\x3a[^\r\n]+\/([a-z0-9]+\.php|\d+)\r$/Hm	2	0	0	1
+1573	1573	Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2039/H	2	0	0	1
+1574	1574	Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2040/H	2	0	0	1
+1575	1575	^\W	2	0	0	1
+1576	1576	^\W	2	0	0	1
+1577	1577	^\/[a-z]{3}\?[A-F0-9]{8}$	2	0	0	1
+1578	1578	^Referer\x3a\x20http\x3a\x2f\x2f?[^\x2f]+\/[a-z]{3,20}((<sep>[_-]?)[a-z]{3,20}(=sep)([a-z]{3,20}(=sep))?)?[a-z]{3,20}\/\d{10,20}(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+1579	1579	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi	2	0	0	1
+1580	1580	Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1581	1581	^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}\r$/Hmi	2	0	0	1
+1582	1582	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi	2	0	0	1
+1583	1583	Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1584	1584	^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1585	1585	^((<\/body).)+?Content\s*?loading.*lease wait.*?<iframe	2	0	0	1
+1586	1586	^(\x4c|\x35)	2	0	0	1
+1587	1587	^(\x76|\x0f)	2	0	0	1
+1588	1588	\/wp-(content|admin|includes)\/	2	0	0	1
+1589	1589	^\d\x00\d	2	0	0	1
+1590	1590	\.php\?$	2	0	0	1
+1591	1591	\?showforum=$	2	0	0	1
+1592	1592	^\s*5a\s*90\s*00\s*03\s*00\s*00\s*00	2	0	0	1
+1593	1593	\x2Fphp-calendar-1.1\x2Fupdate(08|10)\x2Ephp(\x3F|.*(\x26|\x3B))configfile=[^\x26\x3B]*[^a-zA-Z0-9_]	2	0	0	1
+1594	1594	(\.\.\/){1,}	2	0	0	1
+1595	1595	(\.\.\/){1,}	2	0	0	1
+1596	1596	=(https?|ftps?|php)\:\/.{0,100}cmd=	2	0	0	1
+1597	1597	MEAS\.TYPE=((link|class)&)	2	0	0	1
+1598	1598	url=.{8000}	2	0	0	1
+1599	1599	\/ssp\/files\/annonce\.pdf$	2	0	0	1
+1600	1600	\/ssp\/loadjavad\.php$	2	0	0	1
+1601	1601	\/wywg\/[a-z0-9]{2,5}\/[a-z0-9]+\.exe$	2	0	0	1
+1602	1602	\/xml\/p\.php\?id=\d{2,}	2	0	0	1
+1603	1603	ts\/in\.cgi\?pepsi\d+	2	0	0	1
+1604	1604	cs_base_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+1605	1605	\x0d\x0aHost\: (www\.)?nacha\.org\.	2	0	0	1
+1606	1606	\x26n\x3d[a-z]{5}\d{4}	2	0	0	1
+1607	1607	name=(https?|ftps?|php)	2	0	0	1
+1608	1608	\/script\.php?\d{8}	2	0	0	1
+1609	1609	Host\: \d+\.\d+\.\d+\.\d+\x0d\x0a	2	0	0	1
+1610	1610	\/[a-z]+\/[a-z0-9]{120,}\/[a-z0-9]+\/.+\.com$	2	0	0	1
+1611	1611	UPDATE.+SET	2	0	0	1
+1612	1612	ASCII\(.+SELECT	2	0	0	1
+1613	1613	DELETE.+FROM	2	0	0	1
+1614	1614	INSERT.+INTO	2	0	0	1
+1615	1615	UNION\s+SELECT	2	0	0	1
+1616	1616	SELECT.+FROM	2	0	0	1
+1617	1617	UPDATE.+SET	2	0	0	1
+1618	1618	ASCII\(.+SELECT	2	0	0	1
+1619	1619	DELETE.+FROM	2	0	0	1
+1620	1620	INSERT.+INTO	2	0	0	1
+1621	1621	UNION\s+SELECT	2	0	0	1
+1622	1622	SELECT.+FROM	2	0	0	1
+1623	1623	ver=[v\d]+	2	0	0	1
+1624	1624	\/Setup_[0-9]{3}([A-Z][0-9])?\.exe$	2	0	0	1
+1625	1625	\/\d+\/installer\/Installer(Clean)?\.exe$	2	0	0	1
+1626	1626	\/(nte|ld)\/[0-9A-Z]*trest1[0-9](\.php|\s\.asp|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$	2	0	0	1
+1627	1627	^[a-z0-9\x40\x2d\x5f]{5,12}..\x00\x00..\x00\x00\x78\x9c	2	0	0	1
+1628	1628	=sent$	2	0	0	1
+1629	1629	\.php\?get[^=]*=\d_\d{5,}$	2	0	0	1
+1630	1630	\.php\?[a-z]_info=[a-z0-9]{1,4}_\d+?$	2	0	0	1
+1631	1631	Host\x3A\x20[^\r\n]*.rr.nu/H	2	0	0	1
+1632	1632	^(.{0,63}\x00.{0,62}\x00.{0,61}\x00.{0,60}\x00)(.{0,62}\x00{2})(.{0,59}[A-Za-z0-9]{5})((<b1>.).{0,63}(=b1).{0,62}(=b1).{0,61}(=b1).{0,60}(=b1))(.(<b2>.).{0,62}(=b2).{0,61}(=b2).{0,60}(=b2).{0,59}(=b2))(..(<b3>.).{0,61}(=b3).{0,60}(=b3).{0,59}(=b3).{0,58}(=b3))(...(<b4>.).{0,60}(=b4).{0,59}(=b4).{0,58}(=b4).{0,57}(=b4))(....(<b5>.).{0,59}(=b5).{0,58}(=b5).{0,57}(=b5).{0,56}(=b5))(.....(<b6>.).{0,58}(=b6).{0,57}(=b6).{0,56}(=b6).{0,55}(=b6))(......(<b7>.).{0,57}(=b7).{0,56}(=b7).{0,55}(=b7).{0,54}(=b7))(.......(<b8>.).{0,56}(=b8).{0,55}(=b8).{0,54}(=b8).{0,53}(=b8))(........(<b9>.).{0,55}(=b9).{0,54}(=b9).{0,53}(=b9).{0,52}(=b9))(.........(<b10>.).{0,54}(=b10).{0,53}(=b10).{0,52}(=b10).{0,51}(=b10))	2	0	0	1
+1633	1633	\.tar$	2	0	0	1
+1634	1634	\x2Fjs\x2F[\r\n]*\x2Eexe$	2	0	0	1
+1635	1635	^(<mac_addr>[\x00-\xff]{6})(=mac_addr){2,}$	2	0	0	1
+1636	1636	^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED)	2	0	0	1
+1637	1637	^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED)	2	0	0	1
+1638	1638	^(\\r\\n|\x0d\x0a)C	2	0	0	1
+1639	1639	\/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+1640	1640	<iframe.*?src.*.*?<\/iframe>	2	0	0	1
+1641	1641	[a-z]{4,10}\x08velodrivve\x03biz\x00	2	0	0	1
+1642	1642	PRIVMSG.*@(portscan|nmap|back|udpflood|tcpflood|httpflood|linuxhelp|rfi|system|milw0rm|logcleaner|sendmail|join|part|help)	2	0	0	1
+1643	1643	\/[A-Z]Setup_[0-9]{4}\.exe$	2	0	0	1
+1644	1644	\.php.+?(c((onfi|f)g|alendar)|p(a(ge|th)|rog)|l(ang(uage)?|ib)|f(older|ile|ad)|d(omain|ir|f)|s(ettings|bp)|a(genda|uth)|i(con|ncl|d)|n(ame|ews)|r(oot|f)|gallery|type|ext|mod|[a-z](\[.*\])+?)\s*=\s*https?	2	0	0	1
+1645	1645	\/[a-f0-9]{16}\/.+?\.(exe|zip)$	2	0	0	1
+1646	1646	^\s?\+x=[0-9]*\;\ +y=[0-9]	2	0	0	1
+1647	1647	User-Agent\:[^\n]+\; UA\d\d\d\d\d\;/H	2	0	0	1
+1648	1648	^\/load.php\?showforum=(ato|obe|rhino|lib)$	2	0	0	1
+1649	1649	^[a-z]{5}\d=\x5f\d\x5f	2	0	0	1
+1650	1650	index.php\?[0-9a-f]{32}$	2	0	0	1
+1651	1651	o/\d{9}\/[0-9a-f]{32}\/[0-9]$	2	0	0	1
+1652	1652	\/out.php\?id=\d$	2	0	0	1
+1653	1653	\/\?[a-z0-9]{5,}=[a-zA-Z0-9\x25]{40,}\x253D$	2	0	0	1
+1654	1654	^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$	2	0	0	1
+1655	1655	\/((article|contact|new)s|read|(fo|tu)r)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.eot|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.EOT)$	2	0	0	1
+1656	1656	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})1\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}1\.PDF)$	2	0	0	1
+1657	1657	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})2\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}2\.PDF)$	2	0	0	1
+1658	1658	^(\/[a-z]{3,20})?\/([a-z]{3,20}[-_])+[a-z]{3,20}\.jar$	2	0	0	1
+1659	1659	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})3\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}3\.PDF)$	2	0	0	1
+1660	1660	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/foto\.png$	2	0	0	1
+1661	1661	\.png$	2	0	0	1
+1662	1662	^\/[a-zA-Z0-9_\x2f-]{300,}\.html?$	2	0	0	1
+1663	1663	\/\d+\.mp3\x3frnd\x3d\d+$	2	0	0	1
+1664	1664	(Is|CheckRemote)DebuggerPresent	2	0	0	1
+1665	1665	(Create|Connect|Peek)NamedPipe	2	0	0	1
+1666	1666	ftp(open|get)file	2	0	0	1
+1667	1667	^\/r\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1668	1668	^\/t\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1669	1669	^\/[a-f0-9]{32}\.eot$	2	0	0	1
+1670	1670	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/new\.png$	2	0	0	1
+1671	1671	\.gif$	2	0	0	1
+1672	1672	\/(w(hite|orld)|step)\/\d+$	2	0	0	1
+1673	1673	\.psd$	2	0	0	1
+1674	1674	\.jpeg$	2	0	0	1
+1675	1675	\/(w(hite|orld)|step)\/mypic\.dll$	2	0	0	1
+1676	1676	getqq\.jpg$	2	0	0	1
+1677	1677	^[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(((=q)).)+?\.txt\?e=\d+(&[fh]=\d+)?(=q)	2	0	0	1
+1678	1678	\.php\?t[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1679	1679	([a-z+-]{0,4}[0-9.*]+[a-z$+-]{0,4},){24}	2	0	0	1
+1680	1680	[\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]+	2	0	0	1
+1681	1681	\.php\?spl=[A-Z]{3}	2	0	0	1
+1682	1682	\.php\?b[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1683	1683	\.php\?n[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1684	1684	^[^?#]+?\.php\?page[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1685	1685	\.php\?v[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1686	1686	\.php\?doit[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1687	1687	^[^?#]+?\.php\?id[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1688	1688	(-?\d+\x3a-?\d+\x3a){100}	2	0	0	1
+1689	1689	\x2Fsrc\x2Ephp\x3Fcase\x3D[a-f0-9]{16}$	2	0	0	1
+1690	1690	[\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]	2	0	0	1
+1691	1691	value\x3D\x22\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23	2	0	0	1
+1692	1692	\x2Fredirect\x2Ephp\x3Fd\x3D[0-9a-f]{8}$	2	0	0	1
+1693	1693	\/\d+\.js\?\d+&[a-f0-9]{16}$	2	0	0	1
+1694	1694	^\/[a-z0-9_\-]{48}$	2	0	0	1
+1695	1695	\.php\?e=[^&]+?$	2	0	0	1
+1696	1696	\/[a-z]\/[0-9]\/[0-9a-f]{32}$	2	0	0	1
+1697	1697	archive=[^\x3e]+?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+1698	1698	^\/[a-z]+\/$	2	0	0	1
+1699	1699	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/image\.gif$	2	0	0	1
+1700	1700	\/w(hite|orld|step)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.PDF)$	2	0	0	1
+1701	1701	\/(w(hite|orld)|step)\/get(a+|n+)\.jpg	2	0	0	1
+1702	1702	\.php\?usernms=[^@]+@[^\r\n]+$	2	0	0	1
+1703	1703	^(\x3a\d{1,5})?$	2	0	0	1
+1704	1704	^[^\r\n]+?\.(c(o(l(leg(e((confidential|-station|prowler)\.net|s?explained\.com)|iate(explained|info)\.com)|(o(rado-springs-jobs|nexplained)|umnexplore)\.com)|m(p(uter(explained\.com|themes\.net)|assiondefinition\.com)|m(oditylingerie|unesinfo|ercekid)\.com)|n(ce(rtparis\.net|ptsets\.com)|trolwedding\.com)|((rnell|upon)explained|peguide)\.com|7\.us)|a(((mpaign|talog|det)explained|n(cersexplained|adadaycore)|p(itali[sz]eguide|ricornhi)|b(leexplained|indynamic))\.com|r((tograph(yanalysis|erwhat)|cinomas?explained|scratch-remover|eblack)\.com|insurance-compare\.net)|ce\.us)|h((a(r(med-episodes|les-proxy|tpixel)|p(elsinfo|terball)|nnelexplained)|ristmas(gift-ideas|motion)|inesenewyearboom|eckingwatch)\.com|(orizo|urros)\.es)|(e(l(lularexplained|iac-diet)|ntigrade(explained|info))|(li(nical|ck)|ustomized)explained|r(uiseshipdating|iticsmart)|pu-benchmark|nc-cs)\.com|8\.biz|z\.cc)|a((ll(about(((collegi|gradu)at|yal)e|s(eminary|tudent)|(facul|varsi)ty|bestsellers|academic|teaching|harvard|ucla|pro)|babyours)|n((tip	2	0	0	1
+1705	1705	desbi|alyzelan)d|onymous-film)|(mericas-nexttopmode|gentsbal)l|r(chitectureice|lingtonwriter)|c(ademicexplaine|tionmo)d|ero(flotinfo|bicfund))\.com|u((toma(tedexplained|kers24)|stralia-airlines|xiliaryverb)\.com|di(t(jewellery\.com|report\.net)|o-planet\.com))|p((rilfools(hotel|spin)|ple-airport)\.com|[fh]i\.biz)|ir((bnb-coupon|waysinfo)\.com|portshuttleseattle\.net)|v(enue(domain|hello)\.com|li\.biz)|\.e\.gy)|b((a(c(helorexplained|kpackscope)|by(online-shop|revision)|(rcelonarea|ggagecoo)l|s(icexplained|escope)|ttle-field-3)|e((st-hoteldeal|er-calorie|t-award)s|nefitexplained)|u(y-invite|dgetyep)|logger-com)\.com|r((o(adbandinternet-providers|king(explained|guide))|unomarsalbum|yan-college)\.com|ea(st(cancertattoos\.net|explained\.com)|dmachine-recipes\.com))|o(((om(ing|s)|nd)explained|tany(explained|info)|dybuildingdomains|rrowings?24)\.com|stoncolleges\.net)|irthcertificatetemplate\.net|3g\.biz)|d(e((((benture|posit)explaine|alershipislan)d|n(guefevertreatment|verhowto)|ductguide|veloptea)\.com|(xterstre	2	0	0	1
+1706	1706	ming|ciduoustrees)\.net)|o((ctorate(s?explained|info)|llar-converter|gwalking-jobs|texplained|mainsknow)\.com|wnload(starcraft|-films|ubuntu)\.net)|(a(ncecentralsonglist|rtmouthexplained)|na-replication|hcp-server|vd-codec|rivewww)\.com|i((s(count|ease)explained|nnerparty-recipes|walifile)\.com|rect-golf\.net))|e((a(r(fulexplained|th-clinic)|sy(-costumes|repayment))|conomic(save|24))\.com|\.gy)|4((4qs|h5)\.com|[jp]\.org|ql\.biz)|3(vt\.info|gb\.biz|q\.org)|2(eat\.com|sf\.biz|u\.se)|8(c1\.net|x\.biz)|7(c\.org|p\.biz)|11r\.(biz|us))(\x3a\d{1,5})?$	2	0	0	1
+1707	1707	^[^\r\n]+?\.(f((a(c(ultyexplained|e-bok)|(ncy-font|ke-nail)s|ir(explained|fuse)|shion-wallpaper|lterguide)|i(nanc(i(al|ng)explained|epets)|rm(explained|s24)|lter-coffee)|o(r(umexplained|ecastbooks|ceestate)|x-drama)|udaninfo)\.com|re(e(-(((foodcoupon|angrybird)s|s(oundclips|tock)|photoeditor)\.com|music-download\.net)|(p(owerpointthem|roduct-sampl)es|dom-ofspeech)\.com|fileconverter\.net)|snoever\.com)|l(a(shplayerdownload\.net|tbelly-diet\.com)|oridaunemploymentclaim\.com|v-downloader\.net)|e(rtility-calculator\.net|stivalexplained\.com)|b(-smileys\.com|skins\.net))|l((i(n(k(explained|master)|colnsbirthdaytea)|(ability|ver)explained|(berty-saf|ftmov)e|stings(biz|red)|teraturemulti)|u(ng(explained|abscess)|ggageboom)|o(cationssecure|ndon-riots|gback))\.com|e((a(singexplained|ther-trousers)|(edsunited-new|d-candle)s|cturer(explained|info)|nd(ing|er)explained|isure-diving)\.com|u(kemiaexplained\.com|e\.biz)|tup\.org)|a(guay\.(com|es)|-gazzetta\.com)|6\.org)|i(n(s((ur(er(s(explained|24)|explained)|ancesexplain	2	0	0	1
+1708	1708	d)|ide-film)\.com|(pection-camera|taflex)\.net)|d(e(pendenceday(portal|realty)|mnityexplained)\.com|ividual-healthinsurance\.net)|t(er(estexplained\.com|trigo\.net)|ranet(explained|pm)\.com)|((vestment|centive)explained|expensivehyper)\.com|f(ections?explained\.com|o\.se))|((mmersio|sd)nexplained|ronmancom|pone-5)\.com|i(nkai|lg)\.biz)|m((e(tropolis((cruis|fac|mov)e|pixel)|(lanoma|dical)explained|r(idiantotal|cedes-cls)|ntal-healthjobs|morialdaycon|ssenger-mac|ansgift)|i(ami(-holidays|what)|di-editor)|baexplained)\.com|a(r((tial-empires|ket-hq)\.com|iogames-online\.net)|n((agejoin|ualzap)\.com|ipal-university\.net)|(lignanthypertension|gazinedownload)\.net|s(on(wave|car)|tersexplained)\.com|c2\.org))|e((s(ta(tes(mob|fx)|blishstyle)|lexplained)|mploy(e(eexplained|r24)|mentexplained))\.com|n(((gagement-photo|able-cookie)s|rollexplained)\.com|trepreneur-ideas\.net)|x(((hibition|po)explained|ecutive-decision)\.com|tremedeal\.net)|l(ect(ronicexplained|orate123)\.com|guay\.(com|es))|q(uityexplained\.com|8\.biz))|	2	0	0	1
+1709	1709	((o(a(d(minister|vertize|just)|cademic|llocate)|(thic-literatur|handl)e|(bailou|conduc)t|govern)|r(a(duate(explained|sinfo)|ndparentsdayplan)|oceryexplained|4)|ym(glas|car)s|m[69])\.com|a(((llaudet|te)explained|mevelocity|rnerguide)\.com|511\.net)|cwsa\.org)|h(o((me(made-biscuits|pageexplained)|(nours|tline|using)explained|6)\.com|stel-barcelona\.net)|a(r(dback(city|yoga)|vardexplained)|n(dlechange|ukkahbio)|lloweenorange)\.com|y(perthyroidsymptoms\.net|d\.me)|ellokittypictures\.net)|j((o(urnalism(explained|info)|hn-grisham|ker-tattoo)|query-examples)\.com|a(cksonvillepath\.com|vacollection\.net)|(vvg|6)\.org)|k(ilometersreach|udosexplained|jyg)\.com)(\x3a\d{1,5})?$	2	0	0	1
+1710	1710	^[^\r\n]+?\.(p(r(o(pert(ies(-forsale\.net|winters\.com)|y-(singapore|rental)\.net)|(fessors|state)explained\.com)|e(miums(e(xplained|ek)|guide)|(acher|cinct|late)sinfo|pexplained)\.com|i(va(te(car-sales|explained)\.com|do\.info)|nceton\.me))|e((n(sionexplained|thousepal|cetruck)|diatricsexplained)\.com|rsonal(trainer-certification\.net|-injuryclaims\.com)|tardo\.es)|o((wer(borrowings?|repayment|debts)|rt(land-holidays|alexplained)|intexplained|litical24)\.com|kertexas-holdem\.net)|a((ss(engersinfo|agepix)|ge(explained|as)|cemaker-surgery|ttinson-robert|rk-edu)\.com|loaltocollege\.net)|(u(blicationgift|pils?info)|ickups(articles|gen)|neumoniaexplained|sychologyquotes|lus-sign)\.com|h(o(toedit(orfreedownload\.net|ingsite\.com)|neexplained\.com)|pbb-themes\.com|yscology\.net)|cbp\.net|9\.org)|o(n(line(((f(o(ster|rce)|irstborn|raternal|ulltime)|b(r(idegroom|owse)|oxoffice)|e((valuat|xpress)e|fficient)|-(collegecourse|radiostation)|d(escendant|aughter|iscusse)|v(illage|acant)|re(sidence|al))s|c((r(iti(c(ize|al)|	2	0	0	1
+1711	1711	ue)|ew)|o(nsider|usin)|a(pture|meo)|elluloid)s|ha(racters|teau))|a(((vailabl|doptiv|llianc|pprais)e|ss(esse|ay)|unt)s|n((cestor|alyze)s|imated)|way)|per(sonal-trainer|manents))\.com|mediaconverter\.net)|e-lyrics\.com|amia\.biz)|(ver(seasexplained|drawnreal)|(wnership|ffline)explained|cean(ic-cable|you)|rphanagesinfo|klahomafuse)\.com|a(klandour\.com|pg\.org))|r(e((s(idenc(e(attorney|dating|cook|food)|yexplained)|erves(development|core))|(c(o(ver(ing|ed)|up)|laim)guid|laxationhyp|bateventur)e|g(i(on(private|mentor)|stercommunity)|ainguide)|t(r(ainingexplained|ieveguide)|ailexplained)|motecontrol-helicopter|viewwinters|payment24)\.com|alestate-perth\.net)|(a(cetracksinfo|veexplained|iserepair|tetask)|ising-antivirus|bnnetwork)\.com|o((o(m(sfootball|mateco)|fcute)|admodern)\.com|yallondonhospital\.net))|s((o((lventsourc|ftenguid)e|urceexplained|cietiesinfo|ng-india)|a(n(antoniosource|diegodiscover)|l(aryexplaine|euploa)d)|ta(nford(explained|info)|(bilis|v)eguide|r-treck)|p(ecialtyexplained|iralwatch|orts-tab)|	2	0	0	1
+1712	1712	h(oolexplained|eduleedu)|ites?explained)\.com|e((minar(y(explained|info)|explained)|c((urities|tor)explained|what)|aworld-coupons)\.com|rvertransfer\.net)|m(ier\.org|oz\.us)|hellgascard\.net|gba\.biz)|m(o((t(oristsinfo|iveshare)|ntre-breitling|dernexplained|squesinfo)\.com|hamed\.me)|(y(borrowings|-husband)|ultimediaexplained|inistriesinfo)\.com|mcd\.us)|n((a(ming(mac|our)|uticalfit|vigateadd)|e(tworkexplained|w-college))\.com|8\.biz))(\x3a\d{1,5})?$	2	0	0	1
+1713	1713	^[^\r\n]+?\.(t(e((l(e(phoneexplained|comsguide)|learth)|n(ured(explained|info)|nis-ranking))\.com|mp(l(ates-gratis\.com|ecollege\.net)|converter\.net)|a(ching(-certificate\.net|explained\.com)|m\.pro))|r(a(((nsferbyt|de-)e|in(eesinf|ge)o|mray)\.com|vel(insurance-comparison\.net|agentnerd\.com))|e(k-bicycles|nd-online)\.net|uckstool\.com|onco\.es)|(o(wn(housepic|study|euro|meta)|(tal-tool|memap)s|pgamebook|olboxsol)|u(mors?explained|lsatrain|rn-ons)|attoo-websites|ype-racer|wainfo)\.com|h((anksgivinggaming|riftexplained)\.com|e(sis-examples\.com|atreparis\.net))|i(mezonevendor\.com|dl\.net)|cmn\.biz)|w(e(b((b(estseller|ailout)|administer)\.com|site(downloader\.net|explained\.com)|developertoolbar\.net)|(l(lesley|fare)explained|akenguide)\.com)|or(th(voice|war)\.com|ld-records\.net)|ater(front-property\.net|-plants\.com)|(riterpics|hoiscan)\.com|pbh\.org|sse\.us)|s((t(ud(ent(financecontact|s?explained)|yexplained)|r(eetmaphub|ongat)|patricksweightloss|onewhat)|wissairinfo)\.com|u((mmertimelyrics|nset-wallpape	2	0	0	1
+1714	1714	|per-committee|itegraphic)\.com|b\.(name|cat|es)))|v((i(llage((in|na)no|crystal)|deo(-mediaset|explained)|ta(minssms|lwow)|rtualexplained)|o(lumesynergy|ucheragent|ters24)|a(rsityexplained|lentinesproxy)|entureexplained)\.com|qtel\.net|f1\.us)|u(n(i(versityexplained\.com|nstalltool\.net|\.me)|((secured|am)explained|ravelguide)\.com|limited-web-hosting\.net)|(cla(explained|info)|s-inflation|alinfo|zdom)\.com|[04]\.org)|y((o(u(ngstersinfo|rbroking)|mkippursocial)|(eshiva|ale)explained|vxs)\.com|nna\.biz)|zwr\.org)(\x3a\d{1,5})?$	2	0	0	1
+1715	1715	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+1716	1716	[a-z]{8}.(:?tif|gif)	2	0	0	1
+1717	1717	^.{2}[a-zA-Z0-9]+\x2e[01]	2	0	0	1
+1718	1718	(\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(	2	0	0	1
+1719	1719	^\w+?\[[^\]]+?\]\.src[\r\n\s]*=	2	0	0	1
+1720	1720	(\/(php)?|\.php)\?[\s\+]*\-[A-Za-z]	2	0	0	1
+1721	1721	^[A-Z]=[A-Za-z/+0-9=]{200,400}$	2	0	0	1
+1722	1722	^\{?[a-fA-F0-9]{4}\}?(\x5cu\{?[a-fA-F0-9]{4}\}?){20}	2	0	0	1
+1723	1723	^\{?[a-fA-F0-9]{4}\}?(\x25u\{?[a-fA-F0-9]{4}\}?){20}	2	0	0	1
+1724	1724	[^a-zA-Z0-9_\-\.][a-zA-Z]{7}\.class	2	0	0	1
+1725	1725	^[\r\n\s]*?\\?\(.+?\\?\)\.keep\.previous[\r\n\s]*[\r\n\s]*?[\x22\x27]contentArea	2	0	0	1
+1726	1726	\/vw\.php\?i=[a-fA-F0-9]+?\-[a-fA-F0-9]+?$	2	0	0	1
+1727	1727	^[\x11\x21-\x26\x41\x45\x70-\x79]	2	0	0	1
+1728	1728	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1729	1729	^.{0,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.jsp\x22	2	0	0	1
+1730	1730	^..[\x81\x82\x83\x84\x85\x86\x87]\x81	2	0	0	1
+1731	1731	^..[\x81\x82\x83\x84\x85\x86\x87]\x83	2	0	0	1
+1732	1732	^..[\x81\x82\x83\x84\x85\x86\x87]\x84	2	0	0	1
+1733	1733	^..[\x81\x82\x83\x84\x85\x86\x87]\x85	2	0	0	1
+1734	1734	REGISTER.{400}	2	0	0	1
+1735	1735	SELECT.+geometrycollectionfromwkb	2	0	0	1
+1736	1736	SELECT.+WHERE.+SELECT.+\x60	2	0	0	1
+1737	1737	ALTER.+DATABASE.+\x22\x2E(\x22|\x2E\x22|\x2E\x2E\x2F\x22).+UPGRADE.+DATA	2	0	0	1
+1738	1738	^Authorization\x3A Basic.{120}/Hmi	2	0	0	1
+1739	1739	^Host\x3a[^\x3a\r\n]+?\x3a[^\r\n]{6}/Hmi	2	0	0	1
+1740	1740	^[^\x00]+?\x00	2	0	0	1
+1741	1741	^[^\x00]+?\x00	2	0	0	1
+1742	1742	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*22C83263-E4B8-4233-82CD-FB047C6BF13E	2	0	0	1
+1743	1743	^Cache-Control\x3a\x20(max-age=0|no-cache)\r?$	2	0	0	1
+1744	1744	^\/\?id=[0-9]{13}&msg=	2	0	0	1
+1745	1745	^13\d{11}	2	0	0	1
+1746	1746	^Callback\x3a\x20<http[^>]+><http	2	0	0	1
+1747	1747	^[^\r\n]*uuid\x3a[^\r\n\x3a]{181}	2	0	0	1
+1748	1748	^[^\r\n]+#[^\x22\r\n]{2049}	2	0	0	1
+1749	1749	^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1750	1750	^[^\r\n]*urn\x3aservice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1751	1751	^[^\r\n]*urn\x3adevice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1752	1752	^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{1,180}\x3a[^\r\n\x3a]{181}	2	0	0	1
+1753	1753	M-SEARCH\s+[^\n]{500}	2	0	0	1
+1754	1754	(\/\.){70,}	2	0	0	1
+1755	1755	[\w]{70,}	2	0	0	1
+1756	1756	\xB6\x29\x8C\x23\xFF\xFF\xFF[\xF8-\xFF]	2	0	0	1
+1757	1757	^.{27}	2	0	0	1
+1758	1758	[0-9a-zA-Z]{200,}	2	0	0	1
+1759	1759	(GET).\/%.{1586,}	2	0	0	1
+1760	1760	ctxsys\x2Edrvxtabc\x2Ecreate\x5Ftables.+(SELECT|DELETE|CREATE|INSERT|UPDATE|OUTFILE)	2	0	0	1
+1761	1761	[^a-zA-Z0-9]+\.message	2	0	0	1
+1762	1762	\x3d[^\x26]{720}	2	0	0	1
+1763	1763	ENTER\x20LANGUAGE\x20\x3D.{55}	2	0	0	1
+1764	1764	[a-zA-Z0-9]{1000,}	2	0	0	1
+1765	1765	\xbc[\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4]	2	0	0	1
+1766	1766	\xae[\xef\xcf][\xf0\xd0][\xe5\xc5][\xee\xce]\xa0\xa2[\xe7\xc7][\xe5\xc5][\xf4\xd4]\xa2	2	0	0	1
+1767	1767	[\xf3\xd3][\xe8\xc8][\xe5\xc5][\xec\xcc][\xec\xcc][\xe5\xc5][\xf8\xd8][\xe5\xc5][\xe3\xc3][\xf5\xd5][\xf4\xd4][\xe5\xc5]	2	0	0	1
+1768	1768	[\xf6\xd6][\xe2\xc2][\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4]	2	0	0	1
+1769	1769	Cookie\:\ +REMOTE_ADDR=	2	0	0	1
+1770	1770	Authorization\x3a\s*Basic\s*[a-zA-Z0-9]{255,}==	2	0	0	1
+1771	1771	\x2findex\x2etmpl(\x3a\x3a\x24DATA|\x2f|\x2e)\x0d\x0a	2	0	0	1
+1772	1772	\/[a-z0-9]{30,}\.php\?height=\d+&sid=\d+&width=[a-z0-9]+&	2	0	0	1
+1773	1773	\.php\?sex=\d+&children=\d+&userid=	2	0	0	1
+1774	1774	^SSH-\s[^\n]{200}	2	0	0	1
+1775	1775	value\x22[^\x22]*\x2Eswf\x3finfo\x3D	2	0	0	1
+1776	1776	^(CLIENT|MACHINE)_INFO	2	0	0	1
+1777	1777	Host\x3a \d{8,10}(\x0d\x0a|\x3a\d{1,5}\x0d\x0a)/H	2	0	0	1
+1778	1778	\/tmp\/[^\/]+\.pdf$	2	0	0	1
+1779	1779	\/tmp\/[^\/]+\.jar$	2	0	0	1
+1780	1780	^Directory	2	0	0	1
+1781	1781	^HEAD[^s]{432}	2	0	0	1
+1782	1782	^PUT[^s]{432}	2	0	0	1
+1783	1783	^POST[^s]{432}	2	0	0	1
+1784	1784	^TRACE[^s]{432}	2	0	0	1
+1785	1785	^DELETE[^s]{432}	2	0	0	1
+1786	1786	^LOCK[^s]{432}	2	0	0	1
+1787	1787	^MKCOL[^s]{432}	2	0	0	1
+1788	1788	^COPY[^s]{432}	2	0	0	1
+1789	1789	^MOVE[^s]{432}	2	0	0	1
+1790	1790	\x2Frequests\x2Fstatus\x2Exml\x3F[^\x0A\x0D]*input\x3D[^\x0A\x0D\x26\x3B]{1000}	2	0	0	1
+1791	1791	^\/[0-9]{5}\.jar$	2	0	0	1
+1792	1792	Host\x3a \d{4,}[^A-Za-z\.]	2	0	0	1
+1793	1793	^\/[0-9]$	2	0	0	1
+1794	1794	^\/[a-z]{13,14}\.jar$	2	0	0	1
+1795	1795	^\s*?STOR\s+[^\r\n]*?nsswitch\.conf\r$	2	0	0	1
+1796	1796	^\s*?STOR\s+[^\r\n]*?\x2f(tgt|trace|rbp(c|p))\.conf\r$	2	0	0	1
+1797	1797	T.*?T.*?Y.*.*?R.*?O.*?M.*.*?T	2	0	0	1
+1798	1798	[0-9a-zA-Z]{10}	2	0	0	1
+1799	1799	[0-9a-zA-Z]{10}	2	0	0	1
+1800	1800	Host\x3a \d{4,}[^A-Za-z\.]	2	0	0	1
+1801	1801	^\/m[a-zA-Z0-9-_]{3,14}\/[a-zA-Z0-9-_]{3,17}$	2	0	0	1
+1802	1802	SELECT data FROM [^\x20]+?\x20INTO DUMPFILE [\x27\x22]c\x3a\/windows\/system32\/[a-z0-9_-]+?\.exe[\x27\x22]	2	0	0	1
+1803	1803	[a-zA-Z0-9]{5}	2	0	0	1
+1804	1804	[0-9a-zA-Z]{50}	2	0	0	1
+1805	1805	\x90{200}	2	0	0	1
+1806	1806	^\s+A{500}	2	0	0	1
+1807	1807	^[\r\n\s]*?\x28[^\x29]*?shellcode	2	0	0	1
+1808	1808	^[\r\n\s]*?\x28[^\x29]*?shellcode	2	0	0	1
+1809	1809	\.(php|asp|py|exe|htm|html)\/[joewxy](U[0-9a-f]{8})?H[0-9a-f]{8}V[0-9a-f]{8}\d{3}R[0-9a-f]{8}\d{3}T[0-9a-f]{8,}	2	0	0	1
+1810	1810	[\r\n\s]+(<var1>([a-z]([a-z0-9_])*|_+([a-z0-9])([a-z0-9_])*))[\r\n\s]*\x3d[\r\n\s]*CreateObject\(\s*[\x22\x27]Wscript\.Shell[\x27\x22]\s*\).+?(=var1)\.run	2	0	0	1
+1811	1811	^((>>).)+?#([46][1-9a-fA-F]|[57][\daA])	2	0	0	1
+1812	1812	^\s*?fun\s*?\(	2	0	0	1
+1813	1813	[\?&]mail=[^&]+?[\x3b\x2c\x7c\x27]	2	0	0	1
+1814	1814	WSH\.run\x28\x5c+?[\x22\x27][a-z0-9_-]+?\.exe	2	0	0	1
+1815	1815	^(90|0x5a|0+?132)\s*?,\s*?(71|0x47|0+?107)\s*?,\s*?(70|0x46|0+?106)\s*?,\s*?(48|0x30|0+?60)\s*?,\s*?(89|0x59|0+?131)\s*?,\s*?(84|0x54|0+?124)\s*?,\s*?(112|0x70|0+?160)	2	0	0	1
+1816	1816	\/\??[a-f0-9]{60,}(\x3b\d+){1,4}$	2	0	0	1
+1817	1817	\/\??[a-f0-9]{60,}\x3b4[0-1]\d{5}$	2	0	0	1
+1818	1818	^\/([a-z0-9]{3,7}\/)?[a-z]{3,7}\.swf$	2	0	0	1
+1819	1819	^(25)?282176\x25(25)?29\x25(25)?26chrw\x25(25)?2801	2	0	0	1
+1820	1820	^Referer\x3a[^\r\n]+\/gate.php\r$/Hm	2	0	0	1
+1821	1821	Host\x3a\x20(\.*[a-f0-9]\.*){32}\./Hm	2	0	0	1
+1822	1822	^( Systems|\.com\/techsupport)	2	0	0	1
+1823	1823	^\s*?(<v1>[^\x29\s]+)\s*?\x29\s*?To Ubound\x28(=v1)\s*?\x29\s*?(dim\s*?)?(<v2>[^\s\x3d]+)\s*?\x3d\s*?(=v2)\+Cstr\x28\s*?Chr\x28(=v1)\x28i\x29[\+\-]\d+\x29\x29.+?Execute\s*?(=v2)	2	0	0	1
+1824	1824	^[0-9][^=]	2	0	0	1
+1825	1825	^\s*?\d[\d\x2e]{255}	2	0	0	1
+1826	1826	^\s*?\d[\d\x2e]{255}	2	0	0	1
+1827	1827	\s+?trigger\s+?[^\x20]+?\s+?after\s+?insert\s+?on\s+?	2	0	0	1
+1828	1828	^..[^\x00]+\x00	2	0	0	1
+1829	1829	^..[^\x00]+\x00	2	0	0	1
+1830	1830	^..[^\x00]+\x00	2	0	0	1
+1831	1831	^..[^\x00]+\x00	2	0	0	1
+1832	1832	^([^>]*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]*?\.swf[\x22\x27])([^>]*?\swidth\s*\s*?[\x22\x27]0[\x22\x27])[^>]*?\sheight\s*\s*?[\x22\x27]0[\x22\x27]	2	0	0	1
+1833	1833	^(<addr1>.{4})(<addr2>.{4})(=addr2)(=addr1)	2	0	0	1
+1834	1834	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1835	1835	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1836	1836	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1837	1837	Type\x2FAction.+Launch.+\x28\x2F[a-z]\x2F[a-z].+NewWindow\x20true	2	0	0	1
+1838	1838	^=\s*\x22\s*[^\s\x22\x28]{1000}	2	0	0	1
+1839	1839	^(USE|PASS|SELECT|UPDATE|INSERT|ASCII|SHOW|CREATE|DESCRIBE|DROP|ALTER)\s+?(.{1}){300}	2	0	0	1
+1840	1840	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d+?&){3,}[a-z\_\-]{4,10}=-?[a-z0-9]+$	2	0	0	1
+1841	1841	^\s*\[\s*[\x22\x27]\\u[a-f0-9]{4}\\u[a-f0-9]{4}	2	0	0	1
+1842	1842	^[^\x00]+\x00\x00\x01	2	0	0	1
+1843	1843	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1844	1844	^.{6}[^\x00]+	2	0	0	1
+1845	1845	^.{6}[^\x00]+	2	0	0	1
+1846	1846	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1847	1847	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1848	1848	^\x20+\x3a\x20([0-9A-F]{2}\x3a){5}[0-9A-F]{2}\x0d\x00\x0a	2	0	0	1
+1849	1849	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1850	1850	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1851	1851	^(\x01((\x01((\x04((\x03(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x04(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?|\x02(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?))?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|\x02([\x01\x02\x03\x04])?|\x03([\x01\x02])?))?|\x03((\x03(\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e])?)?)?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13])?|\x02([\x01\x02])?))?|\x05((\x02(\x01([\x01\x02\x03\x04\x05\x06\x07])?)?|\x01([\x01\x02\x03])?))?|\x02(([\x01\x02]|\x03(\x01([\x01\x02\x03])?)?))?|\x06(\x01([\x01\x02\x03\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x07([\x01\x02])?|\x04))?|\x02((\x02([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|(\x01)?\x01))?)	2	0	0	1
+1852	1852	^(\x41\xd8\x41\xd8\x41\xdc){2,}\x41\x00	2	0	0	1
+1853	1853	^\s*\x28\s*retPtrAddr\.add\s*\x28\s*i\s*\*\s*8\s*\x29\s*,\s*rop\s*\x5b	2	0	0	1
+1854	1854	^\S+?drivestoredirect	2	0	0	1
+1855	1855	^\s*(f0VMR|9FTE|\/RUxG)	2	0	0	1
+1856	1856	^\s*=\s*[\x27\x22]\s*POST	2	0	0	1
+1857	1857	^.*?[\x24\x60]	2	0	0	1
+1858	1858	^\s*=\s*[^>]*file\x3a[^>]*\/\x24MFT\/	2	0	0	1
+1859	1859	^\s*(\x28|\%28)s	2	0	0	1
+1860	1860	^\s*\d*[^\x20-\x7e\r\n\t]	2	0	0	1
+1861	1861	^[\x30-\x3f\x7D]	2	0	0	1
+1862	1862	^[\x30-\x3f\x7D]	2	0	0	1
+1863	1863	AUTH\s+\S+\s+([a-zA-Z0-9\+\/=]{4})*[a-zA-Z0-9\+\/=]{3}\s	2	0	0	1
+1864	1864	^\s*((>).)+?\s*src\s*=\s*[\x22\x27]\s*[^\x27\x28]+?[\x22\x27]\s*onError\s*=\s*prompt\s*\x28\s*[^)]*?(document|s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+1865	1865	legal[^x7B]*\x7B[^\x7D]*restore	2	0	0	1
+1866	1866	legal[^x7B]*\x7B[^\x7D]*restore	2	0	0	1
+1867	1867	errordict\s+\x2Finvalidfileaccess	2	0	0	1
+1868	1868	errordict\s+\x2Finvalidfileaccess	2	0	0	1
+1869	1869	\x2Ebindnow[^\x7D]*\x7D\s*stopped	2	0	0	1
+1870	1870	\x2Ebindnow[^\x7D]+\x7D\s*stopped	2	0	0	1
+1871	1871	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1872	1872	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1873	1873	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1874	1874	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1875	1875	^\s*	2	0	0	1
+1876	1876	^\s*	2	0	0	1
+1877	1877	^\s*	2	0	0	1
+1878	1878	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){5}	2	0	0	1
+1879	1879	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7}	2	0	0	1
+1880	1880	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7}	2	0	0	1
+1881	1881	Template=.*\.\.	2	0	0	1
+1882	1882	act\x3D[^\x26\s\r\n]{257}	2	0	0	1
+1883	1883	app\x3D[^\x26\s\r\n]{257}	2	0	0	1
+1884	1884	[\x20-\x7e]{5,}\x5c\x00[\x20-\x7e]{5,}	2	0	0	1
+1885	1885	^[\x50-\x59]	2	0	0	1
+1886	1886	^[^\r\n]*?\x60[^\x60]*?\$\{IFS\}	2	0	0	1
+1887	1887	\bsolusvmc-node\b	2	0	0	1
+1888	1888	^\s*?\(\s*?[^,\s]*?\s*?,\s*?[\x22\x27][a-f0-9]{100}	2	0	0	1
+1889	1889	^mail\s*?from\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b	2	0	0	1
+1890	1890	^(\x25(25)*?20|\s)*?runmumaa\W	2	0	0	1
+1891	1891	^\s*?(<var>[^=\s\x3b]+)\s*\s*?getBits\(\s*?\)\x3b.+?flashvars\s*\s*?\x5c\x22(=var)\s*\s*?\x22\s*?\+\s*?(=var)\s*?\+\s*?\x22\x5c\x22	2	0	0	1
+1892	1892	^[a-z-]+\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b.*\x3b.*\x7d\s*\x3b(=[\r\n])	2	0	0	1
+1893	1893	^\s*\x28\s*[\x22\x27]\s*message	2	0	0	1
+1894	1894	^(\.|\[\s*?[\x22\x27])defineProperties\s*?\x28	2	0	0	1
+1895	1895	^[^\r\n]+\.hta\r?\n	2	0	0	1
+1896	1896	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1897	1897	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1898	1898	^(<num_value>\d+)\x7d,\x22id\x22\x3a(=num_value)	2	0	0	1
+1899	1899	^[(\x60|%60)(\x27|%27)]	2	0	0	1
+1900	1900	^\/(home\/a3user|root)\/agile3\/patches\/	2	0	0	1
+1901	1901	^.*?\x26	2	0	0	1
+1902	1902	(\x0a|\\n)\/s1Caa6	2	0	0	1
+1903	1903	^(\\r\\n|\x0d\x0a)C	2	0	0	1
+1904	1904	^\d{3}	2	0	0	1
+1905	1905	^(https\/\/|(\d{1,3}\.){3}\d{1,3}|([a-z0-9-]+\.)+[a-z]{1,8})	2	0	0	1
+1906	1906	^(==[A-Z0-9+/]{2}|=[A-Z0-9+/]{3}|[A-Z0-9+/]{4})([A-Z0-9+/]{4})*$	2	0	0	1
+1907	1907	^[A-Za-z0-9+/]{2}([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1908	1908	[\?\&]cmd_param=[^\&\r\n]{500}	2	0	0	1
+1909	1909	(%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))	2	0	0	1
+1910	1910	^.{11}([\xC0-\xC1]|[\xF5-\xFF]|\xE0[\x80-\x9F]|\xF0[\x80-\x8F]|[\xC2-\xDF]([\x80-\xBF])|[\xE0-\xEF]([\x80-\xBF]{2})|[\xF0-\xF4]([\x80-\xBF]{3})|([\x00-\x7F\xF5-\xFF])[\x80-\xBF]|([\xC2-\xDF]|[\xE0-\xEF]|[\xE0-\xEF][\x80-\xBF]|[\xF0-\xF4]|[\xF0-\xF4][\x80-\xBF]|[\xF0-\xF4][\x80-\xBF]{2})[\x80-\xBF]|([\xE0-\xEF])[\x80-\xBF]([\x80-\xBF])|([\xF0-\xF4])[\x80-\xBF]([\x80-\xBF]{2})|([\xF0-\xF4][\x80-\xBF])[\x80-\xBF]([\x80-\xBF]))	2	0	0	1
+1911	1911	^[^\x22]*[\x24\x60]+	2	0	0	1
+1912	1912	^[^\x22]*[\x24\x60]+	2	0	0	1
+1913	1913	^[a-z0-9\-_\.\/]+\x00	2	0	0	1
+1914	1914	^SOAPAction\x3a\s+?[^\r\n]*?http\x3a\/\/purenetworks\.com\/HNAP1\/([^\x2f]+?[\x2f])?[^\x2f]	2	0	0	1
+1915	1915	\/dev-report-overview\.html[^\"]*?\x3b	2	0	0	1
+1916	1916	^\s*\x22{2}	2	0	0	1
+1917	1917	^[\x22\x27]t(eamviewer(\d+|api)|v(c(hat|ontrol)|filetransfer|joinv|present|s(endfile|q(customer|support))|v(ideocall|pn))\d)	2	0	0	1
+1918	1918	^Host\x3a[^\n]{0,50}?\x3b	2	0	0	1
+1919	1919	^[\s>]	2	0	0	1
+1920	1920	^[\s>]	2	0	0	1
+1921	1921	^((\x0d\x0a).)+\x22(https?|file):\x2f\x2f	2	0	0	1
+1922	1922	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1923	1923	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1924	1924	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1925	1925	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1926	1926	^\s*?\x29	2	0	0	1
+1927	1927	^\s*?\(x\s*,\s*1,\s*24000\s*\x29	2	0	0	1
+1928	1928	^\s*[\x22\x27][^\x22\x27]{0,128}\x2e\x2e	2	0	0	1
+1929	1929	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1930	1930	=\s*\x25\s*\{\s*.+?\bProcessBuilder\b	2	0	0	1
+1931	1931	^[ a-zA-Z0-9+_]*[\x27\x3b]	2	0	0	1
+1932	1932	destination=[^&]*\x24\x28	2	0	0	1
+1933	1933	name=[^&]*\x24\x28	2	0	0	1
+1934	1934	^[^&]+\x2527(UNION|SELECT)	2	0	0	1
+1935	1935	[^&]*(\x60|\x24)	2	0	0	1
+1936	1936	(\x60|\x24)	2	0	0	1
+1937	1937	(\/GponForm\/diag_FORM\?images\/|\.html\?images\/)	2	0	0	1
+1938	1938	^((\S\:\\){2,}|\S\:\\\S\:\S\:|S\:\\\\\\([0-9]{1,3}\.){3}[0-9]{1,3}|\S\:\\\\\\([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+1939	1939	^(www\.)?(cisco|linksys)\.com\/jnap\/	2	0	0	1
+1940	1940	^.{1,10}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)	2	0	0	1
+1941	1941	(\%3C){1000}	2	0	0	1
+1942	1942	A{1000}	2	0	0	1
+1943	1943	id\=[^\r\n]*?(select|delete|union|update|insert)	2	0	0	1
+1944	1944	^\d{2,5}(\&|\d)	2	0	0	1
+1945	1945	^(8=|9BQQ==)\r?\n?	2	0	0	1
+1946	1946	=\s*\x25\s*\{\s*(.+?\bgetRunTime\b).+?\bexec\b	2	0	0	1
+1947	1947	^[0-9]+	2	0	0	1
+1948	1948	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\[[^\x5d]*?\W	2	0	0	1
+1949	1949	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\%5b[^\x5d]*?\W	2	0	0	1
+1950	1950	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\[[^\x5d]*?\W	2	0	0	1
+1951	1951	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\%5b[^\x5d]*?\W	2	0	0	1
+1952	1952	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\[[^\x5d]*?\W	2	0	0	1
+1953	1953	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1954	1954	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1955	1955	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1956	1956	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\[[^\x5d]*?\W	2	0	0	1
+1957	1957	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\%5b[^\x5d]*?\W	2	0	0	1
+1958	1958	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\[[^\x5d]*?\W	2	0	0	1
+1959	1959	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\%5b[^\x5d]*?\W	2	0	0	1
+1960	1960	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\[[^\x5d]*?\W	2	0	0	1
+1961	1961	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1962	1962	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1963	1963	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1964	1964	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\[[^\x5d]*?\W	2	0	0	1
+1965	1965	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\%5b[^\x5d]*?\W	2	0	0	1
+1966	1966	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\[[^\x5d]*?\W	2	0	0	1
+1967	1967	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\%5b[^\x5d]*?\W	2	0	0	1
+1968	1968	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\[[^\x5d]*?\W	2	0	0	1
+1969	1969	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1970	1970	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1971	1971	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1972	1972	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\[[^\x5d]*?\W	2	0	0	1
+1973	1973	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\%5b[^\x5d]*?\W	2	0	0	1
+1974	1974	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\[[^\x5d]*?\W	2	0	0	1
+1975	1975	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\%5b[^\x5d]*?\W	2	0	0	1
+1976	1976	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\[[^\x5d]*?\W	2	0	0	1
+1977	1977	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1978	1978	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1979	1979	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1980	1980	ping_addr=[\d.]*[^\d.]	2	0	0	1
+1981	1981	\?write_(m(ac|sn)|hdv|pid|tan)&[^&]*\x3b	2	0	0	1
+1982	1982	^User-Agent\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}	2	0	0	1
+1983	1983	^X-Forwarded-For\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}	2	0	0	1
+1984	1984	pjl\x5Fready\x5Fmessage\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+1985	1985	^[^=]{1,}$	2	0	0	1
+1986	1986	^\x22[^\x22]*\x3b[^\x22]*\x22/P	2	0	0	1
+1987	1987	^\s*[\x22\x27]	2	0	0	1
+1988	1988	\.hta([?&]|$)	2	0	0	1
+1989	1989	^[A-Za-z0-9+/]{0,4}?[^\x20-\x7e]	2	0	0	1
+1990	1990	\%(25)?temp\%	2	0	0	1
+1991	1991	^[a-zA-Z0-9]+$	2	0	0	1
+1992	1992	[^&]*(\x60|\x24)	2	0	0	1
+1993	1993	^User-Agent\x3a[^\r\n]*JDatabaseDriverMysqli/Hmi	2	0	0	1
+1994	1994	(localhost|127\.0\.0\.1)/W	2	0	0	1
+1995	1995	^[^\r\n]{128,}\r\n	2	0	0	1
+1996	1996	^[^\+]+\+0A	2	0	0	1
+1997	1997	^[^\+]+(\+[A-F0-9]{2}){4,}	2	0	0	1
+1998	1998	^.{0,100}\+0A.{0,100}\x40	2	0	0	1
+1999	1999	^[^\r\n]{50,}	2	0	0	1
+2000	2000	^\S{0,7}\/(meeting|fb\/smb|namedusers|metric)	2	0	0	1
+2001	2001	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+2002	2002	^(((:?0x[a-f0-9]{2}|0+?\d{1,3})\s*?,\s*?)*?\d{1,3})(((:?0x[a-f0-9]{2}|\d{1,3})\s*?,\s*?)*?0+?\d{1,3})(((:?0+?\d{1,3}|\d{1,3})\s*?,\s*?)*?0x[a-f0-9]{2})((:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?,\s*?)+(:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?\)	2	0	0	1
+2003	2003	^form(Ping|Tracert)$	2	0	0	1
+2004	2004	^form(Ping|Tracert)$	2	0	0	1
+2005	2005	^.{1,50}\/uapi-cgi\/	2	0	0	1
+2006	2006	^.{1,50}\/uapi-cgi\/	2	0	0	1
+2007	2007	^[^&]{150,}	2	0	0	1
+2008	2008	^[^&]{150,}	2	0	0	1
+2009	2009	\bexec\b	2	0	0	1
+2010	2010	parent=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2011	2011	oId=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2012	2012	[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2013	2013	^\s+?[^\s\>]+?\s+?SYSTEM\s	2	0	0	1
+2014	2014	^[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2015	2015	^[A-Z]{8}\x3a	2	0	0	1
+2016	2016	^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5bnull\x5d	2	0	0	1
+2017	2017	^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5b\x5d	2	0	0	1
+2018	2018	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2019	2019	^.{0,5}(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2020	2020	^\s*(<worker>[A-Za-z0-9_-]{1,20})\s*=\s*null\x3b.{1,300}(=worker)\s*=\s*document\.getElementById\([\x22\x27](=worker)[\x22\x27]\)\x3b.{1,300}\.addEventListener\([\x22\x27]DOMNodeInserted[\x22\x27]\s*,\s*(<callback0>[A-Za-z0-9_-]{1,20}).{0,300}(=worker)(<worker_ext>(\.\w{1,20})+)\s*=\s*\d+\x3b.{1,300}function\s*(=callback0)\([^\)]+\)\s*\{\s*.{1,300}\.requestAnimationFrame\((<callback>[A-Za-z0-9_-]{1,20})\)\x3b.{1,300}function\s*(<garbagecollector>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*.{0,100}for\s*\(let\s*(<gc_counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=gc_counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=gc_counter)(\+{2}|-{2})\s*\)\s*.{1,300}function\s*(=callback)\([^\)]+\)\s*\{\s*.{1,300}(=garbagecollector)\(\)\s*\x3b\s*.{1,300}\((=worker)(=worker_ext)\)	2	0	0	1
+2021	2021	^\s*(<opt>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*let\s*(<o_var>[A-Za-z0-9_-]{1,20})\s*=\s*\{\}\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=o_var)\.(<x_prop>[A-Za-z0-9_-]{1,20}).{1,300}for\s*\(\s*let\s*(<counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)(\+{2}|-{2})\).{1,100}(=opt)\(\).{1,300}let\s*(<leaked_stack_obj>[A-Za-z0-9_-]{1,20})\s*=\s*null.{1,100}let\s*(<obj_proto>[A-Za-z0-9_-]{1,20})\s*=\s*\(\{\}\)\.__proto__\x3b.{1,300}(=obj_proto)\.__defineGetter__\([\x22\x27](=x_prop)[\x22\x27],\s*Error\.prototype\.toString\)\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=obj_proto)\.__defineGetter__\([\x22\x27](<message_proto>[A-Za-z0-9_-]{1,20})[\x22\x27].{1,300}delete\s*(=obj_proto)\.(=message_proto)\x3b.{1,300}(=obj_proto)\.\w+\s*=\s*Array\.prototype.{1,300}(=opt)	2	0	0	1
+2022	2022	^\s*(<func_opt>[\w-]{1,20})\((<var_a>[\w-]{1,20})\s*,\s*(<var_b>[\w-]{1,20}).{1,300}((=var_a)\.(=var_b)|(=var_b)\.(=var_a))\s*=\s*\d+\x3b\s*((=var_a)|(=var_b))\.push\(\d+\)\x3b\s*((=var_a)\.(=var_a)|(=var_b)\.(=var_b))\s*=\s*0x.{1,300}Object\.prototype\.push\s*=\s*Array\.prototype\.push\x3b\s*for\s*\(\s*let\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\).{1,300}let\s*((=var_a)|(=var_b))\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}\x3b.{1,300}(=func_opt)\(((=var_a)|(=var_b)),\s*\{\}.{1,300}let\s*(<var_o>[\w-]{1,20})\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}.{1,300}(=func_opt)\((=var_o)	2	0	0	1
+2023	2023	^\s*(<func_a>[\w-]{1,20})\((<obj1>[\w-]{1,20})\s*,\s*(<tmp_obj>[\w-]{1,20})\s*,\s*(<value>[\w-]{1,20})\).{1,300}(=obj1)\.\w+\s*=\s*\d+\.\d+\x3b\s*var\s*\w+\s*=\s*\{__proto__:\s*(=tmp_obj)\}\x3b\s*(=obj1)\.\w+\s*=\s*(=value)\x3b.{1,300}var\s*(=obj1)\s*=\s*\{\w+:\s*\d+\.\d+\s*,\s*\w+:\s*\d+\.\d+\}\x3b\s*for\s*\(\s*var\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\)\s*\{\s*(=func_a)\((=obj1)\s*,\s*(\x22{2}|\x27{2})\s*,\s*(\x22{2}|\x27{2})\)\x3b.{1,300}(=func_a)\((=obj1)\s*,\s*(=obj1)\s*,\s*\d+\.\d{8,}.{1,300}eval\((=obj1)\.	2	0	0	1
+2024	2024	^form(RebootCheck|Wsc)$	2	0	0	1
+2025	2025	^[^&]{42,}	2	0	0	1
+2026	2026	^[^&]{512,}	2	0	0	1
+2027	2027	^Callback\x3a\x20\x3chttp[^\x3a]+\x3a\d{1,5}[^\/]/Hmi	2	0	0	1
+2028	2028	^[^&]{90,}	2	0	0	1
+2029	2029	^\d[012345]	2	0	0	1
+2030	2030	^\d[012345]	2	0	0	1
+2031	2031	^\d[012345]	2	0	0	1
+2032	2032	^\d[012345]	2	0	0	1
+2033	2033	^\d[012345]	2	0	0	1
+2034	2034	^\d[012345]	2	0	0	1
+2035	2035	^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e)	2	0	0	1
+2036	2036	^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e)	2	0	0	1
+2037	2037	^[^&\x0d\r]+[\n\x0a]	2	0	0	1
+2038	2038	^\s*(<func_a>[\w\-]{1,20})\((<obj_1>[\w\-]{1,20})\s*,\s*(<obj_2>[\w\-]{1,20}).{1,300}(=obj_1)\.(<prop_2>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,300}?(=obj_2)\.pop\(\).{1,300}?(=obj_1)\.(<prop_1>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,500}Object\.prototype\.p(op|ush)\s*=\s*Array\.prototype\.p(op|ush)\x3b.{1,500}var\s*(<obj_3>[\w\-]{1,20})\s*=\s*\{\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)?\s*,\s*((=prop_2)\s*\x3a\s*\d+(\.\d+)?|(=prop_2)\s*\x3a\s*\d+(\.\d+)?\s*,\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)).{1,500}(=func_a)\(\s*((=obj_3)\s*,\s*new\s*Object\(\)|\s*new\s*Object\(\)\s*,\s*(=obj_3)\s*).{1,500}?(=func_a)\((=obj_3)	2	0	0	1
+2039	2039	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2040	2040	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2041	2041	^[^&\r\n]+(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2042	2042	^(%[a-f0-9]{2}){5,}	2	0	0	1
+2043	2043	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2044	2044	^%(3b|0a|26|60|7C|24)	2	0	0	1
+2045	2045	^\/(icons|cgi-bin)	2	0	0	1
+2046	2046	^\/(icons|cgi-bin)	2	0	0	1
+2047	2047	^\/(icons|cgi-bin)	2	0	0	1
+2048	2048	[^\r\n]*true	2	0	0	1
+2049	2049	\x2f(FURUKAWA|APROS)\x2f	2	0	0	1
+2050	2050	[^\r\n]*(\x60|\x24|\x7c|\bsh\b)	2	0	0	1
+2051	2051	^[^\r\n=]*(union|select)	2	0	0	1
+2052	2052	^[^&=]*(union|select)	2	0	0	1
+2053	2053	^(<class>[A-Z0-9_-]{1,20})\s*.*?(<var>[A-Z0-9_-]{1,15})\s*=\s*(&amp\x3b|0x|\\x|&?h)*\d{8}\s*.*?(ReDim|Dim)\s*(=var)\(\d{4,20}\).*?set\s*(=var)\(\d+\)\s*=\s*new\s*(=class).*?Erase\s*(=var).*?Erase\s*(=var)	2	0	0	1
+2054	2054	^[^\x22]+\.jsp\x22	2	0	0	1
+2055	2055	([\x60\x3b\x7c]|%60|%3b|%7c|%26|(\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2056	2056	^[\s\x22\x27]*check_ping\b	2	0	0	1
+2057	2057	^\s*(<obj>[\w\-]{1,20})\s*=\s*document\.getElementById\(.{1,500}Class\s*(<class>[\w\-]{1,20}).{1,500}End\s*Class.{1,500}set\s*(=obj)\.scroll((Left|Top)(Max)?|Height|Width)\s*=\s*New\s*(=class)	2	0	0	1
+2058	2058	[^\r\n]*\x5c(n|c)[^\r\n]{0,100}[\x60\x24]	2	0	0	1
+2059	2059	([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2060	2060	^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2061	2061	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2062	2062	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2063	2063	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2064	2064	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2065	2065	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2066	2066	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2067	2067	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2068	2068	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2069	2069	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2070	2070	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2071	2071	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2072	2072	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2073	2073	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2074	2074	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2075	2075	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2076	2076	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2077	2077	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2078	2078	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2079	2079	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2080	2080	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2081	2081	\.((php\d{0,}|phps|pht|phtm|phtml|shtml|htaccess|phar|inc))	2	0	0	1
+2082	2082	^[^&]{100,}	2	0	0	1
+2083	2083	^[a-zA-Z0-9]+\.(zip|7z|gz)	2	0	0	1
+2084	2084	^(\x28|\x29|\x3c|\x3e|\x26|\x2a|\xe2|\x80|\x98|\x7c|\x3f|\x3b|\x5b|\x5d|\x5e|\x7e|\x21|\x2e|\xe2|\x80|\x9d|\x25|\x40|\x2f|\x5c|\x3a|\x2b|\x2c|\x60)	2	0	0	1
+2085	2085	^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr)	2	0	0	1
+2086	2086	^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr)	2	0	0	1
+2087	2087	^[0-9]{1,10}\x3b	2	0	0	1
+2088	2088	^(%2e|\.)exec	2	0	0	1
+2089	2089	^[a-zA-Z0-9]{5,40}	2	0	0	1
+2090	2090	^[a-zA-Z0-9]{7,200}	2	0	0	1
+2091	2091	^\d+..([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))-XX:OnOutOfMemoryError=	2	0	0	1
+2092	2092	^[^&=]*(union|select|update|insert|delete)	2	0	0	1
+2093	2093	^[^&=]*(union|select|update|insert|delete)	2	0	0	1
+2094	2094	((%2F|\/)(\.|%2E){2}(%2F|\/))	2	0	0	1
+2095	2095	((%2F|\/)(\.|%2E){2}(%2F|\/))	2	0	0	1
+2096	2096	^(%2E%2E%2F|\.\.\/)	2	0	0	1
+2097	2097	^[a-zA-Z0-9]{5,45}	2	0	0	1
+2098	2098	^([A-Z]\x00){20}\x00\x00	2	0	0	1
+2099	2099	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+2100	2100	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+2101	2101	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+2102	2102	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2103	2103	^SOAPAction\x3a\x20\x22?urn\x3aNETGEAR-ROUTER\x3aservice\x3a.{128,}(:\d#)/Hm	2	0	0	1
+2104	2104	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2105	2105	^[a-zA-Z0-9+/]{1000,}	2	0	0	1
+2106	2106	\We[\s\x22\x27,+]*?v[\s\x22\x27,+]*?a[\s\x22\x27,+]*?l\W	2	0	0	1
+2107	2107	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2108	2108	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2109	2109	^[^<]{30,}<\/NewMACAddress>	2	0	0	1
+2110	2110	^0+(&|$)	2	0	0	1
+2111	2111	^0+(&|$)	2	0	0	1
+2112	2112	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2113	2113	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2114	2114	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2115	2115	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2116	2116	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2117	2117	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2118	2118	^\/(icons|cgi-bin)	2	0	0	1
+2119	2119	^\/(icons|cgi-bin)	2	0	0	1
+2120	2120	^\/(icons|cgi-bin)	2	0	0	1
+2121	2121	^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2122	2122	(yJ0eXAiOiJKV1Qi|InR5cCI6IkpXVCJ)/H	2	0	0	1
+2123	2123	^(CREATE|SELECT|INSERT|UPDATE|EXEC)	2	0	0	1
+2124	2124	^["']\s*:\s*["']\s*[^0-9]+	2	0	0	1
+2125	2125	^\s?([\x3b\x0a\x26\x60\x7c\x24]|%(3b|0a|26|60|7c|24))	2	0	0	1
+2126	2126	^\s*=\s*[\x22\x27]\s*ms-msdt\x3a	2	0	0	1
+2127	2127	(\x2e|%2e)(\x2e|%2e)(\x2f|%2f)	2	0	0	1
+2128	2128	myname=[^&]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2129	2129	^\x2fdefault\x2fen_US\x2fframe(\x2eA100)?\x2ehtml\?(content|sidebar)=.*\x2e\x2e\x2f	2	0	0	1
+2130	2130	^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2131	2131	^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2132	2132	[^a-zA-Z0-9_\-\.][a-zA-Z]{8}\.jar	2	0	0	1
+2133	2133	^\s?(file|https?)\x3a	2	0	0	1
+2134	2134	^(\/?\.\.?\/){2}	2	0	0	1
+2135	2135	\b(<xps>[a-zA-Z]{7})\.classPK.+?\b(=xps)\[a-zA-Z]{12}\.classPK.+?\b(=xps)\$[a-zA-Z]{12}\.classPK	2	0	0	1
+2136	2136	^[\r\n\s\+]*.+?\}[\r\n\s]*?catch	2	0	0	1
+2137	2137	^(application\/(x-)?|text\/)xml	2	0	0	1
+2138	2138	^(application\/(x-)?|text\/)xml	2	0	0	1
+2139	2139	\/((index|toc)\.html?)?\?\/\/	2	0	0	1
+2140	2140	^.{0,10}[\x3b\x0a\x26\x60\x7c\x24]	2	0	0	1
+2141	2141	[?&]ap=	2	0	0	1
+2142	2142	^\d+\s*[^\r\n]{50,}	2	0	0	1
+2143	2143	(web|decorators|seraph-config)\x2exml$	2	0	0	1
+2144	2144	com.atlassian.jira\x2f(jira\x2dwebapp\x2ddist|atlassian\x2djira\x2dwebapp)\x2fpom\x2e(properties|xml)$	2	0	0	1
+2145	2145	^[^\x3c]{,100}\x27	2	0	0	1
+2146	2146	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+2147	2147	^(Begin|End)\=/P	2	0	0	1
+2148	2148	\/\?[a-f0-9]{64}\;\d\;\d	2	0	0	1
+2149	2149	\x7b?(visibility\x3ahidden|display\x3anone)\x3b?\x7d?\x22><div>\d{16}	2	0	0	1
+2150	2150	\/[a-z]\/[0-9a-f]{32}$	2	0	0	1
+2151	2151	\/dl\/\w{1,4}\.php\?[0-9]$	2	0	0	1
+2152	2152	\/[a-f0-9]{60,}_js\?	2	0	0	1
+2153	2153	\/[a-f0-9]{60,}_jar$	2	0	0	1
+2154	2154	\/[a-f0-9]{60,}_exe$	2	0	0	1
+2155	2155	,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,	2	0	0	1
+2156	2156	^\/showthread\.php\?t=\d+$	2	0	0	1
+2157	2157	function\x20booom[1-3]{1}\x28\x29	2	0	0	1
+2158	2158	var\x20Cute(Money|Power|Shine)	2	0	0	1
+2159	2159	iframe[^\r\n]*\x2FCUTE-IE\x2Ehtml	2	0	0	1
+2160	2160	^\/[a-z][0-9a-z_+=-]{10,30}\?\w=[0-9.]+\&\w=1.6.0_\d\d$	2	0	0	1
+2161	2161	\.php\?(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+$	2	0	0	1
+2162	2162	\/[a-z0-9]+\.[a-z0-9]{2,4}\/eH[a-z0-9]{60,}$	2	0	0	1
+2163	2163	\/[a-z0-9]+\.[a-z0-9]{2,4}\/oH[a-z0-9]{60,}$	2	0	0	1
+2164	2164	\/indigo\?\d+	2	0	0	1
+2165	2165	^\/\?[a-f0-9]{32}$	2	0	0	1
+2166	2166	=[.\"]\w{8}\.jar/Hi	2	0	0	1
+2167	2167	\.php\?showtopic=[0-9]{6}$	2	0	0	1
+2168	2168	\/[0-9]\.html$	2	0	0	1
+2169	2169	^\?[a-f0-9]{32}\" 	2	0	0	1
+2170	2170	^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$	2	0	0	1
+2171	2171	^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$	2	0	0	1
+2172	2172	^\/t\/[a-f0-9]{32}	2	0	0	1
+2173	2173	\/[A-Z]{20,}\?[A-Z]=\d$	2	0	0	1
+2174	2174	^\/q[a-zA-Z0-9+-]{3,14}\/[a-zA-Z0-9+-]{3,16}\?[a-z]{1,6}=[a-zA-Z0-9+-\._]{7,18}$	2	0	0	1
+2175	2175	^\/Applet\.jar$	2	0	0	1
+2176	2176	\/beacon\/[a-f0-9]{8}\.htm$	2	0	0	1
+2177	2177	\/t\/[a-f0-9]{32}$	2	0	0	1
+2178	2178	^\/[0-9]{3}\.jar$	2	0	0	1
+2179	2179	^[\r\n\s]*[\d\x5b]	2	0	0	1
+2180	2180	^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.jar$	2	0	0	1
+2181	2181	^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.pdf$	2	0	0	1
+2182	2182	\/[0-9]{3}\.pdf	2	0	0	1
+2183	2183	\(\x22[0-9\x3a\x3b\x3c\x3d\x3e\x3fa-k]{50,100}\x22\).{0,200}\)\x3b<\/script><\/body>	2	0	0	1
+2184	2184	^[a-f0-9]{32}	2	0	0	1
+2185	2185	^((<\/applet>).)+?\/.{1,12}\/.{1,12}\x3a.{1,12}p.{1,12}t.{1,12}t.{1,12}h	2	0	0	1
+2186	2186	^(\s*=\s*|[\x22\x27]\s*,\s*)[\x22\x27]	2	0	0	1
+2187	2187	^[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])(((=q)).)+?\.(gif|jpe?g|p(ng|sd))(=q)	2	0	0	1
+2188	2188	^((<\/applet>).)+[\r\n\s]value[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])[a-f0-9]{32}(=q1)	2	0	0	1
+2189	2189	^\/[a-z0-9A-Z]{25,35}\/(([tZFBeDauxR]+q){3}[tZFBeDauxR]+(_[tZFBeDauxR]+)?|O7dd)k(([tZFBeDauxR]+q){3}[tZFBeDauxR]+|O7dd)\/	2	0	0	1
+2190	2190	EGYPACK_CRYPT\d	2	0	0	1
+2191	2191	\/\?[0-9a-f]{60,66}\x3b(1(0[0-3]|1\d)|90)\d{1,3}\x3b\d{1,3}$	2	0	0	1
+2192	2192	^(ckwm)*?(Exp|cc)\.class	2	0	0	1
+2193	2193	^\/command\/[a-zA-Z]{6}$	2	0	0	1
+2194	2194	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+2195	2195	^(a(ttack|dEx[xp])|([a-z]))\.class	2	0	0	1
+2196	2196	^(a(ttack|dEx[xp])|([a-z]))\.class	2	0	0	1
+2197	2197	^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27]((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){10}|(=ascii){10})	2	0	0	1
+2198	2198	^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27][^\x22\x27]+?[\x22\x27][^>]*((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){9,20}|(=ascii){9,20})%3C	2	0	0	1
+2199	2199	^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$	2	0	0	1
+2200	2200	^\/[0-9]{1,2}\/red[0-9]{1,4}\.php[0-9]{0,1}$	2	0	0	1
+2201	2201	\.php\?(b=[a-fA-F0-9]{6}&)?v=1\.((4\.[0-2]\.[0-3]|5\.0\.[0-2]|6.0\.[0-4])\d?|[7-8]\.0\.\d{1,2})$	2	0	0	1
+2202	2202	&k=\d{16}(&|$)	2	0	0	1
+2203	2203	^(((?i:<\/applet>)).)+?[\r\n\s]value[\r\n\s]*[\r\n\s]*?[\x22\x27]?(\d{2,3})?(<sep>([^a-zA-Z0-9]{1,100}|[a-zA-Z0-9]{1,100}))\d{2,3}((=sep)\d{2,3}){20}	2	0	0	1
+2204	2204	^(((?i:<\/applet>)).)+?[\r\n\s]archive[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27]	2	0	0	1
+2205	2205	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+2206	2206	if.{1,10}[<>]=?\s*(<quot>[\x22\x27])1(<sep>[^0-9a-zA-Z])7((=sep)\d+)?(=quot).{1,10}[<>]=?\s*(=quot)1(=sep)7((=sep)\d+)?(=quot)	2	0	0	1
+2207	2207	^[\r\n\s]*[\r\n\s]*?[\x22\x27]http\x3a\/\/[^\/]+?\/\?[A-Za-z0-9]+=[A-Za-z0-9%]{60,}[\x22\x27]	2	0	0	1
+2208	2208	^[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\x22\x27]\.replace\([\r\n\s]*?(<q1>[\x22\x27]?)\/.+?\/g[\r\n\s]*?,[\r\n\s]*?(<q2>[\x22\x27]?)%(=q2)[\r\n\s]*?\)	2	0	0	1
+2209	2209	(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{12,16}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a)	2	0	0	1
+2210	2210	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27]	2	0	0	1
+2211	2211	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(<dot>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<p>((=dot))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<h>(((=p)|(=dot)))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=p).+?value[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(=dot)([^a-f0-9]{2}){1,20}(<e>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<x>((=e))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=e)(([^a-f0-9]{2}){1,20})?[\x22\x27]	2	0	0	1
+2212	2212	\/[a-f0-9]{32}\/[a-z]+?\-[a-z]+?\.php	2	0	0	1
+2213	2213	\.php\?e=\d+(&|$)	2	0	0	1
+2214	2214	^[\r\n\s]*?[\x22\x27][a-f0-9]{2}(<sep>[^a-f0-9]{1,10})(<a>[a-f0-9]{2})(=sep)(<p>[a-f0-9]{2})(=sep)(=p)(=sep)(<l>[a-f0-9]{2})(=sep)(<e>[a-f0-9]{2})[^\x22\x27]+?(=sep)(=p)(=sep)(=a)(=sep)[a-f0-9]{2}(=sep)(=a)(=sep)[^\x22\x27]+?(=sep)(=a)(=sep)(=l)(=sep)[a-f0-9]{2}(=sep)(=e)	2	0	0	1
+2215	2215	\/cod\/[^\x2f]+\.vbs$	2	0	0	1
+2216	2216	[a-f0-9]{32}\.jar	2	0	0	1
+2217	2217	^[^a-z0-9]	2	0	0	1
+2218	2218	\.php\?dwl=[a-z]+$	2	0	0	1
+2219	2219	^[\r\n\s]*[\r\n\s]*?[\x22\x27]h(<sep>\d{2})t(=sep)t(=sep)p(=sep)\x3a	2	0	0	1
+2220	2220	^[\r\n\s]*?[\x22\x27]<([\x27\x22]\s*?\+\s*?[\x22\x27])?a([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?l([\x27\x22]\s*?\+\s*?[\x22\x27])?e([\x27\x22]\s*?\+\s*?[\x27\x22])?t	2	0	0	1
+2221	2221	^\/ep\/cl\.php$	2	0	0	1
+2222	2222	^[\r\n\s]*?[\x22\x27]<applet	2	0	0	1
+2223	2223	=\d+&e=\d+$	2	0	0	1
+2224	2224	\/\d+\/\d\.zip$	2	0	0	1
+2225	2225	(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{10,20}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a)	2	0	0	1
+2226	2226	(<a>[0-9a-z]{2})(<s>((=a))[0-9a-z]{2})[0-9a-z]{2}(=s)[0-9a-z]{2}(<y>[0-9a-z]{2})[0-9a-z]{4}(<dot>[0-9a-z]{2})(=a)(<r>[0-9a-z]{2})(=r)(=a)(=y)(=dot)	2	0	0	1
+2227	2227	^[\r\n\s]*?\(	2	0	0	1
+2228	2228	\/[a-z0-9]{32}\.jar$	2	0	0	1
+2229	2229	^[^\s]*?\s*?\/[^\r\n\s]*?\?src=	2	0	0	1
+2230	2230	^\/([\/_]*?[a-f0-9][\/_]*?){32}\/\d+?$	2	0	0	1
+2231	2231	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?\/([\/_]*?[a-f0-9][\/_]*?){64}[\x22\x27]	2	0	0	1
+2232	2232	^\/([\/_]*?[a-f0-9][\/_]*?){32}$	2	0	0	1
+2233	2233	^\/[a-zA-Z0-9_\x2f-]{300,}\.jar$	2	0	0	1
+2234	2234	^\/[a-zA-Z0-9_\x2f-]{300,}\.eot$	2	0	0	1
+2235	2235	^((<\/applet>).)+?[\x22\x27]687474703a2f2f	2	0	0	1
+2236	2236	\.html\?sv=[1-5](\,\d+?){1,3}$	2	0	0	1
+2237	2237	\/(d|xie|fla)\.php\?[a-z]+687474703a2f2f	2	0	0	1
+2238	2238	\.html\?jar$	2	0	0	1
+2239	2239	^\/\d{4,5}\/\d{7}$	2	0	0	1
+2240	2240	\/\{0,2}[A-Za-z0-9\+\/]+?LvoDc0RHa8NnZ$	2	0	0	1
+2241	2241	^[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*?\.charCodeAt[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*[\r\n\s]*?\)[\r\n\s]*?\^[\r\n\s]*?[a-zA-Z_$][^\r\n\s]*\.charCodeAt[\r\n\s]*?\(	2	0	0	1
+2242	2242	^(<sep>[^\x22\x27]{1,10})100(=sep)97(=sep)115(=sep)104(=sep)115(=sep)116(=sep)121(=sep)108(=sep)101(=sep)46(=sep)97(=sep)114(=sep)114(=sep)97(=sep)121(=sep)	2	0	0	1
+2243	2243	^[a-z0-9]{1,500}?(<s>[a-z0-9]{2})(<t>((=s))[a-z0-9]{2})(<r>(((=s)|(=t)))[a-z0-9]{2})(=t)(<o>(((=s)|(=t)|(=r)))[a-z0-9]{2})(<b>(((=s)|(=t)|(=r)|(=o)))[a-z0-9]{2})(<y>(((=s)|(=t)|(=r)|(=o)|(=b)))[a-z0-9]{2})(=t)((((=s)|(=t)|(=r)))[a-z0-9]{4})(=s)(=t)(=r)	2	0	0	1
+2244	2244	^\/[a-z0-9]+?\?thread=\d+?&x?key=[A-F0-9]{32}$	2	0	0	1
+2245	2245	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+2246	2246	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+2247	2247	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+2248	2248	\/[A-Z]\.xml$	2	0	0	1
+2249	2249	^(<sep>((100).){1,20})100(=sep)101(=sep)102(=sep)97(=sep)117(=sep)108(=sep)116(=sep)35(=sep)86(=sep)77(=sep)76(=sep)	2	0	0	1
+2250	2250	\.php\?a=[^&]+&f=[a-f0-9]{32}&u=[^&]+$	2	0	0	1
+2251	2251	\.php\?a=(dw[a-z0-9]|[hr][2-7])$	2	0	0	1
+2252	2252	(PK\x01\x02.{24}\x0a\x00.{16}[a-z]{4}.class){4}	2	0	0	1
+2253	2253	^(((?i:<\/applet>)).)+?(?i:value)[\r\n\s]*=[\r\n\s]*\x5c?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]+(=slash)	2	0	0	1
+2254	2254	^\d+u\d+s\d+h\d	2	0	0	1
+2255	2255	^((<\/applet>).)+?&#(0*?(1([0-1]\d|2[0-2])|[78][0-9]|9[07-9]|4[8-9]|5[0-7]|6[5-9])|x0*?([46][1-9A-F]|[57][0-9A]|3[0-9]))(\x3b|&#)	2	0	0	1
+2256	2256	^\s*?\d	2	0	0	1
+2257	2257	^\s*\s*?[\x22\x27][^\x22\x27\x3d]{1,20}=[a-f0-9]{20}	2	0	0	1
+2258	2258	^[^\d]{1,20}100[^\d]{1,20}101[^\d]{1,20}102[^\d]{1,20}97[^\d]{1,20}117[^\d]{1,20}108[^\d]{1,20}116[^\d]{1,20}35[^\d]{1,20}86[^\d]{1,20}77[^\d]{1,20}76	2	0	0	1
+2259	2259	^\s*?<<\s*?\/[A-Z0-9a-z]+\([A-Z0-9a-z]+\)\s*?	2	0	0	1
+2260	2260	^\/[a-f0-9]{32}\.php\?q=[a-f0-9]{32}$	2	0	0	1
+2261	2261	\.php\?req=(swf(IE)?|x(ap|ml)|jar|mp3)&	2	0	0	1
+2262	2262	(\0[a-z]{3}\.classPK.{43}){4}	2	0	0	1
+2263	2263	^[\x22\x27]	2	0	0	1
+2264	2264	^\s*\s*?window\.document\.createElement	2	0	0	1
+2265	2265	^(<sep>[^\x22\x27]{0,10})6f(=sep)6c(=sep)6c(=sep)65(=sep)63(=sep)74(=sep)47(=sep)61(=sep)72(=sep)62(=sep)61(=sep)67(=sep)65(=sep)	2	0	0	1
+2266	2266	\/3\/[a-f0-9]{32}\/http\x3a\x2f	2	0	0	1
+2267	2267	\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+)?$	2	0	0	1
+2268	2268	^\x2Fload\x5Fmodule\x2Ephp\x3Fuser\x3D(n1|11?|2)$	2	0	0	1
+2269	2269	^\x2Fmodules\x2F(n[u3]|1|2)\x2Eswf$	2	0	0	1
+2270	2270	^\x2Fmodules\x2F(1|2)\x2Ejar$	2	0	0	1
+2271	2271	^\s*?\(\s*?[\x22\x27]Flash[\x22\x27]	2	0	0	1
+2272	2272	^\s*?[\x22\x27][A-Za-z0-9\s]{500}	2	0	0	1
+2273	2273	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}<script>var	2	0	0	1
+2274	2274	^[\r\n\s]*?<script>[\r\n\s]*?[A-Za-z]+[\r\n\s]*[\r\n\s]*?[\x22\x27][A-Za-z]{9}\x20[A-Za-z\x20]{300}	2	0	0	1
+2275	2275	^\/[a-z]\?[a-z]=[0-9]{5,}$	2	0	0	1
+2276	2276	[^0-9a-f]{1,3}68[^0-9a-f]{1,3}74[^0-9a-f]{1,3}74[^0-9a-f]{1,3}70[0-9a-f]{1,3}3a	2	0	0	1
+2277	2277	^[\x22\x27]	2	0	0	1
+2278	2278	^(e(vtmgr|ext)|actmon|nciesc|EBC32|comm|tdi)\.sys[\x22\x27]	2	0	0	1
+2279	2279	^([\x22\x27]\s*?\])?\(\s*?(\[[\x22\x27])?rc4([\x22\x27]\s*?\])?\(\s*?[\x22\x27][^\x22\x27]+?[\x22\x27]\s*?,\s*?(\[[\x22\x27])?hex2bin([\x22\x27]\s*?\])?\(	2	0	0	1
+2280	2280	^[\x22\x27]	2	0	0	1
+2281	2281	^[\x22\x27]	2	0	0	1
+2282	2282	^[\x22\x27]	2	0	0	1
+2283	2283	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\?\&]e=\d+[\x22\x27]	2	0	0	1
+2284	2284	^[\r\n\s]*?\,[\r\n\s]*?[\x22\x27][\%\\]u"	2	0	0	1
+2285	2285	^(((<\/object>).)+?codebase\s*\s*?[\x22\x27]spl[\x22\x27])(((<\/object>).)+?\/x-java-applet)	2	0	0	1
+2286	2286	^[\w.]*?\.class	2	0	0	1
+2287	2287	^\s*\s*?[\x22\x27]\-	2	0	0	1
+2288	2288	^\s*\s*?[\x22\x27]\-	2	0	0	1
+2289	2289	\/Fqxzdh\.jar$	2	0	0	1
+2290	2290	^\s*?\(\s*?[\x22\x27](AgControl\.AgControl)[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?\.[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?[\x22\x27]\s*?\.\s*?replace\s*?\(	2	0	0	1
+2291	2291	^id=[^&]+&dom=687474703a2f2f[a-f0-9]+2e706870\s*?$/Ps	2	0	0	1
+2292	2292	[^=]+(([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+?2e)+([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+\s*?/P	2	0	0	1
+2293	2293	\.php\?spl=[\w_]+$	2	0	0	1
+2294	2294	^Content-Disposition\x3a[^\r\n]+\.swf/Hm	2	0	0	1
+2295	2295	Referer\x3a[^\r\n]+\.php\/\[\[DYNAMIC\]\]\/\d/Hm	2	0	0	1
+2296	2296	^\s*?[\x3a\x3d]\s*?[\x22\x27]?\-	2	0	0	1
+2297	2297	^\/f(\/[^\x2f]+)?\/14\d{8}(\/\d{9,10})?(\/\d)+(\/x[a-f0-9]+(\x3b\d)+?)?$	2	0	0	1
+2298	2298	^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{14,}\.html(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+2299	2299	^(<sep>.{1,50})u(=sep)n(=sep)c(=sep)t(=sep)i(=sep)o(=sep)n(=sep)\s	2	0	0	1
+2300	2300	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}(\r\n)*?<script>[^\r\n]+?\We[\x22\x27\+]*?v[\x22\x27\+]*?a[\x22\x27\+]*?l\W	2	0	0	1
+2301	2301	^(<sep>.{1,20})\.___\+(=sep)\._\\\+(=sep)\._\\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+(=sep)\.\\\_\+(=sep)\.\\__\+(=sep)\.__\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.___\+(=sep)\.\\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\\_\+(=sep)\._\_\+(=sep)\.\_\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\__\+(=sep)\.\\\\+(=sep)\.\\\$_\+	2	0	0	1
+2302	2302	^\/(pruncd)?flashhigh\.swf$	2	0	0	1
+2303	2303	^\/(pruncd)?flashlow\.swf$	2	0	0	1
+2304	2304	^\/(pruncd)?silverapp1\.xap$	2	0	0	1
+2305	2305	\?action=lnd$	2	0	0	1
+2306	2306	\?action=(pld|exp)&exp=	2	0	0	1
+2307	2307	^Referer\x3a[^\r\n]+\x3a\d{1,5}\/[^\r\n]*?[a-z]+?\.php\?[a-z]+\d/Hm	2	0	0	1
+2308	2308	\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Z-a-z]{18}\.jnlp$	2	0	0	1
+2309	2309	\/k\?t[a-z]*=\d{5,}$	2	0	0	1
+2310	2310	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+2311	2311	^\/[^\x2f]*?flashhigh\.swf$	2	0	0	1
+2312	2312	^\/[^\x2f]*?flashlow\.swf$	2	0	0	1
+2313	2313	^\/[^\x2f]*?iebasic\.html$	2	0	0	1
+2314	2314	^\/[^\x2f]*?silverapp1\.xap$	2	0	0	1
+2315	2315	\/[a-z]{3,7}\.php$	2	0	0	1
+2316	2316	\/([a-z0-9]{1,7}\.php)?\?zho=	2	0	0	1
+2317	2317	^\/[a-f0-9]{32}\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Za-z]+\.(html|jar|swf)$	2	0	0	1
+2318	2318	^\/Drop2(-\d+)\.swf$	2	0	0	1
+2319	2319	^[^\r\n]*?(<name>\/[^\.\/]+\.html)\?[a-z]+?\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(\d{1,5})?\r\n	2	0	0	1
+2320	2320	^Content-Disposition\x3a[^\r\n]+\.swf/Hm	2	0	0	1
+2321	2321	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi	2	0	0	1
+2322	2322	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi	2	0	0	1
+2323	2323	^\s*?\x28\s*?[a-z0-9]{4,6}\s*?\x28\s*?[a-z0-9]{1,3}\s*?,\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x29\s*?\x3b\s*?(<var>[a-z0-9]{1,3})\s*?\x3d\s*?\x28\s*?(=var)\s*?\x2b\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x25\s*?[a-z0-9]{1,3}\.length\x3b	2	0	0	1
+2324	2324	^[A-Za-z0-9]+\x27\s*?src=\x27http\x3a[^\x27]+[\x27]\s*width=1\d\s+height=1\d\s+	2	0	0	1
+2325	2325	^Last-Modified\x3a\x20[^A-Za-z]{2}/Hm	2	0	0	1
+2326	2326	^\/ABs[A-Za-z0-9_]+(\/x?[a-f0-9]+(\x3b\d+)+)?$	2	0	0	1
+2327	2327	^\/AwoVG[A-Za-z0-9_]+$	2	0	0	1
+2328	2328	^[a-z0-9]+\x2A\x2F\x22\x6F\x66\x74\x2E	2	0	0	1
+2329	2329	^Referer\x3a[^\r\n]+?rowedmedia\.com\/search\.php\r?$/Hmi	2	0	0	1
+2330	2330	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r\n)/Hmi	2	0	0	1
+2331	2331	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+2332	2332	^[a-zA-Z0-9]{9}<\/[^>]+>\s+?<[^\s]+\sid=\x22[a-zA-Z]{3,5}\x22\sstyle=\x22display\x3anone\x22>[A-Za-z0-9]{500}	2	0	0	1
+2333	2333	^[a-z]{7}(\s*?[a-z]+\s*?)*?[a-z]{7,}\x2a\x2f	2	0	0	1
+2334	2334	nb[\d+]=Yes	2	0	0	1
+2335	2335	^(<vname>[A-Za-z0-9]+)\s*\s*?navigator.userAgent.toLowerCase\x28\x29\x3b.+?if\(document.cookie[^\r\n]+\([^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]b[\x22\x27+\s]*o[\x22\x27+\s]*t[\x22\x27+\s]*[\x22\x27][^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]s[\x22\x27+\s]*p[\x22\x27+\s]*i[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*r[\x22\x27+\s]*[\x22\x27]	2	0	0	1
+2336	2336	^Referer\x3a[^\r\n]+?\x3a\d+[^\r\n]*?\/[a-z0-9]+\.php\?[a-z0-9]+=\d+(\r\n|&)/Hm	2	0	0	1
+2337	2337	^GET \/(<name>a[a-z]{9,})\/.+?\r\nHost\x3a\x20(=name)\.	2	0	0	1
+2338	2338	^\s*?[\x22\x27][^\x22\x27]+\.php\?id=\d+[\x22\x27]	2	0	0	1
+2339	2339	^\W	2	0	0	1
+2340	2340	^[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(<arg>[a-z0-9]{3,})(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28[^\x29]+\x29\x3b\x2f\x2a[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(=arg)(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28	2	0	0	1
+2341	2341	^\s*?\d+,\s*?\d	2	0	0	1
+2342	2342	^\s*?\d+,\s*?\d	2	0	0	1
+2343	2343	\/14\d{8}(\.jar)?$	2	0	0	1
+2344	2344	^[a-z0-9]*\r\n/H	2	0	0	1
+2345	2345	^[a-z0-9]*\r\n/H	2	0	0	1
+2346	2346	filename=[a-z0-9]*\r\n/H	2	0	0	1
+2347	2347	\/\??4c2H($|[&?]utm_source=)	2	0	0	1
+2348	2348	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+2349	2349	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+2350	2350	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+2351	2351	\/([A-Za-z]{0,3}\d)(\d{0,3}[A-Za-z])[A-Za-z0-9]{4,5}\.swf$	2	0	0	1
+2352	2352	^\s*[^>]*?[a-zA-Z]+\s*\s*?[\x22\x27]([a-z]{0,20}[A-Z])([A-Z]{0,20}[a-z])[A-Za-z]{15,21}[\x22\x27][^>]*([A-Za-z_]{0,200}[0-9])([0-9a-z_]{0,200}[A-Z])([0-9A-Z_]{0,200}[a-z])[A-Za-z0-9_]{200}	2	0	0	1
+2353	2353	\/5\/[a-f0-9]{32}\/\x20*http\x3a\x2f	2	0	0	1
+2354	2354	^\x2f+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x2f\??[a-f0-9]+\x7chttp\x3a\x2f	2	0	0	1
+2355	2355	^Refresh\x3a\x20\d+\x3b\x20url[^\r\n]+\/999\/00000\/\r?$/Hm	2	0	0	1
+2356	2356	^\s*?[\x22\x27][^\x22\x27a-f0-9]68[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]70[^\x22\x27a-f0-9]3a[^\x22\x27a-f0-9]2f[^\x22\x27a-f0-9]2f[^\x22\x27]+?[^\x22\x27a-f0-9]00[\x22\x27]	2	0	0	1
+2357	2357	^\/[a-f0-9]{32}\/e\.html$	2	0	0	1
+2358	2358	Host\x3a\x20a[a-z]{10}\.[a-z]{5}\./H	2	0	0	1
+2359	2359	\.js\?ver=[0-9]\.[0-9]{2}\.[0-9]{4}$	2	0	0	1
+2360	2360	\/\d\/?[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.html&[a-z]+=[^&]+&[a-z]+=\d{3}\.\d{3}\.\d{3,}(\.\d{3,})?$	2	0	0	1
+2361	2361	\/\d\/?[A-Z]+\/[a-f0-9]{40}\/$	2	0	0	1
+2362	2362	\/([a-z0-9]{0,10}[A-Z])([A-Z0-9]{0,10}[a-z])[A-Z-a-z0-9]{5,20}\.jar$	2	0	0	1
+2363	2363	\?([a-z\d\x3d&\x2e]*?[A-Z])([A-Z\d=&\x2e]*?[a-z])([A-Za-z=&\x2e]*?\d)[A-Za-z\d=&\x2e]{50,}$	2	0	0	1
+2364	2364	^\/([a-z0-9]+\/)?[^\x2f]+\?[a-z]{1,40}_id=\d{2,5}?&[a-z]{1,40}_id=\d{2,5}&[^&\x3d]+(_id)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$	2	0	0	1
+2365	2365	&cat_no=\d{2,5}?&no=\d{2,5}&[^&\x3d]+(_no)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$	2	0	0	1
+2366	2366	\x3capplet[^\x3e]+visibility[^\x3e]+hidden[^\x3e]	2	0	0	1
+2367	2367	^\s*?[a-z]+\s*\s*?\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b]	2	0	0	1
+2368	2368	^\s*?	2	0	0	1
+2369	2369	^\/[0-9a-f]{32}\.html$	2	0	0	1
+2370	2370	^\/[a-z\_\-]{4,20}\.php\?([a-z\_\-]{4,20}=\d+?&){3,}[a-z\_\-]{4,20}=-?\d+$	2	0	0	1
+2371	2371	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{4,10}=\d{1,3}&){7,}[a-z\_\-]{4,10}=-?\d+$	2	0	0	1
+2372	2372	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d{1,3}&){3,}[a-z\_\-]{4,10}=-?\d+$	2	0	0	1
+2373	2373	\.jpg$	2	0	0	1
+2374	2374	^\s+\d+\x3b\s*\}	2	0	0	1
+2375	2375	^\/([a-z][a-z\x2f]*\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d)[a-z0-9\x2f]+\/$	2	0	0	1
+2376	2376	^\/([a-z][a-z\x2f]*-[a-z\x2f]+-)[a-z\x2f-]+\/$	2	0	0	1
+2377	2377	^http\x3a\/\/[^\x2f]+\/[A-Z]([a-z0-9]+[A-Z])([A-Z0-9]+[a-z])[A-Za-z0-9]{9,}\.html?\r?$/Hmi	2	0	0	1
+2378	2378	\.js\?chebstr=0\.\d+$	2	0	0	1
+2379	2379	\.js\?chbstr=0\.\d+$	2	0	0	1
+2380	2380	^[^\r\n\x22\?]+[&?][^=\r\n\x22]+=[a-f0-9]+[^\r\n\x22\?]*[&?][^=\r\n\x22]+=[a-f0-9]+\x22\s*\x3b\s*head\.appendChild\(\s*script\s*\)\x3b	2	0	0	1
+2381	2381	^\/([a-z\d]+[+-][a-z\d]+[+-][a-z\d]+[+-])[a-z\d+-]*\/$	2	0	0	1
+2382	2382	^\s*\(\s*[\x22\x27][\x00-\x09\x80-\xff][\x22\x27]\s*\)\s*\x3b\s*[A-Za-z0-9]+\s*=\s*[\x22\x27]	2	0	0	1
+2383	2383	^\s*\x27[^\x27]+\x27width=\x27250\x27\sheight=\x27250\x27>\s*<\/iframe>\s*<\/div>	2	0	0	1
+2384	2384	^[\x3b\x2c]postRequest\x28cfg\.urlSoftDetectorCallback	2	0	0	1
+2385	2385	^[\r\n\s]*?Base64\.decode[\r\n\s]*?\x28[\r\n\s]*?[\x22\x27]	2	0	0	1
+2386	2386	Referer\x3a\x20http\x3a\x2f\x2f[^\r\n\x2f]+\/index\.php\?[^\x3d&]+=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=)?\r\n/H	2	0	0	1
+2387	2387	^[^\n]*\x29\x3b$	2	0	0	1
+2388	2388	^\s*(<var>[^\r\n\s\x3d\x2c\x3b]+)\s*=[^\n]*<iframe([^\n>]*top\x3a-\d+px\x3b)[^\n>]+src\s*=\s*\x5c?[\x22\x27]http[^\n>]+>\s*<\/iframe>\x22\x3bdocument\.write\((=var)\)\x3b\s*$	2	0	0	1
+2389	2389	^[^\x2f\x22\x27]+\/\?[^=&\x22\x27]+=l3S	2	0	0	1
+2390	2390	^.{16}[a-z]{3}\.dll	2	0	0	1
+2391	2391	^.{16}[a-z]{4}\.dll	2	0	0	1
+2392	2392	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{7,8}\d{2,3}\.pdf\r\n/Hm	2	0	0	1
+2393	2393	\.php\?setup=d&s=\d+&r=\d+$	2	0	0	1
+2394	2394	\/\?[a-z0-9]{65,}\x3b \d\x3b \d	2	0	0	1
+2395	2395	^\/wordpress\/\?[A-Za-z0-9]{4}(&utm_source=le)?$	2	0	0	1
+2396	2396	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+2397	2397	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+2398	2398	\/\?nbVykj$	2	0	0	1
+2399	2399	^s?\x3a\x2f\x2f[^\x22\x27]+\/\?[A-Za-z0-9]{5,6}(=[^&\x22\x27]+)?[\x22\x27]\x29\x3bsetCookie\(\x22popundr\x22,1,864e5\)\}	2	0	0	1
+2400	2400	^(<var>[A-Z0-9a-z]{1,20})\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29	2	0	0	1
+2401	2401	^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.[a-z]+\?time=[^&]+&stamp=[a-z]*\d+(\.[a-z]*\d+)+$	2	0	0	1
+2402	2402	^[^\r\n]+\/%(3A|20)http%3A%2F%2F/Hmi	2	0	0	1
+2403	2403	^\/\?3b[A-Z0-9a-z]{2}(&subid=[^&]*)?$	2	0	0	1
+2404	2404	^\/[a-z]+\/$	2	0	0	1
+2405	2405	^\s*\([\x22\x27][A-F0-9a-f]{32}[\x22\x27]\s*\)\s*\x3b\s*}\s*catch\s*\(e\)\s*\{\s*\}\s*\}\s*<\/script>\s*<\/body>	2	0	0	1
+2406	2406	^([^>]*? name\s*=\s*[\x22\x27]flashvars)[^>]*? value\s*=\s*[\x22\x27]url=https?\x3a[^\x22\x27]*?\.wasm	2	0	0	1
+2407	2407	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22(\!(\x22\s*?\+\s*?\x22)?)?Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+2408	2408	^(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{2}(<J>[0-9a-z]{2})[0-9a-z]{4}(=v)[0-9a-z]{6}(=space)[0-9a-z]{2}(=space)[0-9a-z]{64}(=J)(=a)(=v)(=a)	2	0	0	1
+2409	2409	^\d{3}px\x3b\swidth\x3a3\d{2}px\x3b\sheight\x3a3\d{2}px\x3b\x22>[^<>]*?<iframe src=[\x22\x27][^\x22\x27]+[\x22\x27]\swidth=[\x22\x27]2\d{2}[\x22\x27]\sheight=[\x22\x27]2\d{2}[\x22\x27]><\/iframe>[^<>]*?\n[^<>]*?<\/span>	2	0	0	1
+2410	2410	\/[a-z]{4,20}-a\.[a-z]{4,20}\.jar$	2	0	0	1
+2411	2411	\/view.php\?i=\d&key=[0-9a-f]{32}$	2	0	0	1
+2412	2412	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.jar$	2	0	0	1
+2413	2413	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$	2	0	0	1
+2414	2414	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$	2	0	0	1
+2415	2415	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$	2	0	0	1
+2416	2416	^\/[a-z]\/f\.php\?k=\d(&e=\d&f=\d)?$	2	0	0	1
+2417	2417	^\/[a-z]+\/$	2	0	0	1
+2418	2418	\.php\?j=1&k=[0-9](i=[0-9])?$	2	0	0	1
+2419	2419	^\/[a-zA-Z]{7}\.jar$	2	0	0	1
+2420	2420	\/lpdf\.php\?i=[a-zA-Z0-9]+&?$	2	0	0	1
+2421	2421	[a-z0-9]{32}\.jar	2	0	0	1
+2422	2422	\/inf\.php\?id=[a-f0-9]{32}$	2	0	0	1
+2423	2423	^\s*=\s*[\x22\x27]	2	0	0	1
+2424	2424	\/vd\/\d+\x3b[a-f0-9]{32}	2	0	0	1
+2425	2425	\.php\?pprec$	2	0	0	1
+2426	2426	\.php\?c002$	2	0	0	1
+2427	2427	[a-f0-9]{32}\.jar	2	0	0	1
+2428	2428	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1)	2	0	0	1
+2429	2429	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1)	2	0	0	1
+2430	2430	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1)	2	0	0	1
+2431	2431	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1)	2	0	0	1
+2432	2432	[a-f0-9]{32,64}\/[a-f0-9]{32,64}/\w$	2	0	0	1
+2433	2433	\?(s|page|id)=\d+$	2	0	0	1
+2434	2434	^[\r\n\s\+]*[\r\n\s\+]*?(<func>[_a-zA-Z][a-zA-Z0-9_-]+)\([\r\n\s]*?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]*?[\x22\x27][\r\n\s]*?,[\r\n\s]*?[\x22\x27][^\x22\x27]+[\x22\x27][\r\n\s]*?\)\+(=func)	2	0	0	1
+2435	2435	\/FlashPlayer\.cpl$	2	0	0	1
+2436	2436	^((<\/applet>).)+?[\x22\x27]1337\.exe	2	0	0	1
+2437	2437	filename=[a-z]{4}\.txt\x0D\x0A/H	2	0	0	1
+2438	2438	&p=\d+\.\d+\.\d+\.\d+&j=\d+\.\d+\.\d+\.\d+&f=\d+\.\d+\.\d+\.\d+$	2	0	0	1
+2439	2439	^[\r\n\s]*[\r\n\s]*?(<q>[\x22\x27])[a-f0-9]{9,16}\.(jar|zip)(=q)	2	0	0	1
+2440	2440	^\x2Fclicker\x2Ephp$	2	0	0	1
+2441	2441	^(<var>.{1,10})\.\\_\\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\(\!\[\]\+\x22\x22\)\[(=var)\.\_\\_\]\+(=var)\.\\\$\_\+(=var)\.\_\_\+	2	0	0	1
+2442	2442	\?(s|page|id)=\d+&text=\d+$	2	0	0	1
+2443	2443	^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)j51[a-f0-9]{21}\.jar(=q)\r?$/Hm	2	0	0	1
+2444	2444	^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)e51[a-f0-9]{21}\.exe(=q)\r?$/Hm	2	0	0	1
+2445	2445	\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$	2	0	0	1
+2446	2446	\/\{0,2}[A-Za-z0-9\+\/]+?voDc0RHa8NnZ$	2	0	0	1
+2447	2447	^[^\x3b\r\n\x22\x27]+?[A-Za-z0-9\/\_\-]{60,}\.exe\?	2	0	0	1
+2448	2448	^[^\x3b\r\n\x22\x27]+?\.txt\?e=\d+(&[fh]=\d)?	2	0	0	1
+2449	2449	^[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)	2	0	0	1
+2450	2450	[a-z]	2	0	0	1
+2451	2451	\.exe\?(e=)?\d+$	2	0	0	1
+2452	2452	\/j\d{2}\.php\?i=	2	0	0	1
+2453	2453	\/\?whole=\d+$	2	0	0	1
+2454	2454	^\/search\/[0-9]{64}	2	0	0	1
+2455	2455	\/m1[1-6]\.jar$	2	0	0	1
+2456	2456	\/[0-9]{4}\.html$	2	0	0	1
+2457	2457	\/\d+\.pkg$	2	0	0	1
+2458	2458	\/j_[a-z0-9]+_(0422|1723|3544|5076)\.jar$	2	0	0	1
+2459	2459	\/[a-z0-9]{3}\.php\?[a-z]=[a-zA-Z0-9]{10}$	2	0	0	1
+2460	2460	amor\d{0,2}\.jar	2	0	0	1
+2461	2461	[a-f]	2	0	0	1
+2462	2462	=(3[0-9a]|2e)+3a313[3-9](3[0-9]){8}$	2	0	0	1
+2463	2463	(<m>[0-9a-f]{2})(<sep>[^0-9a-f])(<e>((=m))[0-9a-f]{2})(=sep)([0-9a-f]{2}(=sep)){7}(=e)(=sep)(=m)(=sep)[0-9a-f]{2}(=sep)(=e)(=sep)(<d>((=e))[0-9a-f]{2})(=sep)(=d)(=sep)(=e)(=sep)(=d)	2	0	0	1
+2464	2464	^[\r\n\s]*?\([\r\n\s]*?(<q>[\x22\x27])(<m>(((=q)).)+)(=q).+?<(=m)?a(=m)?p(=m)?p(=m)l(=m)?e(=m)?t	2	0	0	1
+2465	2465	\/[a-f0-9]{32}\/[a-f0-9]{32}\.jar$	2	0	0	1
+2466	2466	^\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$	2	0	0	1
+2467	2467	\.jar\?java=\d+$	2	0	0	1
+2468	2468	^((<\/applet>).)+?\.jar\?java=\d+	2	0	0	1
+2469	2469	^((<\/applet>).)+?[\x22\x27]aHR0cDov	2	0	0	1
+2470	2470	^[a-f0-9]{32}=\d{1,10}\r\n/H	2	0	0	1
+2471	2471	\/1[34]\d{8}\.tpl$	2	0	0	1
+2472	2472	^[\r\n\s]*?\([\r\n\s]*?[\x22\x27]f([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?m([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?C([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?h([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?a([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?c([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?d([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?e[\x22\x27]	2	0	0	1
+2473	2473	^\/\d{1,2}(<l>[A-Z])\d{1,2}(=l)\d{1,2}(=l)\d{1,2}\.pdf$	2	0	0	1
+2474	2474	\/java\.php\?eid=[a-f0-9]{32}&	2	0	0	1
+2475	2475	\/pdf\.php\?pdf=[a-f0-9]{32}&	2	0	0	1
+2476	2476	[&?]type=\d+($|&)	2	0	0	1
+2477	2477	^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{32,}\.html(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+2478	2478	^\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?m\d+([\x22\x27]\s*?,\s*[\x22\x27])?C\d+([\x22\x27]\s*?,\s*[\x22\x27])?h\d+([\x22\x27]\s*?,\s*[\x22\x27])?a\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?c\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?d\d+([\x22\x27]\s*?,\s*[\x22\x27])?e\d+[\x22\x27]	2	0	0	1
+2479	2479	\/13[89]\d{7}.swf$	2	0	0	1
+2480	2480	\/[a-z]+\.php\?[a-z]+\d{7}&[a-z]+\d{7,8}$	2	0	0	1
+2481	2481	^(<sep>[^\x22\x27]{0,10})75(=sep)6e(=sep)63(=sep)74(=sep)69(=sep)6f(=sep)6e(=sep)20	2	0	0	1
+2482	2482	^\d+?\*\/\s*?(<vname>[^\s\(\x3b]{1,20})\s*?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)\s*?(\/\*\d+?\*\/\s*?)?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)	2	0	0	1
+2483	2483	[&?]v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=	2	0	0	1
+2484	2484	\/1(3[89]\d{7}|4\d{8})\.xap$	2	0	0	1
+2485	2485	&dr=\d+$	2	0	0	1
+2486	2486	&nrk=\d+$	2	0	0	1
+2487	2487	^Content-Disposition\x3a[^\r\n]+(\W14\d{8})\.pdf\r?$/Hm	2	0	0	1
+2488	2488	^(((<\/iframe>).)+?src\s*\s*?\x22http\x3a[^\x22]+16\.html\x22)(((<\/iframe>).)+?left\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)(((<\/iframe>).)+?top\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)((<\/iframe>).)+?<\/iframe>\x27\x29	2	0	0	1
+2489	2489	^\s*?[A-Z0-9a-z\+]+?\s*?\x7d	2	0	0	1
+2490	2490	^((\/[a-z]+?)*?\/\d+\/)((\/\d+?)*?\/[a-z]+?\/)(\/([a-z]+|\d+)){4,}\/[a-z]+\.pack\.gz$	2	0	0	1
+2491	2491	^\s*?\x28\s*?(<q>[\x22\x27])(((=q)).)+?(=q)\s*?\,\s*?[\x22\x27]container[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27],\s*?[\x22\x27]9\.0\.0[\x22\x27]\s*?,\s*?false\s*?,\s*?flashvars,\s*?params\s*?,\s*?attributes\s*?\x29\s*?\x3b\s*?<\/script>\s*?<\/head>	2	0	0	1
+2492	2492	\/14\d{8}(\.swf)?$	2	0	0	1
+2493	2493	\/14\d{8}(\.pdf)?$	2	0	0	1
+2494	2494	^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.exe/Hm	2	0	0	1
+2495	2495	^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.dll/Hm	2	0	0	1
+2496	2496	\/14\d{8}(\/\d+)*?(\/x[a-f0-9]+[\x3b0-9]*)?$	2	0	0	1
+2497	2497	^\s[^\r\n]*?[\x28\x5b]\s*?[\x22\x27][^\x22\x27]?s[^\x22\x27]?u[^\x22\x27]?b[^\x22\x27]?s[^\x22\x27]?t[^\x22\x27]?r[^\x22\x27]?[\x22\x27]\s*?[\x29\x5d]\s*?(\x5d\s*?)?\x28	2	0	0	1
+2498	2498	\/video.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2499	2499	\/player.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2500	2500	\/search.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2501	2501	^\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28(=var1)\s*\!\s*=\s*[\x27\x22][\x22\x27]\s*?\x29\s*?\{\s*?(<var2>[^\s\x3d]+)\s*\s*?(=var1)\s*?\[	2	0	0	1
+2502	2502	\/1\.php\?r$	2	0	0	1
+2503	2503	^[^a-z]?\x65[^a-z]?\x6e[^a-z]?\x67[^a-z]?\x74[^a-z]?\x68	2	0	0	1
+2504	2504	^\s*?[\x22\x27](<char>[^\x22\x27]+)[\x22\x27]\.replace\x28\s*?[\x22\x27](=char)[\x22\x27]\s*?,	2	0	0	1
+2505	2505	\/banner.php\?sid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2506	2506	\/blog.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2507	2507	\/main\.html$	2	0	0	1
+2508	2508	\.php\?id=[0-9A-F]{44,54}&rnd=[0-9]{3,7}$	2	0	0	1
+2509	2509	^\/tdstest\/[a-f0-9]{32,}\/?$	2	0	0	1
+2510	2510	\/content\/dl\.php\?sl=vbs[a-z0-9]{32}$	2	0	0	1
+2511	2511	\/content\/getvbslink\.php\?d=[a-z0-9]{32}$	2	0	0	1
+2512	2512	Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H	2	0	0	1
+2513	2513	^[a-z0-9]*\r\n/H	2	0	0	1
+2514	2514	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+2515	2515	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+2516	2516	\/street[1-5]\.php$	2	0	0	1
+2517	2517	\/XV-\d+\.exe$	2	0	0	1
+2518	2518	\/bad\/[A-Z0-9]+\.swf$	2	0	0	1
+2519	2519	\/\d\/[A-Z]+\/[a-f0-9]{32}\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?$	2	0	0	1
+2520	2520	^\s*?[^\x28\s]*?\x28\s*?(<a1>[^\s,\x29]+)\s*?,\s*?(<a2>[^\s,\x29]+)\s*?\x29\{[^\r\n]*?[\+=]String.fromCharCode\((=a2)\)[^\r\n]*?\}	2	0	0	1
+2521	2521	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.jar\r\n/Hm	2	0	0	1
+2522	2522	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+2523	2523	\b[a-z]{2}\d+\s*\s*?Yes	2	0	0	1
+2524	2524	^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x20http\x3a\x2f	2	0	0	1
+2525	2525	^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?(\.[a-z]+)?$	2	0	0	1
+2526	2526	^[^\r\n]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?/H	2	0	0	1
+2527	2527	^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x3ahttp\x3a\x2f	2	0	0	1
+2528	2528	^Referer\x3a[^\r\n]+\/4\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?$/Hm	2	0	0	1
+2529	2529	^\s*\s*?[\x22\x27]8\.8\.8\.8[\x22\x27]	2	0	0	1
+2530	2530	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+2531	2531	Host\x3a\x20([\x2eg-z]*[a-f0-9][\x2eg-z]*){32}\./H	2	0	0	1
+2532	2532	\/e\.html$	2	0	0	1
+2533	2533	^(<var>[a-f0-9]{6})-->\s*?<script\s*?type=[\x22\x27]text\/javascript[\x22\x27]\s*?src=[\x22\x27]http\x3a\x2f[^\x22\x27]*?\/[a-z\d]{8}\.php\?id=\d+[\x22\x27]\s*<\/script><!--\/(=var)-->	2	0	0	1
+2534	2534	[&?]t=[a-f0-9]{32}(&|$)	2	0	0	1
+2535	2535	\/5\/[A-Z]{3,}\/[a-f0-9]{32}(\.[^\x2f]+|\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?|\/\d+\/?)?$	2	0	0	1
+2536	2536	^\s*?[_$]+\x28\x29	2	0	0	1
+2537	2537	^\s*?[_$]+\x28\x29	2	0	0	1
+2538	2538	Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)[^\r\n]*?\/search\?q=([A-Z&=\d]*?[a-z])([a-zA-Z\d&=]*?[A-Za-z=&]\d[A-Za-z])([a-zA-Z\d&=]*?[a-z\d][A-Z][A-Za-z\d])[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+[&=A-Za-z0-9]*?\r\n.*?Host\x3a\x20(=refhost)/Hsi	2	0	0	1
+2539	2539	^\s*?\w+\s*?\.\s*?charCodeAt	2	0	0	1
+2540	2540	^\/\?[a-f0-9]{32,64}$	2	0	0	1
+2541	2541	^[^>]*?id\s*[\x22\x27][a-z0-9]+[\x22\x27][^>]*\s*?[\x2a\d]{100}	2	0	0	1
+2542	2542	Referer\x3a\x20http\x3a\x2f+(<dl1>[^\x2e\r\n]+)\x2e[^\x2f\r\n]*?(<dl2>\x2e[^\x2e\r\n\x2f]+\x2e[^\x2e\x2f\r\n]+)\x2f(\??[a-f0-9]{32,64}\/?)?\r\n.*?Host\x3a\x20((=dl1))[^\r\n]*?(=dl2)\r\n/Hsm	2	0	0	1
+2543	2543	Referer\x3a\x20[^\r\n]*?\/[a-f0-9]{32,64}\.swf/H	2	0	0	1
+2544	2544	\.php\?id=[0-9A-F]{32,}&rnd=\d+$	2	0	0	1
+2545	2545	^((<\/div).)+?top\x3a\s*?\x2d[0-9]+px\x3b.+left\x3a\s*?\x2d[0-9]+px\x3b.+<iframe\x20.+?stack=\d+	2	0	0	1
+2546	2546	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)str2long(=sep)).+?(=sep)long2str(=sep)	2	0	0	1
+2547	2547	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)str2long(=sep)	2	0	0	1
+2548	2548	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)long2str(=sep)	2	0	0	1
+2549	2549	^([^>]*?\sname\s*?\x3d\s*?[\x22\x27]?movie[\x22\x27]?)[^>]*?\svalue\s*?\x3d\s*?[\x22\x27][^\x22\x27]+\/(\??[a-f0-9]+)?[\x22\x27]	2	0	0	1
+2550	2550	^Host\x3a[^\r\n]*?\.pw\r$/Hmi	2	0	0	1
+2551	2551	^Host\x3a\x20[a-z0-9]+\.(g[aq]|cf|ml|tk|xyz|info|space)(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+2552	2552	^\s*[a-z]+\s*\s*?(<q1>[\x22\x27])(((=q1)).)+?(=q1)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr\(\s*?\d+\s*?,\s*?\d+\s*?\)\s*?\x3b\s*?[a-z]+\s*\s*?(<q2>[\x22\x27])(((=q2)).)+?(=q2)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr	2	0	0	1
+2553	2553	^(<ccode>[a-f0-9]{6})-->.*?<script.+?<\/script>.*--/(=ccode)-->	2	0	0	1
+2554	2554	^\/[a-z]{2,20}\/[a-z]{2,20}\/(((featur|quot)e|ip)s|d(ropdown|etect)|co(mpiled|re)|header|jquery|lang|min|ga)\.js$	2	0	0	1
+2555	2555	^\s*?<script>\s*?([A-Za-z][A-Za-z\d+]+\s*?\+\s*([A-Za-z][A-Za-z\d]+|[\x22\x27]\\x[2-7][0-9a-fA-F](\\x[2-7][0-9a-fA-F]){0,4}[\x22\x27])\s*?\x3b){20}	2	0	0	1
+2556	2556	^\/js\/analytic\.php\?id=\d+&tz=\-?\d+&rs=\d+x\d+$	2	0	0	1
+2557	2557	^[\x22\x27](<script)[\x22\x27+\s]*<[\x22\x27+\s]*s[\x22\x27+\s]*c[\x22\x27+\s]*r[\x22\x27+\s]*i[\x22\x27+\s]*p[\x22\x27+\s]*t[^\r\n]+\.php\?id=\d+&tz=\x27\+tzSignature\x28\x29\+\x27&rs=	2	0	0	1
+2558	2558	^\/promo\d+(x\d+)?\/promo\.swf\?t=\d+$	2	0	0	1
+2559	2559	Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H	2	0	0	1
+2560	2560	^\s*\x28\s*[\x22\x27]<div\s*style\s*=\s*[\x22\x27]([^\x22\x27\r\n]*position\x3aabsolute\x3b)([^\x22\x27\r\n]*top\x3a\s\-\d+px\x3b)([^\x22\x27\r\n]*left\x3a\s0px\x3b)[^\r\n]*?<iframe[^\r\n>]*\s><\/i[\x22\x27]\+[\x22\x27]frame>[^\r\n]*<\/div>[\x22\x27]\s*\x29\x3b$	2	0	0	1
+2561	2561	^#?\d+	2	0	0	1
+2562	2562	^#?\d+	2	0	0	1
+2563	2563	^\s*var\s*(<var>[^\s=]+)\s*=\s*document.createElement\(\s*[\x22\x27]iframe[\x22\x27](.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b	2	0	0	1
+2564	2564	^\s*\([^\x29]*(\%2F|\/)(\%5B|\[)(\%5E|)([^\x29]*(%3C|\<))([^\x29]*(%3E|\>))([^\x29]*(\%5C|\\)(\%6E|n))	2	0	0	1
+2565	2565	^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27]	2	0	0	1
+2566	2566	^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Chrome_Font\.exe/Hmi	2	0	0	1
+2567	2567	^[^\x2f\x22\x27]+\/([^\x22\x27]*?[?&]oq=[A-Za-z0-9+\x2f_-]+([\x22\x27]|&))([^\x22\x27]*?[&?][a-z]+_[a-z]+=\d+)([^\x22\x27]*?[&?]q=)	2	0	0	1
+2568	2568	^\s*=\s*[\x27\x22](sh(ell(32)?)?|exec)=6wLrBej5\x2f\x2f	2	0	0	1
+2569	2569	(value=[\x22\x27](sh(ell(32)?)?|exec)=|unescape\(EscapeHexString\(.)EB02EB05E8F9FFFFFF	2	0	0	1
+2570	2570	^\s*=\s*[\x22\x27][Hh][Tt][Tt][Pp][Ss]?\x3a\x2f\x2f[^\x2f]+\x2f([^\x2f\x22\x27]+=[^\x2f\x22\x27&]{0,5}QMvXcJ)[^\x2f\x22\x27]{90}	2	0	0	1
+2571	2571	^(rocket|java)script\x22>\s*var\s*(<ifr>[^\s=]+)\s*=\s*[\x22\x27]iframe[\x22\x27].*?\s*var\s*(<var>[^\s=]+)\s*=\s*document\.createElement\(\s*(=ifr)(.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b	2	0	0	1
+2572	2572	^[a-z]\d{3}\(new Array\(	2	0	0	1
+2573	2573	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27]iddqd?\s*=	2	0	0	1
+2574	2574	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=]*\s*=EB02EB05E8F9FFFFFF	2	0	0	1
+2575	2575	^[a-zA-Z0-9]{4}NzgzNDI[a-zA-Z0-9]{8}=\x22	2	0	0	1
+2576	2576	^\d{1,2}\.php$	2	0	0	1
+2577	2577	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+2578	2578	^\/[a-z]+\/$	2	0	0	1
+2579	2579	^\/[a-z]+\/$	2	0	0	1
+2580	2580	^GET\s*?\/stat\/load((?-i)[a-z0-9]*?[A-Z])((?-i)[A-Z0-9]*?[a-z])(<hname>[a-z0-9]+)\.php\s.+?Host\x3a\x20(=hname)\.	2	0	0	1
+2581	2581	^[0-9a-fA-F]{25}$	2	0	0	1
+2582	2582	^[-_\w]+$	2	0	0	1
+2583	2583	\/[a-z]{2}[0-9]{3}[a-z]{2}\/LoginFacebook\.php$	2	0	0	1
+2584	2584	^\d+$	2	0	0	1
+2585	2585	\x2Fgetfile\x2Ephp\x3Fi\x3D[0-9]\x26key\x3D[a-f0-9]{32}$	2	0	0	1
+2586	2586	^\/[a-z]{15}[0-9]\.php$	2	0	0	1
+2587	2587	^\d$	2	0	0	1
+2588	2588	\/\?[a-f0-9]{32}=[^&]+&[a-f0-9]{32}=[^&]+$	2	0	0	1
+2589	2589	^\/\d{5}$	2	0	0	1
+2590	2590	\/[0-9]{2}\.html$	2	0	0	1
+2591	2591	\.php\?[a-z]=.{2}KAhFXlx9.{2}Oj[^&]+$	2	0	0	1
+2592	2592	\x2F[0-9]{3}\.pdf$	2	0	0	1
+2593	2593	^\d{1,2}=[a-zA-Z0-9+=]{100}	2	0	0	1
+2594	2594	^\/[a-z]\.jar$	2	0	0	1
+2595	2595	\/[a-f0-9]+\.zip$	2	0	0	1
+2596	2596	^\/\d{2,}\.[a-z0-9]+$	2	0	0	1
+2597	2597	^\/\?[a-f0-9]{32}$	2	0	0	1
+2598	2598	\/(java(db|im|rh)|silver|flash|msie)\.php\?id=	2	0	0	1
+2599	2599	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}\r\n<script>(var [a-zA-Z0-9]{1,20}\x3b){1,20}[a-zA-Z0-9]{1,20}\s*	2	0	0	1
+2600	2600	^Host\x3a\x20[^\.\r\n]+?\.[a-z]{2,4}\r\n	2	0	0	1
+2601	2601	\/\??[a-f0-9]{60,}\x3b1\d{5}\x3b\d{1,3}$	2	0	0	1
+2602	2602	\/\??[a-f0-9]{60,}\x3b5[0-1]\d{5}$	2	0	0	1
+2603	2603	^\/[^\x2f]+?\/\??[a-f0-9]{60,66}(\x3b\d+){1,4}$	2	0	0	1
+2604	2604	(\/[A-Z][a-z][A-Z][a-z][A-Z][a-z]|(b(m(nw|wn)|n(mw|wm)|w(mn|nm))|m(b(nw|wn)|n(bw|wb)|w(bn|nb))|n(b(mw|wm)|m(bw|wb)|w(bm|mb))|w(b(mn|nm)|m(bn|nb)|n(bm|mb))))\.jar$	2	0	0	1
+2605	2605	^\/index\.php\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+2606	2606	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.swf\r\n	2	0	0	1
+2607	2607	^\/\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+2608	2608	\x20filename=\r\n(\r\n)?$	2	0	0	1
+2609	2609	PK\x01\x02.{42}(<dir>[a-z]{7,}\/)([a-z]+\.class)?(\xfe\xca\x00\x00)?(PK\x01\x02.{42}(=dir)[a-z]+\.class){6,}(PK\x01\x02.{42}[0-9a-z]{5,}(\.[a-z]{3})?)K\x05\x06.{18}$	2	0	0	1
+2610	2610	^\/index\.php\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+2611	2611	\w_\.jar\?[a-f0-9]{8}$	2	0	0	1
+2612	2612	^\d+[\r\n\x2f]	2	0	0	1
+2613	2613	^\d+[\r\n\x2f]	2	0	0	1
+2614	2614	^\d+[\r\n\x2f]	2	0	0	1
+2615	2615	^\d+[\r\n\x2f]	2	0	0	1
+2616	2616	^\d+[\r\n\x2f]	2	0	0	1
+2617	2617	^\d+[\r\n\x2f]	2	0	0	1
+2618	2618	^\d+[\r\n\x2f]	2	0	0	1
+2619	2619	^\d+[\r\n\x2f]	2	0	0	1
+2620	2620	^\d+[\r\n\x2f]	2	0	0	1
+2621	2621	^\d+[\r\n\x2f]	2	0	0	1
+2622	2622	Content-Disposition\x3a[^\r\n]+\.exe-rc4\.exe\r\n	2	0	0	1
+2623	2623	^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/[a-zA-Z0-9]{12}\.php(\?[^&=]+=([a-zA-Z0-9]{8}|0(189|037)|flash|2(551|419)|6332))?$	2	0	0	1
+2624	2624	^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/test\.mp3$	2	0	0	1
+2625	2625	^\/\d{9,10}\/\d{4,5}$	2	0	0	1
+2626	2626	\/index\.html\?p=\d+$	2	0	0	1
+2627	2627	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?[a-f0-9]	2	0	0	1
+2628	2628	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a/Hmi	2	0	0	1
+2629	2629	^(<split>.{1,10})2f(=split)64(=split)69(=split)76(=split)3e(=split)?[^\x22\x27]*[\x22\x27]\.replace\s*\(\s*[\x22\x27]?\/(=split)\/g[\x22\x27]?\s*,\s*[\x22\x27]\x25[\x22\x27]\s*\x29\s*\x3b	2	0	0	1
+2630	2630	^\s*=\s*[\x22\x27]?(10|127|172\.(1[6-9]|2[0-9]|3[01])|192\.168)\.	2	0	0	1
+2631	2631	\.php\?hash=I3QxW[A-Za-z0-9\+\/]+={0,2}$	2	0	0	1
+2632	2632	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\/[a-zA-Z0-9\/\-\_]{60,}\/[a-zA-Z0-9]+\.exe\?[a-zA-Z0-9]+=[a-zA-Z0-9]+(&h=\d+)?[\x22\x27]	2	0	0	1
+2633	2633	^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27]	2	0	0	1
+2634	2634	^\s*type\s*=\s*[\x22\x27]\s*text\/javascript\s*[\x22\x27]\s*>\s+var\s*(<timestamp>[A-Za-z0-9]{1,25})\s*=\s*\(new\sDate\(\)\)\.getTime\(\)\;\s+(<url>[A-Za-z0-9]{1,25})\s*=\s*[\x22\x27]\s*[^\r\n]+\.php\?JBOSSESSION=\s*[\x22\x27]\s+(<urlvar2>[A-Za-z0-9]{1,25})\s*=\s*(=url)\s*\+\s*(=timestamp)\s+window\.location\.href\s*=\s*(=urlvar2)\s+	2	0	0	1
+2635	2635	^\s*[\x22\x27][^\r\n]+\/[a-z0-9]{20,40}\.js[\x22\x27]\s*>\s*<\/script>\s*<\/body>	2	0	0	1
+2636	2636	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+2637	2637	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+2638	2638	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+2639	2639	^http\:\/\/[^\r\n\x2f]+\/\?s=[a-f0-9]{32}[a-z]{2}$	2	0	0	1
+2640	2640	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+2641	2641	^(<vars>[a-z0-9]{1,20})\s*=\s*new\s*Array\x3b\r\n((=vars)\[\d{1,3}\]\s*=\s*\d{4,12}\x3b\r\n){5,40}	2	0	0	1
+2642	2642	^\/([\/_]*?[a-f0-9][\/_]*?){64}$	2	0	0	1
+2643	2643	src\s*=\s*https?\x3A\x2f+[^\x2f]*?((((static)?flick|blogge)r|p(hotobucket|icasa)|wordpress|tinypic)\.com|im(g(\.youtube|ur)\.com|ageshack\.us)|upload\.wikimedia\.org)[^\x2f]	2	0	0	1
+2644	2644	^[a-f0-9]{32}$	2	0	0	1
+2645	2645	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/	2	0	0	1
+2646	2646	[=\"]\w{8}\.jar	2	0	0	1
+2647	2647	^[a-z]{2}\.	2	0	0	1
+2648	2648	\/jdb\/[^\/]+\.class$	2	0	0	1
+2649	2649	\/lib\/adobe\.php\?id=[a-f0-9]{32}$	2	0	0	1
+2650	2650	\/i.php?token=[a-z0-9]+$	2	0	0	1
+2651	2651	\x2Fjerk\x2Ecgi\x3F[0-9]$	2	0	0	1
+2652	2652	^(\?[^=]{1,10}=[^&\r\n]{100,})?$	2	0	0	1
+2653	2653	\.php\?e=[^&]+?$	2	0	0	1
+2654	2654	\.txt\?e=\d+(&[fh]=\d+)?$	2	0	0	1
+2655	2655	^\x2F\x3Fwps\x3D[0-9]$	2	0	0	1
+2656	2656	^[^\r\n]+\/[A-Fa-f0-9]+\.js\?cp=	2	0	0	1
+2657	2657	^\/[a-z0-9]{1,4}\.jnlp$	2	0	0	1
+2658	2658	\.php\?id=[a-f0-9]{32}$	2	0	0	1
+2659	2659	^\/[a-f0-9]{32}\/[a-f0-9]{32}\.swf$	2	0	0	1
+2660	2660	\.php\?[^=]+=([^&]?[a-z0-9]{2}){5}&[^=]+=([^&]?[a-z0-9]{2}){10}&	2	0	0	1
+2661	2661	\/[A-F0-9]{8}\.js\?cp=	2	0	0	1
+2662	2662	^\/[a-z0-9]+[0-9][a-z0-9]+\/\?\d$	2	0	0	1
+2663	2663	\.exe(\?[a-zA-Z0-9]+=[a-zA-Z0-9]+)?&h=\d+$	2	0	0	1
+2664	2664	^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$	2	0	0	1
+2665	2665	^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$	2	0	0	1
+2666	2666	\/\d{6}\.mp3$	2	0	0	1
+2667	2667	\/14\d{8}(\.xap)?$	2	0	0	1
+2668	2668	\.swf\?myid=[a-zA-Z0-9]+$	2	0	0	1
+2669	2669	\.php\?rnd=[0-9]{3,7}&id=[0-9A-F]{44,54}$	2	0	0	1
+2670	2670	\/(Flash[23]?|Ink|New|One|HQ).exe$	2	0	0	1
+2671	2671	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.xap\r\n	2	0	0	1
+2672	2672	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?[^\r\n]*?\/(index.html)?\r\n.*?\r\nHost\x3a\x20(=refhost)[\x3a\r]	2	0	0	1
+2673	2673	\/\d{2,}\.xap$	2	0	0	1
+2674	2674	\.php\?rnd=\d+&id=[0-9A-F]{32,}$	2	0	0	1
+2675	2675	\/\?keyword=(([a-f]{0,31}[0-9])([0-9]{0,31}[a-f])[a-f0-9]{32}|\d{5})$	2	0	0	1
+2676	2676	^\/(.*?[&?][a-z]{2}_[a-z]{2}=\d+(&))(.*?[&?]q=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&))(.*?[&?]oq=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&)).*?[&?][a-z]{3}=[A-Za-z_]{3,20}([a-z\d]*\x2e)([a-z\x2e]*\d)[a-z\d\x2e]+(&|$)	2	0	0	1
+2677	2677	^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Font_Update\.exe	2	0	0	1
+2678	2678	^\s*[\x22\x27]\s*http[^\x22\x27]+\.php\s*[\x22\x27]\s*\x2c\s*[\x22\x27]\s*uylzJB3mWrFjellI9iDFGQjO	2	0	0	1
+2679	2679	=[a-f0-9]{32,}(&|$)	2	0	0	1
+2680	2680	\&e=(cve|flash)	2	0	0	1
+2681	2681	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.htm$	2	0	0	1
+2682	2682	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.swf$	2	0	0	1
+2683	2683	^(0x[a-f0-9]{1,2}, ){500}	2	0	0	1
+2684	2684	^[0-9_,{AbZwP&-]{2000}	2	0	0	1
+2685	2685	^[A-F0-9]+	2	0	0	1
+2686	2686	^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_	2	0	0	1
+2687	2687	^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_	2	0	0	1
+2688	2688	^[a-z0-9]{13}\.[a-z]{3}$	2	0	0	1
+2689	2689	^\d+$	2	0	0	1
+2690	2690	Host\x3a\x20(<refhost>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f(=refhost)(\x3a\d{1,5})?\/?	2	0	0	1
+2691	2691	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\r$|\x3a)	2	0	0	1
+2692	2692	^\/[a-z]{3,20}\.php\?sid=[A-F0-9]{40,200}$	2	0	0	1
+2693	2693	^\/[a-z]{3,20}\.php\?id=4[A-F0-9]{39,200}$	2	0	0	1
+2694	2694	^\/\?o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+$	2	0	0	1
+2695	2695	(.*?[?&]oq=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&)).*?[?&]q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$)	2	0	0	1
+2696	2696	(.*[^&]{3,4}QMvXcJ).*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&.*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$)	2	0	0	1
+2697	2697	^[HX3][^&]Q[cdM][^&]{3}[ab]R	2	0	0	1
+2698	2698	^\/\?[a-f0-9]{114}$	2	0	0	1
+2699	2699	Date\x3a\x20(<dstring>[^\r\n]+)\r\n.*?Last-Modified\x3a\x20(=dstring)\r\n	2	0	0	1
+2700	2700	^\/[a-f0-9]{16}$	2	0	0	1
+2701	2701	^GET (<uri>(\/[A-Za-z0-9]+)?\/\d+\/\d+)\sHTTP\/1\.1\r\nUser-Agent\x3a\x20http\x3a\/\/(<host>[^\r\n]+)(=uri)\r\nHost\x3a\x20(=host)\r\n(\r\n)?$	2	0	0	1
+2702	2702	^Referer\x3a[^\r\n]+?\/[a-z0-9A-Z\_\-]{26,}\.html(\x3a\d{1,5})?\r$	2	0	0	1
+2703	2703	\/3\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+|\/\d+\.\d+\.\d+\.\d+\/?)?$	2	0	0	1
+2704	2704	^\/([A-Za-z_-]*?\d)([a-z0-9_-]*?[A-Z])([A-Za-z0-9_-]{4}){15,}([[A-Za-z0-9_-]{2}\x2e?\x2e|[A-Za-z0-9_-]{3}\x2e)$	2	0	0	1
+2705	2705	^\d$	2	0	0	1
+2706	2706	^[A-F0-9]{16}\x22>	2	0	0	1
+2707	2707	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-zA-Z0-9]{16}\/[a-f0-9]{40}\/[a-zA-Z0-9]+\.jpg$	2	0	0	1
+2708	2708	^[A-F0-9]{16}(&|&amp\x3b)id=\d+(&|&amp\x3b)gid=[A-F0-9\-]+\x22>	2	0	0	1
+2709	2709	^[^>]*?\>	2	0	0	1
+2710	2710	^-?\d+=([a-zA-Z0-9]|%[A-F0-9]{2}){2}(<var1>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){6}(<var2>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){2}(=var2)([a-zA-Z0-9]|%[A-F0-9]{2}){4}(=var1)/P	2	0	0	1
+2711	2711	^\s*?[\x22\x27]([A-Z]{0,19}[a-z]{1,19}[A-Z])[a-zA-Z]{14,20}[\x22\x27][^<>]*([A-Za-z]{0,99}\d)[A-Za-z0-9\x20]{100}	2	0	0	1
+2712	2712	^\s*?(<var1>[^\x29]+)\x29[^\n]*\s*?(=var1)\s*?\x7c{2}\s*?\d+?\s*?\x2c	2	0	0	1
+2713	2713	^\s+\d{1,2}\x3b\s+else\s+(<var>[a-z]+)\s+\-=\s+\d{1,2}\x3b\s+return\s+[a-z]+\.charAt\x28(=var)\/\d{1,2}\x29\x7d	2	0	0	1
+2714	2714	^[a-z0-9_-]+\.([0-9_-]*[A-Z])[A-Z0-9_-]+\.[^\x22]+\x22\s	2	0	0	1
+2715	2715	^[a-z]{10}\.[a-z]{3}\r?$/Hm	2	0	0	1
+2716	2716	Last-Modified\x3a Mon, ((0[29]|16|23|30))\d{2} Jul 2001/H	2	0	0	1
+2717	2717	^\d+\x3b	2	0	0	1
+2718	2718	^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500}	2	0	0	1
+2719	2719	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+2720	2720	^[^\x27]+[\x27]\s*	2	0	0	1
+2721	2721	^\d+\x3b	2	0	0	1
+2722	2722	^([A-Z0-9]*?[a-z])([a-z0-9]*?[A-Z])[A-Za-z0-9]+\x2a\x2f[^\n]*?Function\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28\s*?(=var1)\s*[=!]{2}\s*?[\x27\x22][\x22\x27]\s*?\x29\s*?\{	2	0	0	1
+2723	2723	^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500}	2	0	0	1
+2724	2724	^\s*\x27[^\x27\x3b\r\n]+\x27width=\x27250\x27\sheight=\x27250\x27\>	2	0	0	1
+2725	2725	^[^A-Za-z0-9]	2	0	0	1
+2726	2726	^http\x3a\x2f[^\x27]+[\x27](\swidth=\d{1,2}\sheight=\d{1,2}\s|\sheight=\d{1,2}\swidth=\d{1,2}\s)	2	0	0	1
+2727	2727	^\s*\(\s*[\x22\x27]id[\x22\x27]\s*,\s*?(<var>[^,\x29\s\x3b]+)\s*\x29.*?\.appendChild\s*\(\s*(=var)	2	0	0	1
+2728	2728	^[^<]+\x0d\x0a<\/script>	2	0	0	1
+2729	2729	\?src=[a-z]+snet$	2	0	0	1
+2730	2730	^[0-9a-f]{6}	2	0	0	1
+2731	2731	^(\x20id=\x22\d+\x22)?\x20style=\x22([^\x22\r\n]*top\x3a\x20-\d{3}px\x3b)([^\x22\r\n]*left\x3a-\d{3}px\x3b)([^\x22\r\n]*position\x3a\x20absolute\x3b)[^\x22\r\n]*\x22>\x20<iframe[^\r\n>]*><\x2f	2	0	0	1
+2732	2732	^(\s+style=\x27hidden\x27)?\s+src=\x27https?\x3a[^>\x22\x27]+[\x22\x27]\s*width=\x270\x27\s+	2	0	0	1
+2733	2733	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+2734	2734	^[^\d](.{0,20}[^\d])?100[^\d](.{0,20}[^\d])?101[^\d](.{0,20}[^\d])?102[^\d](.{0,20}[^\d])?97[^\d](.{0,20}[^\d])?117[^\d](.{1,20}[^\d])?108[^\d](.{0,20}[^\d])?116[^\d](.{0,20}[^\d])?35[^\d]([^\d].{0,20}[^\d])?86[^\d](.{0,20}[^\d])?77[^\d](.{0,20}[^\d])?76[^\d]	2	0	0	1
+2735	2735	^(<sep>((\.\\_\\+).){1,10})\.\\_\\+(=sep)\.___\+(=sep)\.\\\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\_\\_\+(=sep)\.\_\\\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\\+(=sep)\.\_\_\$	2	0	0	1
+2736	2736	^[\r\n\s]*[\r\n\s]*?(-[\r\n\s]*?\d|0[\r\n\s]*?-)	2	0	0	1
+2737	2737	SELECT.+FROM	2	0	0	1
+2738	2738	DELETE.+FROM	2	0	0	1
+2739	2739	INSERT.+INTO	2	0	0	1
+2740	2740	UPDATE.+SET	2	0	0	1
+2741	2741	UNION.+SELECT	2	0	0	1
+2742	2742	INTO.+OUTFILE	2	0	0	1
+2743	2743	^SITE\s+EXEC\s[^\n]*?%[^\n]*?%	2	0	0	1
+2744	2744	^PASS\s[^\n]{100}	2	0	0	1
+2745	2745	^MKD\s[^\n]{100}	2	0	0	1
+2746	2746	^REST\s[^\n]{100}	2	0	0	1
+2747	2747	^DELE\s[^\n]{100}	2	0	0	1
+2748	2748	^RMD\s[^\n]{100}	2	0	0	1
+2749	2749	^RMDIR\s[^\n]{100}	2	0	0	1
+2750	2750	^SITE\s+NEWER\s[^\n]{100}	2	0	0	1
+2751	2751	^SITE\s+ZIPCHK\s[^\n]{100}	2	0	0	1
+2752	2752	^USER\s+w0rm	2	0	0	1
+2753	2753	^ALLO\s[^\n]{100}	2	0	0	1
+2754	2754	^CEL\s[^\n]{100}	2	0	0	1
+2755	2755	^CMD\s[^\n]{100}	2	0	0	1
+2756	2756	^CWD\s[^\n]{100}	2	0	0	1
+2757	2757	^SITE\s+CPWD\s[^\n]{100}	2	0	0	1
+2758	2758	^SITE\s+NEWER	2	0	0	1
+2759	2759	^STAT\s+[^\n]*\x3f	2	0	0	1
+2760	2760	^APPE\s[^\n]{100}	2	0	0	1
+2761	2761	^CWD\s+~	2	0	0	1
+2762	2762	^MODE\s+[^ABSC]{1}	2	0	0	1
+2763	2763	^SITE\s[^\n]{100}	2	0	0	1
+2764	2764	^SITE\s+CHOWN\s[^\n]{100}	2	0	0	1
+2765	2765	^SITE\s+EXEC	2	0	0	1
+2766	2766	^XCWD\s[^\n]{100}	2	0	0	1
+2767	2767	^STOR\s[^\n]{100}	2	0	0	1
+2768	2768	^SITE\s+CHMOD\s[^\n]{100}	2	0	0	1
+2769	2769	^LIST\s[^\n]{100,}	2	0	0	1
+2770	2770	^RENAME\s[^\n]*?%[^\n]*?%	2	0	0	1
+2771	2771	^MKDIR\s[^\n]*?%[^\n]*?%	2	0	0	1
+2772	2772	^PASS\s[^\n]*?%[^\n]*?%	2	0	0	1
+2773	2773	^USER\s[^\n]*?%[^\n]*?%	2	0	0	1
+2774	2774	^MDTM\s[^\n]{100}	2	0	0	1
+2775	2775	^RETR\s[^\n]*?%[^\n]*?%	2	0	0	1
+2776	2776	^CWD\s[^\n]*?\.\.\.	2	0	0	1
+2777	2777	^CWD\s+~root	2	0	0	1
+2778	2778	^NLST\s[^\n]{100}	2	0	0	1
+2779	2779	^PORT	2	0	0	1
+2780	2780	REST\s+[0-9]+\n	2	0	0	1
+2781	2781	^RETR\s[^\n]{100}	2	0	0	1
+2782	2782	^RNFR\s[^\n]{100}	2	0	0	1
+2783	2783	^RNTO\s[^\n]{100}	2	0	0	1
+2784	2784	^STAT\s[^\n]{100}	2	0	0	1
+2785	2785	^STOU\s[^\n]{100}	2	0	0	1
+2786	2786	^XMKD\s[^\n]{100}	2	0	0	1
+2787	2787	\s+.*?%.*?%	2	0	0	1
+2788	2788	^530\s+(Login|User)	2	0	0	1
+2789	2789	^PASS\s*\n	2	0	0	1
+2790	2790	^LIST\s+\x22-W\s+\d	2	0	0	1
+2791	2791	^USER\x20[^\x00\x20\x0a\x0d]{100}	2	0	0	1
+2792	2792	^STAT\s+[^\n]*\x2a	2	0	0	1
+2793	2793	^MDTM \d+[-+]\D	2	0	0	1
+2794	2794	^[^\r\n]+\.jar	2	0	0	1
+2795	2795	^\d\.\d(_\d+)?\@\r\n	2	0	0	1
+2796	2796	\x5csecure\x5c[^\x00]{50}	2	0	0	1
+2797	2797	\x5C[^\x5C\x00]{257}	2	0	0	1
+2798	2798	^\s*=\s*.*?\.([abcdehijlmnoprsvwx])(a(d[ep]|s[x])|c(rt|[ho]m|li|pl|md|pp)|d(iz|ll)|e(m[fl]|xe|bs)|h(lp|sq|ta)|jse?|m(d[abzew]|s[tcgip]|htm|ht)|p(cd|if|l[xsc]|[lm]|ot)|r(eg|ar)|s(cr|ct|[hy]s|wf)|v(b[es]?|xd)|w(m[dfsz]|p[msz]|s[cfh])|xl[tw]|folder|fol|ba[st]|i(sp|n[sif])|lnk|nws|ocx|zip|url)[\x27\x22\n\r\s]	2	0	0	1
+2799	2799	(a|#61)(p|#70)(p|#70)(l|#6C)(i|#69)(c|#63)(a|#61)(t|#74)(i|#69)(o|#6F)(n|#6E)(\x2F|#2F)x-shockwave-flash	2	0	0	1
+2800	2800	^[^\r\n]*[\[\|\{][A-Z]{3}[\]\|\}]	2	0	0	1
+2801	2801	^[^\r\n]*win	2	0	0	1
+2802	2802	^[^\r\n]*-PC	2	0	0	1
+2803	2803	^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl)	2	0	0	1
+2804	2804	^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl)	2	0	0	1
+2805	2805	^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb)	2	0	0	1
+2806	2806	^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb)	2	0	0	1
+2807	2807	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3)	2	0	0	1
+2808	2808	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3)	2	0	0	1
+2809	2809	User-Agent\x3a.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi	2	0	0	1
+2810	2810	User-Agent\:.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi	2	0	0	1
+2811	2811	^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}B[\x0d\x0a]{0,2}0[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}t[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}u[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}3[\x0d\x0a]{0,2}M[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}x[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}T[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}q[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}N[\x0d\x0a]{0,2}0	2	0	0	1
+2812	2812	^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}Q[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}1[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}5[\x0d\x0a]{0,2}n[\x0d\x0a]{0,2}c[\x0d\x0a]{0,2}y[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}P[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}3	2	0	0	1
+2813	2813	^[A-Za-z0-9\/\+\x0D\x0A]+?B[\x0d\x0a]{0,2}w[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}C[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}z[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}s[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}U[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}j[\x0d\x0a]{0,2}d	2	0	0	1
+2814	2814	\d*?\.bin	2	0	0	1
+2815	2815	^[^\r\n]*(W(in(dows)?)?[^a-z0-9]?(XP|[7-8])|Vista)	2	0	0	1
+2816	2816	^\d+/V	2	0	0	1
+2817	2817	^\s*,\s*[a-zA-Z]\x3a[\x2f\x5c]	2	0	0	1
+2818	2818	^((PK).)*?\x50\x4b\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00	2	0	0	1
+2819	2819	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+2820	2820	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+2821	2821	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+2822	2822	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+2823	2823	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+2824	2824	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+2825	2825	\bshell\b	2	0	0	1
+2826	2826	\benable\b	2	0	0	1
+2827	2827	^[^\r\n]+\.(t(ar|gz)|exe|zip)	2	0	0	1
+2828	2828	^([\x7f-\xff]){100}/Hi	2	0	0	1
+2829	2829	^((<\/script>).)*?src\s*=\s*\x5c?[\x22\x27]https?\x3a\/\/(www\.)?pastebin\.com\/raw(\/|\.php\?i=)[A-Z-a-z0-9]{8}[\x22\x27]	2	0	0	1
+2830	2830	^.{42}[\x20-\x7f]{1,500}\.jsPK\x05\x06.{4}\x01\x00\x01\x00	2	0	0	1
+2831	2831	\/[0-9]{1,2}\.dat$	2	0	0	1
+2832	2832	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+2833	2833	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+2834	2834	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+2835	2835	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+2836	2836	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+2837	2837	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+2838	2838	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+2839	2839	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+2840	2840	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+2841	2841	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+2842	2842	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+2843	2843	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+2844	2844	Content-Disposition\x3a[^\r\n]*?\.xla[\s\x22\x27]	2	0	0	1
+2845	2845	\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)(\x3a\d{1,5})?$	2	0	0	1
+2846	2846	^[\d\s]	2	0	0	1
+2847	2847	^USER [^\r\n]*?\x22	2	0	0	1
+2848	2848	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+2849	2849	^(\x3a\d{1,5})?$	2	0	0	1
+2850	2850	\.(gif|jpe?g|png)$	2	0	0	1
+2851	2851	^((jp|pn)g|bmp)	2	0	0	1
+2852	2852	^(logins|c(cdata|ookie))	2	0	0	1
+2853	2853	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+2854	2854	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+2855	2855	\/winhost(32|64)\.(exe|pack)$	2	0	0	1
+2856	2856	\/pony\.(exe|pack)$	2	0	0	1
+2857	2857	^[^>]+url=sms\x3a	2	0	0	1
+2858	2858	\/[^\x2f]+\.[^\x2f]+\.wsf$	2	0	0	1
+2859	2859	^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4})	2	0	0	1
+2860	2860	^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4})	2	0	0	1
+2861	2861	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+2862	2862	^[^\r\n]+\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)	2	0	0	1
+2863	2863	^((jp|pn)g|bmp)	2	0	0	1
+2864	2864	^(logins|c(cdata|ookie))	2	0	0	1
+2865	2865	^(m(ultipart|essage|odel)|a(pplication|udio|ccept)|(exampl|imag)e|video|text|\*)	2	0	0	1
+2866	2866	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+2867	2867	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+2868	2868	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+2869	2869	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+2870	2870	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+2871	2871	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+2872	2872	^[a-f0-9]{8,}\.duckdns\.org$	2	0	0	1
+2873	2873	^[^\x3b\x2f\x28]+$	2	0	0	1
+2874	2874	^[^\r\n]{100,}	2	0	0	1
+2875	2875	^[^\r\n]{100,}	2	0	0	1
+2876	2876	^[^\r\n]{100,}	2	0	0	1
+2877	2877	^[^\r\n]{100,}	2	0	0	1
+2878	2878	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+2879	2879	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2880	2880	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2881	2881	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2882	2882	[a-z]{8}.[a-z]{3}	2	0	0	1
+2883	2883	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.zip$	2	0	0	1
+2884	2884	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.vbs$	2	0	0	1
+2885	2885	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.pif$	2	0	0	1
+2886	2886	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.exe$	2	0	0	1
+2887	2887	CN=ssl\d{1,2}.ovh.net($|,)	2	0	0	1
+2888	2888	(\.[a-z]{2}|$)	2	0	0	1
+2889	2889	[a-f0-9]{32}$	2	0	0	1
+2890	2890	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P	2	0	0	1
+2891	2891	^(\x3b|\r\n)	2	0	0	1
+2892	2892	CN=([^\r\n]+?\.)?\.gov\.procurement\.(\.)	2	0	0	1
+2893	2893	^[a-f0-9]+	2	0	0	1
+2894	2894	^[a-f0-9]+	2	0	0	1
+2895	2895	^[a-f0-9]+	2	0	0	1
+2896	2896	^Agent\d{5,6}$	2	0	0	1
+2897	2897	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2898	2898	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2899	2899	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2900	2900	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2901	2901	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2902	2902	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2903	2903	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2904	2904	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2905	2905	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2906	2906	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2907	2907	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2908	2908	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2909	2909	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2910	2910	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2911	2911	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2912	2912	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2913	2913	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2914	2914	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2915	2915	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2916	2916	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2917	2917	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2918	2918	.*[^A-Za-z0-9]edu\.rf\.gd$	2	0	0	1
+2919	2919	\x2edoc[xm]?$	2	0	0	1
+2920	2920	\x2exls[xm]?$	2	0	0	1
+2921	2921	\/\d+$	2	0	0	1
+2922	2922	function(\s_0x[0-9a-f]{4})?\(_0x[0-9a-f]{6},_0x[0-9a-f]{6}\){var _0x[0-9a-f]{6}=/Qi	2	0	0	1
+2923	2923	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2924	2924	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2925	2925	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2926	2926	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2927	2927	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2928	2928	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2929	2929	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2930	2930	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2931	2931	\sLOGIN\s[^\n]*?\s\{	2	0	0	1
+2932	2932	\sLSUB\s[^\n]*?\s\{	2	0	0	1
+2933	2933	\sRENAME\s[^\n]{100}	2	0	0	1
+2934	2934	\sFIND\s[^\n]{100}	2	0	0	1
+2935	2935	\sFETCH\s[^\n]{500}	2	0	0	1
+2936	2936	\sLOGIN\s[^\n]{100}	2	0	0	1
+2937	2937	\sAUTHENTICATE\s[^\n]{100}	2	0	0	1
+2938	2938	\sLIST\s[^\n]*?\s\{	2	0	0	1
+2939	2939	\sPARTIAL.*BODY\[[^\]]{1024}	2	0	0	1
+2940	2940	AUTH\s[^\n]{100}	2	0	0	1
+2941	2941	\sCREATE\s*\{	2	0	0	1
+2942	2942	\sRENAME\s[^\n]*?\s\{	2	0	0	1
+2943	2943	\sLIST\s[^\n]{100}	2	0	0	1
+2944	2944	\sCREATE\s[^\n]{1024}	2	0	0	1
+2945	2945	\sLSUB\s[^\n]{100}	2	0	0	1
+2946	2946	\sAUTHENTICATE\s[^\n]*?\{	2	0	0	1
+2947	2947	\sPARTIAL.*BODY\.PEEK\[[^\]]{1024}	2	0	0	1
+2948	2948	\sUNSUBSCRIBE\s[^\n]{100}	2	0	0	1
+2949	2949	\sUNSUBSCRIBE\s[^\n]*?\s\{	2	0	0	1
+2950	2950	\sSUBSCRIBE\s[^\n]{100}	2	0	0	1
+2951	2951	\sSUBSCRIBE\s[^\n]*?\s\{	2	0	0	1
+2952	2952	\sSTATUS\s[^\n]{100}	2	0	0	1
+2953	2953	\sSTATUS\s[^\n]*?\s\{	2	0	0	1
+2954	2954	\sFETCH\s[^\n]*?\s\{	2	0	0	1
+2955	2955	\sEXAMINE\s[^\n]{100}	2	0	0	1
+2956	2956	\sEXAMINE\s[^\n]*?\s\{	2	0	0	1
+2957	2957	\sAPPEND\s[^\n]{256}	2	0	0	1
+2958	2958	\sCOPY\s[^\n]*?\{	2	0	0	1
+2959	2959	\sDELETE\s[^\n]*?\{	2	0	0	1
+2960	2960	\sDELETE\s[^\n]{100}	2	0	0	1
+2961	2961	\sLOGIN\s\w+\s\{\d+\}[\r]?\n[^\n]*?%	2	0	0	1
+2962	2962	 (FREE XXX|dildo|masturbat|oral sex|ejaculat|up skirt|tits|bondage|lolita|clitoris|cock suck|hardcore (teen|anal|sex|porn)|raw sex|((fuck|sex|porn|xxx) (movies|dvd))|((naked|nude) (celeb|lesbian)))\b	2	0	0	1
+2963	2963	^RETR\s+[^\r\n]+?\x2eexe\r?$	2	0	0	1
+2964	2964	\<xdp\x3axdp(\s+[^\>]*)?\>((\<\/xdp[^\>]*\>).)*?\<pdf	2	0	0	1
+2965	2965	SELECT @@version_compile_os\s*?\x3b	2	0	0	1
+2966	2966	^Server\x3a[^\r\n]*Portable SDK for UPnP devices(\/?\s*$|\/1\.([0-5]\..|8\.0.|(6\.[0-9]|6\.1[0-7])))	2	0	0	1
+2967	2967	^Server\x3a[^\r\n]*Intel SDK for UPnP devices	2	0	0	1
+2968	2968	^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27]	2	0	0	1
+2969	2969	^[8-9]\.0	2	0	0	1
+2970	2970	^(<global_var>(((\]\,__\\x3a\+\+)).)+)]\,__\$\x3a\+\+(=global_var)	2	0	0	1
+2971	2971	^Host\x3a\x20[^\r\n]+\.((b(bsindex|0ne)|chatnook|gotgeeks|3d-game|4irc)\.com|s((cieron|uroot)\.com|lyip\.(com|net))|d(arktech\.org|eaftone\.com|tdns\.net)|e(towns\.(net|org)|ffers\.com)|flnet\.org)(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+2972	2972	^Host\x3a\x20[^\r\n]+\.cd\.am(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+2973	2973	^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}[^\r\n]*\x3C\x2Fiframe\x3E	2	0	0	1
+2974	2974	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2975	2975	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2976	2976	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2977	2977	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2978	2978	^(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?m(\x22\s*?\+\s*?\x22)?C(\x22\s*?\+\s*?\x22)?h(\x22\s*?\+\s*?\x22)?a(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?c(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?d(\x22\s*?\+\s*?\x22)?e	2	0	0	1
+2979	2979	^(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?m(\x27\s*?\+\s*?\x27)?C(\x27\s*?\+\s*?\x27)?h(\x27\s*?\+\s*?\x27)?a(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?c(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?d(\x27\s*?\+\s*?\x27)?e	2	0	0	1
+2980	2980	for\x28[^\x3D\r\n]*[0-9]{1,6}\x2D[0-9]{1,5}\x3B[^\x3D\r\n]\x3E\x3D0\x3B[^\x29\r\n]\x2D\x2D\x29	2	0	0	1
+2981	2981	^User-Agent\x3a[^\r\n]*?Googlebot/Hmi	2	0	0	1
+2982	2982	^\s*?\([^\)]*?(<var>[^\.]+)\s*?\.\s*?length\s*<\s*(0?[0-9]{5,}|0x[a-z0-9]{3,})[^)]+\)\s*?\{\s*?(=var)\s*\s*?(=var)\s*?\+\s*?(=var)\s*?\}	2	0	0	1
+2983	2983	^(nc)?\s*([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=)	2	0	0	1
+2984	2984	\x00[0-9]{4,7}\x02in\x00	2	0	0	1
+2985	2985	^Server\x3a[^\r\n]*miniupnpd\/1\.[0-3]	2	0	0	1
+2986	2986	^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27]	2	0	0	1
+2987	2987	^\s+?(<vname>[^\s\x3d]+)\s*\s*?(0x((6[4-9a-f]|[7-9a-f])|\d{3,})|\d{3,}).+?[\s\x3b]for\s*?\([^\x3b\)]*?\x3b[^\x3b\)]+?\s*?(=vname)[^\)]+?\)\s*?(\{[^}]*?|[^\r\n]*?)document\s*\.\s*createElement	2	0	0	1
+2988	2988	^((<\/title).)*\x26\x23x1F512	2	0	0	1
+2989	2989	^\/tmp\/.+\.exe$	2	0	0	1
+2990	2990	^(&).	2	0	0	1
+2991	2991	((\?|&))pasa=(&).	2	0	0	1
+2992	2992	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp)\.com|m(inecraft\.net|p3\.com)|b(eer\.com|log\.net))|curity(exploit|tactic)s\.com)|tufftoread\.com|ytes\.net)|m(y(((dissen|effec)t|mediapc|psx)\.net|securitycamera\.(com|net|org)|(activedirectory|vnc)\.com|ftp\.(biz|org))|lbfan\.org|mafan\.biz)|d((itchyourip|amnserver|ynns)\.com|dns(\.(net|me)|king\.com)|ns(iskinky\.com|for\.me)|vrcam\.info)|n(o(-ip\.(c(o\.uk|a)|info|biz|net|org)|ip\.(me|us))|et-freaks\.com|flfan\.org|hlfan\.net)|h(o(mesecurity(ma|p)c\.com|pto\.(org|me))|ealth-carereform\.com)|p((rivatizehealthinsurance|gafan)\.net|oint(2this\.com|to\.us))|c((o(uchpotatofries|llegefan)|able-modem)\.org|iscofreak\.com)|g(o(lffan\.us|tdns\.ch)|eekgalaxy\.com)|b(logsyte\.com|ounceme\.net|rasilia\.me)|re(ad-books\.org|directme\.net)|u(nusualperson\.com|fcfan\.org)|w(orkisboring\.com|ebhop\.me)|(3utiliti|quicksyt)es\.com|eating-organic\.net|ilovecollege\.info|fantasyleague\.cc|loginto\.me|zapto\.org)(\x3a\d{1,5})?$	2	0	0	1
+2993	2993	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+2994	2994	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+2995	2995	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+2996	2996	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+2997	2997	^(\d{1,3}\.){3}\d{1,3}(\x3a\d+)?$	2	0	0	1
+2998	2998	\.jpg(\?\d+)?$	2	0	0	1
+2999	2999	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3000	3000	^[^0-9]	2	0	0	1
+3001	3001	^(\x3a\d{1,5})?$	2	0	0	1
+3002	3002	\.(arm(5n|7)?|m(ips|psl))$	2	0	0	1
+3003	3003	\.dyndns\.(biz|info|org|tv)$	2	0	0	1
+3004	3004	(at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work)\.com	2	0	0	1
+3005	3005	^[^&=?]*\/wp-content\/themes\/	2	0	0	1
+3006	3006	^(\x3a\d{1,5})?$	2	0	0	1
+3007	3007	^\x22(v(mware|irtual|irtualbox|m\x20ware|box))	2	0	0	1
+3008	3008	^\x22(v(mware|irtual|irtualbox|m\x20ware|box))	2	0	0	1
+3009	3009	^\x22(v(mware|irtual|irtualbox|m\x20ware|box))	2	0	0	1
+3010	3010	^[a-z0-9.]+\.kali\.org	2	0	0	1
+3011	3011	\.(d(ns(d(ynamic\.(com|net)|\.(info|me))|api\.info|get\.org|53\.biz)|dns01\.com)|(f(lashserv|e100|tp21)|adultdns|mysq1|wow64)\.net|((ima|voi)p01|(user|ole)32|kadm5)\.com|t(tl60\.(com|org)|empors\.com|ftpd\.net)|s(sh(01\.com|22\.net)|ql01\.com)|http((s443|01)\.com|80\.info)|n(s360\.info|tdll\.net)|x(ns01\.com|64\.me)|craftx\.biz)(\x3a\d{1,5})?$	2	0	0	1
+3012	3012	\.(i(s(-(a(-(((h(ard-work|unt)e|financialadviso)r|d(e(mocrat|signer)|octor)|t(e(acher|chie)|herapist)|r(epublican|ockstar)|n(ascarfan|urse)|anarchist|musician)\.com|c(((ubicle-sla|onservati)ve|pa)\.com|a(ndidate\.org|terer\.com)|hef\.(com|net|org)|elticsfan\.org)|l(i(ber(tarian|al)\.com|nux-user\.org)|(a(ndscap|wy)er|lama)\.com)|p((ersonaltrain|hotograph|lay)er\.com|a(inter\.com|tsfan\.org))|b(((ookkeep|logg)er|ulls-fan)\.com|ruinsfan\.org)|s(o(cialist\.com|xfan\.org)|tudent\.com)|g(eek\.(com|net|org)|(reen|uru)\.com)|knight\.org)|n-(a(c(t(ress|or)|countant)|(narch|rt)ist)|en(tertain|gine)er)\.com)|(into-((car(toon)?|game)s|anime)|((not-)?certifie|with-theban)d|uberleet|gone)\.com|(very-((goo|ba)d|sweet|evil|nice)|found)\.org|s(aved\.org|lick\.com)|l(eet\.com|ost\.org)|by\.us)|a-(geek\.(com|net|org)|hockeynut\.com)|t(eingeek|mein)\.de|smarterthanyou\.com)|n-the-band\.net|amallama\.com)|f(rom-((i[adln]|w[aivy]|o[hkr]|[hr]i|d[ce]|k[sy]|p[ar]|s[cd]|t[nx]|v[at]|fl|ga|ut)\.com|m([adinost]\.com|e\.org)|n([cdehjmv	2	0	0	1
+3013	3013	\.com|y\.net)|a([klr]\.com|z\.net)|c([at]\.com|o\.net)|la\.net)|or(-(((mor|som|th)e|better)\.biz|our\.info)|got\.h(er|is)\.name)|uettertdasnetz\.de|tpaccess\.cc)|s(e(l(ls(-(for-(less|u)\.com|it\.net)|yourhome\.org)|fip\.(info|biz|com|net|org))|rve(bbs\.(com|net|org)|ftp\.(net|org)|game\.org))|(aves-the-whales|pace-to-rent|imple-url)\.com|crapp(er-site\.net|ing\.cc)|tuff-4-sale\.(org|us)|hacknet\.nu)|d(o(es(ntexist\.(com|org)|-it\.net)|ntexist\.(com|net|org)|omdns\.(com|org))|yn(a(lias\.(com|net|org)|thome\.net)|-o-saur\.com|dns\.ws)|ns(alias\.(com|net|org)|dojo\.(com|net|org))|vrdns\.org)|h(o(me(linux\.(com|net|org)|unix\.(com|net|org)|(\.dyn)?dns\.org|ftp\.(net|org)|ip\.net)|bby-site\.(com|org))|ere-for-more\.info|am-radio-op\.net)|b(log(dns\.(com|net|org)|site\.org)|(uyshouses|roke-it)\.net|arrel?l-of-knowledge\.info|oldlygoingnowhere\.org|etter-than\.tv)|g(o(tdns\.(com|org)|\.dyndns\.org)|ame-(server\.cc|host\.org)|et(myip\.com|s-it\.net)|roks-th(is|e)\.info)|e(st-((a-la-ma(is|si)|le-patr)on|mon-blogueur	2	0	0	1
+3014	3014	\.com|ndof(internet\.(net|org)|theinternet\.org))|l(e(btimnetz|itungsen)\.de|ikes(candy|-pie)\.com|and-4-sale\.us)|m(i(sconfused\.org|ne\.nu)|yp(hotos\.cc|ets\.ws)|erseine\.nu)|w(ebhop\.(info|biz|net|org)|ritesthisblog\.com|orse-than\.tv)|t(eaches-yoga\.com|raeumtgerade\.de|hruhere\.net)|k(icks-ass\.(net|org)|nowsitall\.info)|o(ffice-on-the\.net|n-the-web\.tv)|(neat-url|cechire)\.com|podzone\.(net|org)|at-band-camp\.net|readmyblog\.org)(\x3a\d{1,5})?$	2	0	0	1
+3015	3015	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3016	3016	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3017	3017	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3018	3018	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3019	3019	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3020	3020	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3021	3021	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3022	3022	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3023	3023	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3024	3024	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3025	3025	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3026	3026	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3027	3027	^1\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3028	3028	^2\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3029	3029	^3\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3030	3030	^4\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3031	3031	^5\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3032	3032	^6\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3033	3033	^7\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3034	3034	^8\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3035	3035	^9\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3036	3036	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3037	3037	^\d	2	0	0	1
+3038	3038	^User-Agent\x3a\x20iTunes\/10\.6\.[0-1]	2	0	0	1
+3039	3039	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3040	3040	(/d{6})	2	0	0	1
+3041	3041	CN=([^\r\n]+?\.)?hizliresim\.com(\.)	2	0	0	1
+3042	3042	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3043	3043	^ip[23]?\.bablosoft\.com$	2	0	0	1
+3044	3044	^[A-Z]=[A-Za-z/+0-9=]{200,400}$	2	0	0	1
+3045	3045	CN=([^\r\n]+?\.)?sharepointin\.com(\.)	2	0	0	1
+3046	3046	CN=([^\r\n]+?\.)?templatern\.com(\.)	2	0	0	1
+3047	3047	CN=([^\r\n]+?\.)?prizegives\.com(\.)	2	0	0	1
+3048	3048	CN=([^\r\n]+?\.)?shareholds\.com(\.)	2	0	0	1
+3049	3049	CN=([^\r\n]+?\.)?mesharepoint\.com(\.)	2	0	0	1
+3050	3050	CN=([^\r\n]+?\.)?prizewings\.com(\.)	2	0	0	1
+3051	3051	CN=([^\r\n]+?\.)?doctricant\.com(\.)	2	0	0	1
+3052	3052	CN=([^\r\n]+?\.)?sharession\.com(\.)	2	0	0	1
+3053	3053	CN=([^\r\n]+?\.)?sharepointle\.com(\.)	2	0	0	1
+3054	3054	CN=([^\r\n]+?\.)?mcsharepoint\.com(\.)	2	0	0	1
+3055	3055	CN=([^\r\n]+?\.)?officenced\.com(\.)	2	0	0	1
+3056	3056	CN=([^\r\n]+?\.)?templatent\.com(\.)	2	0	0	1
+3057	3057	CN=([^\r\n]+?\.)?sharepointen\.com(\.)	2	0	0	1
+3058	3058	CN=([^\r\n]+?\.)?officence\.com(\.)	2	0	0	1
+3059	3059	CN=([^\r\n]+?\.)?templateau\.com(\.)	2	0	0	1
+3060	3060	CN=([^\r\n]+?\.)?sharesbyte\.com(\.)	2	0	0	1
+3061	3061	CN=([^\r\n]+?\.)?officences\.com(\.)	2	0	0	1
+3062	3062	CN=([^\r\n]+?\.)?officentry\.com(\.)	2	0	0	1
+3063	3063	CN=([^\r\n]+?\.)?officested\.com(\.)	2	0	0	1
+3064	3064	CN=([^\r\n]+?\.)?prizemons\.com(\.)	2	0	0	1
+3065	3065	CN=([^\r\n]+?\.)?prizewel\.com(\.)	2	0	0	1
+3066	3066	CN=([^\r\n]+?\.)?sharestion\.com(\.)	2	0	0	1
+3067	3067	CN=([^\r\n]+?\.)?attemplate\.com(\.)	2	0	0	1
+3068	3068	CN=([^\r\n]+?\.)?windocyte\.com(\.)	2	0	0	1
+3069	3069	CN=([^\r\n]+?\.)?logodownload\.org(\.)	2	0	0	1
+3070	3070	^[0-9a-f]{32}	2	0	0	1
+3071	3071	# \d+d \d+dh \d+m # 	2	0	0	1
+3072	3072	\x0D\x0A\x0D\x0ASLP\x3A\d+\x3BMOD\x3A[\S\x3B]+\x3BURL\x3Ahttp\x3A\x2F{2}[^\x3B]+\x3BSRV\x3Aupd\x3B	2	0	0	1
+3073	3073	^\x23\d\d\d\x2f\x21	2	0	0	1
+3074	3074	\x06\x00?$	2	0	0	1
+3075	3075	\.php\?i=\w+_[0-9A-F]{8}&k=\d+$	2	0	0	1
+3076	3076	.asp\?username=.+&serverMac=([0-9A-F]{2}-){5}[0-9A-F]{2}&edition=	2	0	0	1
+3077	3077	\/smain\?scout=acxc[a-z]{3}$	2	0	0	1
+3078	3078	\?sid=[0-9A-F]{180}	2	0	0	1
+3079	3079	.asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2})	2	0	0	1
+3080	3080	\/chr\/\d+\/e\/t\d+\?lid=	2	0	0	1
+3081	3081	mac=([0-9A-F]{2}:){5}([0-9A-F]{2})	2	0	0	1
+3082	3082	mac=([0-9A-F]{2}:){5}([0-9A-F]{2})	2	0	0	1
+3083	3083	cmd=give&pcname=.+&status=\d+$	2	0	0	1
+3084	3084	\?uid=[0-9a-f]{40}&action=\w+&v=[\w.]+&b=\d+$	2	0	0	1
+3085	3085	Host\x3a [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}	2	0	0	1
+3086	3086	\/[0-9A-Z]+\/[0-9A-Z]+\.bin$	2	0	0	1
+3087	3087	\x2fpeca\d+\x2eexe	2	0	0	1
+3088	3088	\.php\?v=[A-Za-z0-9.]+&id=-?\d+&wv=[0-9.]{1,14}$	2	0	0	1
+3089	3089	si\x5F[a-z]{5}[0-9]{5}\x2Ecb	2	0	0	1
+3090	3090	seclog\x5F[a-z]{5}[0-9]{5}\x5F.+\x2Ekcb	2	0	0	1
+3091	3091	&si=\d+&si=\d+&rd=20\d{11}	2	0	0	1
+3092	3092	\x2f\x3fdata\x3d[a-fA-F0-9]{60}	2	0	0	1
+3093	3093	\S{20,40}\'\>	2	0	0	1
+3094	3094	\.php\?e=\d+&o=\w+&b=\w+&id=[0-9a-f]{32}$	2	0	0	1
+3095	3095	c\x3d[0-9a-f]{100}	2	0	0	1
+3096	3096	^\x23BOT\x23(VisitUrl|OpenUrl|Ping|RunPrompt|CloseServer|SvrUninstall|URLUpate|URLDownload)	2	0	0	1
+3097	3097	^\x23botCommand\x25(close\x20command|Error|Finish|Http\x20Flood|Mass\x20Download|Respond\x20\x5bOK|Syn\x20Flood|UDP\x20Flood|uninstall|Update|)	2	0	0	1
+3098	3098	hash=\{[a-f0-9]+-	2	0	0	1
+3099	3099	\/server_privileges\.php\?[0-9a-f]{32}=\d+(&\w+)?$	2	0	0	1
+3100	3100	\.php\?w=\d+&fail=\d+&i=[0-9a-f]{32}$	2	0	0	1
+3101	3101	(\.php|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$	2	0	0	1
+3102	3102	ddos\.(phat(icmp|syn|wonk)|stop|(syn|udp|http)flood|targa3|(syn|ack|random) ([0-9]{1,3}\.){3}[0-9]{1,3})	2	0	0	1
+3103	3103	floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+3104	3104	\.(upda|getfile|dl\dx|dl|download|execute)\w*\s+http\x3a\x2f\x2f	2	0	0	1
+3105	3105	(ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]|mydoom|netdevil|DameWare|kuang2|sub7|iis5ssl|wkssvc|wks1|mysql|wkssvcOth|wkssvcENG|arkeia|arcserve|wins|veritas|netbackup|asn))	2	0	0	1
+3106	3106	\x3A\x02\x034\x5B(BackConnect|help|HTTP.*|SCAN|TCP.*|UDP.*|VERSION)\x5D\x03\x02	2	0	0	1
+3107	3107	(ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|exploited|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]|mydoom|netdevil|DameWare|kuang2|sub7|iis5ssl|wkssvc|wks1|mysql|wkssvcOth|wkssvcENG|arkeia|arcserve|wins|veritas|netbackup|asn))	2	0	0	1
+3108	3108	((\.aim\w*|ascanall|\x3agetshit200)\s+\w+)|((@kill|@get_os_version|@get_computer_name|@get_bot_version|@update|@restart|@reboot|@shutdown)\s)	2	0	0	1
+3109	3109	\.((testdlls|threads|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\dx|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r])	2	0	0	1
+3110	3110	((cvar\.set)|(http\.(execute|update))|((aol)spam\.(setlist|settemplate|start|stop|setuser|setpass))|sniffer\.(addstring|delstring)|pingstop|udpstop|scan(all|stats|del|stop)|clone(stop|start)|c_(raw|mode|nick|join|part|privmsg|action))	2	0	0	1
+3111	3111	((T?FTP)\x3a File transfer|(random|sequential) Port Scan|Random (Spreading|Scanner)|Exploiting IP|Exploiting\.\.|flooding\x3a|flood stopped|sending packets)|Random Method started|FINDFILE|Scan stopped|No scan thread found|thread\(s\) stopped|\x3aExec 	2	0	0	1
+3112	3112	PRIVMSG\s+\S+\s+\x3a\s*(\.user |\.logout|\.die|\.restart|\.mail |\.dns |\.download |\.exec |\.find |\.cmd |\.php |\.tcpflood |\.udpflood |\.raw |\.rndnick|\.pscan |\.ud\.server )	2	0	0	1
+3113	3113	\x7Cddos\x7C(syn|http)\x7C	2	0	0	1
+3114	3114	\?rnd=\d{5,7}\x20HTTP1\/1\.[01]\x0d\x0aHost\x3a\x20	2	0	0	1
+3115	3115	\?aid=\d{9}&url=[\w\.\-]{23}$	2	0	0	1
+3116	3116	\?subid=\d{9}&u=[\w\.\-]{23}$	2	0	0	1
+3117	3117	FileName\x3D[^\r\n]*\x2E(dll|exe)	2	0	0	1
+3118	3118	Subject\x3A\x20[^\r\n]*C\x3A\x5C[^\r\n]*\x2Eexe	2	0	0	1
+3119	3119	download\x2FAntivirus_\d+\x2Eexe	2	0	0	1
+3120	3120	\/installer\.\d+\.exe	2	0	0	1
+3121	3121	\/installer_\d+\.exe	2	0	0	1
+3122	3122	\x0d\x0aHost\: [a-z\x2e]+(security|virus|pro|anti|scan|mypc|total|protect|check|guard|defend)	2	0	0	1
+3123	3123	Setup_20\d+\x2Eexe	2	0	0	1
+3124	3124	\/dl\/AcroIEHelpe(r)?(\d)?\.dll	2	0	0	1
+3125	3125	mac=[0-9A-Fa-f]{12}&	2	0	0	1
+3126	3126	\?type=slg&id=[0-9A-Z]{18}	2	0	0	1
+3127	3127	phid=[A-F0-9]{64}	2	0	0	1
+3128	3128	mode=\d+D[0-9A-F]{150}	2	0	0	1
+3129	3129	^x=[0-9a-zA-Z]{50}/P	2	0	0	1
+3130	3130	\/x\/\?0\w{35}$	2	0	0	1
+3131	3131	\/down\d+\/down\/\?s=[A-F0-9]+\&t=\d+\/\d+\/20	2	0	0	1
+3132	3132	\?spl=\d+&br=[A-Za-z]+&vers=\d\.\d&s=[a-z0-9]+[^&]$	2	0	0	1
+3133	3133	\?spl=MS[0-9]{2}-[0-9]{3}$	2	0	0	1
+3134	3134	\.php\?(land=\d+|affid=\d{5})&(land=\d+|affid=\d{5})$	2	0	0	1
+3135	3135	[1-3]\x2Finstaller\x2FInstaller\x2Eexe	2	0	0	1
+3136	3136	\x2FLayouts\x2FLandings\x2FCentralLandings\x2F\d+\x2Fimages\x2F	2	0	0	1
+3137	3137	MyValue=[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:	2	0	0	1
+3138	3138	\/(ucleaner|udefender|ufixer)\.com\/demo\.php\?	2	0	0	1
+3139	3139	\.php\?1=[a-z0-9]+_[a-z0-9_]+&i=	2	0	0	1
+3140	3140	^User-Agent\:[^\n]+PassSickle/Hmi	2	0	0	1
+3141	3141	\/cd\/un\.php.id=[A-F0-9\-]+&ver=	2	0	0	1
+3142	3142	&os=[a-f0-9]{50}	2	0	0	1
+3143	3143	^GET\x20[^\x0D\x0A]+\x3Fmod\x3Dcmd\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+	2	0	0	1
+3144	3144	^POST\x20[^\x0D\x0A]+\x3Fmod\x3Dlog\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+.*\x0D\x0A\x0D\x0Acurr\x3D.*\x26next\x3D	2	0	0	1
+3145	3145	Content-Length\x3a [1-9]	2	0	0	1
+3146	3146	Host\x3a\s[a-z]{15,19}\.ru(\x3a8080)?/Hm	2	0	0	1
+3147	3147	gameover(\d+)?\.php	2	0	0	1
+3148	3148	\x2F[a-z]{5}\x2Ephp\x3Fid\x3D	2	0	0	1
+3149	3149	\.php\?m=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&[vs]=	2	0	0	1
+3150	3150	\.php\?s=\d&m=[A-F0-9]{16}$	2	0	0	1
+3151	3151	\?id=[A-Za-z]+_[A-Za-z0-9]+&	2	0	0	1
+3152	3152	\/index.dat\?\d{5,9}$	2	0	0	1
+3153	3153	\x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+[a-f0-9]{12}&ext\x3D	2	0	0	1
+3154	3154	^User-Agent\x3a [a-z0-9]{92}/Hmi	2	0	0	1
+3155	3155	\/crack\.\d+\.exe$	2	0	0	1
+3156	3156	^\d+\x7cddos\x7c([^\x7c]+\x7c){5}[^\x7c]+$	2	0	0	1
+3157	3157	^\d+\x7cdlexec\x7c([^\x7c]+\x7c){3}[^\x7c]+$	2	0	0	1
+3158	3158	\.txt$	2	0	0	1
+3159	3159	^\d+\x3a\d\x7c\d+\x7c[0-9a-z]+\x7c\d	2	0	0	1
+3160	3160	\.php\?cmd=getFile&counter=\d	2	0	0	1
+3161	3161	codec=\d+D\d+D\d	2	0	0	1
+3162	3162	(\.aim\w*|ascanall)\s+\w	2	0	0	1
+3163	3163	report=\d+&pid=\d+&wv=[A-Za-z0-9]/P	2	0	0	1
+3164	3164	User\x2DAgent\x3A\x20[a-f0-9]{5,14}\x0D\x0A/H	2	0	0	1
+3165	3165	.php\?gd=\d+_\d+_\d+$	2	0	0	1
+3166	3166	\x2f\d+?\x2erar$	2	0	0	1
+3167	3167	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$	2	0	0	1
+3168	3168	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/	2	0	0	1
+3169	3169	^KEEPALIVE\x7c?\d	2	0	0	1
+3170	3170	kill\-\d+.\d+.\d+.\d+\:\d+%\d	2	0	0	1
+3171	3171	\x0d\x0aMagic-Number\x3a\s+\d+\|\d	2	0	0	1
+3172	3172	\/ping\/[0-9a-fA-F]{64}\/[0-9a-fA-F]+\/[0-9a-fA-F]	2	0	0	1
+3173	3173	\x3Fmod\x3D\w*?\x26id\x3D[^\x26\s]+?\x5F\w+?\x26up\x3D[^\x26]+?\x26mid\x3D[^\x26\s]	2	0	0	1
+3174	3174	Host\: \d+\.\d+\.\d+\.\d	2	0	0	1
+3175	3175	\?n=\d+&id=.+&t=.+&i=\d	2	0	0	1
+3176	3176	id=[a-f0-9-]+&	2	0	0	1
+3177	3177	ID=.{40}&.{6}	2	0	0	1
+3178	3178	(web(\.(velocitycache\.com|autoflash\.info)|update\.(dyndns\.info|hopto\.org)|app\.serveftp\.com)|flash(center\.info|rider\.org)|cache\.dyndns\.info)\r?$/Hmi	2	0	0	1
+3179	3179	((nvidia(s(tream|oft)|drivers)|(rendercode|videosyn)c|flashupdates|syncstream)\.info|194\.192\.14\.125|202\.75\.58\.179)\r?$/Hmi	2	0	0	1
+3180	3180	\/search\?q\=\d+&aq=\d	2	0	0	1
+3181	3181	\x7C(NEW|Awaiting commands)	2	0	0	1
+3182	3182	\x7C(NEW|Awaiting commands)	2	0	0	1
+3183	3183	\x7C(NEW|Awaiting commands)	2	0	0	1
+3184	3184	^\x3c\x21\x2d\x2d\x0d\x0a\x3cimg\x20border=\d+\x20src=\x22\S+\x2f\x23KX8\x2e	2	0	0	1
+3185	3185	^\d+\s*-->	2	0	0	1
+3186	3186	^[0-4]\s*src=\x22[^\x22]+\x22\swidth=\d+\sheight=\d+>\r\n-->	2	0	0	1
+3187	3187	\&p=[0-9A-Za-z]{5}\-[0-9A-Za-z]{5}\-	2	0	0	1
+3188	3188	^Accept-Encoding\x3a\s+([a-z]){3}/Hmi	2	0	0	1
+3189	3189	user=[a-f0-9]{32}&	2	0	0	1
+3190	3190	\/tlog\.php\?logn=[^\s]+&pss=[^\s]	2	0	0	1
+3191	3191	ntarg\.php\?[^\s]*(notdoing|howme|uname)=	2	0	0	1
+3192	3192	\/tnewu\.php\?nlogin=[^\s]+&npss=[^\s]+&invitedby=[^\s]	2	0	0	1
+3193	3193	updatea\.php\?p=\d	2	0	0	1
+3194	3194	&d=.{44}$	2	0	0	1
+3195	3195	filename=j[a-f0-9]{23}\.jar/H	2	0	0	1
+3196	3196	^hello\/[0-9]\.[0-9]\/[0-9]{3}	2	0	0	1
+3197	3197	^[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+3198	3198	^[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+3199	3199	NICK {[a-z]{2,3}\x2D.+?x86[a-z]}[a-z]	2	0	0	1
+3200	3200	^\d+\w+\/\d+\w+ free \(\d+% used\)	2	0	0	1
+3201	3201	^[A-Z]\x3a\x5f	2	0	0	1
+3202	3202	filename=e[a-f0-9]{23}\.exe/H	2	0	0	1
+3203	3203	^Host\x3a\x20[a-z0-9]+\.[a-z0-9]+\.[a-z0-9]+\.pl\x3a\d{2,5}\r$/Hm	2	0	0	1
+3204	3204	^[A-Z]{3}\|[UA]\|[DL]\|W([78]|_XP|VIS)\|x(86|64)\|	2	0	0	1
+3205	3205	^([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4})	2	0	0	1
+3206	3206	^[a-z0-9\+\/]+={0,2}$	2	0	0	1
+3207	3207	^(\r\n|$)	2	0	0	1
+3208	3208	^\d+?\x5d	2	0	0	1
+3209	3209	^[\r\n\s]*?<<((>>).)+?\/[a-zA-Z\d]*?#([46][1-9a-fA-F]|[57][\daA])([a-zA-Z\d])*?#([46][1-9a-fA-F]|[57][\daA])	2	0	0	1
+3210	3210	^(4\x00[1-9a-f]|5\x00[\da])	2	0	0	1
+3211	3211	^Referer\x3a[^\r\n]+\/[a-f0-9]{8}\/1(0\/[0-2]|1\/\d)\/\r$/Hm	2	0	0	1
+3212	3212	data_\d{4}_\d{1,2}_\d{1,2}_\d{1,2}_\d{1,2}\.txt	2	0	0	1
+3213	3213	^\d+?\x7cOnConnect\x7c	2	0	0	1
+3214	3214	^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01	2	0	0	1
+3215	3215	^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01	2	0	0	1
+3216	3216	^[0-9a-f]{22,46}	2	0	0	1
+3217	3217	^((PCACTIV|ONLIN)ETIME|WEBSITE[DS]|CHATROOM|KEYLOGS)	2	0	0	1
+3218	3218	^\S{2,3}\x7c\S+?[au]\x7D\w{2,11}\x0d?\x0a	2	0	0	1
+3219	3219	^\/[A-Z]{1}[0-9]{1,3}\/[A-X]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/[A-Z]{1}[0-9]{4,5}[A-M]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/$	2	0	0	1
+3220	3220	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3221	3221	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3222	3222	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3223	3223	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3224	3224	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3225	3225	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3226	3226	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3227	3227	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3228	3228	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3229	3229	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3230	3230	^(x(86|64)@)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+3231	3231	^[^\x00]+?\x00	2	0	0	1
+3232	3232	Host\x3a\x20([^\r\n]+\.)?bitcrypt\.cc(\x3a\d{1,5})?\r\n/Hmi	2	0	0	1
+3233	3233	ID=\d{24}($|&)	2	0	0	1
+3234	3234	^[a-z0-9_-]*?\.class	2	0	0	1
+3235	3235	name=\x22[a-z0-9\-_\.\s]{0,25}\.gadget\x22	2	0	0	1
+3236	3236	^..[\x0d-\x20](\d{0,27}[a-z])([a-z]{0,27}\d)[a-z0-9]{21,28}(\x03(biz|com|net|org))\x00\x00\x01\x00\x01	2	0	0	1
+3237	3237	^\d\.\d\.\d{4}\]\r\n\(C\)\x20Copyright\x20\d{4}(\x2d\d{4})?\x20Microsoft Corp(:?\.|oration)	2	0	0	1
+3238	3238	^\d+?\.\d+?\sstarted	2	0	0	1
+3239	3239	^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$	2	0	0	1
+3240	3240	MyValue=[a-f0-9]{32}	2	0	0	1
+3241	3241	^([a-zA-Z0-9\x2d\x5f]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]*?9\.9\.9\.9\s+?([a-zA-Z0-9\_\-]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]	2	0	0	1
+3242	3242	^PRIVMSG.*@(portscan|back|(tcp|udp|http)flood|tsunami|(de)?voice|reset|die|say|join|part|(de)?op)	2	0	0	1
+3243	3243	name=\x22DHL(\s|_|\-)?[a-z0-9\-_\.\s]{0,63}\.zip\x22	2	0	0	1
+3244	3244	\/.+(www\.)?[a-z0-9]+\.[a-z]{2,3}\.exe$	2	0	0	1
+3245	3245	adobe-flash\.v\.\d{5}\.exe	2	0	0	1
+3246	3246	\x2Finvoice\x2Escr$	2	0	0	1
+3247	3247	forum\/\?[0-9a-f]{8}$	2	0	0	1
+3248	3248	ups(_parcel_delivery-tracking-notice-|-Delivery-Notification-Message_)\S*\.zip	2	0	0	1
+3249	3249	Host\x3A\x20[^a-z]*[0-9]{4,30}\x2Ecn\x0D\x0A/Hi	2	0	0	1
+3250	3250	User-Agent\x3a\x20[a-z]{3,4}\x0d\x0a/H	2	0	0	1
+3251	3251	\/xxxx_\d+\/	2	0	0	1
+3252	3252	^Host\x3a\s[^\r\n]+?\.[abedgfihkmlonqpsruwvyxz]{16}\.waw\.pl\r$/Hmi	2	0	0	1
+3253	3253	\x10[abedgfihkmlonqpsruwvyxz]{16}\x03waw\x02pl\x00	2	0	0	1
+3254	3254	^[^\x3b]+\\x([57][0-9a]|4[0-9a-f]|6[1-9a-f]|3[0-9])	2	0	0	1
+3255	3255	^(<q>[\x22\x27])(((=q))[^\r\n\x2c])+?(=q)\s*?\+\s*?[\x22\x27][^\r\n\x2c]*?[cg][\x22\x27\+\s]*?[o][\x22\x27\+\s]*?[vm][\x22\x27\+\s]*?\.[\x22\x27\+\s]*?b[\x22\x27\+\s]*?r[\x22\x27\+\s]*?\x2c	2	0	0	1
+3256	3256	^..[\x0d-\x20][a-z]{13,32}(\x03(biz|com|net|org)|\x04info|\x02ru)\x00\x00\x01\x00\x01	2	0	0	1
+3257	3257	^\d	2	0	0	1
+3258	3258	[^\x33][^\x6f\x19\x18\x0e\x4f\x09\x08\x11\x0c\x0f\x0d\x1f\x10\x39][\x00-\x07\x0b\x0a\x1e\x1d\x12\x13\x15\x10\x1b\x1a\x54-\x5f\x50-\x52\x40-\x4b\x4d\x4e\x70-\x7f\x60-\x67\x69-\x6d]{1,14}\x33	2	0	0	1
+3259	3259	^\x2d?\d	2	0	0	1
+3260	3260	My\x20IP\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x0A	2	0	0	1
+3261	3261	^[^\r\n]{0,7}\b(M[ACDEFGHKLMNOPQRSTUVWXYZ]|B[ABDEFGHIJLMNOQRSTVWYZ]|S[ABCDEGHIJKLMNORSTVXYZ]|C[ACDFGHIKLMNORUVWXYZ]|G[ABDEFGHILMNPQRSTUWY]|A[DEFGILMOQRSTUWXZ]|T[CDFGHJKLMNORTVWZ]|P[AEFGHKLMNRSTWY]|N[ACEFGILOPRUZ]|K[EGHIMNPRWYZ]|L[ABCIKRSTUVY]|I[DELMNOQRST]|E[CEGHRST]|V[ACEGINU]|D[EJKMOZ]|F[IJKMOR]|H[KMNRTU]|U[AGMSYZ]|R[EOSUW]|J[EMOP]|Z[AMW]|W[FS]|Y[ET]|OM|QA)\b	2	0	0	1
+3262	3262	^[^\r\n]{0,7}\b(M(A[CFR]|D[AGV]|N[EGP]|L[IT]|Y[ST]|[MS]R|CO|EX|HL|KD|OZ|RT|TQ|US|WI)|S(L[BEV]|[DEH]N|[JOP]M|G[PS]|V[KN]|W[EZ]|Y[CR]|[MU]R|AU|RB|SD|TP)|B(L[MRZ]|R[ABN]|E[LN]|G[DR]|H[RS]|[FW]A|DI|IH|MU|OL|TN|VT)|C(O[DGKLM]|H[ELN]|A[FN]|Y[MP]|[IP]V|[MX]R|CK|RI|UB|ZE)|A(R[EGM]|T[AFG]|L[AB]|N[DT]|U[ST]|BW|FG|GO|IA|SM|ZE)|G(R[CDL]|U[FMY]|I[BN]|N[BQ]|[AM]B|BR|EO|GY|HA|LP|TM)|T(U[NRV]|C[AD]|K[LM]|[GT]O|[HZ]A|[OW]N|JK|LS)|P(R[IKTY]|A[KN]|[HO]L|CN|ER|LW|NG|SE|YF)|N([CPZ]L|I[CU]|[EO]R|AM|FK|GA|LD|RU)|L(B[NRY]|[CKV]A|[AS]O|IE|TU|UX)|I(R[LNQ]|S[LR]|[DM]N|ND|OT|TA)|K([AG]Z|[IO]R|EN|HM|NA|WT)|E(S[HPT]|CU|GY|RI|TH)|V([ACU]T|EN|GB|IR|NM)|D([MZ]A|EU|JI|NK|OM)|F(R[AO]|IN|JI|LK|SM)|H([MN]D|KG|RV|TI|UN)|U([GS]A|KR|MI|RY|ZB)|J(AM|EY|OR|PN)|R([EO]U|US|WA)|Z(AF|MB|WE)|W(LF|SM)|OMN|QAT|YEM)\b	2	0	0	1
+3263	3263	^[a-z0-9_-]*?\.class	2	0	0	1
+3264	3264	^.\x00\x00\x00[a-z0-9]+?\x00	2	0	0	1
+3265	3265	^\d+[\r\n]*?$	2	0	0	1
+3266	3266	^[^\r\n]*?\x3a[^\r\n]*?(port(scan)?|udp[1-3]|tcp|http|download)[^\r\n]+?(\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}|https?\x3A\x2F\x2F)	2	0	0	1
+3267	3267	^[^\r\n]*?(p[ao]rt|udp|c?tcp|http|d(ie|ownload)|mail|c?back|(msg|notice)?flood)	2	0	0	1
+3268	3268	^[a-z]{12}	2	0	0	1
+3269	3269	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x40\x24\x40$	2	0	0	1
+3270	3270	^[a-z]{16}	2	0	0	1
+3271	3271	\/get\/get\.php$	2	0	0	1
+3272	3272	^[A-Za-z0-9\s/+]{100}	2	0	0	1
+3273	3273	^Host\x3a\x20ns1\.help(update(d\.(com?|net?|org?)|k\.(at?|eu?|tw)|r\.net|s\.com)|checks\.net)	2	0	0	1
+3274	3274	^<(<var1>[a-z])>[a-z0-9/]+<\/(=var1)><(<var2>[a-z])>[a-z0-9/]+<\/(=var2)>	2	0	0	1
+3275	3275	^[^\r\n]+?\n$	2	0	0	1
+3276	3276	\x21\x20UDP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+3277	3277	\x21\x20TCP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+3278	3278	\x21\x20HOLD\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+3279	3279	\x21\x20SCANNER\x20(ON|OFF)\x0A	2	0	0	1
+3280	3280	\x21\x20JUNK\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+3281	3281	^[a-z][a-f0-9]{33}	2	0	0	1
+3282	3282	^[a-z][a-f0-9]{33}	2	0	0	1
+3283	3283	^[a-z][a-f0-9]{33}	2	0	0	1
+3284	3284	^[a-z][a-f0-9]{33}	2	0	0	1
+3285	3285	^[a-z][a-f0-9]{33}	2	0	0	1
+3286	3286	^[a-z][a-f0-9]{33}	2	0	0	1
+3287	3287	^[a-z][a-f0-9]{33}	2	0	0	1
+3288	3288	^[a-z][a-f0-9]{33}	2	0	0	1
+3289	3289	^Host\x3A[^\r\n]+?\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(\x3a\d{1,5})?\r?$/Hmi	2	0	0	1
+3290	3290	^[a-f0-9]+$	2	0	0	1
+3291	3291	^[0-9A-F]{12}$	2	0	0	1
+3292	3292	^\S{2,3}\x2d(XP|2K3|VIS|2K8|W7|ERR)\w?\x2d\w+?\x7D\w+?\r\n?	2	0	0	1
+3293	3293	^(MIPS(EL)?|POWERPC|ARM|X86)\x0a$	2	0	0	1
+3294	3294	^(ON|OFF)	2	0	0	1
+3295	3295	^\d+MHz\x00	2	0	0	1
+3296	3296	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})system$	2	0	0	1
+3297	3297	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}D\x3a\x00+?$	2	0	0	1
+3298	3298	^.{2}(<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x08.{2}(=var)	2	0	0	1
+3299	3299	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3300	3300	^[\x53\x54]	2	0	0	1
+3301	3301	^[a-z0-9]{50}	2	0	0	1
+3302	3302	^[a-z0-9]{50}	2	0	0	1
+3303	3303	^\x3c\x2a\x60[\x20-\x7e]+\x60\x2a\x3e$	2	0	0	1
+3304	3304	^\d+\]\r\n$	2	0	0	1
+3305	3305	^((menelao|ho[mr]u)s|adair|johan|kweku)\r\n	2	0	0	1
+3306	3306	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d	2	0	0	1
+3307	3307	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d	2	0	0	1
+3308	3308	^[A-F0-9]{8,12}	2	0	0	1
+3309	3309	^(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?$	2	0	0	1
+3310	3310	^[\x01\x03\x08\x09\x0b]\x00	2	0	0	1
+3311	3311	^\d{1,3}[0-2]	2	0	0	1
+3312	3312	\.tar$	2	0	0	1
+3313	3313	^[a-zA-Z0-9]{8}	2	0	0	1
+3314	3314	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+3315	3315	\x7c[a-f0-9]{16}\x7c\d+\x7c$	2	0	0	1
+3316	3316	[^\x28][^\x76\x74\x02\x03\x15\x54\x12\x13\x0a\x17\x14\x16\x04\x0b\x22][\x05\x09\x0b\x0e\x08\x06\x1a-\x1f\x10\x11\x18\x19\x40-\x47\x48-\x4f\x50-\x53\x55\x56\x58-\x5e\x60-\x68\x6a-\x6f\x70\x72\x76-\x7e]{1,14}\x28	2	0	0	1
+3317	3317	\x00\x05value$	2	0	0	1
+3318	3318	^[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+3319	3319	^\d{1,5}	2	0	0	1
+3320	3320	^.{2}[a-z]{5,}\.[a-z]{2}\x30	2	0	0	1
+3321	3321	^(#+[A-Z]+)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?\${10}	2	0	0	1
+3322	3322	^(in|out)	2	0	0	1
+3323	3323	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3324	3324	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3325	3325	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3326	3326	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3327	3327	^[0-9A-F]{12}	2	0	0	1
+3328	3328	^\d{1,6}\x00pl\x7c	2	0	0	1
+3329	3329	^\d{1,6}\x00sc\x7e\x7c	2	0	0	1
+3330	3330	^\d{1,6}\x00scPK\x7c	2	0	0	1
+3331	3331	^\d{1,6}\x00rn\x7c	2	0	0	1
+3332	3332	^\d{1,6}\x00ret\x7c	2	0	0	1
+3333	3333	^\d{1,6}\x00cap\x7c	2	0	0	1
+3334	3334	^\d{1,6}\x00kl\x7c	2	0	0	1
+3335	3335	^\d{1,6}\x00fm\x7c	2	0	0	1
+3336	3336	^\d{1,6}\x00proc\x7c	2	0	0	1
+3337	3337	^\d{1,6}\x00rg\x7c	2	0	0	1
+3338	3338	^\d{1,6}\x00srv\x7c	2	0	0	1
+3339	3339	^\d{1,6}\x00rs\x7c	2	0	0	1
+3340	3340	^\d{1,6}\x00mic\x7c	2	0	0	1
+3341	3341	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+3342	3342	^NOTICE [^\r\n]+? \x3aREWRITING\x0a[^\r\n]+?\x0ato\x0a[^\r\n]+?\x0a	2	0	0	1
+3343	3343	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3344	3344	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3345	3345	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3346	3346	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3347	3347	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3348	3348	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3349	3349	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3350	3350	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3351	3351	^([A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(64)?$	2	0	0	1
+3352	3352	^([A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(64)?$	2	0	0	1
+3353	3353	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3354	3354	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3355	3355	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3356	3356	^\d+	2	0	0	1
+3357	3357	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3358	3358	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+3359	3359	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+3360	3360	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+3361	3361	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+3362	3362	^.{2}[a-z]{25}\.[a-z]{2,3}[01]	2	0	0	1
+3363	3363	^(([0-9]{1,3}\.){3}[0-9]{1,3})(={2})	2	0	0	1
+3364	3364	\/\?[A-Z]{10,}$	2	0	0	1
+3365	3365	^User-Agent\x3a[^\r\n]+?(MSIE|rv\x3a11)/Hm	2	0	0	1
+3366	3366	\/\d{10}\?w=\d{3}&i=\d{6,10}&v=\d\.\d$	2	0	0	1
+3367	3367	\.php$	2	0	0	1
+3368	3368	^KEEPALIVE\d+$	2	0	0	1
+3369	3369	\x24RECYCLE\.BIN\.\x7B[0-9A-F]{8}\x2D([0-9A-F]{4}\x2D){3}[0-9A-F]{12}\x7D\x5C\x7B[0-9A-F]{8}\x2D([0-9A-F]{4}\x2D){3}[0-9A-F]{12}\x7D\.(scr|pif|cmd)	2	0	0	1
+3370	3370	^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][A-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}	2	0	0	1
+3371	3371	^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][A-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}	2	0	0	1
+3372	3372	\.php\?e=\d{4}\-\d{4}&h=[a-f0-9]{32}$	2	0	0	1
+3373	3373	^[a-f0-9]{7,}$	2	0	0	1
+3374	3374	^.{2}(www)\d?[A-Z]?([a-z]{3,20}\.)?[a-z]{5,}(\d[a-z]{5,})?\.[a-z]{2,5}[01]	2	0	0	1
+3375	3375	^[^\x00]+(\xff\xd9)?$	2	0	0	1
+3376	3376	^0103F\x00[^\x00]+(\xff\xd9)?$	2	0	0	1
+3377	3377	^0103F\x00[^\x00]+(\xff\xd9)?$	2	0	0	1
+3378	3378	^.{2}((\d[A-Z]?|[A-Z]\d?)[a-z]{6,20}|[A-Z]?[a-z]{3,7}\d[a-z]{3,7})\.((\d[A-Z]?|[A-Z]\d?)[a-z]{6,20}|[A-Z]?[a-z]{3,7}\d[a-z]{3,7})\.((com|net|org)[01])[a-z]{2,}[01]	2	0	0	1
+3379	3379	^(<v1>\S{1,100})\s+(<v2>\S{1,100})\s+=\s+\x22\x22\x3b\s+(=v2)\s+\+\=\s+\x27(=v1).+?(=v1)\x27\x3b.+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27]	2	0	0	1
+3380	3380	^[a-z]{12}	2	0	0	1
+3381	3381	^[a-f0-9]{14}$	2	0	0	1
+3382	3382	^\d	2	0	0	1
+3383	3383	\.php\?id=\d+&magic=(-)?\d+$	2	0	0	1
+3384	3384	^.{2}(<CN>((\d?[A-Z]?|[A-Z]?\d?)([a-z]{3,20}|[a-z]{3,6}[0-9_][a-z]{3,6})\.){0,2}?(\d?[A-Z]?|[A-Z]?\d?)[a-z]{3,}([0-9_-][a-z]{3,})?\.(com|org|net|tv)[a-z]{2,9})[01].*?(=CN)[01]	2	0	0	1
+3385	3385	^.[\x0e\x0f]((www|ns))[a-z0-9]{2,3}	2	0	0	1
+3386	3386	^.[\x0a\x0b]((www|ns))[a-z0-9]{1,2}	2	0	0	1
+3387	3387	^KEEPALIVE\x7c?\d	2	0	0	1
+3388	3388	^[a-f0-9]{13,30}$	2	0	0	1
+3389	3389	^[a-f0-9]{13,30}$	2	0	0	1
+3390	3390	^[a-f0-9]{13,30}$	2	0	0	1
+3391	3391	^[a-f0-9]{13,30}$	2	0	0	1
+3392	3392	^[a-f0-9]{13,30}$	2	0	0	1
+3393	3393	^[a-f0-9]{13,30}$	2	0	0	1
+3394	3394	^[a-f0-9]{13,30}$	2	0	0	1
+3395	3395	^[a-f0-9]{13,30}$	2	0	0	1
+3396	3396	^[a-f0-9]{13,30}$	2	0	0	1
+3397	3397	^[a-f0-9]{13,30}$	2	0	0	1
+3398	3398	^[a-f0-9]{13,30}$	2	0	0	1
+3399	3399	^[a-f0-9]{13,30}$	2	0	0	1
+3400	3400	^[a-f0-9]{13,30}$	2	0	0	1
+3401	3401	^[a-f0-9]{13,30}$	2	0	0	1
+3402	3402	^[a-f0-9]{13,30}$	2	0	0	1
+3403	3403	^[a-f0-9]{13,30}$	2	0	0	1
+3404	3404	^[A-F0-9]+\x00	2	0	0	1
+3405	3405	Cookie\x3a mstshash=[a-zA-Z]\r\n	2	0	0	1
+3406	3406	^[^A-Za-z0-9]	2	0	0	1
+3407	3407	^(FM|SM|CP|CM|MC|NF|CH|PS|PT)	2	0	0	1
+3408	3408	^(Lg|Execute|FLD|Sc)\x7c\x2d\x7c	2	0	0	1
+3409	3409	^(\x40|\x21|\x23|\x7e|\x24)	2	0	0	1
+3410	3410	\bnethelper\b/Vi	2	0	0	1
+3411	3411	^\d	2	0	0	1
+3412	3412	[\x04\x06]\x88\x4d\x76$	2	0	0	1
+3413	3413	[\xb0\xb2]\x63\x70\x7b$	2	0	0	1
+3414	3414	^(.{0,56}\x00.{0,55}\x00.{0,54}\x00.{0,53}\x00)(.{0,54}\x00{2})(.{0,50}[A-Za-z0-9]{5})((<b1>.).{0,53}(=b1).{0,52}(=b1).{0,51}(=b1).{0,50}(=b1))(.(<b2>.).{0,52}(=b2).{0,51}(=b2).{0,50}(=b2).{0,49}(=b2))(..(<b3>.).{0,51}(=b3).{0,50}(=b3).{0,49}(=b3).{0,48}(=b3))(...(<b4>.).{0,50}(=b4).{0,49}(=b4).{0,48}(=b4).{0,47}(=b4))(....(<b5>.).{0,49}(=b5).{0,48}(=b5).{0,47}(=b5).{0,46}(=b5))(.....(<b6>.).{0,48}(=b6).{0,47}(=b6).{0,46}(=b6).{0,45}(=b6))(......(<b7>.).{0,47}(=b7).{0,46}(=b7).{0,45}(=b7).{0,44}(=b7))(.......(<b8>.).{0,46}(=b8).{0,45}(=b8).{0,44}(=b8).{0,43}(=b8))(........(<b9>.).{0,45}(=b9).{0,44}(=b9).{0,43}(=b9).{0,42}(=b9))(.........(<b10>.).{0,44}(=b10).{0,43}(=b10).{0,42}(=b10).{0,41}(=b10))	2	0	0	1
+3415	3415	\r\nHost\x3a[^\r\n]+\r\n(Pragma|Cache-Control)\x3a\x20no-cache\r\n(Connection\x3a Keep-Alive\r\n)?(\r\n)?$/H	2	0	0	1
+3416	3416	^Accept\x3a\x20\*\/\*\r\nConnection\x3a\x20close\r\nHost\x3a\x20[^\r\n\x2e]+\x2e[^\r\n\x2e]+(\x3a\d{1,5})?\r\n(\r\n)?$/H	2	0	0	1
+3417	3417	name\x3d\x22(message|letter|.*lebanon\x2donline\x2ecom\x2elb)?\x2ezip\x22\x0d\x0a	2	0	0	1
+3418	3418	^[A-Za-z0-9+/=]+\x24\x3a\d+\x3a\x24$	2	0	0	1
+3419	3419	^[acdefghijlmopqrtwz]{16}\.mynumber\.org$	2	0	0	1
+3420	3420	^Host\x3a (\d+\.){3}\d+$	2	0	0	1
+3421	3421	^[0-9A-Z]{8}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9]{12}-0[0-9]{1}	2	0	0	1
+3422	3422	^(_|Keylogger)	2	0	0	1
+3423	3423	[^\x12][^\x4e\x38\x39\x2f\x6e\x28\x29\x30\x2d\x2e\x2c\x3e\x31\x18][\x40-\x48\x4a-\x4d\x31-\x34\x3a-\x3c\x3f\x50-\x5f\x60-\x6c\x6f\x73-\x7f\x70\x71\x20-\x27\x2a\x2b]{1,14}\x12	2	0	0	1
+3424	3424	^[0-9]{2,3}\x00\x6c\x6c(<var>[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(=var)[^\r\n]+(=var)$	2	0	0	1
+3425	3425	^(GET|POST)\/(watch|search|find|results|open|search|close)\/\?(text=|from=|aq=|ai=|ags=|oe=|btnG=|oprnd=|utm=|channel=|itwm=)	2	0	0	1
+3426	3426	itwm=[A-Za-z0-9\-\_]{29,35}	2	0	0	1
+3427	3427	&itwm=[A-Za-z0-9\-\_]{29,35}	2	0	0	1
+3428	3428	[A-Z0-9\-]{16}-FILE-[^\r\n]+.tmp	2	0	0	1
+3429	3429	Mozilla\/[0-9]{1,2}.[0-9]{1,2}\(compatible\; MSIE [0-9]{1,2}.[0-9]{1,2}\;\)\x0d\x0a	2	0	0	1
+3430	3430	^.{2}[A-Za-z][a-z]*?@[a-z]+\.com0	2	0	0	1
+3431	3431	^User-Agent\x3a\x20[^\r\n]+?(MSIE|rv\x3a11\.0)/Hmi	2	0	0	1
+3432	3432	^\x00+?[\x20-\x7f]+?\x00+?$	2	0	0	1
+3433	3433	^\x00+?[\x20-\x7f]+?\x00+?$	2	0	0	1
+3434	3434	^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi	2	0	0	1
+3435	3435	^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi	2	0	0	1
+3436	3436	^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi	2	0	0	1
+3437	3437	^[\x22\x27][a-z][\x27\x22]	2	0	0	1
+3438	3438	^.(.[a-z]{4,12}\.(us|org|net|biz|info|mobi|com)[01]).*?\x55\x04\x03.	2	0	0	1
+3439	3439	^[0-9]{3}\x7cx	2	0	0	1
+3440	3440	^[0-9]{2}\x7cx	2	0	0	1
+3441	3441	^[a-f0-9]{40,}$	2	0	0	1
+3442	3442	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3443	3443	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps	2	0	0	1
+3444	3444	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps	2	0	0	1
+3445	3445	([0-9A-F]{8}\-){5}\-SH	2	0	0	1
+3446	3446	^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+3447	3447	^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+3448	3448	^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+3449	3449	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3450	3450	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3451	3451	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3452	3452	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3453	3453	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3454	3454	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3455	3455	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3456	3456	^d([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?e([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?f([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?a([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?u([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?l([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?t([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?#([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?V([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?M([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?L[\x22\x27]	2	0	0	1
+3457	3457	^.{4}[\x0a-\x7f]{0,100}[\x00-x09\x80-\xff]	2	0	0	1
+3458	3458	^\/([a-z]*[0-9][a-z-0-9]*)([0-9]*[a-z][a-z-0-9]*)[a-z0-9]{5,8}$	2	0	0	1
+3459	3459	Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(\x3a\d{1,5})?\r\n/H	2	0	0	1
+3460	3460	\/js\/bin\.exe\\d+$	2	0	0	1
+3461	3461	^.{1}([\x20-\x7e]{0,8}?[^\x20-\x7e])(<var>.{10,120}?[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+3462	3462	^.{2}[a-z]+@[a-z]+\.com[01]	2	0	0	1
+3463	3463	^.{2}[a-z]+@[a-z]+\.com[01]	2	0	0	1
+3464	3464	^.{2}[A-Za-z][a-z]*?@[a-z]+\.com[01]	2	0	0	1
+3465	3465	\x00[0-9]{4,7}\x02in\x00	2	0	0	1
+3466	3466	^[\x0e-\x1e]([a-f0-9]{2}){1,3}(dc([a-f0-9]{2}){1,3}){3}.[a-f0-9]{2}	2	0	0	1
+3467	3467	^[\x08-\xFF]([a-f0-9]{2})*?dc978a97	2	0	0	1
+3468	3468	^(gdqg|hdqh|idqi|jdqj|kdqk|ldql|mdqm|ndqn|odqo|pdqp|qdqq|rdqr|sdqs|tdqt|udqu|vdqv|wdqw|xdqx|ydqy|zdqz)[a-j](\x02ch|\x03biz)	2	0	0	1
+3469	3469	^(adra|bdrb|cdrc|ddrd|edre|fdrf|gdrg|hdrh|idri|jdrj|kdrk|ldrl|mdrm|ndrn|odro|pdrp|qdrq|rdrr|sdrs|tdrt|udru|vdrv|wdrw|xdrx|ydry|zdrz)[a-j](\x02ch|\x03biz)	2	0	0	1
+3470	3470	^(0+30)[0-9A-Z]+30[^0-9]	2	0	0	1
+3471	3471	[a-z]{4,10}\.velodrivve\.biz$	2	0	0	1
+3472	3472	[a-z]{4,10}\.bedrifg\.org$	2	0	0	1
+3473	3473	[a-z]{4,10}\.fedbook\.org$	2	0	0	1
+3474	3474	[a-z]{4,10}\.goodbird\.biz$	2	0	0	1
+3475	3475	[a-z]{4,10}\.verekt\.biz$	2	0	0	1
+3476	3476	[a-z]{4,10}\.barrout\.org$	2	0	0	1
+3477	3477	[a-z]{4,10}\.biojart\.biz$	2	0	0	1
+3478	3478	[a-z]{4,10}\.benefin\.org$	2	0	0	1
+3479	3479	\.(upda|getfile|dl\dx|dl|download|execute)\w*\s+ftp\x3a\x2f\x2f	2	0	0	1
+3480	3480	\/operator\/login\.php$	2	0	0	1
+3481	3481	^.{8}[\x20-\x7e]+?\x7b\x9e	2	0	0	1
+3482	3482	^Subject\x3a [^\r\n]+?Foi Instalado	2	0	0	1
+3483	3483	^\/[56]\d{4}\x2c.*?\x2c[A-Z]\x3a[\x2f\x5c].+?\.exe	2	0	0	1
+3484	3484	\x00\x07[a-z0-9]{7}\x02eu\x00	2	0	0	1
+3485	3485	[^a-z0-9\-\.][a-z]{32,48}\x02ru\x00\x00	2	0	0	1
+3486	3486	^ETag\x3a\x20\x22\d+75BCD15\d+\x3a[a-f0-9]{1,6}	2	0	0	1
+3487	3487	^<(<var1>[a-z])>[a-z0-9/]+<\/(=var1)><(<var2>[a-z])>[a-z0-9/]+<\/(=var2)>$	2	0	0	1
+3488	3488	^Host\x3a[^\r\n]+?cvredirect.no-ip.net/Hmi	2	0	0	1
+3489	3489	^Host\x3a[^\r\n]+?cvredirect.ddns.net/Hmi	2	0	0	1
+3490	3490	^Keylogger\r$	2	0	0	1
+3491	3491	^[\x22\x27]NEGOCIO_ONLINE(\.(zip|exe))[\x27\x22]\x0d\x0a	2	0	0	1
+3492	3492	^[A-F0-9]{48}\.bin\r\n	2	0	0	1
+3493	3493	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d+\/stat\x03\x08\x0c$	2	0	0	1
+3494	3494	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d+\/control\x03\x08\x0c$	2	0	0	1
+3495	3495	^Host\x3a[^\r\n]+?\r\n(\r\n)?$/Hi	2	0	0	1
+3496	3496	^Host\x3a[^\r\n]+\.asia\r\n/Hmi	2	0	0	1
+3497	3497	^Host\x3a[^\r\n]+\.ru\r\n/Hmi	2	0	0	1
+3498	3498	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title><\/html>$	2	0	0	1
+3499	3499	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+3500	3500	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+3501	3501	^[a-z0-9]{1,10}[A-F0-9]+\.bin\r\n$	2	0	0	1
+3502	3502	^\s*\s*?[\x22\x27]javax.naming.InitialContext	2	0	0	1
+3503	3503	\x7c([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})$	2	0	0	1
+3504	3504	^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/n\d+\.png$	2	0	0	1
+3505	3505	(JUNK|HOLD) Flooding (\d{1,3}\.){3}\d{1,3} for \d+ seconds.\r?\n	2	0	0	1
+3506	3506	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})Wrod--\\\$	2	0	0	1
+3507	3507	^(:?[78]|XP)	2	0	0	1
+3508	3508	\.php\?\d{1,4}$	2	0	0	1
+3509	3509	\.php\?\d{1,4}$	2	0	0	1
+3510	3510	\/config\.php\?id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+	2	0	0	1
+3511	3511	^AuthToken=[A-Za-z0-9+/]{43}=$	2	0	0	1
+3512	3512	\.[^\x3F]+\?id=\d+&act=\d+$	2	0	0	1
+3513	3513	^.{2}[A-Z]?[a-z]+\.[A-Z]?[a-z]+@gmail\.com[01]	2	0	0	1
+3514	3514	^[0-9A-Z]+232A	2	0	0	1
+3515	3515	^\d{1,3}$	2	0	0	1
+3516	3516	^(Cek\x20This|miss\x20[A-Za-z0-9]{2,20}|[A-Za-z0-9]{2,20}Porn)\r\n	2	0	0	1
+3517	3517	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3518	3518	^(likes|check|login_status)\.json\?	2	0	0	1
+3519	3519	^[0-9A-F]{16}$	2	0	0	1
+3520	3520	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3521	3521	^[A-F0-9]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\/	2	0	0	1
+3522	3522	^[a-z0-9/%=]{100,}$	2	0	0	1
+3523	3523	^(-[0-9]+|[A-F0-9]{32})=1$	2	0	0	1
+3524	3524	^(-[0-9]+|[A-F0-9]{32})=1&type=zip$	2	0	0	1
+3525	3525	^(-[0-9]+|[A-F0-9]{32})=1&type=filter$	2	0	0	1
+3526	3526	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}&u=	2	0	0	1
+3527	3527	^[A-Za-z0-9\/\.=]{250,}$	2	0	0	1
+3528	3528	^\d+\x0a$	2	0	0	1
+3529	3529	^[A-Za-z0-9]{25,}$	2	0	0	1
+3530	3530	^\d{2,4}$	2	0	0	1
+3531	3531	^[a-z0-9]{6}$	2	0	0	1
+3532	3532	^=?[a-z0-9]{6}$	2	0	0	1
+3533	3533	^(pe|pp|s)$	2	0	0	1
+3534	3534	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3535	3535	^(mfa\.[\w-]{84}|[\w-]{24}\.[\w-]{6}\.[\w-]{27})\x0d\x0a	2	0	0	1
+3536	3536	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})\d(\r\n)?$/Hmi	2	0	0	1
+3537	3537	&p=[a-z0-9]{12}(&v=[a-z0-9\.-]{1,24})?$	2	0	0	1
+3538	3538	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3539	3539	^[A-F0-9]{8}$	2	0	0	1
+3540	3540	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x00$	2	0	0	1
+3541	3541	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3542	3542	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+3543	3543	^[a-z]{200,}$	2	0	0	1
+3544	3544	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3545	3545	^(The White House|And increasing numbers|Drivers for a parcel|The Italian region worst hit|Although Interpol issued|President Donald Trump|Restaurants are still allowed|A paper released on Friday)	2	0	0	1
+3546	3546	^[a-f0-9]{32}$	2	0	0	1
+3547	3547	^[A-Za-z0-9\-_\.]{20,80}\.[a-z]{2}\d{2}\.com$	2	0	0	1
+3548	3548	^[a-fA-F0-9]{61}\.[a-fA-F0-9]{63}\.[a-fA-F0-9]{63}\.	2	0	0	1
+3549	3549	^88[a-fA-F0-9]{38}b9\.	2	0	0	1
+3550	3550	^8b[a-fA-F0-9]{46}b9\.	2	0	0	1
+3551	3551	&uuid=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+3552	3552	^[a-z]{256}$	2	0	0	1
+3553	3553	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3554	3554	\x2Fu\x2Fupd\x5F(cb|.+\x2Ecb)	2	0	0	1
+3555	3555	^(\d+|(\w+)?grabbers?|uploader)(&luck=\d)?$	2	0	0	1
+3556	3556	\x2F(data|main|patch)\x2Ecfg	2	0	0	1
+3557	3557	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3558	3558	c\x3d[0-9a-f]{100}	2	0	0	1
+3559	3559	\.php\?U=\d+@\d+@\d+@\d+@\d+@[a-f0-9]+$	2	0	0	1
+3560	3560	^(0-9]{1,3}\.){3}\d{1,3}$	2	0	0	1
+3561	3561	^[^?#]+?\.php\?f=\w+&e=\d+$	2	0	0	1
+3562	3562	id=[A-F0-9]{20}	2	0	0	1
+3563	3563	^(x\d{1,2}){5,}	2	0	0	1
+3564	3564	\?ca[sc]hingDeny=[0-9A-Za-z]{16}&	2	0	0	1
+3565	3565	^[a-f0-9]-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+3566	3566	^[a-f0-9]-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+3567	3567	^\d+$	2	0	0	1
+3568	3568	^\d+$	2	0	0	1
+3569	3569	^\d+$	2	0	0	1
+3570	3570	^[a-z0-9]{60}	2	0	0	1
+3571	3571	^[A-F0-9\-]+&ver=	2	0	0	1
+3572	3572	^[A-F0-9\-]+&ver=	2	0	0	1
+3573	3573	\/task.php\?id=[^&]{32,64}&task=\d	2	0	0	1
+3574	3574	^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}&a=	2	0	0	1
+3575	3575	c\x3d[0-9A-F]{100}	2	0	0	1
+3576	3576	^[a-f0-9]{100,200}\/[a-f0-9]{6,9}\/[A-Z0-9_]{4,200}\.com	2	0	0	1
+3577	3577	\.php\?m=\w&n=\w+_\w+(@|@.c|@.t)$	2	0	0	1
+3578	3578	^\d{5,9}$	2	0	0	1
+3579	3579	\x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+121212121212	2	0	0	1
+3580	3580	^[a-z]{3,6}\x3d[A-F0-9]{50}	2	0	0	1
+3581	3581	^([0-9A-F][0-9A-F]-){5}([0-9A-F][0-9A-F])	2	0	0	1
+3582	3582	verint=\d+&uid=\d+&wv=[A-Za-z0-9]+&report=\d+&abbr=[A-Za-z0-9]+&pid=\d	2	0	0	1
+3583	3583	^\d+$	2	0	0	1
+3584	3584	^(\d+|x.+)	2	0	0	1
+3585	3585	^[a-z0-9]{12,14}(&p2=([a-z0-9]([\._-])?){1,24}(_DROPPER)?)$	2	0	0	1
+3586	3586	id=x.+_[0-9A-F]{8}&build_id=.	2	0	0	1
+3587	3587	^[A-Za-z0-9+\/=]+?$	2	0	0	1
+3588	3588	v=\d+&rnd=\d	2	0	0	1
+3589	3589	\?mac=[0-9]*?&os=[a-z]*?&ver=[0-9]{8}&id=	2	0	0	1
+3590	3590	p4=\d+&p5=\d+&hs=\d	2	0	0	1
+3591	3591	^[a-f0-9]	2	0	0	1
+3592	3592	^\d	2	0	0	1
+3593	3593	\x2Ephp\x3Fid\x3D\d*\x26v\x3D\d*\x26tm\x3D\d*\x26b\x3D	2	0	0	1
+3594	3594	\.asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2})+&ver=\d	2	0	0	1
+3595	3595	id=\d+&bid=[^&]+&query=\w+&data=\w	2	0	0	1
+3596	3596	^[a-z]{1,4}\x3d[a-z0-9]+?$	2	0	0	1
+3597	3597	^\d{5}\x2eddns[a-z0-9]\x2eeu$	2	0	0	1
+3598	3598	^\/[A-Z]+\.php\?php=receipt$	2	0	0	1
+3599	3599	^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x3A[0-9]{1,5}	2	0	0	1
+3600	3600	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3601	3601	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3602	3602	^[a-f0-9]{8}\x2D[a-f0-9]{8}\x2D[a-f0-9]{8}\x2D[a-f0-9]{8}$	2	0	0	1
+3603	3603	^(id|key)=	2	0	0	1
+3604	3604	User-Agent\x3a[^\r\n]+[^\x20]\x3bTrident\/4\.0\x29\s\d{2}\x3a\d{2}\s\r$	2	0	0	1
+3605	3605	&userid=\d{4}&other=[MF]	2	0	0	1
+3606	3606	^[A-Z]{10}$	2	0	0	1
+3607	3607	^\x2F[a-f0-9]{40,60}$	2	0	0	1
+3608	3608	\/[a-z0-9]+$	2	0	0	1
+3609	3609	^[a-z0-9]{196}	2	0	0	1
+3610	3610	^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+3611	3611	^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+3612	3612	^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+3613	3613	\/[a-z]\/$	2	0	0	1
+3614	3614	^\/ad[^\x2f]*?\/\?[a-z]{1,5}\x3d\x2e?[a-z0-9]+?$	2	0	0	1
+3615	3615	^[a-z]{15}$	2	0	0	1
+3616	3616	^[a-z]{3,4}\/\d{1,4}$	2	0	0	1
+3617	3617	^subject=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})_((list|que)_done|ini(_done)?)&data	2	0	0	1
+3618	3618	^\d+?\x22	2	0	0	1
+3619	3619	^\/[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{5}\/\d+\/\d{2}[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{3}\/$	2	0	0	1
+3620	3620	^[^\r\n]+?\$	2	0	0	1
+3621	3621	^[A-Za-z0-9]{15}([A-Za-z0-9]{19})?$	2	0	0	1
+3622	3622	=[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+3623	3623	^[a-f0-9]{32}\/[0-9]$	2	0	0	1
+3624	3624	\/get\d*\.php\?c=[A-Z]{8}&d=[0-9A-F]{250,}$	2	0	0	1
+3625	3625	\/crypt_[^\/]*?sell[^\/]*?\d\.exe$	2	0	0	1
+3626	3626	\/[A-F0-9]+$	2	0	0	1
+3627	3627	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+3628	3628	^[^\x22\x2f\r\n]+?\x22\r\n	2	0	0	1
+3629	3629	^[^&]+?&\d+$	2	0	0	1
+3630	3630	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3631	3631	^id=[A-Z0-9]+?&info=[A-Z0-9]+?$	2	0	0	1
+3632	3632	^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}	2	0	0	1
+3633	3633	^\x2F(policy|cache)$	2	0	0	1
+3634	3634	^(ode)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&h(wid)	2	0	0	1
+3635	3635	(\?|&)guid=[^!&]+?\!	2	0	0	1
+3636	3636	^\d+\d+?(&ver=\d+?)?&req=\d+?(&r=)?$	2	0	0	1
+3637	3637	^mac=([A-F0-9]{2}-){5}[A-F0-9]{2}&t1=	2	0	0	1
+3638	3638	\.((jp|pn)g|cgi|gif)\?tq=	2	0	0	1
+3639	3639	^\/[b-u][A-Za-z0-9]{6,25}\.php$	2	0	0	1
+3640	3640	^Last-Modified\x3a(\s[^\r\n]{2}|[^\r\n\s]{3}),	2	0	0	1
+3641	3641	^\d{5,}$	2	0	0	1
+3642	3642	\?[0-9a-f]{6}$	2	0	0	1
+3643	3643	\?ID=[A-Z]{10}$	2	0	0	1
+3644	3644	^[0-9A-F]{12,24}	2	0	0	1
+3645	3645	^\x2F[a-f0-9]{40,60}$	2	0	0	1
+3646	3646	\.cgi\?s(id)\d{1,12}&r=	2	0	0	1
+3647	3647	\/([^\x2f]+?\/)?[a-z-_]+?\.(php|html)$	2	0	0	1
+3648	3648	^\x2fimage\x2f[A-Za-z0-9\+_-]+\.jpg$	2	0	0	1
+3649	3649	\/\/?$	2	0	0	1
+3650	3650	^(\x3a\d{1,5})?$	2	0	0	1
+3651	3651	^(\x3a\d{1,5})?$	2	0	0	1
+3652	3652	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})$	2	0	0	1
+3653	3653	^[A-Za-z0-9]{48}\x3a([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})$	2	0	0	1
+3654	3654	\/0\/$	2	0	0	1
+3655	3655	^[^\x2f]+\/[a-z0-9]+$	2	0	0	1
+3656	3656	\/([a-z]{4,9}\/[a-z]{3,10}\?[a-z_]{2,9}=[0-9]{2,8}|[a-z]{10})&[a-z]{5,9}=[a-zA-Z0-9_*]{30,}$	2	0	0	1
+3657	3657	^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}_	2	0	0	1
+3658	3658	^\/lolo\/[0-9]+\/[0-9]+\/[0-9]+\/[0-9]+\.html$	2	0	0	1
+3659	3659	^\/log\/[0-9]+\/[0-9]+\/\?id=[0-9]+$	2	0	0	1
+3660	3660	^\/[\/a-z0-9]+$	2	0	0	1
+3661	3661	^\/\?\d([A-Za-z0-9~_]{4})*([A-Za-z0-9~_]{2}--|[A-Za-z0-9~_]{3}-|[A-Za-z0-9~_]{4})$	2	0	0	1
+3662	3662	^\/UID\d+\.jsp\?	2	0	0	1
+3663	3663	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+3664	3664	\.php\?id=[a-zA-Z]{15,}&?x=\d+&?os=[0-9.]+&?n=\d	2	0	0	1
+3665	3665	^[0-9A-F]{550,}\.html	2	0	0	1
+3666	3666	\/Setup_\d+\.exe$	2	0	0	1
+3667	3667	\?0=.*\&1=.*\&2=.*\&3=.*\&4=.*\&5=.*\&6=.*\&7=.*\&8=	2	0	0	1
+3668	3668	&ver=\d\.\d$	2	0	0	1
+3669	3669	^\/([A-Fa-f0-9]+|index\.php)$	2	0	0	1
+3670	3670	^(c(omment|_id)|m(jdu)?)=	2	0	0	1
+3671	3671	^\/1+$	2	0	0	1
+3672	3672	(MSIE|rv\x3a11)	2	0	0	1
+3673	3673	\/\d+\.png\?uid=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+3674	3674	&data=([a-z]\d){7,}$	2	0	0	1
+3675	3675	^([a-z]\d){7,}\.zip\x22	2	0	0	1
+3676	3676	(MSIE|rv\x3a11\.0)	2	0	0	1
+3677	3677	^\x2f[a-zA-Z]{4,}\x2ephp\x3f[a-zA-Z]{2,10}\x3d([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+	2	0	0	1
+3678	3678	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+3679	3679	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})$	2	0	0	1
+3680	3680	=0[0-2](&\w+=[a-fA-F0-9]{8}){2}&\w+=[a-fA-F0-9]+$	2	0	0	1
+3681	3681	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3682	3682	0[0-2]0000[a-fA-F0-9]{16,}$	2	0	0	1
+3683	3683	^\d+$	2	0	0	1
+3684	3684	^([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})+	2	0	0	1
+3685	3685	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+?$	2	0	0	1
+3686	3686	^\x5b[^\r\n]+\(64\s=\s\d\)\sEXE\s=	2	0	0	1
+3687	3687	^[a-zA-Z0-9+/]{43}	2	0	0	1
+3688	3688	^winver=\d+&ver=\d+$	2	0	0	1
+3689	3689	^\/\?0=([^&]+?&\d+)+?[^=&]+?$	2	0	0	1
+3690	3690	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+3691	3691	^[a-z]{2,}=(%[A-F0-9]{2})+&	2	0	0	1
+3692	3692	^[a-z]{2,}=(%[A-F0-9]{2})+&	2	0	0	1
+3693	3693	^\/[^\x2f]+\/0000[A-F0-9]{4}\/0[0-2]\/[A-F0-9]{8}$	2	0	0	1
+3694	3694	^\/0[0-2]\/[^\x2f]+\/0000[A-F0-9]{4}\/[^\x2f]+\/[A-F0-9]{8}$	2	0	0	1
+3695	3695	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]svchost\.exe[\x22\x27]\r\n	2	0	0	1
+3696	3696	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]explorer\.exe[\x22\x27]\r\n	2	0	0	1
+3697	3697	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]hkcmd\.exe[\x22\x27]\r\n	2	0	0	1
+3698	3698	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]server\.exe[\x22\x27]\r\n	2	0	0	1
+3699	3699	^\d+?\/(\d+?\/-?\d+?\.(php|jsp))?$	2	0	0	1
+3700	3700	\?uid=\d+&context=\w+&mode=text&data=\w+$	2	0	0	1
+3701	3701	^\/\d+$	2	0	0	1
+3702	3702	^\/sys\/(who|genid|data|upload|update)	2	0	0	1
+3703	3703	^a=(%[0-9A-Fa-f]{2})+\x26b=[0-9A-Za-z]+(%3[dD]){0,2}\x26c=(%[0-9A-Fa-f]{2})+$	2	0	0	1
+3704	3704	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3705	3705	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3706	3706	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3707	3707	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3708	3708	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+3709	3709	^\/[a-z]+\/[a-z]+\.exe$	2	0	0	1
+3710	3710	\.php\?uid=\d{5,6}&ver=[^&]+(&traff=\d+)?$	2	0	0	1
+3711	3711	^Host\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+3712	3712	^[a-z]{4,12}=([A-Za-z0-9+/]{4})*[A-Za-z0-9+/]{3}=&[a-z]{4,12}=[A-Za-z0-9+/]{4}	2	0	0	1
+3713	3713	\/0[0-2](\/[^\/]*?)?\/0000[a-fA-F0-9]{4}(\/[^\/]*?)?\/[a-fA-F0-9]{8}(\?\w+=[a-fA-F0-9]+)?$	2	0	0	1
+3714	3714	^http\x3a\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/[a-z_-]+\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r?$	2	0	0	1
+3715	3715	^[C-J]\r\n	2	0	0	1
+3716	3716	^[A-Z]+$	2	0	0	1
+3717	3717	^(32|64)$	2	0	0	1
+3718	3718	\/$	2	0	0	1
+3719	3719	^[a-f0-9]+(\x20[a-f0-9]+)+$	2	0	0	1
+3720	3720	^\/-?[a-f0-9]{8,9}\/-?\d+(\.php|\/)$	2	0	0	1
+3721	3721	&_=\d+$	2	0	0	1
+3722	3722	&_=\d+$	2	0	0	1
+3723	3723	&_=\d+$	2	0	0	1
+3724	3724	^User-Agent\x3a[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x30442e9d036a40c8cbd41f8f4c9afab1ba\x20no-cache\r\n(\r\n)?$	2	0	0	1
+3725	3725	^\d+$	2	0	0	1
+3726	3726	^[a-z]=[a-f0-9]{80,}$	2	0	0	1
+3727	3727	\/[a-f0-9]{32}\.png$	2	0	0	1
+3728	3728	&(un)?key=[A-Z]+$	2	0	0	1
+3729	3729	\.php\?pn=[^&]+&s=[0-9]+&x=0\.[0-9]{7}$	2	0	0	1
+3730	3730	^\/([a-z]{4,9}\/[a-z]{4,12}\?[a-z]{4,7}\=[0-9]{5,7})$	2	0	0	1
+3731	3731	^\/p\?\d+(\x3b\d+){4}$	2	0	0	1
+3732	3732	^\/s\?\d+\x3b\d+\x3b\d{1,2}\.\d_(32|64)_\d+(\x3b\d+){4}$	2	0	0	1
+3733	3733	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3734	3734	\/[a-f0-9]{8}\/archive\/\d{8,10}\.html$	2	0	0	1
+3735	3735	\?[0-9a-f]{5,}=\d+&id=\d+&v=\d+$	2	0	0	1
+3736	3736	iid=[a-fA-F0-9]{32}&kernel=	2	0	0	1
+3737	3737	iid=[a-fA-F0-9]{32}&username=	2	0	0	1
+3738	3738	^[a-z]{2}\x3d[a-z0-9]+?[A-F0-9]+?$	2	0	0	1
+3739	3739	^\x2F[a-z]\x2Ephp\x3Fp\x3D[a-z0-9]{30,}$	2	0	0	1
+3740	3740	^\x2Ftrack\x2F\x3Fip\x3D\d&data\x3D	2	0	0	1
+3741	3741	\/\d{5}\/(<s1>[a-z]{3})[a-z]\.php\?(=s1)_id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3742	3742	^filename=[a-z]+?\.[a-z]+?&data=	2	0	0	1
+3743	3743	^Host\x3a[^\r\n]+\r\n(Connection\x3a\x20Keep-Alive\r\n)?(\r\n)?	2	0	0	1
+3744	3744	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+3745	3745	^\x0a([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})\x0a	2	0	0	1
+3746	3746	_W\d+\.[A-F0-9]+\/\d+\/[^\x2f]+\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/$	2	0	0	1
+3747	3747	x20InfoPath\x2e\d[^\x29]+$	2	0	0	1
+3748	3748	\/\d{4,}\.txt$	2	0	0	1
+3749	3749	\/([a-z]+|\d+)\.jpg	2	0	0	1
+3750	3750	\?[a-z0-9]{32}$	2	0	0	1
+3751	3751	[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+3752	3752	\.[a-z]{3,4}$	2	0	0	1
+3753	3753	\/[A-Za-z]{4,9}\.dot$	2	0	0	1
+3754	3754	\/get(_new)?\.php\?[a-zA-Z]{4,}=0\.[0-9]{10,}&key=[a-zA-Z0-9]{4,}$	2	0	0	1
+3755	3755	\/get(_new)?\.php\?[a-zA-Z]{4,}=0\.[0-9]{10,}&key=[a-zA-Z0-9]{4,}&pdf=[a-zA-Z]{4,}$	2	0	0	1
+3756	3756	^\/document\.php\?rnd=[0-9]{4}&id=[A-F0-9]{100,}$	2	0	0	1
+3757	3757	\/0[0-2](\/[^\/]*?)?\/0000[a-fA-F0-9]{4}(\/[^\/]*?)?\/[a-fA-F0-9]{8}(\?\w+=[a-fA-F0-9]+)?$	2	0	0	1
+3758	3758	^[a-zA-Z]{4,}=0\.[0-9]{10,}&jndj=[a-zA-Z0-9]{4,}$	2	0	0	1
+3759	3759	^[a-zA-Z]{4,}=0\.[0-9]{10,}&jndj=[a-zA-Z0-9]{4,}&ncm=[a-zA-Z]{4,}$	2	0	0	1
+3760	3760	^\/[a-f0-9]+000[a-f0-9]{37}$	2	0	0	1
+3761	3761	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3762	3762	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P	2	0	0	1
+3763	3763	\.php\?check=\d$	2	0	0	1
+3764	3764	^tekst=\w+$	2	0	0	1
+3765	3765	^User-Agent\x3a MSIE \d+\.\d+\r\n	2	0	0	1
+3766	3766	\/libso\d{1,4}\.php\?id=[a-zA-Z0-9]+$	2	0	0	1
+3767	3767	\/[0-9]{2}\.exe\?[0-9]$	2	0	0	1
+3768	3768	^\/0[a-f0-9]{48}$	2	0	0	1
+3769	3769	path=[A-Z]\x3a\x5c[A-F0-9]+\r\nlog=	2	0	0	1
+3770	3770	^(Connection\x0d\x0a)?\x0d\x0a$	2	0	0	1
+3771	3771	^[a-z0-9]{10,}$	2	0	0	1
+3772	3772	\?sid=[a-f0-9]{40}&cid=[0-9]$	2	0	0	1
+3773	3773	[A-F0-9]{8}(-[A-F0-9]{4}){2}-[A-F0-9]{8}	2	0	0	1
+3774	3774	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3775	3775	\/[A-Za-z]+\.php\?((id|token1|token2|C)=[A-Za-z0-9\/=+%]*={0,2}&?){4}$	2	0	0	1
+3776	3776	^([a-zA-Z]*?\d)([a-z0-9]*?[A-Z])[a-zA-Z0-9+/]{30}	2	0	0	1
+3777	3777	^[a-z]{256}$	2	0	0	1
+3778	3778	^[abcdefghiklmnopqrstvxyz123456789]{62}\.aaaaaaaaaaaa	2	0	0	1
+3779	3779	^(Connection\x3a[^\r\n]+\r\n)?Accept\x3a[^\r\n]+\r\n(Accept-Encoding\x3a[^\r\n]+\r\n)?Accept-Language\x3a[^\r\n]+\r\n(Referer\x3a[^\r\n]+[^\r\n]*?\r\n)?User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)	2	0	0	1
+3780	3780	\.php\?lid=[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$	2	0	0	1
+3781	3781	^[A-F0-9]{2}F4[A-F0-9]{2}0(1|2|3)[A-F0-9]{8}	2	0	0	1
+3782	3782	&m=\d$	2	0	0	1
+3783	3783	^[a-f0-9]{31}\x3B([a-zA-Z0-9+/=]+)?\r?$	2	0	0	1
+3784	3784	\?q=[a-f0-9]{32}$	2	0	0	1
+3785	3785	^(<id>[a-z])\x22\sname=\x22(=id)\x22>TVqQAA	2	0	0	1
+3786	3786	^version=\d{4}-\d{1,2}-\d{1,2}$	2	0	0	1
+3787	3787	[\x80-\xff]	2	0	0	1
+3788	3788	(xyz|pw)$	2	0	0	1
+3789	3789	^[A-Z0-9_-]+\.analytics-akadns\.com$	2	0	0	1
+3790	3790	^[A-Z0-9_-]+\.akamai-analytics\.com$	2	0	0	1
+3791	3791	^[A-Z0-9_-]+\.akamai-information\.com$	2	0	0	1
+3792	3792	^[A-Z0-9_-]+\.akamai-technologies\.com$	2	0	0	1
+3793	3793	^[A-Z0-9_-]+\.sync-akamai\.com$	2	0	0	1
+3794	3794	^\/[^\r\n]+\.php\?[a-f0-9]{32}(=(%3D|\x3d)*[A-Za-z0-9%\/]+&[a-f0-9]{32}){4,}=(%3D|\x3d)*[A-Za-z0-9%\/]+$	2	0	0	1
+3795	3795	^.{0,15}[^\x20-\x7e\r\n]	2	0	0	1
+3796	3796	\?---[A-Z]$	2	0	0	1
+3797	3797	^\/help(me)?\.bmp$	2	0	0	1
+3798	3798	\/[a-z0-9]{16}\.php\?ufw=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3799	3799	(BrowsingHistoryView|WebBrowserPassView)\.exe$	2	0	0	1
+3800	3800	[\x80-\xff]	2	0	0	1
+3801	3801	\.php\?a=\d{5,10}.+\x3a\d\x3a\d\x3a\d\.\d\x3a\d$	2	0	0	1
+3802	3802	=8ACEFC[0-9A-F]{150,}$	2	0	0	1
+3803	3803	\?[a-f0-9]{32}$	2	0	0	1
+3804	3804	^ps0=[A-F0-9]+\&ps1=[A-F0-9]+($|\&[a-z]s\d=)	2	0	0	1
+3805	3805	\.php\?computerid=[a-fA-F0-9]{32}&(public|private)=\d$	2	0	0	1
+3806	3806	^[^_]+_[^\_]+_[A-F0-9]{10}_[0-9]{2}-[0-9]{2}-20[0-9]{2}\s[0-9]{1,2}\.[0-9]{1,2}\.[0-9]{1,2}\.	2	0	0	1
+3807	3807	\/(tr(_w)?|ft)\.so$	2	0	0	1
+3808	3808	^([a-zA-Z0-9+/\x20]{4})*([a-zA-Z0-9+/\x20]{2}==|[a-zA-Z0-9+/\x20]{3}=|[a-zA-Z0-9+/\x20]{4})$	2	0	0	1
+3809	3809	^\/v\d+\/lady_[ix]	2	0	0	1
+3810	3810	\/(IUpdate|fbclient|IETask|Mixeds|Ubuntu10)\.dll$	2	0	0	1
+3811	3811	\?action=\d(&botId=[A-F0-9]{32})?$	2	0	0	1
+3812	3812	^[^&]+?\.html\?s=[^&]+?&d=$	2	0	0	1
+3813	3813	\/victim\.php\?info=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&ip=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3814	3814	\/savekey\.php\?file=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3815	3815	\/images\/.*_2[FB].*\.(avi|gif|bmp|jpeg|png)$	2	0	0	1
+3816	3816	^[A-F0-9]{8}$	2	0	0	1
+3817	3817	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a)?	2	0	0	1
+3818	3818	^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$	2	0	0	1
+3819	3819	^\/kb\/\d{4,8}$	2	0	0	1
+3820	3820	\.[a-z]{3}\?[a-z]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3821	3821	^[a-zA-Z]{7}=([A-Za-z0-9+/]|%2[FB]){2}AAAA[a-z]A[^\s=]+=?$	2	0	0	1
+3822	3822	END\x20CERTIFICATE-----$	2	0	0	1
+3823	3823	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+3824	3824	^get=\d+($|&)	2	0	0	1
+3825	3825	^(Mozilla\/|Shockwave)	2	0	0	1
+3826	3826	=11&[^&]{1,7}2[^&]{6,12}&[^&]{1,7}410&[^&]{1,7}650&[^&]{1,7}51$	2	0	0	1
+3827	3827	(\x20MSIE\x20|rv\x3a11)	2	0	0	1
+3828	3828	^id=[0-9A-Z]+&count=	2	0	0	1
+3829	3829	^guid=[^&]+?&ver=[^&]+?(&fc=[^\r\n]+)?$	2	0	0	1
+3830	3830	\.php\?rid=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3831	3831	^machine=[^&]+$/Pi	2	0	0	1
+3832	3832	\.(arm(5n|7)?|m(ips|psl))$	2	0	0	1
+3833	3833	[a-z]+\.php\?aid=\d+&sid=[a-z0-9]+$	2	0	0	1
+3834	3834	^\/oscp\/[a-z]+$	2	0	0	1
+3835	3835	\/(countdown|check)\/[a-f0-9]{30,45}\/([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})?$	2	0	0	1
+3836	3836	\.php\?key=[^\r\n]+&string=[^\r\n]+?(\x3a\x3a[^\x3a]+?){5,}$	2	0	0	1
+3837	3837	\.php\?key=[^\r\n]+&string=[^\r\n]+?((\x3a\x3a|3A3A)[^\x3a]+?){5,}$	2	0	0	1
+3838	3838	^((Passwords|PCinformation)\.txt|(Data|GrabbedTxtFiles)\.zip)\x22\r\n	2	0	0	1
+3839	3839	\/[a-z]+2\.php\?jpg=[^&]+$	2	0	0	1
+3840	3840	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$	2	0	0	1
+3841	3841	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$	2	0	0	1
+3842	3842	\.php\?Hwid=[^&]+[0-9](&(Pc|Etat)=[^&]+)?(&user=[^&]+&Ip=[^&]+&Ping=[^&]+&v=[^&]+&Ville=[^&]+&Pays=[^&]+&Region=[^&]+)?$	2	0	0	1
+3843	3843	\.php\?[a-z]{3,8}=[a-f0-9]{16}[01][a-z]+$	2	0	0	1
+3844	3844	^((a((lbu|d)m|ccount|uthor)|c(ont(ac|en)|lien)t|p(artners|hoto)|(memb|us)er|session|video|hash|key|id)=[a-z0-9]{6,12}&){4}	2	0	0	1
+3845	3845	\.(aspx|txt)\?[a-z0-9]{3}=[a-f0-9]{32}&[a-z0-9]{3}=[^&]+&[a-z0-9]{3}=[a-f0-9]{32}$	2	0	0	1
+3846	3846	\.php\?string=[a-zA-Z0-9+=]+$	2	0	0	1
+3847	3847	^([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})$	2	0	0	1
+3848	3848	^c=[A-F0-9]{10,}&v=[^&]+&h=[^&]+&t=[0-9]$	2	0	0	1
+3849	3849	^([a-f0-9]{30,60})$	2	0	0	1
+3850	3850	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3851	3851	\x26affid\x3D[0-9]{4,7}$	2	0	0	1
+3852	3852	[\x80-\xff]{16}	2	0	0	1
+3853	3853	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+3854	3854	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}	2	0	0	1
+3855	3855	^[0-9a-f]{4,8}\x3d\x2d?\d+(&id\x3d\d+)?$	2	0	0	1
+3856	3856	^[A-Z0-9]{18}$	2	0	0	1
+3857	3857	^[a-z]{3,4}\x2F[a-f0-9]{24}$	2	0	0	1
+3858	3858	^\/[a-z0-9]{1,10}\/?\?.+?$	2	0	0	1
+3859	3859	\/[a-z0-9A-Z]\.exe$	2	0	0	1
+3860	3860	^\d+$	2	0	0	1
+3861	3861	^\d+$	2	0	0	1
+3862	3862	^\/[a-z0-9+\/=]{16,400}$	2	0	0	1
+3863	3863	&s=\{?[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}\}?(&|$)	2	0	0	1
+3864	3864	^(cache|logs)\/[^\x2f]+\.(exe|dll|doc|bin)$	2	0	0	1
+3865	3865	^\/[a-z0-9.&-]+([a-z0-9]{4}-){3}[a-z0-9.&+-]+$	2	0	0	1
+3866	3866	=\d+$	2	0	0	1
+3867	3867	\/[A-Z0-9]+\.[aj]sp\?[a-zA-Z0-9+/\x20=]+$	2	0	0	1
+3868	3868	\.php\?w=\d+&i=[0-9a-f]{32}&a=\d+$	2	0	0	1
+3869	3869	\?action=\w+gen&v=\d	2	0	0	1
+3870	3870	\/counter(\?[a-z]?\d{1,2}|[^\x2f]*\d\.exe|.*?[]([A-Za-z_-]{0,200}[0-9][A-Za-z_-]{0,200}[0-9])([A-Z0-9_-]{0,200}[a-z][A-Z0-9_-]{0,200}[a-z])([a-z0-9_-]{0,200}[A-Z][a-z0-9_-]{0,200}[A-Z])[A-Za-z0-9_-]{50,}(&|$)	2	0	0	1
+3871	3871	^[^\r\n]+\.(jpe?g|gif|png)\r\n	2	0	0	1
+3872	3872	^\/report[0-9]?_(v[0-9])?[A-Z]?[A-F0-9_-]+_[0-9]{1,3}_(st(arted|ep)|already|mark|p(rocess|a(ge|yload))|watch2|http|image|gdiplus|crc|DIRRR|finished|(ex(cept|ecuted)))	2	0	0	1
+3873	3873	\/[a-z]+\.php\?[A-F0-9]{250,}$	2	0	0	1
+3874	3874	^Accept\x3a\x20text\/\*,\x20application\/\*\r\nUser-Agent\x3a\x20[^\r\n]+\r\n(Pragma|Cache-Control)\x3a\x20no-cache\r\nConnection\x3a Keep-Alive\r\nHost\x3a[^\r\n]+?\r\n(\r\n)?$	2	0	0	1
+3875	3875	^[A-F0-9]{250,}$	2	0	0	1
+3876	3876	^\d+?$	2	0	0	1
+3877	3877	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3878	3878	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}	2	0	0	1
+3879	3879	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3880	3880	^\/debug\/trace\/(Fw(Downloaded|Check)|N(oFw|sis))$	2	0	0	1
+3881	3881	^\/[a-z]+\.php\?num=\d+&rev=	2	0	0	1
+3882	3882	^[A-Za-z0-9]{14,15}$	2	0	0	1
+3883	3883	^\d{2}$	2	0	0	1
+3884	3884	\.php\?v\x3d\d+?\x26rs\x3d((\d+?\x2d){3})?\d+?\x26n\x3d\d	2	0	0	1
+3885	3885	^(<vname>[^\r\n\x3a]+)(<n1>[0-4])\x3a\x20\d+\r\n(=vname)(<n2>(((=n1))[0-4]))\x3a\x20\d+\r\n(=vname)(<n3>((((=n1)|(=n2)))[0-4]))\x3a\x20\d+\r\n(=vname)((((=n1)|(=n2)))[0-4])\x3a\x20\d+\r\n	2	0	0	1
+3886	3886	\/counter\/\?id=[A-Z0-9_-]{60,}&rnd=\d{1,}$	2	0	0	1
+3887	3887	^[0-9a-f]{32}\.php	2	0	0	1
+3888	3888	^[A-F0-9]{30}	2	0	0	1
+3889	3889	^[a-f0-9]{24}$	2	0	0	1
+3890	3890	^\x00\x00\x00[\x72-\x74]	2	0	0	1
+3891	3891	(\d{1,3}\.){3}\d{1,3} (\d{1,3}\.){3}\d{1,3} \x3a(Linux|FreeBSD|SunOS)	2	0	0	1
+3892	3892	^\d+[\x22\x27]	2	0	0	1
+3893	3893	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3894	3894	^[0-9]{2,3}\x00\x6c\x6c(<var>[\x20-\x2f\x30-\x39\x3a-\x40\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x5b-\x60\x7b-\x7e])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(=var)[^\r\n]+(=var)$	2	0	0	1
+3895	3895	^(-[0-9]+|[A-F0-9]{32})=1&type=txt$	2	0	0	1
+3896	3896	^([a-f0-9]{2}-){5}[a-f0-9]{2}	2	0	0	1
+3897	3897	^[a-f0-9]{18}\x22	2	0	0	1
+3898	3898	^(<id>[a-z])\x22\sname=\x22(=id)\x22>[a-zA-Z0-9+/=]{28}	2	0	0	1
+3899	3899	^[A-Za-z0-9]{10,}[\-\)\(]{1,2}	2	0	0	1
+3900	3900	data=[a-zA-Z0-9\+\/]{64}/P	2	0	0	1
+3901	3901	<root><clnt>\d{8}-\d{4}-\d{4}-\d{4}-[0-9A-F]{12}</clnt><code>CheckUpdate</code>/P	2	0	0	1
+3902	3902	\d{2}\x7C\d{1,3}\x7C\d{1,3}http\x3A\x2F\x2F	2	0	0	1
+3903	3903	^X-ID\x3a\x20\d+\r?$/Hm	2	0	0	1
+3904	3904	\/ff\.ie\?rnd=\x2d?\d	2	0	0	1
+3905	3905	c=[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}	2	0	0	1
+3906	3906	^.{2}(<fake_org>([asdfgh]+|[qwerty]+|[zxcvbn]+|[23werf]+)[01]).+?\x06\x03\x55\x04\x0a.{2}(=fake_org)	2	0	0	1
+3907	3907	^\d{1,6}\x00msg\x7c	2	0	0	1
+3908	3908	^\/counter\/\?([a-z]=(0\.\d{8}|1[A-Z0-9a-z]+))+&r=\d+$	2	0	0	1
+3909	3909	[^A-Za-z0-9+/]TVqQA	2	0	0	1
+3910	3910	\/im(age|g)\.php\?id=\d+$	2	0	0	1
+3911	3911	^.{1,1000}p([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?o([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?w([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?r([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?s([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?h([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l	2	0	0	1
+3912	3912	^(-[0-9]+|[A-F0-9]{32})=1$	2	0	0	1
+3913	3913	^([a-z0-9]{0,19}[A-Z])(([A-Z0-9]{0,19}[a-z])|([A-Za-z]{0,19}\d)|([A-Z]+\.))[a-zA-Z0-9]{3,20}[\x2e\x20][a-z]{2,3}$	2	0	0	1
+3914	3914	^.{0,15}[^\x20-\x7e\r\n]	2	0	0	1
+3915	3915	^\d{30}\w{6}-\d{2}-\d{3}-\d{9}$	2	0	0	1
+3916	3916	(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3917	3917	^[a-zA-Z0-9/+]{171}=	2	0	0	1
+3918	3918	ms-?office	2	0	0	1
+3919	3919	^(Connection\r\n)?\r\n$	2	0	0	1
+3920	3920	^(Connection\r\n)?\r\n$	2	0	0	1
+3921	3921	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3922	3922	^[0-9]+lu[0-9]+d[0-9]+$	2	0	0	1
+3923	3923	^[a-f0-9]{16}$	2	0	0	1
+3924	3924	^[a-z0-9_\/+-]{1000}	2	0	0	1
+3925	3925	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3926	3926	^\d{4,8}$	2	0	0	1
+3927	3927	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3928	3928	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3929	3929	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3930	3930	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3931	3931	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3932	3932	^[\x00-\x01]\x00.\x00[\x00-\x01]\x00.\x00.{4}\x01\x00.\x00{3}.{48}\x05\x00{3}	2	0	0	1
+3933	3933	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3934	3934	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3935	3935	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3936	3936	^[\x00-\x01]\x00.\x00[\x00-\x01]\x00.\x00.{4}\x01\x00.\x00{3}.{48}\x05\x00{3}	2	0	0	1
+3937	3937	^Host\x3a\x20[^\r\n]+\r\n(Connection\x3a\x20Keep-Alive\r\n)?(\r\n)?$	2	0	0	1
+3938	3938	^(WOW64\x3b\s)?Trident\/[457]\.0\x3b\s*SLCC2\x3b\s\.NET\sCLR\s2\.0\.50727\x3b\s\.NET\sCLR\s3\.5\.30729\x3b\s(\x20\.NET\x20CLR\x203\.5\.30729\x3b\s)?\.NET\sCLR\s3\.0\.30729\x3b\sMedia\sCenter\sPC\s6\.0\x3b\s\.NET4\.0C\x3b\s\.NET4\.0E(\.NET4\.0E(\x3b\s)?)?(\x3b\sInfoPath\.3)?\)$	2	0	0	1
+3939	3939	^[a-z0-9]+\.(biz|com|net|org)	2	0	0	1
+3940	3940	\/wp-(content|admin|includes)\/	2	0	0	1
+3941	3941	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3942	3942	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3943	3943	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3944	3944	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3945	3945	^[A-Za-z0-9\/\-\+]{40,}\.=auth\.	2	0	0	1
+3946	3946	^[A-Za-z0-9\/\-\+]{10,}\.=connect\.	2	0	0	1
+3947	3947	^[A-Za-z0-9\/\-\+]{10,}AAAA--\.	2	0	0	1
+3948	3948	^[A-Z]{2}-[0-9]{1,5}\x3aEnd(\x3a[0-9]{1,5})?$	2	0	0	1
+3949	3949	^[a-z0-9]{8}	2	0	0	1
+3950	3950	^(\d{1,3}\.)\d{1,3}$	2	0	0	1
+3951	3951	^\/[a-z]\.php\?query=[a-f0-9]{32}$	2	0	0	1
+3952	3952	^[A-F0-9]{50,}$	2	0	0	1
+3953	3953	^([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=|[A-Z0-9+\/]{4})$	2	0	0	1
+3954	3954	^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$	2	0	0	1
+3955	3955	^data=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3956	3956	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+3957	3957	^(<js>\$[a-z0-9]{1,15})\s*=\s*\[System\.Text\.Encoding\]::ASCII\.GetString\(\[System\.Convert\]::FromBase64String\((=js)\)\)\s*Set-Content\s*(-Path\s*C:\\Windows\\Temp\\[a-z0-9]{1,15}\.[a-z0-9]{2,4}\s*|-Value\s*(=js)\s*|-Encoding\s*ASCII){3}	2	0	0	1
+3958	3958	^(<content>\[a-z0-9]{1,15})\s*=\s*\[System\.Convert\]::FromBase64String\(\$[a-z0-9]{1,15}\)\s*Set-Content\s*(-Path\s*C:\\Windows\\Temp\\[a-z0-9]{1,15}\.vbe\s*|-Value\s*(=content)\s*|-Encoding\s*Byte){3}	2	0	0	1
+3959	3959	^[a-zA-Z0-9\x21\x2a\x2f\x2e\x3b\x3a\x5b\x5d\x7b\x7d]+$	2	0	0	1
+3960	3960	^[0-9]{3,5}\s*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+3961	3961	^[a-z0-9]{3,10}$	2	0	0	1
+3962	3962	^[a-z0-9]{5,30}$	2	0	0	1
+3963	3963	^\d{3,15}$	2	0	0	1
+3964	3964	^\/([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3965	3965	^[a-z]{3,10}=[a-z0-9]+$	2	0	0	1
+3966	3966	^[a-z]{3,10}=[a-z0-9]+$	2	0	0	1
+3967	3967	^[a-z]{3,10}=[a-z0-9]+$	2	0	0	1
+3968	3968	^\.(space|press|website)$	2	0	0	1
+3969	3969	^\/hyllkjit\/[a-f0-9]{8}\/\?n=\d{4,10}$	2	0	0	1
+3970	3970	^9([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3971	3971	^(\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?<pushvar>\.push\x28\x22)(\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)([\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)([\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)	2	0	0	1
+3972	3972	^lessie(\/[0-9]\.0)?$	2	0	0	1
+3973	3973	^Cakle(\/[0-9]\.0)?$	2	0	0	1
+3974	3974	^Damien(\/[0-9]\.0)?$	2	0	0	1
+3975	3975	^Solar(\/[0-9]\.0)?$	2	0	0	1
+3976	3976	^muhstik(-scan)?(\/[0-9]\.0)?$	2	0	0	1
+3977	3977	^Shaolin(\/[0-9]\.0)?$	2	0	0	1
+3978	3978	^Rift(\/[0-9]\.0)?$	2	0	0	1
+3979	3979	^Tsunami(\/[0-9]\.0)?$	2	0	0	1
+3980	3980	^Yowai(\/[0-9]\.0)?$	2	0	0	1
+3981	3981	^Yakuza(\/[0-9]\.0)?$	2	0	0	1
+3982	3982	^Hentai(\/[0-9]\.0)?$	2	0	0	1
+3983	3983	\/[A-Za-z0-9]{2,8}[-_][a-zA-Z0-9-_]+\/\?InvoiceType=Regular&date=[0-9-_]+$	2	0	0	1
+3984	3984	^[A-F0-9]+\x2d\x2d\x3e(\r\n)?$	2	0	0	1
+3985	3985	^CN=(help|g(ui(de|ld)|round))\.domainoutlet\.site$	2	0	0	1
+3986	3986	^CN=((jasper|qwe|alter|car|param|bike|genwar)\.)?drivethrough\.top$	2	0	0	1
+3987	3987	^CN=((justin|digest)\.)?drinkeatgood\.space$	2	0	0	1
+3988	3988	^\d	2	0	0	1
+3989	3989	^\/[a-zA-Z0-9]{1,19}\/?\?[abdefijhgv\x22](\x7C\x2d?\d+?[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\%^&\(\)\x20_{}\.~]{1,14})?$	2	0	0	1
+3990	3990	^\/(<n>\d)(=n){1,2}$	2	0	0	1
+3991	3991	\/\d+$	2	0	0	1
+3992	3992	^\/[a-f0-9]{7,8}\/[a-f0-9]{7,8}\/$	2	0	0	1
+3993	3993	^GET\x20\/[A-F0-9]{32}\x20HTTP\/1\.1\r\nHost\x3a\x20[^\r\n]+\r\n\r\n$	2	0	0	1
+3994	3994	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3995	3995	_[A-F0-9]{12}\.jpg$	2	0	0	1
+3996	3996	_[A-F0-9]{12}&filename=\w{1,20}\.jpg$	2	0	0	1
+3997	3997	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+3998	3998	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+3999	3999	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+4000	4000	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4001	4001	^[0-9]{3}$	2	0	0	1
+4002	4002	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4003	4003	^.+(IlR5cGUiO|JUeXBlIj|iVHlwZSI6)	2	0	0	1
+4004	4004	\.jpg\?v=\d+&d=(\d{8}T\d{6}Z)([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+4005	4005	^\/[^\x2f]+\/pops[a-z]?\.php$	2	0	0	1
+4006	4006	\.php\?s=\d+&cn=	2	0	0	1
+4007	4007	^[a-z]{4,10}\.freemooon\.org$	2	0	0	1
+4008	4008	[a-z]{4,10}\.olimpian\.org$	2	0	0	1
+4009	4009	[a-z]{4,10}\.sunsay\.biz$	2	0	0	1
+4010	4010	[a-z]{4,11}\.feellgood\.org$	2	0	0	1
+4011	4011	[a-z]{4,11}\.kinomix\.org$	2	0	0	1
+4012	4012	[a-z]{4,10}\.beneton\.biz$	2	0	0	1
+4013	4013	[a-z]{4,10}\.bigdoggi\.biz$	2	0	0	1
+4014	4014	[a-z]{4,10}\.bjksfohseaguu\.org$	2	0	0	1
+4015	4015	[a-z]{4,10}\.closedoors\.net$	2	0	0	1
+4016	4016	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4017	4017	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4018	4018	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4019	4019	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4020	4020	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$	2	0	0	1
+4021	4021	^(www|bbs|cms|down|up|file|ftp)	2	0	0	1
+4022	4022	\/log\/proc\.php.key=[a-z0-9]{11}	2	0	0	1
+4023	4023	code=[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}	2	0	0	1
+4024	4024	x=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+4025	4025	mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+4026	4026	^RAV\d\.\d\d	2	0	0	1
+4027	4027	^([a-z0-9:.,]{3,10}\s){50,}[a-z0-9:.,]{3,10}\s*$	2	0	0	1
+4028	4028	^[a-zA-Z0-9]{20}	2	0	0	1
+4029	4029	\x2E(p(hp|ng)|jpe?g|cgi|gif)\x3F(v\d{1,2}|pr)\x3D	2	0	0	1
+4030	4030	\/\?rnd=\d+&id=\d+$	2	0	0	1
+4031	4031	port=[1-9]{1,5}	2	0	0	1
+4032	4032	\/getfile\.php\?r=-?\d+&p=	2	0	0	1
+4033	4033	\/manda\.php\?id=(-)?\d{8,10}&v=\w	2	0	0	1
+4034	4034	\/\?id(\d+)?&rnd=\d+$	2	0	0	1
+4035	4035	\.php\?hdr_ctx=[0-9]{1,5}_[0-9]{1,5}$	2	0	0	1
+4036	4036	^\/\d+\.functions$	2	0	0	1
+4037	4037	\/\d{10}$	2	0	0	1
+4038	4038	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4039	4039	^[A-F0-9]{100,}$	2	0	0	1
+4040	4040	^\d	2	0	0	1
+4041	4041	^\/[a-z-_]+?\.(php|html)$	2	0	0	1
+4042	4042	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4043	4043	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+4044	4044	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4045	4045	^data=[a-zA-Z0-9+\/]{64}	2	0	0	1
+4046	4046	^\d{4}$	2	0	0	1
+4047	4047	\.(jpg|png|gif)\?v[0-9]{1,2}=[0-9]+&tq=	2	0	0	1
+4048	4048	^\/[mp]od[12]\/[^\/]+?\.exe$	2	0	0	1
+4049	4049	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4050	4050	\/[0-9]{2}\.exe$	2	0	0	1
+4051	4051	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+4052	4052	[\x80-\xff]	2	0	0	1
+4053	4053	\.(me|net)$/W	2	0	0	1
+4054	4054	\/[A-Z]?[a-z]{1,3}[0-9]?\.exe$	2	0	0	1
+4055	4055	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4056	4056	^[a-z]\.	2	0	0	1
+4057	4057	^((malwarehuntertea|nomoreranso)m|politiaromana|ransomware|carder)\.(bit|coin)$	2	0	0	1
+4058	4058	^((malwarehuntertea|nomoreranso)m|politiaromana|ransomware|carder)\.(bit|coin)$	2	0	0	1
+4059	4059	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4060	4060	^m=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+4061	4061	^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$	2	0	0	1
+4062	4062	\/[0-9]{10}.php1$	2	0	0	1
+4063	4063	^[A-F0-9]{10,}(BBZ|BBY)[A-F0-9]{,1000}$	2	0	0	1
+4064	4064	^[A-F0-9]{10,}$	2	0	0	1
+4065	4065	^[A-F0-9]{10,}$	2	0	0	1
+4066	4066	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+4067	4067	^\/d[0-9]?\.php\?check$	2	0	0	1
+4068	4068	^\/d[0-9]?\.php\?servers$	2	0	0	1
+4069	4069	^\/[a-z]\.php\?check=[a-f0-9]{32}$	2	0	0	1
+4070	4070	^[a-f0-9]{8}$	2	0	0	1
+4071	4071	\.aspx\?m=[A-F0-9]{3,40}&i=[A-F0-9]{3,40}&p=[A-F0-9]{3,40}$	2	0	0	1
+4072	4072	^([\x3a\x2c\x2e]?[A-Za-z0-9]{1,8}[\x3a\x2c\x2e]?[\x3a\x2c\x2e]?\s*){50,}$	2	0	0	1
+4073	4073	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4074	4074	^[a-z]{1,10}=[A-Z]+(&[a-z]{1,10}=[A-Z]+){2,}$	2	0	0	1
+4075	4075	^[A-F0-9]{16}$	2	0	0	1
+4076	4076	\/rpt\d	2	0	0	1
+4077	4077	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4078	4078	^\/fbot\.arm\d{1}\.u$	2	0	0	1
+4079	4079	^\/[A-F0-9]{30,60}\/1\/0\/0$	2	0	0	1
+4080	4080	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4081	4081	^[A-F0-9]+$	2	0	0	1
+4082	4082	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+4083	4083	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+4084	4084	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+4085	4085	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+4086	4086	^[a-z0-9\-\.]{1,60}\.ssmailer\.com$	2	0	0	1
+4087	4087	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4088	4088	^[a-z]=[a-f0-9]{80,}$	2	0	0	1
+4089	4089	^Mozilla\/\d+\.\d+\x20\x28compatible\x3b\x20MSIE\x20\d+\.\d+\x3b\x20Windows\x20NT\x20\d+\.\d+\x3b\x20SV1\x29$	2	0	0	1
+4090	4090	^php.{0,500}[\x80-\xff]	2	0	0	1
+4091	4091	^[a-zA-Z0-9_-]{2,6}=[a-zA-Z0-9_-]+(\x3b\x20[a-zA-Z0-9_-]{2,6}=[a-zA-Z0-9_-]+){1,6}={0,2}?$	2	0	0	1
+4092	4092	^[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(&[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$	2	0	0	1
+4093	4093	^[A-F0-9]{8}_[A-F0-9]{8}\.sql	2	0	0	1
+4094	4094	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+4095	4095	\/[a-z-_]{75,}\.php$	2	0	0	1
+4096	4096	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4097	4097	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4098	4098	^[^\x20-\x7e\r\n]{2}$	2	0	0	1
+4099	4099	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+4100	4100	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4101	4101	^\/\?([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4102	4102	^[a-zA-Z0-9=/&?\x2e-]+$	2	0	0	1
+4103	4103	^\d{5,10}$	2	0	0	1
+4104	4104	^[a-z0-9/%=]{100,}$	2	0	0	1
+4105	4105	\/[a-z0-9]+\/[a-z0-9]+\.exe$	2	0	0	1
+4106	4106	^[a-zA-Z0-9]+$	2	0	0	1
+4107	4107	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[A-Za-z]+?	2	0	0	1
+4108	4108	^.([a-z0-9+/]*?[A-Z])([A-Z0-9+/]*?[a-z])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\.29a\.de$	2	0	0	1
+4109	4109	(^|\.)en-content\.com$	2	0	0	1
+4110	4110	ch=1$	2	0	0	1
+4111	4111	^\/\?ptrxcz_[a-z0-9A-Z]{30}$	2	0	0	1
+4112	4112	[a-z]{2}\.CAB.bin	2	0	0	1
+4113	4113	\.php\?(print_)?receipt=(s00|\d{3})_\d+$	2	0	0	1
+4114	4114	^sleep \d+[\r\x2c]	2	0	0	1
+4115	4115	\.php\?id=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}&os=\d\.\d[^&]*&bot_id=	2	0	0	1
+4116	4116	\.php\?id=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}-(\d{1,3}\.){3}\d{1,3}&gr	2	0	0	1
+4117	4117	\(b\x3a\d+?\x3bc\x3aAMD-	2	0	0	1
+4118	4118	\(b\x3a\d+?\x3bc\x3aINT-	2	0	0	1
+4119	4119	^\/uploading\/id=\d{2,20}&u=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4120	4120	user=[a-f0-9]{31,32}&	2	0	0	1
+4121	4121	^$	2	0	0	1
+4122	4122	\/gate\.php\?reg=([a-z]{10}|[A-Za-z]{15})$	2	0	0	1
+4123	4123	\(b\x3a\d+?\x3bc\x3a[^\x3b]+AuthenticAMD\x3b	2	0	0	1
+4124	4124	\(b\x3a\d+?\x3bc\x3a[^\x3b]+GenuineIntel\x3b	2	0	0	1
+4125	4125	\?hostid=[0-9A-F]+?&	2	0	0	1
+4126	4126	^\/[a-z0-9]{3,}\/upload\/img\.jpg$	2	0	0	1
+4127	4127	\.php\?[a-zA-Z0-9]+[a-zA-Z0-9]+?&[a-zA-Z0-9]+([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4})(&[a-zA-Z0-9]+[a-f0-9]{32}){2}$	2	0	0	1
+4128	4128	\.php\?ver=\d\&cver=\d\&id=\d{5}$	2	0	0	1
+4129	4129	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4130	4130	^\x2Flts\x2Etxt$	2	0	0	1
+4131	4131	\/\d\d[A-F0-9]{4}0000\/log$	2	0	0	1
+4132	4132	\/[a-z]{2,3}\/(\d{3,4}x\d{3,4}|default)\.bmp\.gz$	2	0	0	1
+4133	4133	\/cp\/\?(logo\.jpg|adm)	2	0	0	1
+4134	4134	\x2Fping\x2Ehtml\x3Fr\x3D[0-9]{5,14}$	2	0	0	1
+4135	4135	^g=[A-Z0-9]+&cmd=	2	0	0	1
+4136	4136	&arg2=(([a-f0-9]{32})|([A-Za-z0-9\x2b\x2f]{4})*([A-Za-z0-9\x2b\x2f]{2}==|[A-Za-z0-9\x2b\x2f]{3}=|[A-Za-z0-9\x2b\x2f]{4}))(&|$)	2	0	0	1
+4137	4137	filename=[a-f0-9]{13}\.file\r\n	2	0	0	1
+4138	4138	\/monitor\.php\?resp=ID\x3a[A-Za-z]{15}	2	0	0	1
+4139	4139	\/gate\.php\?cmd=(get(installconfig|exe)|urls)$	2	0	0	1
+4140	4140	\.php\?(q|name)=	2	0	0	1
+4141	4141	^\x2F(acheb|bajree|cyacrin|dauber|eaves)\x2Easpx\x3FRandom\x3D[a-z]{16}$	2	0	0	1
+4142	4142	^\/201\d{5,8}\/\d{6,11}\/\d{5,10}\.jsp$	2	0	0	1
+4143	4143	\.php\?a1=\d+&a2=([0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}|([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4}))(&a\d+=[^&]+)+$	2	0	0	1
+4144	4144	&HD=[A-F0-9]{32}&	2	0	0	1
+4145	4145	&id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&os=	2	0	0	1
+4146	4146	\.asp\?MAC=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&VER=[^&]+$	2	0	0	1
+4147	4147	\/log\?(start|install)\x7caid=	2	0	0	1
+4148	4148	\.php\?user=[a-f0-9]{32}&id=\d+&type=\d+($|&)	2	0	0	1
+4149	4149	^\/post\.aspx\?[^&]+=[0-9]{9,10}$	2	0	0	1
+4150	4150	^\/j\/[a-f0-9]{8}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{12}\/0001\/?$	2	0	0	1
+4151	4151	^\x2Fel\x2Fsregister\x2Ephp\x3Fname\x3D[a-f0-9]{32}$	2	0	0	1
+4152	4152	^\x2Fel\x2Fslogin\x2Ephp\x3Fuid\x3D[a-f0-9]{32}$	2	0	0	1
+4153	4153	\.php\?m=[A-F0-9]{12}	2	0	0	1
+4154	4154	&rvz1=\d+&rvz2=\d+?$	2	0	0	1
+4155	4155	^\/getc(loud|onf)\/\?c=	2	0	0	1
+4156	4156	^\/home\/index\.asp\?typeid=(1[13]?|[3579])$	2	0	0	1
+4157	4157	\/tasksz\.php\?(dc|load)	2	0	0	1
+4158	4158	^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3Ffile(index\x3D[A-Z]|n\x3Dnoexist|wh\x3Dfalse)	2	0	0	1
+4159	4159	^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3FRe\x3D	2	0	0	1
+4160	4160	^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3Fverify\x3D	2	0	0	1
+4161	4161	\.asp\?IDPC=[^\x26]*?\x26(Status=|Msg=)[^\x26]*?$	2	0	0	1
+4162	4162	^OPC=\d	2	0	0	1
+4163	4163	^\/[^\x2f]+?\.hlp$	2	0	0	1
+4164	4164	^\/(components|wp-content|tmp)/api/[a-zA-Z0-9\/\x20]{43}=\/(toll|inv|notice|get_label)$	2	0	0	1
+4165	4165	&build_id=[A-F0-9]+$	2	0	0	1
+4166	4166	^&op=\d{1,2}&id=\w+?&ui=.+?&bv=\d{1,2}\.\d{1,2}($|&)	2	0	0	1
+4167	4167	\/vtris\d?\.php\?srs=\d{1,10}$	2	0	0	1
+4168	4168	\/soft(32|64)\.dll$	2	0	0	1
+4169	4169	\/ord\/[^\x2f]+?\.exe$	2	0	0	1
+4170	4170	\/zConfig\/\d+$	2	0	0	1
+4171	4171	\/zImprimer\/\d+-	2	0	0	1
+4172	4172	\/enc\/1$	2	0	0	1
+4173	4173	^\/p\/(p(hphphphphphphp|thon)|(dropytho|admmmom)n|u(pdata-server|dom)|eyewheye|joompler|rubbay|tempzz)	2	0	0	1
+4174	4174	[a-z]\d{2}$	2	0	0	1
+4175	4175	\/images2\/[0-9a-fA-F]{500}	2	0	0	1
+4176	4176	^(u(wf(ekfyj|ubpeb)|d(xowub|zycaf)|h(duxic|zubvo)|x(fokur|osgik)|celgos|ggifym|mpefan|qlahaf)|s(u(t(fasof|imjy)|kbewli)|i(ttanyg|webheb|hemuj)|e(suhror|xjereh)|o(haxim|qvaqo)|axyjuw)|r(i(zsebym|firac|sytfa|trios)|e(bfelqi|kvyfo)|u(xymqic|jfeag)|y(buhoq|kafeh)|acadpuh)|j(y(meegom|vvozoz|kyvca|torqu)|a(mwazer|ibzup)|e(btelyx|dytlu)|o(dkymy|kenqi))|o(t(geguuz|xolpow|pipug)|q(lapjim|jogxi)|cgaextu|gdowkys|jpaxlam|vquqaip|smuryf)|i(r(ojvuqu|hegre)|v(kikcop|nuvuk)|hmytog|kevzaq|mgohut|pdehas|wvahin|zxirfy)|b(y((cmolh|vbym)y|gotbys|jlegta)|i(pulte|wuvba)|o(pwyeb|wbaiv))|p(e(dugtap|gyrgun|vhyvys)|y(nxomoj|ykxug)|a(gube|waha)v|ogwytfy)|d(e(afesqy|hjujuq)|o(hwapih|xilik)|a(lwoza|rabub)|inymak)|t(a(hfifak|ixcih)|i(wciwu|koqo)x|ecviqir|ozfyma|uriwil)|g(i(jevsog|nnyjyb)|olhysux|ywilhof|azuzoz|edopan|ubahvi)|y((n(japru|kicy)|kocna)r|bsahov|dabxag|xyqwiz|zsabuq)|h(a(hsekju|poneg)|e(ztymut|dybih)|uquqxov|itakat)|w(a(pifnu|rkafo)c|e(tifjam|fecfo)|ibveces|yjenqo)|a(d(nedat|tesok)|qzepylu|baxhad|smukuf|wewsip)|l(u((fseki|pylz	2	0	0	1
+4177	4177	)m|ditla)|eqgugom|opoqyv)|z(u(pivzed|qijcel)|aefofin|idamuk|ylhomu)|v(u(njuet|ohsub)|ijsixem|otqygiq|euwhyz)|m(u(zupdyg|hipew|wosiv)|osjinme|abuhos)|x(o(fsimi|gitaj|moqol)|ikmonej|enacoz)|f(e(vnotow|tucxo)|i(dedhah|xavpu))|k(u(btyhuz|irfufo)|ejejib|ycufvy)|n((iliqri|obzeky)x|eluzjiv)|c(ylqiduh|aqxaro|itsibe)|q(aijroke|iquzcy|uohdit)|e(gnisje|stesgo|vdyvaz))\.ru$	2	0	0	1
+4178	4178	\/[a-z]\.htm\?[A-Za-z0-9]+$	2	0	0	1
+4179	4179	Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+4180	4180	Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+4181	4181	\/p?2p\/[a-z]{3}$	2	0	0	1
+4182	4182	\/\d\.php\?sid=[0-9A-F]{32}$	2	0	0	1
+4183	4183	^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?\r?$	2	0	0	1
+4184	4184	^\/mod_jshoppi(-|ng|\/)	2	0	0	1
+4185	4185	( MSIE |rv\x3a11)	2	0	0	1
+4186	4186	( MSIE |rv\x3a11)	2	0	0	1
+4187	4187	( MSIE |rv\x3a11)	2	0	0	1
+4188	4188	( MSIE |rv\x3a11)	2	0	0	1
+4189	4189	\/[a-z]+\.k(ey)?btc$	2	0	0	1
+4190	4190	&id=[A-F0-9]+$	2	0	0	1
+4191	4191	\/images\/view\.php$	2	0	0	1
+4192	4192	\/txt\/read\.php$	2	0	0	1
+4193	4193	^hwid=[A-F0-9]{4}(-[A-F0-9]{4}){7}&func=	2	0	0	1
+4194	4194	\/[A-Za-z0-9-_]{75,}\.html$	2	0	0	1
+4195	4195	filename=\x22[A-Z]\x3a\\.+?\\[a-f0-9]{32}\.zip\x22\r\n	2	0	0	1
+4196	4196	^\/me\/(get(ref|ua)\.php|videos\.txt)$	2	0	0	1
+4197	4197	\/infect(-\d)?\.php$	2	0	0	1
+4198	4198	&hash=[^&]+$	2	0	0	1
+4199	4199	^Host\x3a[^\r\n]+?webdav\.cloudme\.com[^\r\n]*?\r?$	2	0	0	1
+4200	4200	\.exe\?dummy=\d+$	2	0	0	1
+4201	4201	^(<v1>.).{33}(=v1).{9}(<v2>.)(.{4}(=v2)){3}	2	0	0	1
+4202	4202	\.png$	2	0	0	1
+4203	4203	\x26enckey\x3D[A-F0-9]+$	2	0	0	1
+4204	4204	^\/action\.php\?action=get_(mails|red)$	2	0	0	1
+4205	4205	^Host\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4206	4206	\/data\.cfg$	2	0	0	1
+4207	4207	\/bn_versions\/\d+?\.exe$	2	0	0	1
+4208	4208	^(Accept\x3a\x20text\/\*, application\/\*\r\n)?User-Agent\x3a[^\r\n\x3b\x28\x29]+\r\nHost\x3a[^\r\n]+checkip\.dyndns\.org\r\nCache-Control\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4209	4209	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4210	4210	&user=\d+$	2	0	0	1
+4211	4211	^Host\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4212	4212	\/web_[0-9A-F]{12}\.jpg$	2	0	0	1
+4213	4213	^Mozilla(\/4\.0)?$	2	0	0	1
+4214	4214	Host\x3a\x20[a-z0-9]{16}\.[^\r\n]*?(tor|onion)	2	0	0	1
+4215	4215	^\/([^\x2f]+\/)?rp\?[a-z]=	2	0	0	1
+4216	4216	^User-Agent\x3a\x20(\d*[a-z])[a-z0-9]+\r\nHost\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4217	4217	^Host\x3a[^\r\n]+bagacaoutra\.ru\r\n	2	0	0	1
+4218	4218	^Host\x3a[^\r\n]+bagacavoltou\.ru	2	0	0	1
+4219	4219	^Host\x3a[^\r\n]+bagacaveia\.ru	2	0	0	1
+4220	4220	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4221	4221	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4222	4222	\/state[^\x2f]*\.php\?[A-Za-z0-9+/]*={0,2}$	2	0	0	1
+4223	4223	^Accept\x3a\x20\*\/\*,[^\r\n]+, MZ	2	0	0	1
+4224	4224	^\/[^\x2f]+?\.exe$	2	0	0	1
+4225	4225	^[A-F0-9]+$	2	0	0	1
+4226	4226	\/redirect\.php\?loc=mail$	2	0	0	1
+4227	4227	&(uid|name|file)=[a-f0-9]+$	2	0	0	1
+4228	4228	\?HostID=([A-F0-9]{2}(-|<>)){5}[A-F0-9]{2}$	2	0	0	1
+4229	4229	\/\?bit=(32|64)&version=\d{4}-\d{1,2}-\d{1,2}$	2	0	0	1
+4230	4230	\/\?check$	2	0	0	1
+4231	4231	^Host\x3a[^\r\n]+\r\nAccept-Language\x3a[^\r\n]+\r\nAccept\x3a[^\r\n]+\r\nAccept-Encoding\x3a[^\r\n]+\r\nConnection\x3a\x20close\r\nUser-Agent\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4232	4232	[A-Z]{100}(&\w+=[a-zA-Z0-9/+=]+){0,2}$	2	0	0	1
+4233	4233	^\w+=([a-zA-Z0-9/+=]{1,30}&\w+=)?[a-zA-Z0-9+/]{0,13}[A-Z]{200}	2	0	0	1
+4234	4234	(&(boardid|bbsNo|strBoardID|userid|bbs|filename|code|pid|seqNo|ReportID|v|PageNumber|num|view|read|action|page|mode|idx|cateId|bbsId|pType|pcode|index|tbl|idx_num|act|bbs_id|bbs_form|bid|bbscate|menu|tcode|b_code|bname|tb|borad01|borad02|borad03|mid|newsid|table|Board_seq|bc_idx|seq|ArticleID|B_Notice|nowPage|webid|boardDiv|sub_idxa)=[^&]+){3}$	2	0	0	1
+4235	4235	\/setup\/[a-zA-Z0-9!-]{100,}$	2	0	0	1
+4236	4236	\/app\.exe$	2	0	0	1
+4237	4237	^Host\x3a[^\r\n]+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4238	4238	=c3NoOi8v[A-Za-z0-9+/]+={0,2}$	2	0	0	1
+4239	4239	\.asp\?([A-Za-z0-9+*]{4})*([A-Za-z0-9+*]{2}==|[A-Za-z0-9+*]{3}=|[A-Za-z0-9+*]{4})$	2	0	0	1
+4240	4240	\?wd=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})$	2	0	0	1
+4241	4241	&version=\d+$	2	0	0	1
+4242	4242	^[A-Za-z0-9/_]+={0,2}$	2	0	0	1
+4243	4243	\/[a-z]\/infects\/[a-z]\?[a-z]=[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}	2	0	0	1
+4244	4244	^\d{4}	2	0	0	1
+4245	4245	^\d{4}	2	0	0	1
+4246	4246	^Host\x3a\x20(\d{1,3}\.){3}\d{1,3}\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4247	4247	\/lns.txt$	2	0	0	1
+4248	4248	^\/[a-z]+?\.*?ini\?\d+$	2	0	0	1
+4249	4249	\/[a-f0-9]{8}\/page_\d{8,10}\.html$	2	0	0	1
+4250	4250	^[a-z]{1,7}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4251	4251	SSID=[0-9]{5}[0-8][01][a-f0-9]{36}	2	0	0	1
+4252	4252	SSID=[0-9]{5}[0-8][01][a-f0-9]{36}	2	0	0	1
+4253	4253	^[\x20-\x7e\s]{0,20}[^\x20-\x7e\s]	2	0	0	1
+4254	4254	^s?\x3a\x2f+[^\r\n\s]+\.exe	2	0	0	1
+4255	4255	\.jpg\?vid=\d+$	2	0	0	1
+4256	4256	^[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\nUser-Agent\x3a	2	0	0	1
+4257	4257	\.php\?[a-z]+=0000[a-fA-F0-9]{4}&[a-z]+=\?[A-F0-9]+&[a-z]=\d{4}&[a-z]=\d{4}$	2	0	0	1
+4258	4258	^[0-9a-f]+$	2	0	0	1
+4259	4259	\/r\.php\?[A-F0-9]+=?$	2	0	0	1
+4260	4260	^m=([A-Za-z0-9+/]{4}){11}(([A-Za-z0-9+/]{4}){6})?AA==	2	0	0	1
+4261	4261	\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/\x20]{2}==|[A-Za-z0-9+/\x20]{3}=|[A-Za-z0-9+/\x20]{4})$	2	0	0	1
+4262	4262	^\d+\x20	2	0	0	1
+4263	4263	^\d+\x20	2	0	0	1
+4264	4264	^\d+\x20	2	0	0	1
+4265	4265	^\d+\x20	2	0	0	1
+4266	4266	^\d+\x20	2	0	0	1
+4267	4267	^\d+\x20	2	0	0	1
+4268	4268	^\d+\x20	2	0	0	1
+4269	4269	^\d+\x20	2	0	0	1
+4270	4270	\.php\?a1=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&a2=[a-f0-9]{32}&a3=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4271	4271	\/(im(age|g)|pict)\.(jpg|php)\?id=\d+&act=[12]$	2	0	0	1
+4272	4272	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4273	4273	\.php\?hwid=[A-F0-9]{16}$	2	0	0	1
+4274	4274	^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/general\.png$	2	0	0	1
+4275	4275	^\/\d+$	2	0	0	1
+4276	4276	^[\x2fa-z\d]+\.exe$	2	0	0	1
+4277	4277	\.php\?command=(g(hl|et(ip|id|backconnect))|update2?|dl|log)($|&)	2	0	0	1
+4278	4278	\.(gif|jpe?g)\.zip$	2	0	0	1
+4279	4279	^(zh-CN|en-US)\x3b rv\x3a1\.7\.6\)\r\n	2	0	0	1
+4280	4280	(,0x[0-9a-f]{2}){10}$	2	0	0	1
+4281	4281	\/default\.aspx?\?tmp=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4282	4282	^[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(&[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$	2	0	0	1
+4283	4283	\/\d{8,10}\.html$	2	0	0	1
+4284	4284	^\x40\x24[^\x20-\x7e\r\n]+$	2	0	0	1
+4285	4285	^\/[A-F0-9]+$	2	0	0	1
+4286	4286	^\/[a-z0-9]+\.jpg\?([a-z0-9]*[A-Z]+[a-z0-9])[A-Za-z0-9]+=\d{1,4}$	2	0	0	1
+4287	4287	\.png\x3f[0-9a-f]{4,8}\x3d\d+?$	2	0	0	1
+4288	4288	^Host\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4289	4289	(\/((p(lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|osts?\/[a-z0-9]+|rogcicicic)|s(ystem\/(logs|engine)\/[^\x2f]+?|e(rv(au|er)|ct)|gau\/.*?|alam|ucks|can|ke)|([a-z]*[0-9])([0-9]*[a-z])(setup\d+\.exe)[a-z0-9]{5,10}|a(d(min\/images\/\w+|obe)|salam|live|us)|m(edia\/files\/\w+|a(cros?|rch)|soffice)|d(o(c(\/[a-z0-9]+)?|ne)|bust)|(~.+?\/\.[^\x2f]+|\.css)\/.+?|in(voice\/[^\x2f]+|fos?)|c(onfig|hris|alc)|u(swinz\w+|pdate)|xml\/load\/[^\x2f]+|([Dd]ocumen|ve)t|Ozonecrytedserver|w(or[dk]|insys)|t(mp\/.+?|est)|fa(cture|soo)|n(otepad|ach)|k(be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe|(([a-z0-9]*?[3456789][a-z0-9]*?[3456789])([a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(^\/(image\/.+?\/[^\x2f]+|x\/setup)|keem)\.exe)	2	0	0	1
+4290	4290	\.pdf\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4291	4291	\.zip\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4292	4292	\.htm\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4293	4293	\.xml\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4294	4294	^\/[a-z0-9_-]+\.jpg\?[A-Za-z0-9]{2,10}=\d{1,4}$	2	0	0	1
+4295	4295	^(www\.)?google(\.[a-z]{2,3})+$	2	0	0	1
+4296	4296	\.log$	2	0	0	1
+4297	4297	\/([a-z0-9]+_){4,}[a-z0-9]+(\/[a-f0-9]+)*?\/[a-f0-9]+\.([Ee][Xx][Ee])[a-z0-9]+$	2	0	0	1
+4298	4298	^\/pm\.sh\?\d+$	2	0	0	1
+4299	4299	\.asp\?m=(INS|UAC)(&p=&a=)?&i=201\d{11}&	2	0	0	1
+4300	4300	\?ver=\d+$	2	0	0	1
+4301	4301	^\/(i686|arm|mips(el)?)\?ver=\d+$	2	0	0	1
+4302	4302	&u=[a-f0-9]{16}&p=	2	0	0	1
+4303	4303	\/[a-f0-9]{16}\.down$	2	0	0	1
+4304	4304	\.php\/data$	2	0	0	1
+4305	4305	\/catalog\/\d{3,}$	2	0	0	1
+4306	4306	\.php\?cookie=1$	2	0	0	1
+4307	4307	^\/[A-Za-z0-9]+?\/file\.php$	2	0	0	1
+4308	4308	\/tor\/[^\x2f\x2e]+(32|64)\.dll$	2	0	0	1
+4309	4309	\.php\?shinu=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4310	4310	^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$	2	0	0	1
+4311	4311	^\/link\.txt\?[0-9]{1,2}\x3a[0-9]{1,2}\x3a[0-9]{1,2}	2	0	0	1
+4312	4312	\.php\?uuid=[a-z0-9]{32}$	2	0	0	1
+4313	4313	^(Referer\x3a[^\r\n]+\r\n)?Host\x3a[^\r\n]+[\r\n]+$	2	0	0	1
+4314	4314	\.exe\?$	2	0	0	1
+4315	4315	^\/\w+\.php\?f=[a-z]?\d{1,3}(\.(dat|gif))?$	2	0	0	1
+4316	4316	\/\?[a-zA-Z0-9]{1,3}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4317	4317	\.php\?cn(ame)	2	0	0	1
+4318	4318	^(Host\x3a [^\r\n]+?\r\nConnection\x3a Keep-Alive|Connection\x3a Keep-Alive\r\nHost\x3a [^\r\n]+?)\r\n(\r\n)?$	2	0	0	1
+4319	4319	\.php\?file=(64|86)$	2	0	0	1
+4320	4320	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4321	4321	meta=(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?(&?id=[a-z]+)?$	2	0	0	1
+4322	4322	^\/[a-z]+?\/\?([a-z]+[A-Za-z0-9\x5f\x2d]+&){1,}ai=[^&]{5}([A-Za-z0-9\x5f\x2d]{4})*([A-Za-z0-9\x5f\x2d]{2}==|[A-Za-z0-9\x5f\x2d]{3}=|[A-Za-z0-9\x5f\x2d]{4})(&|$)	2	0	0	1
+4323	4323	(^|=)[A-F0-9]{70,}($|&)	2	0	0	1
+4324	4324	^[A-Za-z0-9+/]{64}\x0a	2	0	0	1
+4325	4325	\/viewforum\.php\?f=\d+&sid=[A-F0-9]{32}$	2	0	0	1
+4326	4326	\?uid=\d{8}&ver=\d\.\d{2}&mk=[0-9a-zA-Z]{6}&os=[A-Za-z0-9]+&rs=[a-z]+&c=\d+&rq=\d	2	0	0	1
+4327	4327	^Content-Disposition\x3a[^\r\n]*\.sct[\x22\x27\s\r\n]	2	0	0	1
+4328	4328	\.php\?cmd=p&id=\w+.*?&rnd=[\x2e\d]+$	2	0	0	1
+4329	4329	myguy\.(xls(\.hta)?|exe)$	2	0	0	1
+4330	4330	\/invoice[^a-z\/]*?\.(exe|zip|7z|rar|com|vbs|ps1)$	2	0	0	1
+4331	4331	\/[\x2f\x2bA-Za-z0-9]{59}AAA==$	2	0	0	1
+4332	4332	^\/[^\x2f]+?\/create\.php\?[a-z0-9]+\x3d[a-z0-9\x5f\x2d]+?$	2	0	0	1
+4333	4333	\.php\?id=\d+&stat=[a-z0-9]{32}(&cidl=\d+|&sidl=[\d%:\x20-]+)?$	2	0	0	1
+4334	4334	\/[A-Z0-9]{4,8}\/[A-Z0-9]{8}\.DAT$	2	0	0	1
+4335	4335	\.exe\?\.\d+$	2	0	0	1
+4336	4336	^Host\x3a[^\r\n]+\r\n((Cache-Control|Pragma)\x3a[^\r\n]+\r\n)?(\r\n)?$	2	0	0	1
+4337	4337	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4338	4338	^\/Search\/en-US\?query=[a-z]{200,400}&pgArea=header$	2	0	0	1
+4339	4339	\/stat\d+\.php	2	0	0	1
+4340	4340	\?url=[0-9]&affid=[0-9]{5}	2	0	0	1
+4341	4341	\.php\?id=[0-9a-f]{8}$	2	0	0	1
+4342	4342	^6\.[0-2]\x20\d\d\x3a\d\d\x20	2	0	0	1
+4343	4343	^IPHONE\d+\x2e\d+\x28(host\x3a|[^\r\n\x2c]+\x2c(\d{1,3}\.){3}\d{1,3})	2	0	0	1
+4344	4344	(1|2)\.(p(hp|ng)|jpe?g|cgi|gif)\?sv=\d{2,3}&tq=	2	0	0	1
+4345	4345	[\?&]p=\d&t=\d(&|$)	2	0	0	1
+4346	4346	^\x2fhistory\x2f[A-Za-z0-9+_-]+\x2easp$	2	0	0	1
+4347	4347	^\x2fdocs\x2fname\x3d\x2f[A-Za-z0-9+_-]+$	2	0	0	1
+4348	4348	^\x2ftech\x2fs\x2easp\x3fm\x3d[A-Za-z0-9+_-]+$	2	0	0	1
+4349	4349	^\x2fmanage\x2fasp\x2fitem\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26mux\x3d[A-Za-z0-9+_-]+$	2	0	0	1
+4350	4350	^\x2farticle\x2f30441\x2fReview\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26data\x3d[A-Za-z0-9+_-]+$	2	0	0	1
+4351	4351	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4352	4352	^\/[A-Za-z0-9-_]{30,}\/$	2	0	0	1
+4353	4353	^build\d	2	0	0	1
+4354	4354	^[a-zA-Z0-9]{5}6164(3[0-9]){4}31303[0-9]([a-f0-9][a-f0-9]){5,}\.	2	0	0	1
+4355	4355	^[a-zA-Z0-9]{5}6364(3[0-9]){4}\d{1,3}\.	2	0	0	1
+4356	4356	^[a-zA-Z0-9]{5}6464(3[0-9]){4}\.	2	0	0	1
+4357	4357	^[a-zA-Z0-9]{5}6664(3[0-9]){4}\.	2	0	0	1
+4358	4358	^[a-zA-Z0-9]{5}6864(3[0-9]){4}31303[0-9]\.	2	0	0	1
+4359	4359	^[a-zA-Z0-9]{5}7264(3[0-9]){4}31303[0-9]([a-f0-9][a-f0-9]){10,}\.	2	0	0	1
+4360	4360	^[a-zA-Z0-9]{5}7164(3[0-9]){4}\.	2	0	0	1
+4361	4361	^[a-f0-9]{8}$	2	0	0	1
+4362	4362	^\d{1,3}$	2	0	0	1
+4363	4363	^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+4364	4364	^[A-Za-z0-9\/\+\=]{100,}$	2	0	0	1
+4365	4365	\.(txt|gif|exe|bmp)$	2	0	0	1
+4366	4366	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4367	4367	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4368	4368	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4369	4369	^[A-F0-9]{128}$	2	0	0	1
+4370	4370	^DEMONS((\/|\s)[0-9]\.0)?$	2	0	0	1
+4371	4371	^Hakai((\/|\s)[0-9]\.0)?$	2	0	0	1
+4372	4372	^Messiah((\/|\s)[0-9]\.0)?$	2	0	0	1
+4373	4373	^Liquor((\/|\s)[0-9]\.0)?$	2	0	0	1
+4374	4374	^Nija((\/|\s)[0-9]\.0)?$	2	0	0	1
+4375	4375	^Gemini((\/|\s)[0-9]\.0)?$	2	0	0	1
+4376	4376	^Kayla((\/|\s)[0-9]\.0)?$	2	0	0	1
+4377	4377	^Sector((\/|\s)[0-9]\.0)?$	2	0	0	1
+4378	4378	^OSIRIS((\/|\s)[0-9]\.0)?$	2	0	0	1
+4379	4379	^lessie(\/[0-9]\.0)?$	2	0	0	1
+4380	4380	^Cakle(\/[0-9]\.0)?$	2	0	0	1
+4381	4381	^Damien(\/[0-9]\.0)?$	2	0	0	1
+4382	4382	^Solar(\/[0-9]\.0)?$	2	0	0	1
+4383	4383	^muhstik(-scan)?(\/[0-9]\.0)?$	2	0	0	1
+4384	4384	^Shaolin(\/[0-9]\.0)?$	2	0	0	1
+4385	4385	^Rift(\/[0-9]\.0)?$	2	0	0	1
+4386	4386	^Tsunami(\/[0-9]\.0)?$	2	0	0	1
+4387	4387	^Yowai(\/[0-9]\.0)?$	2	0	0	1
+4388	4388	^Yakuza(\/[0-9]\.0)?$	2	0	0	1
+4389	4389	^Hentai(\/[0-9]\.0)?$	2	0	0	1
+4390	4390	^[a-zA-Z/+=]$	2	0	0	1
+4391	4391	\?uid=[A-F0-9]{15,}&pid=\d+$	2	0	0	1
+4392	4392	\.php\?[A-F0-9]{15,25}$	2	0	0	1
+4393	4393	^(Sucessful|Failed|Missing\x20CBA8|Missing\x20LANDesk\x20Agent)$	2	0	0	1
+4394	4394	^POST\shttp\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.0\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+4395	4395	^name=v[0-9]{1,2}_kt[0-9]{1,2}p[0-9]{1}_[0-9]{8,10}$	2	0	0	1
+4396	4396	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4397	4397	^\/[a-z]\.php	2	0	0	1
+4398	4398	^\d{1,6}$	2	0	0	1
+4399	4399	^[A-Z0-9]{8}	2	0	0	1
+4400	4400	^\d{15}	2	0	0	1
+4401	4401	^(winload(32)?|cmms)\x0d\x0a	2	0	0	1
+4402	4402	^\d$	2	0	0	1
+4403	4403	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4404	4404	^\/[a-z]+\/\?ip=	2	0	0	1
+4405	4405	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+4406	4406	^\d{1,5}\.[2-5]0[0-5]\.\d+? Firefox\/7\.0\.1	2	0	0	1
+4407	4407	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4408	4408	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4409	4409	^(update_hash|js|key|arsiv_(hash|link))$	2	0	0	1
+4410	4410	\/([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})\.jpg$	2	0	0	1
+4411	4411	^[a-z0-9]{11}=\d{16}$	2	0	0	1
+4412	4412	^[A-Za-z0-9]{3,25}=[a-f0-9]{28,}$	2	0	0	1
+4413	4413	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4414	4414	^Hello, World((\/|\s)[0-9]\.0)?$	2	0	0	1
+4415	4415	\/cgi\/[a-z0-9]{1,31}\.bin$	2	0	0	1
+4416	4416	^[0-9a-zA-Z=%-]{0,48}(%[A-F0-9]{2}){4}	2	0	0	1
+4417	4417	\?id=\d+&act=[12]$	2	0	0	1
+4418	4418	\?id=\d+&act=\d$	2	0	0	1
+4419	4419	^([A-F0-9]{2}%3A){5}[A-F0-9]{2}&	2	0	0	1
+4420	4420	\/([a-z]{0,7}[0-9])([0-9]{0,7}[a-z])[a-z0-9]{7,8}\/([a-z]{0,7}[0-9])([0-9]{0,7}[a-z])[a-z0-9]{7,8}$	2	0	0	1
+4421	4421	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&isAdvpp=(true|false)$	2	0	0	1
+4422	4422	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+4423	4423	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+4424	4424	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+4425	4425	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+4426	4426	^\d\.\d_(64|32)_\d\x3a	2	0	0	1
+4427	4427	(^|\.)15438\.xyz$	2	0	0	1
+4428	4428	(^|\.)12724\.xyz$	2	0	0	1
+4429	4429	(^|\.)21736\.xyz$	2	0	0	1
+4430	4430	^[a-f0-9]+\x08\x00$	2	0	0	1
+4431	4431	^([A-Za-z0-9%2b%2f]{4})*([A-Za-z0-9%2b%2f]{2}%3d%3d|[A-Za-z0-9%2b%2f]{3}%3d|[A-Za-z0-9%2b%2f]{4})$	2	0	0	1
+4432	4432	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4433	4433	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4434	4434	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4435	4435	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4436	4436	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4437	4437	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4438	4438	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4439	4439	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4440	4440	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4441	4441	^Host\x3a\x20(\d{1,3}\.){3}\d{1,3}\r\nConnection\x3a\x20close(\r\n)+$	2	0	0	1
+4442	4442	^[A-Z]+$	2	0	0	1
+4443	4443	^\d+$	2	0	0	1
+4444	4444	^(64|86)$	2	0	0	1
+4445	4445	\/counter\/(\?[a-z]?\d{1,2}|[^\x2f]*\d\.exe|.*?[]([A-Za-z_-]{0,200}[0-9][A-Za-z_-]{0,200}[0-9])([A-Z0-9_-]{0,200}[a-z][A-Z0-9_-]{0,200}[a-z])([a-z0-9_-]{0,200}[A-Z][a-z0-9_-]{0,200}[A-Z])[A-Za-z0-9_-]{50,}(&|$)	2	0	0	1
+4446	4446	^\/(\w+\/){1,5}\?[a-z]{1,6}=[a-z0-9]{2,40}(&[a-z]{1,6}=([a-z0-9]){1,40}(%3D){0,2}){1,4}$	2	0	0	1
+4447	4447	^\d{5,10}\x7d	2	0	0	1
+4448	4448	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+4449	4449	\/\d{8,10}\.html$	2	0	0	1
+4450	4450	^\d{1,3}=	2	0	0	1
+4451	4451	(Proxy-)?Connection\x3a[^\r\n]+?\r\n(Pragma|Cache-Control)\x3a[^\r\n]+?\r\n(\r\n)?$	2	0	0	1
+4452	4452	\/?[a-zA-Z0-9]{1,3}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4453	4453	^\d+$	2	0	0	1
+4454	4454	^\/\?m=[abcde]&p1=[a-f0-9]{8,12}(&p2=[^&]+)?(&p3=[^&]+)?$	2	0	0	1
+4455	4455	[&?]a=([a-zA-Z0-9_-]{25,}|(0\.)?\d+)(&|$)	2	0	0	1
+4456	4456	^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$	2	0	0	1
+4457	4457	\.(aspx?|php)\?q=(KT)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$	2	0	0	1
+4458	4458	^[A-Za-z]{1,10}=[^&]+(&[A-Za-z]{1,10}=[^&]+){10,}$	2	0	0	1
+4459	4459	^[a-f0-9]{32}\x3b$	2	0	0	1
+4460	4460	^\/(kas|ser|mac)[0-9]+\.png$	2	0	0	1
+4461	4461	^\/s\.php\?id=[a-z0-9]{2,6}$	2	0	0	1
+4462	4462	\.php\?d=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4463	4463	^[a-z0-9!\x22#%&'()*,.\/\x3a\x3b<=>?@\[\] ^_`{|}~\s-]+?downloading\.?\s*Please wait\x2e*<\/div\>\s*<iframe src\s*=\s*[\x22\x27]http\:\/\/[^\x22\x27]+\.php[\x22\x27]\s*style\s*=\s*[\x22\x27]display\x3a\s*none\x3b\s*[\x22\x27]>\s*<\/iframe\>\s*$	2	0	0	1
+4464	4464	^[a-f0-9]{16}$	2	0	0	1
+4465	4465	^[A-Za-z0-9]{3,4}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})	2	0	0	1
+4466	4466	^[A-Za-z0-9]{3,4}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+4467	4467	[a-z0-9]{3,4}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+4468	4468	^Mozilla\/4\.0\x20\(compatible\x3b\x20MSIE\x20\d{1,2}\.0\.\d+\.\d+\.0\x3b\x20Windows\x20NT\x20	2	0	0	1
+4469	4469	^[\x20-\x7e\r\n]{0,28}[^\x20-\x7e\r\n]	2	0	0	1
+4470	4470	^\/([a-z]{0,9}?\d)(\d{0,9}?[a-z])[a-z0-9]{4,10}$	2	0	0	1
+4471	4471	(^|&)id=\d+($|&)	2	0	0	1
+4472	4472	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+4473	4473	^\d?\.dll$	2	0	0	1
+4474	4474	^(32|64)$	2	0	0	1
+4475	4475	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)$	2	0	0	1
+4476	4476	\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d{1,5}$	2	0	0	1
+4477	4477	^env=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4478	4478	\/pict\.(jpg|php|xsp)\?id=\d+((&data=|&bid=)[^&]*?)?$	2	0	0	1
+4479	4479	^SESSIONID=[A-Z0-9]{16}	2	0	0	1
+4480	4480	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+4481	4481	^(\/\w{3,12}){2,4}\?[a-z]{3,12}=([A-Za-z0-9+/\x20]{4})*([A-Za-z0-9+/\x20]{2}==|[A-Za-z0-9+/\x20]{3}=|[A-Za-z0-9+/\x20]{4})$	2	0	0	1
+4482	4482	^\d+$	2	0	0	1
+4483	4483	^POST \/(<filep>[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(=filep)[a-z]+?\.net\r\n	2	0	0	1
+4484	4484	[=\"]\w{8}\.jar	2	0	0	1
+4485	4485	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4486	4486	filename\x3D\x22[^\r\n]*security[^\n]+\.exe	2	0	0	1
+4487	4487	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4488	4488	^[A-F0-9]{30}$	2	0	0	1
+4489	4489	\.php\?cx=[A-F0-9]+&b=[A-F0-9]+&gt=[A-F0-9]+&tx=[A-F0-9]+$	2	0	0	1
+4490	4490	^\/ucD[A-Za-z0-9_\/\-+]{171}$	2	0	0	1
+4491	4491	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+4492	4492	^<CHECK>([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/CHECK>$	2	0	0	1
+4493	4493	^[a-zA-Z0-9\/+_-]{171}$	2	0	0	1
+4494	4494	\/\d+\/\d+\.exe$	2	0	0	1
+4495	4495	^[A-Za-z0-9]{20,22}&usg=[A-Za-z0-9_]{34}&bvm=bv\.81[1-7]{6}\,d\.[A-Za-z0-9_]{3}\r\n	2	0	0	1
+4496	4496	^fn=[^&]*\.gif&code=\d+$	2	0	0	1
+4497	4497	^[A-F0-9]+$	2	0	0	1
+4498	4498	^log=save&session_id=[^&]+&value=[^&]+$	2	0	0	1
+4499	4499	%comSpec%\s\/c\s((\\x50)|(\\x70)|[Pp])\^?((\\x4f)|(\\x5f)|[Oo])\^?((\\x57)|(\\x77)|[Ww])\^?((\\x45)|(\\x65)|[Ee])\^?((\\x52)|(\\x72)|[Rr])\^?((\\x53)|(\\x73)|[Ss])\^?((\\x48)|(\\x68)|[Hh])\^?((\\x45)|(\\x65)|[Ee])\^?((\\x4c)|(\\x6c)|[Ll])\^?((\\x4c)|(\\x6c)|[Ll])\^?((\\x2e)|\.)\^?((\\x45)|(\\x65)|[Ee])\^?((\\x58)|(\\x78)|[Xx])\^?((\\x45)|(\\x65)|[Ee])\^?\s	2	0	0	1
+4500	4500	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4501	4501	^([a-f0-9]{2}){23,60}$	2	0	0	1
+4502	4502	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4503	4503	^[0-9]*?[a-z]/P	2	0	0	1
+4504	4504	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a8080$	2	0	0	1
+4505	4505	^\/[a-z]{4}(\d{1,3}\.){3}\d{1,3}[a-z]{6}\.txt	2	0	0	1
+4506	4506	^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+4507	4507	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+	2	0	0	1
+4508	4508	^[a-zA-Z0-9=/&?\x2e-]+$	2	0	0	1
+4509	4509	^[a-f0-9]{8}\.grp[0-9]*\.ping\.adm\.([a-f0-9]+\.){2,}	2	0	0	1
+4510	4510	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+4511	4511	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+4512	4512	^[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}$	2	0	0	1
+4513	4513	^[\x20-\x25\x27-\x3c\x3e-\x7e]{25,}$	2	0	0	1
+4514	4514	^(i686|x86_64|arm|mipsel)\-(static-linux|w64|iamsatan)\-(mingw32|uclibc(gnueabi)?)	2	0	0	1
+4515	4515	^[^\\\*\+\=\|\:\;\x22\?\>\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}[\d_]+\.(jpg|png)\x22\x0d\x0a	2	0	0	1
+4516	4516	^([A-Za-z0-9%2b%2f]{4})*([A-Za-z0-9%2b%2f]{2}%3d%3d|[A-Za-z0-9%2b%2f]{3}%3d|[A-Za-z0-9%2b%2f]{4})$	2	0	0	1
+4517	4517	^\/[^\x2f]+?\.htm$	2	0	0	1
+4518	4518	^\d{2,7}$	2	0	0	1
+4519	4519	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\.bin$	2	0	0	1
+4520	4520	^Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x3A\d{1,5}\r?$	2	0	0	1
+4521	4521	^Host\x3a[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(\r\n)?$	2	0	0	1
+4522	4522	(\/((p(lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|osts?\/[a-z0-9]+|rogcicicic)|s(ystem\/(logs|engine)\/[^\x2f]+?|e(rv(au|er)|ct)|gau\/.*?|alam|ucks|can|ke)|([a-z]*[0-9])([0-9]*[a-z])(setup\d+\.exe)[a-z0-9]{5,10}|a(d(min\/images\/\w+|obe)|salam|live|us)|m(edia\/files\/\w+|a(cros?|rch)|soffice)|d(o(c(\/[a-z0-9]+)?|ne)|bust)|(~.+?\/\.[^\x2f]+|\.css)\/.+?|in(voice\/[^\x2f]+|fos?)|c(onfig|hris|alc)|u(swinz\w+|pdate)|xml\/load\/[^\x2f]+|([Dd]ocumen|ve)t|Ozonecrytedserver|w(or[dk]|insys)|t(mp\/.+?|est)|fa(cture|soo)|n(otepad|ach)|k(be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe|(([a-z0-9]*?[3456789][a-z0-9]*?[3456789])([a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(^\/(image\/.+?\/[^\x2f]+|x\/setup)|keem)\.exe$)	2	0	0	1
+4523	4523	^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+4524	4524	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4525	4525	^[a-zA-Z0-9\/+_-]{171}$	2	0	0	1
+4526	4526	^cnc\.[a-fA-F0-9]{14}.xyz$	2	0	0	1
+4527	4527	^[^&]+&[a-z]=[^&]+&[a-z]=[A-F0-9]+$	2	0	0	1
+4528	4528	^[A-Za-z0-9]{3,20}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4529	4529	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4530	4530	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4531	4531	_aWQ9[a-zA-Z0-9\/]{43,46}(JmdpZD|Z2lkP|ZnaWQ9)	2	0	0	1
+4532	4532	^\/[a-f0-9]+$	2	0	0	1
+4533	4533	^[A-Z]{4}	2	0	0	1
+4534	4534	\.php\?host=[^&]+&password=[a-f0-9]{32}$	2	0	0	1
+4535	4535	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+4536	4536	^\x2F[a-f0-9]{40,60}$	2	0	0	1
+4537	4537	^[^\r\n]+\.exe(\x3b)?$	2	0	0	1
+4538	4538	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4539	4539	\r\nHost\x3a[^\r\n]+\r\n(Content-Length\x3a\x20\d+\r\n)?Connection\x3a\x20Keep-Alive\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4540	4540	Content-Disposition\x3a[^\r\n]+=[\x22\x27]?[a-z]?\d{1,3}(\.dat)?[\x22\x27]?\r\n	2	0	0	1
+4541	4541	Content-Disposition\x3a[^\r\n]+=[\x22\x27]?[a-z]?\d{1,3}(\.dat)?[\x22\x27]?\r\n	2	0	0	1
+4542	4542	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4543	4543	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4544	4544	^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$	2	0	0	1
+4545	4545	^Host\x3a\x20[^\r\n]+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4546	4546	^[a-z0-9]+\.appsync-api\.(eu|us)-(ea|we)st-[12]\.avsvmcloud\.com$	2	0	0	1
+4547	4547	^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$	2	0	0	1
+4548	4548	=[a-z0-9\(_~\-\.\x00]{300,}\x00$	2	0	0	1
+4549	4549	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$/Wm	2	0	0	1
+4550	4550	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$/Wm	2	0	0	1
+4551	4551	^[A-Z0-9\-]{30,42}$	2	0	0	1
+4552	4552	^\d+?\r\n	2	0	0	1
+4553	4553	^__io_r=[0-9]{10}_[01]_[0-9]{4,5}_[0-9]{7,8}_[0-9]{1,2}\x3b\x20__io_vl=[0-9]_[0-9]{6}_[0-9]{3}_[0-9]{2}\x3b\x20__io_bl=[0-9]{1,2}:[0-9]:[0-9]{4,5}:[0-9]{2}\x3b\x20Session_id=[0-9A-F]{12}\x3b\x20__io_uniq=[0-9A-F]{8,22}_[0-9A-F]{12,20}\x3b\x20__io_f=[0-9]{2}::[0-9]{10}::[0-9]{9,10}::[0-9]{9,10}$	2	0	0	1
+4554	4554	\.php\?c=[a-f0-9]{160}$	2	0	0	1
+4555	4555	Cache-Control\r\n(\r\n|Cookie\r\n\r\n)$	2	0	0	1
+4556	4556	^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$	2	0	0	1
+4557	4557	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4558	4558	^dkv=[a-f0-9]{32}\x3bYSC=\d+$	2	0	0	1
+4559	4559	^(resp|onl|pr)=	2	0	0	1
+4560	4560	^id=\d+&cred=[a-z]+\x7c	2	0	0	1
+4561	4561	[\x80-\xff]	2	0	0	1
+4562	4562	(retdl|fb|step) HTTP\/1\.1$	2	0	0	1
+4563	4563	^\/[0-9]{6,16}-(pro|xl2|us1)$	2	0	0	1
+4564	4564	^(81|freq|domains|over|rate|npcap\.exe)\/?\s*[^\/]*$	2	0	0	1
+4565	4565	^\/[0-9a-f]{16}$	2	0	0	1
+4566	4566	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4567	4567	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4568	4568	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4569	4569	^[A-F0-9]{24}	2	0	0	1
+4570	4570	^[a-z0-9]{32}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4571	4571	^\/[a-z0-9]{32}\/\d\/$	2	0	0	1
+4572	4572	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4573	4573	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4574	4574	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4575	4575	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/Psi	2	0	0	1
+4576	4576	^transfer=[A-Za-z0-9/+=]+$	2	0	0	1
+4577	4577	^__gads=\d{9,10}:[01]:\d+:\d+(:\d{2,4})?\x3b\s_gat=(10|6)\.[0-3]\.\d{4,6}\.(32|64)\x3b\s_ga=\d\.\d+\.\d+\.\d+\x3b\s_u=[0-9A-F]+:[0-9A-F]+\x3b\s__io=\d{2}_\d{9,10}_\d{9,10}_\d{9,10}\x3b\s_gid=[0-9A-F]{12}$	2	0	0	1
+4578	4578	^[A-Z]{256}$	2	0	0	1
+4579	4579	^[0-9]{90,180}\r\n	2	0	0	1
+4580	4580	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r\n	2	0	0	1
+4581	4581	^\/vpn-service\/[a-z]{15}\/crunchyroll-vpn$	2	0	0	1
+4582	4582	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4583	4583	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4584	4584	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4585	4585	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4586	4586	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4587	4587	^SSID=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4588	4588	^(id|tfzT)=	2	0	0	1
+4589	4589	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4590	4590	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+4591	4591	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+4592	4592	^[a-zA-Z0-9]{32}\.dot$	2	0	0	1
+4593	4593	^[0-9A-F]{21,22}\x20HTTP\/1\.1$	2	0	0	1
+4594	4594	^[0-9A-F]+$	2	0	0	1
+4595	4595	^C=(M[ACDEGHKLMNOPQRSTUVWXYZ]|G[ABDEFGHILMNPQRSTUWY]|B[ABDEFGHIJMNORSTVWZ]|A[DEFGILMNOQRSTUWXZ]|S[ABCEGHIJKLMNRTUVZ]|C[ACFHIKLMNORSVXYZ]|T[CDFGHJKMNOPRTVWZ]|P[AEFGHKLMNRSTWY]|N[ACEFGILOPRTUZ]|K[EGHIMNRWYZ]|L[ACIKSTUVY]|I[DELMNOST]|E[CEGHRST]|F[IJKMORX]|U[AGKMSYZ]|V[ACEGINU]|D[EJKMOZ]|H[KMNRTU]|R[EOSUW]|J[EMOP]|W[FS]|Y[ET]|Z[AM]|OM|QA),\sST=((M[ADEINOST]|N[CDEHJMVY]|A[KLRZ]|I[ADLN]|W[AIVY]|C[AOT]|O[HKR]|[GLP]A|K[SY]|S[CD]|T[NX]|V[AT]|[HR]I|DE|FL|UT))[A-Z]{2},\sL=[A-Z][a-z]{2,15}(\s[A-Z][a-z]{2,10})?,\sO=[A-Z][a-z]{2,25}\s[A-Z][a-z]{2,25}(\s[A-Z][a-z]{2,25})?(\s[A-Z][a-z]{2,25})?(\s(Inc|LLC)\.)?,\sCN=[a-z]{4,11}\.[a-z]{2,4}$	2	0	0	1
+4596	4596	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4597	4597	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4598	4598	\x1c([a-z0-9]{28})[^\r\n]+(\x03(net|com)|\x02in)	2	0	0	1
+4599	4599	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4600	4600	^[a-zA-Z0-9/+]{171}=$	2	0	0	1
+4601	4601	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4602	4602	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4603	4603	^OSID=[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+4604	4604	\=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4605	4605	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4606	4606	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4607	4607	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4608	4608	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4609	4609	^[a-z0-9_]{6}[^a-z0-9_]	2	0	0	1
+4610	4610	^[a-z0-9]{5}\.com$	2	0	0	1
+4611	4611	^[a-z]{3,15}\x3a\x20	2	0	0	1
+4612	4612	^[a-zA-z]{5,10}_[A-F0-9]{12}$	2	0	0	1
+4613	4613	^[a-zA-z]{5,10}_[A-F0-9]{12}$	2	0	0	1
+4614	4614	^[^\"]+\x7c\x22\x2c\x22	2	0	0	1
+4615	4615	^[a-z0-9]{32}	2	0	0	1
+4616	4616	^[a-z0-9]{32}	2	0	0	1
+4617	4617	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4618	4618	^(curl|wget)_?(c(ve_20(1((7_1161|8_760)0|9_10758)|20_16846)|url_xxljobUnauth)|tp5)$	2	0	0	1
+4619	4619	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4620	4620	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4621	4621	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4622	4622	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+4623	4623	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4624	4624	^_?([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4625	4625	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4626	4626	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4627	4627	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4628	4628	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4629	4629	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4630	4630	^[a-f0-9]{5,12}&a=	2	0	0	1
+4631	4631	CN=([^\r\n]+?\.)?hotjar\.info(\.)	2	0	0	1
+4632	4632	^\/\?d=[a-f0-9]{16}$	2	0	0	1
+4633	4633	^[a-z]{1}	2	0	0	1
+4634	4634	^Date\x3a\x20[^\r\n]+[0-9]{2}::[0-9]{2}\x20	2	0	0	1
+4635	4635	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+4636	4636	^[A-P]{256}$	2	0	0	1
+4637	4637	^[a-f0-9]{32}\r\n\r\nPK	2	0	0	1
+4638	4638	^pk=[A-Za-z0-9]{8,50}&value=[a-f0-9]{50,500}$	2	0	0	1
+4639	4639	^[A-Z]{2}-[A-Z0-9]{10,20}-[A-Z0-9]{6,10}-[A-Z0-9]{2,8}-[A-Z0-9]{2,8}-[0-9]{2,5}$	2	0	0	1
+4640	4640	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$	2	0	0	1
+4641	4641	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$	2	0	0	1
+4642	4642	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$	2	0	0	1
+4643	4643	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+4644	4644	^\.(93joshua|purrple|black)$	2	0	0	1
+4645	4645	Content-Disposition\x3a\x20form-data\x3b\s*name=\x22(source|formdata|billinfo|cardinfo)\x22	2	0	0	1
+4646	4646	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4647	4647	^[A-Za-z0-9_-]+$	2	0	0	1
+4648	4648	(\/((p(lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|o(sts?\/[a-z0-9]+|ny[a-z]*)|rogcicicic|m\d{1,2})|s(ystem\/(logs|engine)\/[^\x2f]+?|e(rv(au|er)|ct)|vchost[^\x2f]*|gau\/.*?|alam|ucks|can|ke)|([a-z]*[0-9])([0-9]*[a-z])(setup\d+\.exe)[a-z0-9]{5,10}|in(voice(\/[^\x2f]+|[^\x2f]*)|st\d+|fos?)|a(d(min\/images\/\w+|obe)|salam|live|us)|m(edia\/files\/\w+|a(cros?|rch)|soffice)|d(o(c(\/[a-z0-9]+)?|ne)|bust)|(~.+?\/\.[^\x2f]+|\.css)\/.+?|c(onfig|hris|alc)|u(swinz\w+|pdate)|xml\/load\/[^\x2f]+|([Dd]ocumen|ve)t|Ozonecrytedserver|w(or[dk]|insys)|t(mp\/.+?|est)|fa(cture|soo)|n(otepad|ach)|k(be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe|(([a-z0-9]*?[3456789][a-z0-9]*?[3456789])([a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(^\/(image\/.+?\/[^\x2f]+|x\/setup)|[\x2f\s]order|keem)\.exe$)	2	0	0	1
+4649	4649	^CN=www\.[0-9a-z]{8,20}\.net$	2	0	0	1
+4650	4650	^[A-F0-9]+$	2	0	0	1
+4651	4651	\.[dghbcijklmnfqrwxyz23stuopaev4569]{26}\.[a-z0-9_-]{1,50}\.[a-z]{2,8}$	2	0	0	1
+4652	4652	^[a-zA-z]{8}\.	2	0	0	1
+4653	4653	^[a-zA-z]{8}\.	2	0	0	1
+4654	4654	[^\x18][^\x44\x32\x33\x25\x64\x22\x23\x3a\x27\x24\x26\x34\x3b\x12][\x20\x21\x28-\x2f\x70-\x77\x79-\x7f\x60-\x63\x65\x66\x67-\x6f\x50-\x5f\x40-\x42\x46-\x4f\x30\x31\x35\x36\x38\x3e\x39\x3b]{1,14}\x18	2	0	0	1
+4655	4655	^[A-F0-9]{32}	2	0	0	1
+4656	4656	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4657	4657	^tt[cf]$	2	0	0	1
+4658	4658	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4659	4659	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4660	4660	^([1-3]?)\/download\.php\?filename=ccom	2	0	0	1
+4661	4661	^[a-z]$	2	0	0	1
+4662	4662	\/([0-9]*?[a-z]*?[a-z0-9)([a-z0-9]*[0-9][a-z]*[0-9][a-z0-9]*\.exe)(setup\d+\.exe)[a-z0-9]{5,15}\.exe	2	0	0	1
+4663	4663	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+4664	4664	^User-Agent\x3a\x20(Mozilla\/|Shockwave)	2	0	0	1
+4665	4665	id\x3d[a-z0-9]{8}\x2d[a-z0-9]{4}\x2d[a-z0-9]{4}\x2d[a-z0-9]{4}\x2d[a-z0-9]{12}\x26key\x3d[a-z0-9]{512}	2	0	0	1
+4666	4666	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+4667	4667	^([a-f0-9]{32})=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4668	4668	^[a-z0-9]{32}	2	0	0	1
+4669	4669	^[\x20-\x7e]+?.{8}\x7d\x9f	2	0	0	1
+4670	4670	^[\x20-\x7e]+?.{8}\x7a\x9f	2	0	0	1
+4671	4671	^[\x20-\x7e]+?.{8}\x78\x9a	2	0	0	1
+4672	4672	^[\x20-\x7e]+?.{8}\x7f\x9f	2	0	0	1
+4673	4673	^[\x20-\x7e]+?.{8}\xc3\x70	2	0	0	1
+4674	4674	^[\x20-\x7e]+?.{8}\x7c\x9e	2	0	0	1
+4675	4675	^.{4}[\x20-\x7e]+?.{4}\x78\x9c	2	0	0	1
+4676	4676	^[\x20-\x7e]+?.{8}\x7c\x99	2	0	0	1
+4677	4677	^[\x20-\x7e]+?.{8}\x7f\x9b	2	0	0	1
+4678	4678	^[\x20-\x7e]+?.{8}\x31\xd9	2	0	0	1
+4679	4679	^[\x20-\x7e]+?.{8}\x70\x9b	2	0	0	1
+4680	4680	^[\x20-\x7e]+?.{8}\xda\x41	2	0	0	1
+4681	4681	^[\x20-\x7e]+?.{8}\x7a\x9a	2	0	0	1
+4682	4682	^[\x20-\x7e]+?.{8}\x3f\xa6	2	0	0	1
+4683	4683	^[\x20-\x7e]+?.{8}\x70\x9b	2	0	0	1
+4684	4684	^[\x20-\x7e]+?.{8}\x39\xdd	2	0	0	1
+4685	4685	^.{4}[\x20-\x7e]+?.{4}\x78\x9c	2	0	0	1
+4686	4686	^[\x20-\x7e]+?.{8}\x3b\xd8	2	0	0	1
+4687	4687	^[\x20-\x7e]+?.{8}\x79\x9b	2	0	0	1
+4688	4688	^[\x20-\x7e]+?.{8}\x7c\x9c	2	0	0	1
+4689	4689	^[\x20-\x7e]+?.{8}\x79\x95	2	0	0	1
+4690	4690	^[\x20-\x7e]+?.{8}\x71\x95	2	0	0	1
+4691	4691	^[\x20-\x7e]{5,}.{8}\x78\x9c	2	0	0	1
+4692	4692	^[\x20-\x7e]+?.{8}\x7b\x95	2	0	0	1
+4693	4693	^[\x20-\x7e]+?.{8}\x79\x9f	2	0	0	1
+4694	4694	^[A-Z]{14}$	2	0	0	1
+4695	4695	^.{4}[\x20-\x7e]+?.{4}\x71\x94	2	0	0	1
+4696	4696	^[\x20-\x7e]*?.{8}\x79\x9e	2	0	0	1
+4697	4697	^.{4}[\x20-\x7e]+?.{4}\x7c\x9c	2	0	0	1
+4698	4698	^[\x20-\x7e]+?.{8}\x7f\x9d	2	0	0	1
+4699	4699	^[\x20-\x7e]+?.{8}\x49\xa5	2	0	0	1
+4700	4700	^[\x20-\x7e]+?.{8}\x79\x94	2	0	0	1
+4701	4701	^.{8}[\x20-\x7e]+?.{5}\x7b\x9e	2	0	0	1
+4702	4702	^.{4}[\x20-\x7e]+?.{4}\x7d\x94	2	0	0	1
+4703	4703	^[\x20-\x7e]+?.{8}\x7d\x94	2	0	0	1
+4704	4704	^multipart/form-data\x3b\x20boundary=[a-f0-9]{60}$	2	0	0	1
+4705	4705	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+4706	4706	^[\x20-\x7e]+?.{8}\x7b\x98	2	0	0	1
+4707	4707	^[\x20-\x7e]+?.{8}\x31\xad	2	0	0	1
+4708	4708	^[\x20-\x7e]+?.{8}\x40\xa3	2	0	0	1
+4709	4709	^[\x20-\x7e]+?.{8}\x7d\x98	2	0	0	1
+4710	4710	^.{4}[\x20-\x7e]{5}.{4}\x7a\x9a	2	0	0	1
+4711	4711	^[\x20-\x7e]+?.{8}\x71\x9d	2	0	0	1
+4712	4712	^[\x20-\x7e]+?.{8}\x7a\x9b	2	0	0	1
+4713	4713	^.{8}\x70\x94[\x20-\x7e]	2	0	0	1
+4714	4714	^[\x20-\x7e]+?.{8}\x79\xda	2	0	0	1
+4715	4715	^[\x20-\x7e]+?.{8}\x30\xa5	2	0	0	1
+4716	4716	^[\x20-\x7e]+?.{8}\x70\x9a	2	0	0	1
+4717	4717	^[\x20-\x7e]+?.{8}\x79\x9b	2	0	0	1
+4718	4718	^[\x20-\x7e]+?.{8}\x31\xd9	2	0	0	1
+4719	4719	^[\x20-\x7e]+?.{8}\x79\x9c	2	0	0	1
+4720	4720	^[\x20-\x7e]+?.{8}\x7d\x99	2	0	0	1
+4721	4721	^[\x20-\x7e]+?.{8}\x7b\x9d	2	0	0	1
+4722	4722	^[\x20-\x7e]+?.{8}\x2e\x96	2	0	0	1
+4723	4723	^[\x20-\x7e]+?.{8}\x78\x9c	2	0	0	1
+4724	4724	^[\x20-\x7e]+?.{8}\x70\x98	2	0	0	1
+4725	4725	^[\x20-\x7e]+?.{8}\x4a\xae	2	0	0	1
+4726	4726	^[\x20-\x7e]+?.{8}\x71\x9e	2	0	0	1
+4727	4727	^.{8}[\x20-\x7e]+?[\x00]*?\x78\x9c	2	0	0	1
+4728	4728	^.{8}[\x20-\x7e]+?[\x00]*?\x78\x9c	2	0	0	1
+4729	4729	^.{8}[\x20-\x7e]+?\x79\x94	2	0	0	1
+4730	4730	^[\x20-\x7e]+?.{8}\x84\x60	2	0	0	1
+4731	4731	^[\x20-\x7e]+?.{8}\x40\xd8	2	0	0	1
+4732	4732	^[\x20-\x7e]+?.{8}\x7f\x94	2	0	0	1
+4733	4733	^[\x20-\x7e]+?.{8}\x79\x9c	2	0	0	1
+4734	4734	^[\x20-\x7e]+?.{8}\x7a\x9c	2	0	0	1
+4735	4735	^[\x20-\x7e]+?.{8}\x7e\x9c	2	0	0	1
+4736	4736	^[\x20-\x7e]+?.{8}\x39\x99	2	0	0	1
+4737	4737	^[\x20-\x7e]+?.{8}\x49\xa2	2	0	0	1
+4738	4738	^[\x20-\x7e]+?.{8}\x79\x9d	2	0	0	1
+4739	4739	^[\x20-\x7e]+?.{8}\x7b\x9f	2	0	0	1
+4740	4740	^[\x20-\x7e]+?.{8}\x79\x9a	2	0	0	1
+4741	4741	^[\x20-\x7e]+?.{8}\x70\x94	2	0	0	1
+4742	4742	^[\x20-\x7e]+?.{8}\x44\xdf	2	0	0	1
+4743	4743	^.{4}[\x20-\x7e]+?.{4}\x7b\x9e	2	0	0	1
+4744	4744	^[\x20-\x7e]+?.{8}\x7b\x9e	2	0	0	1
+4745	4745	^[\x20-\x7e]+?.{8}\x83\x7f	2	0	0	1
+4746	4746	^.{8}[\x20-\x7e]+?\x7c\x9f	2	0	0	1
+4747	4747	^[\x20-\x7e]+?.{8}\x7d\x9a	2	0	0	1
+4748	4748	^.{9,28}\x78\x9c	2	0	0	1
+4749	4749	^.{8}[\x20-\x7e]{5}\x78\x9c	2	0	0	1
+4750	4750	^[\x20-\x7e]+?.{8}\x4a\xd5	2	0	0	1
+4751	4751	^[\x20-\x7e]+?.{8}\x79\xdd	2	0	0	1
+4752	4752	^[\x20-\x7e]+?.{8}\x70\x9e	2	0	0	1
+4753	4753	^[\x20-\x7e]+?.{10}\x7a\x5d	2	0	0	1
+4754	4754	^.{8}[\x20-\x7e]+?.{5}\x7c\x9e	2	0	0	1
+4755	4755	^[\x20-\x7e]+?.{8}\x7d\x9e	2	0	0	1
+4756	4756	^[\x20-\x7e]+?.{8}\x70\x9c	2	0	0	1
+4757	4757	^[\x20-\x7e]+?.{8}\x3b\xdf	2	0	0	1
+4758	4758	^[\x20-\x7e]+?.{8}\x47\xd9	2	0	0	1
+4759	4759	^[\x20-\x7e]+?.{8}\x79\x99	2	0	0	1
+4760	4760	^.{8}[\x20-\x7e]+?.{2}\x78\x9c	2	0	0	1
+4761	4761	^.{4}[\x20-\x7e]{5}.{4}\x96\x71	2	0	0	1
+4762	4762	^[\x20-\x7e]+?.{8}\x7b\x9b	2	0	0	1
+4763	4763	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4764	4764	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4765	4765	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4766	4766	([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4767	4767	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4768	4768	^[a-f0-9]{32}	2	0	0	1
+4769	4769	>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}>	2	0	0	1
+4770	4770	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4771	4771	^[A-Za-z0-9_]{20}\/[a-f0-9]{40}$	2	0	0	1
+4772	4772	\/[a-z0-9]{1,31}\.bin$	2	0	0	1
+4773	4773	^[A-Za-z0-9\-_~]{75,}$	2	0	0	1
+4774	4774	(JmJ1aWxkP|YnVpbGQ9|ZidWlsZD)	2	0	0	1
+4775	4775	^[\x80|\x40]\x00[\x80|\x40]\x00\x00\x00	2	0	0	1
+4776	4776	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4777	4777	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4778	4778	^[A-Za-z0-9]{16,32}$	2	0	0	1
+4779	4779	^[a-zA-Z0-9_-]{171}$	2	0	0	1
+4780	4780	(Q(k(MIdh|UMcR)|0IPdR)|(DQg91|FRghw)F|(NCD3U|VGCHA)X|C(Qwh2E|RQxxF)|J(DCHYT|FDHEW)|R(UYIcB|kIJcR)|GQglxE|ZCCXEQ)	2	0	0	1
+4781	4781	(fCxTeXN0ZW0gSWRsZS|wsU3lzdGVtIElkbGUg|8LFN5c3RlbSBJZGxlI)	2	0	0	1
+4782	4782	(I(iwidmFsdWUiO|sInZhbHVlIjo)i|iLCJ2YWx1ZSI6I)	2	0	0	1
+4783	4783	^[0-9a-f]{64}$	2	0	0	1
+4784	4784	^[0-9a-f]{64}$	2	0	0	1
+4785	4785	^[\x01-\x4c]$	2	0	0	1
+4786	4786	CN=([^\r\n]+?\.)?OU=Delegated\ Licensor,KYP\ SDT\ LTD(\.)	2	0	0	1
+4787	4787	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4788	4788	^key=\w+\&data=	2	0	0	1
+4789	4789	^\d+$	2	0	0	1
+4790	4790	\.php\?zs=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&t=[0-9]{1,2}$	2	0	0	1
+4791	4791	^[0-9D]+$	2	0	0	1
+4792	4792	\.(dll|exe|zip|json)$	2	0	0	1
+4793	4793	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4794	4794	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4795	4795	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4796	4796	^\/[a-zA-Z0-9]{9,12}\/t\.html$	2	0	0	1
+4797	4797	^\/[a-z]{3,10}\.php\?[a-z]{3,10}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4798	4798	^[a-z]{256}$	2	0	0	1
+4799	4799	^[0-9]&(index|pi|serv)=	2	0	0	1
+4800	4800	^[0-9]&(index|pi|serv)=	2	0	0	1
+4801	4801	^[0-9]&(index|pi|serv)=	2	0	0	1
+4802	4802	^\/[a-zA-Z0-9+=]{29,44}.{0,8}=$	2	0	0	1
+4803	4803	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4804	4804	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})([\r\n]([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?$	2	0	0	1
+4805	4805	^[A-Za-z0-9]{1,15}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+4806	4806	(IiwiM2ZlMTEiOi|IsIjNmZTExIjoi|iLCIzZmUxMSI6I)	2	0	0	1
+4807	4807	(IiwiYXU1byI6I|IsImF1NW8iOi|iLCJhdTVvIjoi)	2	0	0	1
+4808	4808	(ifQ==|In0=|J9)$	2	0	0	1
+4809	4809	^[a-z]{256}-\.jpg$	2	0	0	1
+4810	4810	^[IJKL].*(PT0iLC|09Iiwi|9PSIsI)[a-zA-Z0-9+\/]+(PT0iLC|09Iiwi|9PSIsI)	2	0	0	1
+4811	4811	^[a-f0-9]{5,12}&a=	2	0	0	1
+4812	4812	^[a-zA-Z0-9]{12}\.onion	2	0	0	1
+4813	4813	^\x7b(\x22[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.[a-z]{2,10}\x22,){4}\x22[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.[a-z]{2,10}\x22\x7d$	2	0	0	1
+4814	4814	^[a-z]{256}\.gif$	2	0	0	1
+4815	4815	(JTBEJTBBJTBEJTBBJTREJTY1JTZEJTZGJTcyJTc5JTNBJTIw|UwRCUwQSUwRCUwQSU0RCU2NSU2RCU2RiU3MiU3OSUzQSUyM|lMEQlMEElMEQlMEElNEQlNjUlNkQlNkYlNzIlNzklM0ElMj)	2	0	0	1
+4816	4816	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d+)?$	2	0	0	1
+4817	4817	^\/[a-zA-Z0-9]{9,12}\/x\.html$	2	0	0	1
+4818	4818	^[0-9]+$	2	0	0	1
+4819	4819	^([A-Za-z0-9%+\/]{4,6})*([A-Za-z0-9%+\/]{2}==|[A-Za-z0-9%+\/]{3}=|[A-Za-z0-9%+\/]{4})$	2	0	0	1
+4820	4820	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4821	4821	^[\x01-\x04]	2	0	0	1
+4822	4822	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4823	4823	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4824	4824	[a-z]{8}.(:?psd|dib)	2	0	0	1
+4825	4825	[a-z]{8}.(:?dib|psd)	2	0	0	1
+4826	4826	https:\/\/[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}.[a-z]{3,12}.com\/[a-z]{3,4}\/[a-z0-9]{6}_[a-z0-9]{32}	2	0	0	1
+4827	4827	^[a-z0-9]{6}_[a-z0-9]{32}	2	0	0	1
+4828	4828	\.php\?[a-z]{3}=(baby|child|adult)	2	0	0	1
+4829	4829	^[a-f0-9=]{5,12}&ap=	2	0	0	1
+4830	4830	^[0-9]{8}$	2	0	0	1
+4831	4831	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4832	4832	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4833	4833	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4834	4834	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4835	4835	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4836	4836	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4837	4837	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4838	4838	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4839	4839	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4840	4840	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4841	4841	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$	2	0	0	1
+4842	4842	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$	2	0	0	1
+4843	4843	^(update|designs)$	2	0	0	1
+4844	4844	^\d$	2	0	0	1
+4845	4845	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a80$	2	0	0	1
+4846	4846	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4847	4847	\*\*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\*\*	2	0	0	1
+4848	4848	^\/wp\x2dcontent\/[a-z]{3}\/[0-9]{16}\.exe$	2	0	0	1
+4849	4849	^[A-Za-z0-9-_]{176}$	2	0	0	1
+4850	4850	^\/\.x\/irq\d$	2	0	0	1
+4851	4851	^\/\.x\/\dsh$	2	0	0	1
+4852	4852	^(?<len>.{2})\xc0\xff(=len)\x00\x00.{2}\x00\x00\x01\x78\x9c	2	0	0	1
+4853	4853	\x24url[0-9]{1}\s=\s'(http|https):\/\/[^']*\x27\x3b	2	0	0	1
+4854	4854	^\/[A-Za-z0-9]{10,11}\/	2	0	0	1
+4855	4855	\.php\?serial=[a-z0-9]{16}	2	0	0	1
+4856	4856	^[0-3]{2}_[0-2]{2}\.php$	2	0	0	1
+4857	4857	^dBrowser\x20\d\x20CallGetResponse\x3a\d$	2	0	0	1
+4858	4858	^\/\w$	2	0	0	1
+4859	4859	^\/wrte\?maid=[A-Z0-9]{8}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{12}$	2	0	0	1
+4860	4860	^\/[a-z0-9]{1,3}\/service\?uuid=[A-Z0-9]{8}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{12}$	2	0	0	1
+4861	4861	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n][\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n][\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4862	4862	^\/wp-includes\/[A-Za-z0-9]{10}\/$	2	0	0	1
+4863	4863	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4864	4864	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4865	4865	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4866	4866	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4867	4867	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4868	4868	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4869	4869	^[A-Za-z0-9]{16,32}$	2	0	0	1
+4870	4870	^[A-Za-z0-9]{16,32}$	2	0	0	1
+4871	4871	^\d+$	2	0	0	1
+4872	4872	^\/[A-Za-z0-9]{30}\.php$	2	0	0	1
+4873	4873	^[a-f0-9]{5}([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})[a-f0-9]{2}-v[a-f0-9]{2}\x0a\x22\x3e\x0a\x3c	2	0	0	1
+4874	4874	^([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})$	2	0	0	1
+4875	4875	^[a-zA-Z0-9+\/]+([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})$	2	0	0	1
+4876	4876	^[a-zA-Z0-9+\/]+([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})$	2	0	0	1
+4877	4877	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4878	4878	^[a-z0-9]{8}\r\n	2	0	0	1
+4879	4879	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+4880	4880	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4881	4881	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4882	4882	^[0-9]{6,10}\.	2	0	0	1
+4883	4883	^\/[a-zA-z]{14}\/	2	0	0	1
+4884	4884	^\/[a-zA-z]{14}\/	2	0	0	1
+4885	4885	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4886	4886	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4887	4887	^[A-Z]{16}$	2	0	0	1
+4888	4888	^\/\x3fusername\x3d[a-z0-9]{2,3}_\d$	2	0	0	1
+4889	4889	^[A-Z]{16}$	2	0	0	1
+4890	4890	^[A-Z]{16}$	2	0	0	1
+4891	4891	^([A-F0-9]\x00){12}	2	0	0	1
+4892	4892	^([A-F0-9]\x00){12}	2	0	0	1
+4893	4893	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4894	4894	^[A-F0-9]{12}	2	0	0	1
+4895	4895	^([A-F0-9]\x00){12}	2	0	0	1
+4896	4896	^[A-F0-9]{12}	2	0	0	1
+4897	4897	^(<letter>[a-z])(=letter)\,	2	0	0	1
+4898	4898	O=(GoDaddy)[A-Z][a-z]+\s[A-Z][a-z]+\s(NL|Pty|Inc|Corp|Ltd)\.?,.+CN=[a-z]{5,}\.[a-z]{2,3}($|,)	2	0	0	1
+4899	4899	[eE]mail(Address)admin@	2	0	0	1
+4900	4900	^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email)	2	0	0	1
+4901	4901	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+4902	4902	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+4903	4903	^[A-F0-9]{12}	2	0	0	1
+4904	4904	^\d	2	0	0	1
+4905	4905	^\x2F[a-z]{1}\x2Ehtm$	2	0	0	1
+4906	4906	\/index.dat\?\d{5,9}$	2	0	0	1
+4907	4907	^\/[A-Za-z]{2,}\/\?[a-z]\sHTTP\/1\.[0-1]\r\nUser-Agent\x3a Mozilla\/4\.0 \x28compatible\x3b MSIE 7\.0\x3b Windows NT 5\.1\x3b SV1\x29\r\nHost\x3a\x20[^\r\n]+?(\x3a(443|8080|900[0-9]))?\r\n(Connection\x3a\x20Keep-Alive\r\n)?\r\n$	2	0	0	1
+4908	4908	^Host\x3a\x20([a-z0-9]{0,19}[A-Z])([A-Z0-9]{0,19}[a-z])[a-zA-Z0-9]{4,20}\.[a-z]{2,3}/H	2	0	0	1
+4909	4909	^[a-zA-Z0-9\+\/]+={0,2}$/P	2	0	0	1
+4910	4910	filename=[a-f0-9]{32}v\.(docm|zip)\x0d\x0a/Hmi	2	0	0	1
+4911	4911	^((\x00\x00\x00).)*?_\x00((\x00\x00).)*?_\x00((\x00\x00).)*?_\x00((\x00\x00).)*?\x2e\x00t\x00x\x00t	2	0	0	1
+4912	4912	^[a-z]\x29	2	0	0	1
+4913	4913	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title	2	0	0	1
+4914	4914	^.{2}([a-z]{0,15}\d)(<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x0a.{2}(=var)	2	0	0	1
+4915	4915	^\/[a-z]$	2	0	0	1
+4916	4916	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4917	4917	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4918	4918	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4919	4919	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4920	4920	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4921	4921	^.{2}(<fake_loc>([asdfgh]+|[qwerty]+|[zxcvbn]+|[23werf]+)[01]).+?\x06\x03\x55\x04\x07.{2}(=fake_loc)	2	0	0	1
+4922	4922	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4923	4923	^[a-z0-9/=\+]$	2	0	0	1
+4924	4924	^[a-z0-9/=\+]$	2	0	0	1
+4925	4925	^\/d\/[a-z]+\d+\.jpg$	2	0	0	1
+4926	4926	\/p?2p\/[0-9]{1,2}\.exe$	2	0	0	1
+4927	4927	^\/2p\/[a-z]{1,2}\.exe$	2	0	0	1
+4928	4928	\/[a-z0-9]{3,}\.gz$	2	0	0	1
+4929	4929	\/mss\d+\.exe$	2	0	0	1
+4930	4930	^\/download\/ftp\/(grabftp|grabftp64)\.bin$	2	0	0	1
+4931	4931	^\/image\/(data|flags)\/[^\x2f]+\.exe$	2	0	0	1
+4932	4932	(\x20MSIE\x20|rv\x3a11)	2	0	0	1
+4933	4933	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4934	4934	^\/[a-z]{3,6}\/[a-z]{3,6}\.[a-z]{3}$	2	0	0	1
+4935	4935	^[A-Z]{2}-[0-9]{1,5}\x3aBegin$	2	0	0	1
+4936	4936	^[A-Z]{2}-[0-9]{1,5}\x3aStartU$	2	0	0	1
+4937	4937	^\/command\/[A-Fa-f0-9]{8}\-([A-Fa-f0-9]{4}\-){3}[A-Fa-f0-9]{12}\.cmd$	2	0	0	1
+4938	4938	^<CHECK>([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/CHECK>	2	0	0	1
+4939	4939	^\{\x22uid\x22\x3a\x22[a-f0-9]+\x22\}$	2	0	0	1
+4940	4940	^[A-Za-z0-9_-]{171}$	2	0	0	1
+4941	4941	^\/[a-f0-9]{8}\/\D+\d{8,10}\.html$	2	0	0	1
+4942	4942	^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}\/){1,10})\sHTTP\/1\.1\r\nReferer\x3a\x20http:\/\/(\d{1,3}\.){3}\d{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+4943	4943	^\x2f\x00{3}[A-Z0-9]{6}_[a-f0-9]+\x00{16}$	2	0	0	1
+4944	4944	[A-Za-z0-9]{62}	2	0	0	1
+4945	4945	^(php)?Yuok\\\d\d	2	0	0	1
+4946	4946	Data\\\d\d	2	0	0	1
+4947	4947	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+4948	4948	^\/\?id\=[A-Z]{12,28}[0-9]$	2	0	0	1
+4949	4949	^\/\?id\=[A-Z]{12,28}[0-9]$	2	0	0	1
+4950	4950	\/\?p=p52dcW[A-Za-z]{4}	2	0	0	1
+4951	4951	^.{2}(<var>[a-zA-Z0-9]{24}[01]).+?\x06\x03\x55\x04\x07.{2}(=var)	2	0	0	1
+4952	4952	^(<var>[a-zA-Z0-9]{1,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+4953	4953	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+4954	4954	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+4955	4955	^.(<orgname>.[^01]+).*?\x55\x04\x0b.(=orgname)	2	0	0	1
+4956	4956	[^\x15][^\x49\x3f\x3e\x28\x69\x2f\x2e\x37\x2a\x29\x2b\x39\x36][\x20-\x27\x2c\x2d\x30\x31\x33-\x36\x38\x3b-\x3d\x40-\x47\x4a-\x4d\x4f\x50-\x5f\x60\x68\x6b-\x6f\x70-\x74\x76-\x7f]{1,14}\x15	2	0	0	1
+4957	4957	^[0-9]-[0-9]-[0-9]{5}-[0-9]\r\n	2	0	0	1
+4958	4958	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4959	4959	^[A-Za-z0-9\/_\-\+]{171}=$	2	0	0	1
+4960	4960	[a-zA-Z0-9]{8}\/	2	0	0	1
+4961	4961	^[a-z]\.(tech|online)$	2	0	0	1
+4962	4962	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+4963	4963	^[a-zA-Z0-9-_]{171}$	2	0	0	1
+4964	4964	[a-z0-9]{8}\/.*\?[a-z0-9]{3,10}=[a-z0-9]{8,11}$	2	0	0	1
+4965	4965	updateb\.php\?p=\d	2	0	0	1
+4966	4966	&os=[0-9a-z]{40}	2	0	0	1
+4967	4967	&(<vname>[a-z]+)1=[A-F0-9]+&(=vname)2=[A-F0-9]+&(=vname)3=[A-F0-9]+&(=vname)4=[A-F0-9]	2	0	0	1
+4968	4968	^[1-z]{13}=[0-9]{16}$	2	0	0	1
+4969	4969	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4970	4970	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4971	4971	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4972	4972	^\/[A-F0-9]{33}$	2	0	0	1
+4973	4973	^\d+?\x00	2	0	0	1
+4974	4974	%(USERPROFILE|APPDATA)%	2	0	0	1
+4975	4975	%(USERPROFILE|APPDATA)%	2	0	0	1
+4976	4976	%(USERPROFILE|APPDATA)%	2	0	0	1
+4977	4977	%(USERPROFILE|APPDATA)%	2	0	0	1
+4978	4978	^[0-9]{10}$	2	0	0	1
+4979	4979	^key=[A-F0-9]{32}$	2	0	0	1
+4980	4980	^[a-f0-9]{60}\x0d\x0a	2	0	0	1
+4981	4981	^(pro)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4982	4982	[0-9]{1,2}	2	0	0	1
+4983	4983	\d{1,2}	2	0	0	1
+4984	4984	[0-9]{1,2}	2	0	0	1
+4985	4985	[0-9]{1,2}	2	0	0	1
+4986	4986	[0-9]{1,2}	2	0	0	1
+4987	4987	[0-9]{1,2}	2	0	0	1
+4988	4988	CN=([^\r\n]+?\.)?supportmicrohere\.com(\.)	2	0	0	1
+4989	4989	CN=([^\r\n]+?\.)?jbdelmarket\.com(\.)	2	0	0	1
+4990	4990	[0-9]{1,3}	2	0	0	1
+4991	4991	[0-9]{1,3}	2	0	0	1
+4992	4992	^ETag\x3a\x20[0-9]{6}-[0-9]{3,5}-[0-9]{8}\r\n	2	0	0	1
+4993	4993	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+4994	4994	[a-f0-9]{60}$	2	0	0	1
+4995	4995	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+4996	4996	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+4997	4997	^[a-z0-9]{33}	2	0	0	1
+4998	4998	^[qbedm]{1}[a-zA-Z]{1,3}646[a-zA-Z0-9]{1,3}\.	2	0	0	1
+4999	4999	^[zjr9x]{1}[tmdhpz]{1}[0-9a-z]{1,6}266([a-zA-Z0-9]{1,6})?\.	2	0	0	1
+5000	5000	^5\.[0-2]\x20\d\d\x3a\d\d\x20	2	0	0	1
+5001	5001	^\d{1,5}\x00ll	2	0	0	1
+5002	5002	^LIST-[A-Za-z0-9]{16}\.	2	0	0	1
+5003	5003	^LS-[A-Za-z0-9]{16}\.	2	0	0	1
+5004	5004	^SIZE-[A-Za-z0-9]{16}\.	2	0	0	1
+5005	5005	^LD-[A-Za-z0-9]{16}\.	2	0	0	1
+5006	5006	^CB-[A-Za-z0-9]{16}\.	2	0	0	1
+5007	5007	^CD-[A-Za-z0-9]{16}\.	2	0	0	1
+5008	5008	^EX-[A-Za-z0-9]{16}\.	2	0	0	1
+5009	5009	^ALIVE-[A-Za-z0-9]{16}\.	2	0	0	1
+5010	5010	^EXIT-[A-Za-z0-9]{16}\.	2	0	0	1
+5011	5011	^finito-[A-Za-z0-9]{16}\.	2	0	0	1
+5012	5012	^.{4}(R(k(Z(GQkBG|CQEY)|BCRUVG)|0FFRkFH|UJDQUE)|Q(U(V(CQ0FB|GQUc)|NCRkI)|kFDQkZC|EJFRUY)|(Z(AQkVF|GRkJA)R|JBQ0JGQ)g|FFQkNBQQ|dBRUZBRw)	2	0	0	1
+5013	5013	\/([0-9]{2,8}\.)?[0-9]{4,16}\.dat$	2	0	0	1
+5014	5014	\/([0-9]{2,8}\.)?[0-9]{4,16}\.dat$	2	0	0	1
+5015	5015	^(send|receive)	2	0	0	1
+5016	5016	^(send|receive)	2	0	0	1
+5017	5017	^(send|receive)	2	0	0	1
+5018	5018	^(send|receive)	2	0	0	1
+5019	5019	^[0-9a-zA-Z]{32}	2	0	0	1
+5020	5020	^\/\.x\/var\/run\/tty\d$	2	0	0	1
+5021	5021	^\/var\/(run|tmp)\/pty$	2	0	0	1
+5022	5022	^\/[a-z0-9]{45,60}\/[a-z0-9]{35,65}\/[a-z0-9]{38,60}\.php\?data=active$	2	0	0	1
+5023	5023	^\/\?m=[abcde]&p1=[a-f0-9-]{8,40}(&p2=[^&]+)?(&p3=[^&]+)?$	2	0	0	1
+5024	5024	^sg\x3a\x20[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}[\r\n]+$	2	0	0	1
+5025	5025	\/\?m=[a-z]&p1=[a-z0-9]{8,12}(&p2=[^&]+)?(&p3=[^&]+)?$	2	0	0	1
+5026	5026	^[A-Za-z0-9+=/]{172}$	2	0	0	1
+5027	5027	^(FileManager|PortScan|ExecuteCommand|DatabaseManager)	2	0	0	1
+5028	5028	^[A-Za-z]{15,20}$	2	0	0	1
+5029	5029	^PHPSESSID=[a-z0-9]{26}$	2	0	0	1
+5030	5030	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5031	5031	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5032	5032	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5033	5033	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5034	5034	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5035	5035	^[\da-z]{11}	2	0	0	1
+5036	5036	^[A-Z]{2}	2	0	0	1
+5037	5037	^[A-Z]{2}	2	0	0	1
+5038	5038	^\/admin[0-9]?\/client\.php$	2	0	0	1
+5039	5039	^\/[a-z0-9]{16}\/	2	0	0	1
+5040	5040	^(\d{1,3}\.){3}\d{1,3}\|\|	2	0	0	1
+5041	5041	^\/[a-zA-Z0-9]{1,25}\-[a-f0-9]{8}$	2	0	0	1
+5042	5042	^[a-f0-9]{32}	2	0	0	1
+5043	5043	^[A-Z]{2}[A-F0-9]{16}	2	0	0	1
+5044	5044	^Referer\x3a\x20[a-zA-Z0-9_\-.]+\x28[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]\x29\w+\x0d\x0a	2	0	0	1
+5045	5045	^[A-Z0-9]{18}$	2	0	0	1
+5046	5046	^[A-Za-z0-9+/=]{730,}	2	0	0	1
+5047	5047	^[a-f0-9]{32}	2	0	0	1
+5048	5048	^[a-f0-9]{32}	2	0	0	1
+5049	5049	\/([a-zA-Z0-9+/\x20]{4})*([a-zA-Z0-9+/\x20]{2}==|[a-zA-Z0-9+/\x20]{5}=|[a-zA-Z0-9+/\x20]{4})([a-zA-Z=]{4}?)$	2	0	0	1
+5050	5050	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5051	5051	^\/([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})([a-zA-Z=]{4})?(\x20?)$	2	0	0	1
+5052	5052	^\/([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})([a-zA-Z=]{4})?(\x20?)$	2	0	0	1
+5053	5053	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+5054	5054	(([a-zA-Z0-9]\0){10,})	2	0	0	1
+5055	5055	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+5056	5056	^\/([a-zA-Z0-9]{280,408})$	2	0	0	1
+5057	5057	^\/([a-zA-Z0-9=]{60,408})$	2	0	0	1
+5058	5058	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+5059	5059	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+5060	5060	(TWljcm9zb2Z0IENvcnBvcmF0aW9uL|1pY3Jvc29mdCBDb3Jwb3JhdGlvbi|NaWNyb3NvZnQgQ29ycG9yYXRpb24u)[a-zA-Z0-9\x2f\x2b]{25,35}(Cg0KQzpc|oNCkM6XD|KDQpDOlw\x2b)	2	0	0	1
+5061	5061	^[0-9]{3}$	2	0	0	1
+5062	5062	(www\.((b(an(co(dobrasil|hsbc)|espa)|radesco(prime)?|b)|hsbc(pr(ivatebank|emier)|ba(merindus|nk))?|s(antander(banespa|net)?|erasa(experian)?)|uolhost)\.com\.br|c((aixa((economica(federal)?|qui)\.gov|\.(com|gov))|onsultasintegradas\.rs\.gov|ef\.(com|gov))\.br|redicard\.com(\.br)?)|itau(p(ersonnalite|rivatebank)|uniclass)?\.com\.br,|ame(ricanexpress\.com(\.br)?|x\.com\.br))|((b(an(co(dobrasil|hsbc)|risul)|radesco(prime)?|b)|hsbc(pr(ivatebank|emier)|ba(merindus|nk))?|s(erasa(experian)?|antander)|uolhost)\.com|c(aixa((economica(federal)?|qui)\.gov|\.(com|gov))|onsultasintegradas\.rs\.gov|ef\.(com|gov)|redicard\.com))\.br|itau((p(ersonnalite|rivatebank)|uniclass)\.com\.br|\.com\.br,)|ame(ricanexpress.com(\.br)?|x\.com\.br)|\*(linhadefensiva*|hsbc*))	2	0	0	1
+5063	5063	^\/(GetProDownConfig|downservers|ShopIp)\.aspx\?ShopId=[0-9]+$	2	0	0	1
+5064	5064	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+5065	5065	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+5066	5066	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+5067	5067	^\x5b[A-Z]{2}\x5d\x20[A-Z0-9]{32}\x20\x5b[0-9]{2}\x2d[0-9]{2}\x2d[0-9]{4}\x20[0-9]{2}\x2d[0-9]{2}\x2d[0-9]{2}\x5d\x5bsplit\x5d	2	0	0	1
+5068	5068	Subject\x3a[0-9]{1,2}\x2f[0-9]{1,2}\x2f[0-9]{4}\x20[0-9]{1,2}\x3a[0-9]{1,2}\x3a[0-9]{2}\x20[AP]	2	0	0	1
+5069	5069	^\d{3,6}$	2	0	0	1
+5070	5070	^.{2}([A-Z]{0,32}[^A-Z01])(<var>[^01]{4,33}[01]).+?\x06\x03\x55\x04\x08.{2}(=var)	2	0	0	1
+5071	5071	^\/[A-Za-z0-9]{16}\/[A-Za-z0-9]{16}\.php$	2	0	0	1
+5072	5072	^\/[A-Za-z0-9]{16}\/[A-Za-z0-9]{48}\.mp3$	2	0	0	1
+5073	5073	[A-Za-z0-9]{16}\x0d\x0a/Content|2d|Disposition|3a	2	0	0	1
+5074	5074	^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}	2	0	0	1
+5075	5075	^[A-Za-z0-9=/+]{100}	2	0	0	1
+5076	5076	^[A-Za-z0-9=/+]{100}	2	0	0	1
+5077	5077	CN=([^\r\n]+?\.)?edou\.me(\.)	2	0	0	1
+5078	5078	^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}\}	2	0	0	1
+5079	5079	^###\d+###[a-zA-Z0-9\-\.]{2,63}###\x00+$	2	0	0	1
+5080	5080	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+5081	5081	^([A-Za-z0-9]{4})*([A-Za-z0-9]{2}==|[A-Za-z0-9]{3}=|[A-Za-z0-9]{4})$	2	0	0	1
+5082	5082	^[A-Za-z0-9=+/\x22\x00]{100,1000}$	2	0	0	1
+5083	5083	^([A-F0-9]\x00){12}	2	0	0	1
+5084	5084	^[A-Za-z0-9]{262}$	2	0	0	1
+5085	5085	^[a-f0-9]{32}	2	0	0	1
+5086	5086	^(\x3a\d{1,5})?$	2	0	0	1
+5087	5087	^[A-Za-z0-9-_]{171}$	2	0	0	1
+5088	5088	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5089	5089	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5090	5090	\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|	2	0	0	1
+5091	5091	^(([a-z0-9])()){33,}\.ru$	2	0	0	1
+5092	5092	^\x12\x0b\x01\x00\x00\x01[\x00]{6}.[a-f0-9]{6,}(([\x01|\x02|\x03]\d{1,3}){4}|\x03::1)\x00\x00\x01	2	0	0	1
+5093	5093	^(0\x3d\w\x261\x3d\d{3}\x262\x3d\d{3})$	2	0	0	1
+5094	5094	^\d{6}	2	0	0	1
+5095	5095	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5096	5096	^.(<servercert>[\x00-\xff][\x20-\x7f]{1,50})\x30.+?\x55\x04\x03.(=servercert)\x30	2	0	0	1
+5097	5097	[a-f0-9]{24}\.[a-f0-9]{16}	2	0	0	1
+5098	5098	^[a-z]{4}\x3d	2	0	0	1
+5099	5099	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+5100	5100	^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}	2	0	0	1
+5101	5101	^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}	2	0	0	1
+5102	5102	^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}	2	0	0	1
+5103	5103	^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}	2	0	0	1
+5104	5104	^[a-f0-9]{32}\x7c\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x7c	2	0	0	1
+5105	5105	^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+5106	5106	^(ct_start|chr_start|moz_start|grb_start|upl_start)	2	0	0	1
+5107	5107	^(sqlite|mozglue|nss3|freebl3|softokn3)	2	0	0	1
+5108	5108	\{[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}\}	2	0	0	1
+5109	5109	\.jpg\?id=\d+$	2	0	0	1
+5110	5110	^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}	2	0	0	1
+5111	5111	^([A-Za-z0-9\x2b\x2f\x3d]){15,25}$	2	0	0	1
+5112	5112	^([A-Za-z0-9\x2b\x2f\x3d]){10,30}$	2	0	0	1
+5113	5113	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5114	5114	^\/[a-zA-Z0-9]{32}$	2	0	0	1
+5115	5115	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5116	5116	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5117	5117	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+5118	5118	^[A-F0-9]{8}\-[A-F0-9]{4}\-[A-F0-9]{4}\-[A-F0-9]{4}\-[A-F0-9]{12}$	2	0	0	1
+5119	5119	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5120	5120	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5121	5121	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5122	5122	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5123	5123	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5124	5124	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5125	5125	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5126	5126	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5127	5127	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5128	5128	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5129	5129	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5130	5130	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5131	5131	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5132	5132	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5133	5133	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5134	5134	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5135	5135	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5136	5136	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)	2	0	0	1
+5137	5137	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5138	5138	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5139	5139	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5140	5140	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5141	5141	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5142	5142	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5143	5143	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5144	5144	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5145	5145	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5146	5146	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5147	5147	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)	2	0	0	1
+5148	5148	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5149	5149	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5150	5150	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5151	5151	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5152	5152	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5153	5153	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)	2	0	0	1
+5154	5154	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5155	5155	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5156	5156	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5157	5157	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5158	5158	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5159	5159	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5160	5160	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5161	5161	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5162	5162	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5163	5163	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5164	5164	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5165	5165	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5166	5166	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5167	5167	^\d{4}\/\w{2,8}_\w{8}\.bmp	2	0	0	1
+5168	5168	\.(bmp|png|jpe?g)$	2	0	0	1
+5169	5169	\.(bmp|png|jpe?g)$	2	0	0	1
+5170	5170	\.(bmp|png|jpe?g)$	2	0	0	1
+5171	5171	\.(bmp|png|jpe?g)$	2	0	0	1
+5172	5172	\.(bmp|png|jpe?g)$	2	0	0	1
+5173	5173	\/\d{6,8}\/\w{2,5}_\w{8}\.bmp$	2	0	0	1
+5174	5174	^[0-9]{15,16}\x7d$	2	0	0	1
+5175	5175	^[a-z0-9]{19}	2	0	0	1
+5176	5176	^[a-f0-9]{32}\.gif\"	2	0	0	1
+5177	5177	^[A-Za-z0-9]{3,20}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+5178	5178	^[a-f0-9]{32}	2	0	0	1
+5179	5179	^\d{14}\.jpg\x22/P	2	0	0	1
+5180	5180	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+5181	5181	^((([a-f0-9]){2}){16})	2	0	0	1
+5182	5182	^[A-Z0-9]{12}$	2	0	0	1
+5183	5183	^[A-Z0-9]{10}\x22	2	0	0	1
+5184	5184	^images[a-f0-9]{8}\.	2	0	0	1
+5185	5185	^[a-f0-9]{12}	2	0	0	1
+5186	5186	^[A-F0-9]{32}	2	0	0	1
+5187	5187	^([A-Za-z0-9~\+\/]{4})*([A-Za-z0-9~\+\/]{2}==|[A-Za-z0-9~\+\/]{3}=|[A-Za-z0-9~\+\/]{4})$	2	0	0	1
+5188	5188	^\d+\.\d+\.\d{3,5}	2	0	0	1
+5189	5189	^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\x7c	2	0	0	1
+5190	5190	^([0-9A-F]{2}(-)?){16}\x7c	2	0	0	1
+5191	5191	^http|3a 2f 2f|[a-z]{5,10}.(com|org|net)\/$	2	0	0	1
+5192	5192	^[a-f0-9]{8}\-[a-f0-9]{8}\x22\x0d\x0a	2	0	0	1
+5193	5193	^AUTHINFO\s+USER\s[^\n]{200}	2	0	0	1
+5194	5194	^SEARCH\s+[^\n]{1024}	2	0	0	1
+5195	5195	--backup-dir\s+\x2e\x2e\x2f	2	0	0	1
+5196	5196	^200\s[^\n]{64}	2	0	0	1
+5197	5197	^Location\x3a[^\n]{128}	2	0	0	1
+5198	5198	^newgroup\x3a[^\n]{21}	2	0	0	1
+5199	5199	^XAT\s+[^\n]{1024}	2	0	0	1
+5200	5200	^sendsys\x3a[^\n]{21}	2	0	0	1
+5201	5201	^checkgroups\x3a[^\n]{21}	2	0	0	1
+5202	5202	^ihave\x3a[^\n]{21}	2	0	0	1
+5203	5203	^rmgroup\x3a[^\n]{21}	2	0	0	1
+5204	5204	^sendme\x3a[^\n]{21}	2	0	0	1
+5205	5205	^senduuname\x3a[^\n]{21}	2	0	0	1
+5206	5206	^version\x3a[^\n]{21}	2	0	0	1
+5207	5207	Enter User Name\x3a(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*\s*(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*f(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*a(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*c(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*t(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*o(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*r(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*y(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*[\r\n]	2	0	0	1
+5208	5208	\x2FHiShowServlet\x2Fservlet.+(InstalNum|UserActivation)	2	0	0	1
+5209	5209	Host\x3A[^\n\r]*jiao.com/Hi	2	0	0	1
+5210	5210	imei=\d{2}-?\d{6}-?\d{6,}-?\d{1,}	2	0	0	1
+5211	5211	^\s*?\(\s*?(<var>[^\x3d\x3b\)\s]+)\s*\s*?0\s*?\x3b\s*?(=var)\s*?\<\s*?(0x)?\d{4,}\s*?\x3b\s*?(=var)\+\+\s*?\)\s*?\x7b\s*?(<var2>[^\x3d\x3b\)\s]+)\s*\s*?(=var2)\s*?\+\s*?[\x22\x27]\d+[\x22\x27]	2	0	0	1
+5212	5212	^\s*?\(\s*?(<var>[^\x3d\x3b\)\s]+)\s*\s*?0\s*?\x3b\s*?(=var)\s*?\<\s*?(0x)?\d{4,}\s*?\x3b\s*?(=var)\+\+\s*?\)\s*?\x7b\s*?(<var2>[^\x3d\x3b\)\s]+)\s*\s*?(=var2)\s*?\+\s*?[\x22\x27]\d+[\x22\x27]	2	0	0	1
+5213	5213	\/kt\/JpNx9n$	2	0	0	1
+5214	5214	^\d{15}\r\n$	2	0	0	1
+5215	5215	^[a-f0-9]	2	0	0	1
+5216	5216	^[a-f0-9]	2	0	0	1
+5217	5217	^(update|startcharge)	2	0	0	1
+5218	5218	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+5219	5219	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+5220	5220	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+5221	5221	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+5222	5222	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+5223	5223	^((sear|wat)ch|results|close|find|open)\/\?[a-zA-Z]{2,8}=	2	0	0	1
+5224	5224	^bot_id=[a-f0-9]{32}&	2	0	0	1
+5225	5225	\/RequestActionsToExecute$	2	0	0	1
+5226	5226	\/n\/\d{15}$	2	0	0	1
+5227	5227	\/ad-(strat|devi)\/$	2	0	0	1
+5228	5228	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+5229	5229	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+5230	5230	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+5231	5231	^[a-f0-9]{30,35}&app_package_name=	2	0	0	1
+5232	5232	^\/flash\/api\.php\?id=\d	2	0	0	1
+5233	5233	^Host\x3a[^\r\n]+?dmp\.[^\r\n]+?\r?$	2	0	0	1
+5234	5234	^\/gac\/[a-f0-9]{15}$	2	0	0	1
+5235	5235	&game=[a-f0-9]{40}$	2	0	0	1
+5236	5236	&id=\d{15}$	2	0	0	1
+5237	5237	^Host\x3a\x20[a-z0-9.]+\.bb800\.com	2	0	0	1
+5238	5238	^Host\x3a\x20[a-z0-9.]+\.bb800\.com	2	0	0	1
+5239	5239	\/NotifyLog$	2	0	0	1
+5240	5240	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+5241	5241	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+5242	5242	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+5243	5243	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+5244	5244	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+5245	5245	^d(id|ei)=[A-F0-9]{10,100}&method=IS[A-Z]{1,10}$	2	0	0	1
+5246	5246	&data=(([A-Za-z0-9]|%2[FB]){4})*(([A-Za-z0-9]|%2[FB]){2}==|([A-Za-z0-9]|%2[FB]){3}=|([A-Za-z0-9]|%2[FB]){4})$	2	0	0	1
+5247	5247	^Host\x3a[^\n\r]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[\r\n]+$	2	0	0	1
+5248	5248	\.php\?id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&type=	2	0	0	1
+5249	5249	\?id=([a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$	2	0	0	1
+5250	5250	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+5251	5251	Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r)	2	0	0	1
+5252	5252	(^|&|\x22|\{\x22)id(=|\x22\x3a\x22)([a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})(&|\x22|$)	2	0	0	1
+5253	5253	^\{\x22(os|type)\x22\x3a	2	0	0	1
+5254	5254	^[a-z]{15}\.(com|ru|cn|su)$/W	2	0	0	1
+5255	5255	^[a-z]{15}\.(com|ru|cn|su)$/W	2	0	0	1
+5256	5256	^[a-z]{15}\.(com|ru|cn|su)$/W	2	0	0	1
+5257	5257	\.php\?m=[abcdefgh]&p1=[a-f0-9]{16}&p2=[^\r\n]+$	2	0	0	1
+5258	5258	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5259	5259	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5260	5260	\.php\?m=[abcdefgh]&p1=[a-f0-9]{16}$	2	0	0	1
+5261	5261	^[a-z]{15}\.(ru|su|cn)$	2	0	0	1
+5262	5262	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5263	5263	^([0-9]{15})$	2	0	0	1
+5264	5264	(\x00\\\x00.*?){2}\x00{2}\xFF{2}.{128,}[\x04-\xFF][\x00-\xFF]{3}\x00{4}$	2	0	0	1
+5265	5265	(\x00\\\x00.*?){2}\x00{2}\xFF{2}.{128,}[\x04-\xFF][\x00-\xFF]{3}\x00{4}$	2	0	0	1
+5266	5266	^.{4}	2	0	0	1
+5267	5267	^.{4}	2	0	0	1
+5268	5268	^.{4}	2	0	0	1
+5269	5269	^.{27}	2	0	0	1
+5270	5270	^.{27}	2	0	0	1
+5271	5271	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5272	5272	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5273	5273	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5274	5274	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5275	5275	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5276	5276	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5277	5277	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5278	5278	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5279	5279	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5280	5280	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5281	5281	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5282	5282	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5283	5283	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5284	5284	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5285	5285	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5286	5286	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5287	5287	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5288	5288	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5289	5289	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5290	5290	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5291	5291	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5292	5292	^.{27}	2	0	0	1
+5293	5293	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5294	5294	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5295	5295	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5296	5296	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5297	5297	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5298	5298	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5299	5299	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5300	5300	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5301	5301	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5302	5302	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5303	5303	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5304	5304	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5305	5305	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5306	5306	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5307	5307	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5308	5308	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5309	5309	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5310	5310	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5311	5311	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5312	5312	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5313	5313	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5314	5314	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5315	5315	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5316	5316	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5317	5317	^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5318	5318	^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5319	5319	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5320	5320	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5321	5321	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5322	5322	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5323	5323	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5324	5324	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5325	5325	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5326	5326	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5327	5327	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5328	5328	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5329	5329	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5330	5330	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5331	5331	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5332	5332	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5333	5333	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5334	5334	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5335	5335	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5336	5336	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5337	5337	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5338	5338	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5339	5339	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5340	5340	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5341	5341	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5342	5342	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5343	5343	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5344	5344	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5345	5345	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5346	5346	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5347	5347	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5348	5348	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5349	5349	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5350	5350	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5351	5351	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5352	5352	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5353	5353	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5354	5354	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5355	5355	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5356	5356	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5357	5357	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5358	5358	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5359	5359	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5360	5360	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5361	5361	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5362	5362	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5363	5363	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5364	5364	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5365	5365	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5366	5366	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5367	5367	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5368	5368	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5369	5369	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5370	5370	^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5371	5371	^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5372	5372	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5373	5373	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5374	5374	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5375	5375	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5376	5376	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5377	5377	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5378	5378	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5379	5379	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5380	5380	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5381	5381	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5382	5382	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5383	5383	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5384	5384	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5385	5385	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5386	5386	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5387	5387	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5388	5388	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5389	5389	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5390	5390	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5391	5391	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5392	5392	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5393	5393	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5394	5394	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5395	5395	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5396	5396	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5397	5397	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5398	5398	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5399	5399	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5400	5400	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5401	5401	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5402	5402	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5403	5403	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5404	5404	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5405	5405	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5406	5406	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5407	5407	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5408	5408	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5409	5409	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5410	5410	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5411	5411	^.{4}	2	0	0	1
+5412	5412	^.{4}	2	0	0	1
+5413	5413	^.{4}	2	0	0	1
+5414	5414	^.{4}	2	0	0	1
+5415	5415	^.{4}	2	0	0	1
+5416	5416	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5417	5417	^.{4}	2	0	0	1
+5418	5418	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5419	5419	^.{4}	2	0	0	1
+5420	5420	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5421	5421	^.{4}	2	0	0	1
+5422	5422	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5423	5423	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5424	5424	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5425	5425	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5426	5426	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5427	5427	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5428	5428	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5429	5429	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5430	5430	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5431	5431	^.{4}	2	0	0	1
+5432	5432	^.{4}	2	0	0	1
+5433	5433	^.{4}	2	0	0	1
+5434	5434	^.{4}	2	0	0	1
+5435	5435	^.{4}	2	0	0	1
+5436	5436	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5437	5437	^.{4}	2	0	0	1
+5438	5438	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5439	5439	^\x00.{3}\xFFSMB(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f).{28}(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f)	2	0	0	1
+5440	5440	^.{4}	2	0	0	1
+5441	5441	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5442	5442	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5443	5443	^\x00.{3}\xFFSMB(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f).{28}(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f)	2	0	0	1
+5444	5444	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5445	5445	^PRIVMSG\s+[^\s]+\s+\x3a\s*\x01SENDLINK\x7c[^\x7c]{69}	2	0	0	1
+5446	5446	^\s*?\d+?\s*?\)https\x3a\x2f	2	0	0	1
+5447	5447	\/tslyphper([A-Za-z0-9+/-_]{4})*([A-Za-z0-9+/-_]{2}==|[A-Za-z0-9+/-_]{3}=|[A-Za-z0-9+/-_]{4})\.html$	2	0	0	1
+5448	5448	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x22|\x27	2	0	0	1
+5449	5449	\.php$	2	0	0	1
+5450	5450	\.php$	2	0	0	1
+5451	5451	\.php$	2	0	0	1
+5452	5452	\.php\?usernms=[^@]+@[^\r\n]+$	2	0	0	1
+5453	5453	^\s*\.\s*location\s*\.\s*href\s*=\s*redirect_url	2	0	0	1
+5454	5454	^[a-z0-9_]{50,}	2	0	0	1
+5455	5455	^(www(1\.masterconsultas\.com\.ar|\.linkedin\.com)|(tools\.google|facebook)\.com|cfspart\.impots\.gouv\.fr)	2	0	0	1
+5456	5456	^\s*?\d+?\s*?\)https\/\/[^/]+\.edu\/	2	0	0	1
+5457	5457	^\s*?\d+?\s*?\)(https://(w(ww(\.((bankofamerica|paypal|ups|wellsfargo)\.com|a(dobecloud\.com|mazon\.co\.jp)|tax\.service\.gov\.uk|cibc\.mobi)|1\.royalbank\.com)|ebmail\.(i(llinois|ndstate)\.ed|optusnet\.com\.a)u)|(s(i(tekey\.bankofamerica|gnin\.ebay)|ecure(\.bankofamerica|05c\.chase))|login\.((microsoftonlin|liv)e|verizonwireless|alibaba)|my\.screenname\.aol)\.com|((ex(change\.(louisvill|purdu)|mail\.oregonstat)e|owa\.uaa\.alaska)\.ed|ib\.nab\.com\.a)u|voscomptesenligne\.labanquepostale\.fr|auth\.centurylink\.net)|/logon/logon/chaseOnline|#www\.kucoin\.com)	2	0	0	1
+5458	5458	^[^/]+(xfinity|comcast)\.(com|net)	2	0	0	1
+5459	5459	^\s*\.\s*style\s*\.\s*visibility\s*=\s*[\x22\x27]visible[\x22\x27]	2	0	0	1
+5460	5460	^["']?post	2	0	0	1
+5461	5461	^((\.php).+)\.php\x22	2	0	0	1
+5462	5462	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+5463	5463	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+5464	5464	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+5465	5465	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+5466	5466	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+5467	5467	^[^\x22]+<\s*?script\s*?.+data\x3atext/html\x3bbase64,	2	0	0	1
+5468	5468	=[A-Za-z0-9._+-]+%40[A-Za-z0-9.-]+\.[A-Za-z]{2,6}&data	2	0	0	1
+5469	5469	[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}$	2	0	0	1
+5470	5470	\/usaa\.com(\.|-)(sec(ure)?|inet|ent)(\.|-)	2	0	0	1
+5471	5471	^\s*?\d+?\s*?\)https?\x3a\x2f	2	0	0	1
+5472	5472	^(l(o(ading|gin)|imited)|(proccess|card)ing|b(illing|ank)|success)\.php	2	0	0	1
+5473	5473	\x3b[a-f0-9]{32}	2	0	0	1
+5474	5474	Content\-Length\x3a\x20\d{3}\x0d\x0a	2	0	0	1
+5475	5475	\.asp$	2	0	0	1
+5476	5476	\/[a-f0-9]{32}\/\?\d$	2	0	0	1
+5477	5477	\/[a-f0-9]{32}\/\?\d$	2	0	0	1
+5478	5478	\s*(<var>[^)]+)\s*\).+window\s*\.\s*location\s*=\s*\(\s*(=var)	2	0	0	1
+5479	5479	\/webapps\/[a-f0-9]{5}\/websrc	2	0	0	1
+5480	5480	\.asp$	2	0	0	1
+5481	5481	(\/mpp\/[0-9a-f]{32}\/|\/[0-9a-f]{32}\/mpp\/)	2	0	0	1
+5482	5482	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}$	2	0	0	1
+5483	5483	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}$	2	0	0	1
+5484	5484	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+5485	5485	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+5486	5486	^[a-f0-9]{32}\??\x0d\x0a	2	0	0	1
+5487	5487	^data=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+5488	5488	\/submit$	2	0	0	1
+5489	5489	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+5490	5490	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+5491	5491	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+5492	5492	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+5493	5493	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+5494	5494	(udo\.photo|ulcraft\.com|biennale\.info|topstyle\.me|urest\.org|ukit\.me)$	2	0	0	1
+5495	5495	(udo\.photo|ulcraft\.com|biennale\.info|topstyle\.me|urest\.org|ukit\.me)$	2	0	0	1
+5496	5496	^\s*?\(\s*[^,]+,\s*?[^,]+,\s*?(128|256|512)\s*?\)	2	0	0	1
+5497	5497	^\d{5,20}\x22/Q	2	0	0	1
+5498	5498	^[^\x22|\x27]+<\s*?script((<\s*?\/\s*?script).)+?data\x3atext\/html\x3b(charset=UTF-8\x3b)?base64\x2c	2	0	0	1
+5499	5499	^[a-z]+\-[a-z]+\-[a-z0-9]{8,11}\.glitch\.me$	2	0	0	1
+5500	5500	^[a-z]*?[0-9]{3,9}[a-z]*?\.[a-z]{2,4}	2	0	0	1
+5501	5501	^[a-z]*?[0-9]{3,9}[a-z]*?\.[a-z]{2,4}$	2	0	0	1
+5502	5502	^\s*?\(\s*?unescape\s*?\(	2	0	0	1
+5503	5503	^[a-z0-9]{15}\.	2	0	0	1
+5504	5504	^\s*?\(\s*[^,]+,\s*?[^,]+,\s*?(128|256|512)\s*?\)	2	0	0	1
+5505	5505	^ui=[^&]+&pw=	2	0	0	1
+5506	5506	^id=[^&%]+%40[^&]+&pass=	2	0	0	1
+5507	5507	^\s*(\./|\.\./)*(s(e(curity(-check|cvv)|rver|condpage)|uccess)|l(o(ad(ing|er)|g(off))|iamg)|d(e(livery|tails)|one|hl)|i(d(entity)?|ndex2|i)|p(ro(cess(ing)?|file)|hone|ass|in|ayment)|w(e(iter|bsc)|ait)|t(hanky[o0]u|racking)|v(alidate|erify?|bv)|L(oginVerification|L1|2|ogin2)|f(orward|irst|in(al|ish))|b(illing2?|ank)|e(rror|xcel|nd)|questions|1loader|account|recova|confirm|outlook|update(bill|card)?|good|SS|verification|qes|upgrade2?|activation|check(ing)?|ex|indexx|warning|re(name|try))\.	2	0	0	1
+5508	5508	^id=[^&]+&ps=	2	0	0	1
+5509	5509	\.(ga|gq|cf|ml|gdn|tk|icu)$	2	0	0	1
+5510	5510	^mail=[^\x25]+\x2540[^&]+&pass=[^&]+$	2	0	0	1
+5511	5511	^a=[^\x25]+\x2540[^&]+&b=[^&]+	2	0	0	1
+5512	5512	^email=[^\x25]+\x2540[^&]+&epass=[^&]+	2	0	0	1
+5513	5513	^(s)?\x3a\/\/[^\/]*((a(m(ericanexpress|azon)|(dob|ppl)e|libaba|ol)|r(e(gions|max)|bcroyalbank)|f(irst-online|acebook|edex)|m(icrosoft(online)?|atch)|u(s(bank|aa|ps)|ps)|(technologyordi|googl)e|na(twest|ver)|d(ropbox|hl)|yahoo(mail)?|1(26|63)|keybank|qq)\.com|i(n(t(ertekgroup\.org|uit\.com)|vestorjunkie\.com|g\.nl)|c(icibank\.com|scards\.nl)|mpots\.gouv\.fr|rs\.gov)|c((h(ristianmingl|as)e|apitalone(360)?|ibcfcib|panel)\.com|om(mbank\.com\.au|cast\.net)|redit-agricole\.fr)|b(a(nkofamerica\.com|rclays\.co\.uk)|(igpond|t)\.com|luewin\.ch)|o((utlook|ffice)\.com|range\.(co\.uk|fr)|nline\.hmrc\.gov\.uk)|s(((aatchiar|untrus)t|c)\.com|ecure\.lcl\.fr|parkasse\.de)|h(a(lifax(-online)?\.co\.uk|waiiantel\.net)|otmail\.com)|p((rimelocation|aypal)\.com|ostbank\.de)|l(i(nkedin|ve)\.com|abanquepostale\.fr)|we(llsfargo\.com|stpac\.co\.nz)|etisalat\.ae)\/?	2	0	0	1
+5514	5514	^ud=[^&]*&pd=[^&]*	2	0	0	1
+5515	5515	^uname=[^&]+&psw=	2	0	0	1
+5516	5516	=[a-f0-9]{32}&session=[a-f0-9]{40}$	2	0	0	1
+5517	5517	^password=[^&]*&submit=Next$	2	0	0	1
+5518	5518	\?rid=[a-f0-9]{64}$	2	0	0	1
+5519	5519	\?rid=[a-f0-9]{64}\x0d\x0a	2	0	0	1
+5520	5520	\x0d\x0aReferer\x3a\x20[^\r\n]+[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\r\n	2	0	0	1
+5521	5521	\/\?email=[a-zA-Z0-9+&*-]+(\.[a-zA-Z0-9_+&*-]+)*@([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}\x0d\x0a	2	0	0	1
+5522	5522	^Editbox1=[^%]+(@|%40)[^&]+&	2	0	0	1
+5523	5523	^EM=[^%]+(@|%40)[^&]+&	2	0	0	1
+5524	5524	^e=[^%]+(@|%40)[^&]+&	2	0	0	1
+5525	5525	\.(tk|gq|ga|xyz|ml|cf)$	2	0	0	1
+5526	5526	^userid=[^&]*&passid=[^&]*&Token=$	2	0	0	1
+5527	5527	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5528	5528	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5529	5529	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5530	5530	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5531	5531	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5532	5532	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5533	5533	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5534	5534	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5535	5535	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5536	5536	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5537	5537	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5538	5538	^[^\r\n]+(s(e(rvic|cur)e|c(otia|ure)|antander|ign\-?in|napchat)|c(h(eck(out)?|a(in|se))|ustomer|onfirm|loud)|p(ay(pa[il]|ment)|(hon|ost)e|rivacy)|i(n(terac|sta)|cloud|phone|tunes)|re(solution|covery|fund|port|dir)|a(pp(id|le)|ccount|mazon)|n(otification|etflix|terac)|l(o(cked|gin)|imited)|(etransf|twitt|ord)er|d(ocusign|ropbox)|f(acebook|orgot)|veri(tas|f)|upd(ate|t)|yahoo|bofa|hmrc)	2	0	0	1
+5539	5539	^(s)?\x3a\/\/[^\/]*(ebay\.co\.uk|singtel\.com|blockchain\.com)\/?	2	0	0	1
+5540	5540	^(s)?\x3a\/\/[^\/]*(s(ocietegenerale\.com|parkasse\.at|ina\.com\.cn|wisscom\.ch|ec\.gov)|b(bva(compass\.com|\.com\.co)|anque-accord\.fr|mo\.com)|g(o((ogle\.co|v)\.uk|daddy\.com)|mail\.com)|(z(illow|oosk)|images\.kw|office365)\.com|t(el(stra\.com\.au|ekom\.com)|-online\.de)|c(reditmutuel\.fr|panel\.net|iti\.com)|((realestate|nab)\.com\.a|unc\.ed)u|d(esjardins\.c(om|a)|iscover\.com)|e(arthlink\.net|ftel\.com\.au|bay\.de)|a(bl\.com\.pk|liyun\.com|nz\.co\.nz)|w(estpac\.com\.au|ikimedia\.org)|v(isaeurope\.ch|erizon\.net)|h(blibank\.com\.pk|sbc\.com)|paypal\.co\.uk)\/?	2	0	0	1
+5541	5541	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5542	5542	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5543	5543	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5544	5544	^POST\x20(?<var>[^\x20]+).+Referer\x3a\x20[^\r\n]+(=var)[\r\n]+	2	0	0	1
+5545	5545	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5546	5546	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5547	5547	^s?\x3a\/\/[^\/]*(goo(gle(\.(c(om\.[en]g|a)|r[ou])|apps\.com)|\.gl)|c(iovaccocapital\.com|entrin\.net\.id|artasi\.it)|s((antander\.com\.b|fr\.f)r|tandardbank\.co\.za)|(aliexpress|vanguard|tdbank|ibm)\.com|e(xperienceasb\.co\.nz|im\.ae)|n((avy)?fcu\.org|wolb\.com)|unicredit\.it|mbna\.co\.uk|oney\.fr|zkb\.ch)\/?	2	0	0	1
+5548	5548	^[a-z]{36,38}\-dot\-[a-z]+\-[a-z]+\-\d{6}\.[a-z]{2}\.[a-z]\.appspot\.com$	2	0	0	1
+5549	5549	^[a-f0-9]{32}(\/index\.php)?\x0d\x0a	2	0	0	1
+5550	5550	^[^\r\n]+\.edu	2	0	0	1
+5551	5551	^(s)?\x3a\/\/[^\/]*((t(dcanadatrust|escobank|radekey)|r(ealtyexecutive|bcd)s|x(finity|oom)|ourtime)\.com|a(s(perasoft\.com|b\.co\.nz)|(ccesbankplc|nz)\.com|mazon\.co\.uk|ruba\.it)|m((icrosoftstore|organstanley|sn)\.com|a(de-in-china\.com|il\.ru))|s((eniorpeoplemeet|cotiabank)\.com|antander\.co\.uk|uddenlink\.net)|c(o((ldwellbankerpreviews|x)\.com|mpresso\.co\.th)|fapubs\.org)|w(e(althmanagement\.com|bmail\.sfr\.fr)|ww-01\.ibm\.com)|l((endingtree|loydsbank)\.com|abanquepostale\.mobi)|v((aluewalk|ideotron)\.com|erifyemailaddress\.org)|n(a(tionwide\.co\.uk|vyfederal\.org)|etsuite\.com)|b(a(nquepopulaire\.fr|9hus\.in)|iztree\.com)|i(nternetbanking\.caixa\.gov\.br|cloud\.com)|d(iscoverbank\.com|hl\.co\.uk)|k(iwibank\.co\.nz|eybank\.com)|fidelitybank\.ng|paypal\.fr|ebay\.it)\/?	2	0	0	1
+5552	5552	^(d((ocu|uco)sign|ropbox)|o(ffice365|nedrive)|adobe|gdoc)	2	0	0	1
+5553	5553	^(d((ocu|uco)sign|ropbox)|o(ffice365|nedrive)|adobe|gdoc)	2	0	0	1
+5554	5554	<title>\s*(log\s*in|sign\s*in)	2	0	0	1
+5555	5555	<title>\s*(s(e(nd money, pay online or set up a merchant|cure) account|uspicious (transaction |activities))|con(firm card security information|to limitato)|(profile updat|mot de pass)e|login)\s*-\s*paypal\s*<\/title>	2	0	0	1
+5556	5556	^\/v0\/b\/(send|hit|few|lik|mtn|eli|rfda)\d.*\.appspot\.com\/	2	0	0	1
+5557	5557	^em=[^&]*&ps=[^&]*$	2	0	0	1
+5558	5558	https\/\/[^/]+\.edu	2	0	0	1
+5559	5559	^[a-z0-9]{24,28}\.php\?client_id=	2	0	0	1
+5560	5560	\.php\?template=[^\r\n]+&valid=[^\r\n]+&session=[a-f0-9]{32,}$	2	0	0	1
+5561	5561	^uname=[^&]*&pass	2	0	0	1
+5562	5562	^emid=[^&]*&epass	2	0	0	1
+5563	5563	(verify|support|account|copyright|help|verified|service|badge|verification|safety)?.{0,30}tiktok(verify|support|account|copyright|help|verified|service|badge|verification|safety)?.{0,30}(\.ml|\.ga|\.cf|\.gq|\.tk|\.xyz$)	2	0	0	1
+5564	5564	^[a-f0-9]{42}\.js\x27\x29\.then\x28(.{1,1000}themes\/js\/[a-f0-9]{42}\.js\x27\x29\.then\x28){5,}	2	0	0	1
+5565	5565	\w{1,255}\/\w{1,255}'\]\s*==\s*"\w{1,255}\"	2	0	0	1
+5566	5566	^[a-f0-9]{42}\.css\x27\x29\.then\x28(.{1,1000}themes\/css\/[a-f0-9]{42}\.css\x27\x29\.then\x28){5,}	2	0	0	1
+5567	5567	[\w\d]{8}\.	2	0	0	1
+5568	5568	[\w\d]{8}	2	0	0	1
+5569	5569	\.(jpe?g|png|svg)$	2	0	0	1
+5570	5570	\.(css|ttf|woff2?|js)$	2	0	0	1
+5571	5571	^[a-f0-9]{8}-([a-f0-9]{4}-){3}a-f0-9]{12}	2	0	0	1
+5572	5572	[a-z0-9]{32}	2	0	0	1
+5573	5573	^\s*?\.\s*?Ctr\s*?\.\s*?decrypt	2	0	0	1
+5574	5574	^\s*?\.\s*?Ctr\s*?\.\s*?decrypt	2	0	0	1
+5575	5575	\.php\?e=[a-zA-Z0-9+&*-]+(\.[a-zA-Z0-9_+&*-]+)*@([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$	2	0	0	1
+5576	5576	^1=[^%]+(@|%40)[^&]+&	2	0	0	1
+5577	5577	^username=[^%]+(@|%40)[^&]+&	2	0	0	1
+5578	5578	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5579	5579	\.php	2	0	0	1
+5580	5580	^([^0-9][a-zA-Z0-9_]{1,254}),\s*([^0-9][a-zA-Z0-9_$]{1,254}),\s*256\)\x3b	2	0	0	1
+5581	5581	\/nrp=[a-f0-9]{32}$	2	0	0	1
+5582	5582	\/nrp=[a-f0-9]{32}$	2	0	0	1
+5583	5583	nrp=[a-f0-9]{32}	2	0	0	1
+5584	5584	(outlook|helpdesk|help desk)	2	0	0	1
+5585	5585	Set-Cookie\x3a\x20[a-z0-9]{4}=\x22\x22\x3b	2	0	0	1
+5586	5586	^/?username=[a-zA-Z0-9.-]+@[a-zA-Z0-9.]+.[a-zA-Z]{2,3}$	2	0	0	1
+5587	5587	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x22\x7d$	2	0	0	1
+5588	5588	[a-f0-9]{8}.	2	0	0	1
+5589	5589	[a-f0-9]{8}.	2	0	0	1
+5590	5590	[a-f0-9]{8}.	2	0	0	1
+5591	5591	[a-f0-9]{8}.	2	0	0	1
+5592	5592	[a-f0-9]{8}.	2	0	0	1
+5593	5593	[a-f0-9]{8}.	2	0	0	1
+5594	5594	[a-f0-9]{8}.	2	0	0	1
+5595	5595	[a-f0-9]{8}.	2	0	0	1
+5596	5596	[a-f0-9]{8}.	2	0	0	1
+5597	5597	[a-f0-9]{8}.	2	0	0	1
+5598	5598	[a-f0-9]{8}.	2	0	0	1
+5599	5599	&a_failed=[01]$	2	0	0	1
+5600	5600	&a_failed=[01]$	2	0	0	1
+5601	5601	^[0-9]{3,4}	2	0	0	1
+5602	5602	^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}-[a-f0-9]{8}\.	2	0	0	1
+5603	5603	^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}-[a-f0-9]{8}\.	2	0	0	1
+5604	5604	^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}-[a-f0-9]{8}\.	2	0	0	1
+5605	5605	^(php|html)$	2	0	0	1
+5606	5606	^(php|html)$	2	0	0	1
+5607	5607	 (6011|5[1-5]\d{2}|4\d{3}|3\d{3}) \d{4} \d{4} \d{4}	2	0	0	1
+5608	5608	 (6011|5[1-5]\d{2}|4\d{3}|3\d{3})-\d{4}-\d{4}-\d{4}	2	0	0	1
+5609	5609	 (6011|5[1-5]\d{2}|4\d{3}|3\d{3})\d{12} 	2	0	0	1
+5610	5610	 (3[4|7]\d{2}|2014|2149|2131|1800)\d{11} 	2	0	0	1
+5611	5611	 (3[4|7]\d{2}|2014|2149|2131|1800) \d{4} \d{4} \d{3} 	2	0	0	1
+5612	5612	 (3[4|7]\d{2}|2014|2149|2131|1800)-\d{4}-\d{4}-\d{3} 	2	0	0	1
+5613	5613	 (30[0-5]\d|36\d{2}|38\d{2})\d{10} 	2	0	0	1
+5614	5614	 (30[0-5]\d|36\d{2}|38\d{2}) \d{4} \d{4} \d{2} 	2	0	0	1
+5615	5615	 (30[0-5]\d|36\d{2}|38\d{2})-\d{4}-\d{4}-\d{2} 	2	0	0	1
+5616	5616	 (3[4|7]\d{2}|2014|2149|2131|1800) \d{6} \d{5} 	2	0	0	1
+5617	5617	 (3[4|7]\d{2}|2014|2149|2131|1800)-\d{6}-\d{5} 	2	0	0	1
+5618	5618	filename=\s*[^\n]+\.exe	2	0	0	1
+5619	5619	 \d\d-\d{7} 	2	0	0	1
+5620	5620	 ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])-\d{2}-\d{4} 	2	0	0	1
+5621	5621	 ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2]) \d{2} \d{4} 	2	0	0	1
+5622	5622	SSN ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])\d{6} 	2	0	0	1
+5623	5623	SSN# ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])\d{6} 	2	0	0	1
+5624	5624	User-Agent\x3a[^\n]+McAfee AutoUpdate	2	0	0	1
+5625	5625	User-Agent\x3a[^\n]+Winamp/Hi	2	0	0	1
+5626	5626	(gif|car(d|tao)|jpe?g)\.exe$	2	0	0	1
+5627	5627	\.exe$	2	0	0	1
+5628	5628	User-Agent\x3a[^\n]+Windows-Update-Agent	2	0	0	1
+5629	5629	((\?|&))password=(&)	2	0	0	1
+5630	5630	((\?|&))passwd=(&)	2	0	0	1
+5631	5631	((\?|&))pass=(&)	2	0	0	1
+5632	5632	((\?|&))pwd=(&)	2	0	0	1
+5633	5633	((\?|&))pw=(&)	2	0	0	1
+5634	5634	((\?|&))passphrase=(&)	2	0	0	1
+5635	5635	((\?|&))pword=(&)	2	0	0	1
+5636	5636	\x3C\x3C[^>]*\x2FJavaScript	2	0	0	1
+5637	5637	Location\: (http\:\/\/)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/	2	0	0	1
+5638	5638	\.png$	2	0	0	1
+5639	5639	\.jpeg$	2	0	0	1
+5640	5640	\.bmp$	2	0	0	1
+5641	5641	^User-Agent\:[^\n]+Java\/\d\.\d/Hmi	2	0	0	1
+5642	5642	^Content-Type\x3a\s*([av])(video\/x\-ms\-(w[vm]x|asf)|a(udio\/x\-ms\-w(m[av]|ax)|pplication\/x\-ms\-wm[zd]))/Hi	2	0	0	1
+5643	5643	\.exe\b	2	0	0	1
+5644	5644	^(ANONYMOUS|PASSDSS-3DES-1)\r\n	2	0	0	1
+5645	5645	((\x0d|\x05)Admin(istrator)?|\x04root|\x06USERID)	2	0	0	1
+5646	5646	^[^/s]*(eth_(g(et(B(lock(TransactionCountBy(Number|Hash)|By(Number|Hash))|alance)|Transaction(By(Block(Number|Hash)AndIndex|Hash)|(Receip|Coun)t)|Uncle(ByBlock(Number|Hash)AndIndex|CountByBlock(Number|Hash))|(Filter(Change|Log)|Log)s|Co(mpilers|de)|StorageAt|Work)|asPrice)|((new(PendingTransaction|Block)?|uninstall)Filt|blockNumb)er|s((end(Raw)?Transactio|ig)n|ubmit(Hashrate|Work)|yncing)|c(o(mpile(S(olidity|erpent)|LLL)|inbase)|all)|(estimateGa|account)s|protocolVersion|hashrate|mining)|shh_(new(Identity|Filter|Group)|get(FilterChan|Messa)ges|uninstallFilter|hasIdentity|addToGroup|version|post)|db_(get(String|Hex)|put(String|Hex))|net_(listening|peerCount|version)|web3_(clientVersion|sha3))	2	0	0	1
+5647	5647	\x3C\x3C[^>]*\x2FEmbeddedFile	2	0	0	1
+5648	5648	&|#|\+|!	2	0	0	1
+5649	5649	[0-9a-f]{40}[^0-9a-f]/P	2	0	0	1
+5650	5650	^.\x04[^\x08\x10\x14\x20\x30\x40]	2	0	0	1
+5651	5651	^[\x80-\xff]	2	0	0	1
+5652	5652	^[67]\.[01235]	2	0	0	1
+5653	5653	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+5654	5654	^\d\d?\.\d	2	0	0	1
+5655	5655	OS 4_2_[0-9] like	2	0	0	1
+5656	5656	\/\?v=\d	2	0	0	1
+5657	5657	^\d+\.\d	2	0	0	1
+5658	5658	((command(statu)?|bookmark|shortcut)s|h(omepage|istory)|eula(status)?|installation|activate|dumplog)	2	0	0	1
+5659	5659	^(\x3a\d{1,5})?$	2	0	0	1
+5660	5660	^(\x3a\d{1,5})?$	2	0	0	1
+5661	5661	filename\x3d[\x27\x22][a-z0-9]{1,3}\x2Eexe	2	0	0	1
+5662	5662	select[^\r\n]+from	2	0	0	1
+5663	5663	\x26Phone(Number\x3D|\x5FNumber\x3D|\x2DNumber\x3D)	2	0	0	1
+5664	5664	^(\x3a\d{1,5})?$	2	0	0	1
+5665	5665	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]\x7d	2	0	0	1
+5666	5666	User-Agent|3a|[^\n]+Windows-Update-Agent/Hsmi	2	0	0	1
+5667	5667	\x0d\x0aContent-Length\x3a \d{0,6}\x0d\x0a	2	0	0	1
+5668	5668	^(sh|lu|to)	2	0	0	1
+5669	5669	^(\x3a\d{1,5})?$	2	0	0	1
+5670	5670	[0-9a-f]{40}[^0-9a-f]	2	0	0	1
+5671	5671	^[^\r\n]+showip\.[a-z]+(\x3a\d{1,5})?$	2	0	0	1
+5672	5672	^(\x3a\d{1,5})?$	2	0	0	1
+5673	5673	^[a-z0-9\-\.]{1,60}\.dns-report\.com$	2	0	0	1
+5674	5674	^\/(text|json|xml)?$	2	0	0	1
+5675	5675	^\/changelog\/(appversion|changelog|help)$	2	0	0	1
+5676	5676	\d/\d+.jpg	2	0	0	1
+5677	5677	^(com|io|host)	2	0	0	1
+5678	5678	^[A-Z]=([A-Za-z0-9+/])+=?$	2	0	0	1
+5679	5679	^[0-9]{18}\/[0-9]{18}\/[a-zA-Z0-9]{5,7}$	2	0	0	1
+5680	5680	[A-F0-9]{96}$	2	0	0	1
+5681	5681	^CN=www\.[0-9a-z]{8,20}\.net$	2	0	0	1
+5682	5682	^(\x01|\x02)(\x4b|\x4c|\x4d)	2	0	0	1
+5683	5683	^[A-Za-z0-9+\/]{50,}={0,2} HTTP\/	2	0	0	1
+5684	5684	CN=([^\r\n\,]+?[\.-])?app\d	2	0	0	1
+5685	5685	^[a-z0-9]{40,}	2	0	0	1
+5686	5686	OS 4_2_[0-9] like	2	0	0	1
+5687	5687	^AUTH\s[^\n]{50}	2	0	0	1
+5688	5688	^LIST\s[^\n]{10}	2	0	0	1
+5689	5689	^XTND\s[^\n]{50}	2	0	0	1
+5690	5690	^APOP\s[^\n]{256}	2	0	0	1
+5691	5691	^PASS\s[^\n]{50}	2	0	0	1
+5692	5692	^USER\s+[^\n]*?%	2	0	0	1
+5693	5693	^UIDL\s+-\d	2	0	0	1
+5694	5694	^DELE\s+-\d	2	0	0	1
+5695	5695	^RSET\s[^\n]{10}	2	0	0	1
+5696	5696	^DELE\s[^\n]{10}	2	0	0	1
+5697	5697	^STAT\s[^\n]{10}	2	0	0	1
+5698	5698	^TOP\s[^\n]{10}	2	0	0	1
+5699	5699	^CAPA\s[^\n]{10}	2	0	0	1
+5700	5700	^APOP\s+USER\s[^\n]{256}	2	0	0	1
+5701	5701	^PASS\s+[^\n]*?%	2	0	0	1
+5702	5702	^USER\s[^\n]{50}	2	0	0	1
+5703	5703	\x64\x12\x54\x6a[\x20\x10\x02]\x00\x00\x00\xf4\x1f\x00\x00	2	0	0	1
+5704	5704	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D25FCAFC-F795-4609-89BB-5F78B4ACAF2C	2	0	0	1
+5705	5705	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BD9E5104-2F20-4A9F-AB14-82D558FF374E	2	0	0	1
+5706	5706	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2BBD45A5-28AE-11D1-ACAC-0800170967D9	2	0	0	1
+5707	5707	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2BBD45A5-28AE-11D1-ACAC-0800170967D9	2	0	0	1
+5708	5708	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2BBD45A5-28AE-11D1-ACAC-0800170967D9	2	0	0	1
+5709	5709	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02000002-9DFA-4B37-ABE9-1929F4BCDEA2	2	0	0	1
+5710	5710	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02000002-9DFA-4B37-ABE9-1929F4BCDEA2	2	0	0	1
+5711	5711	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3310FA24-A027-47B3-8C49-1091077317E9	2	0	0	1
+5712	5712	^[^>]*?classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*?083B40D3-CCBA-11D2-AFE0-00C04F7993D6	2	0	0	1
+5713	5713	^[^>]*?classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*083B40D3-CCBA-11D2-AFE0-00C04F7993D6	2	0	0	1
+5714	5714	^PASS\s+PRO(-|\s)*search\s+Crawler	2	0	0	1
+5715	5715	^\x2f	2	0	0	1
+5716	5716	^Authorization\x3a\s*Basic\s+YWRtaW46cGFzc3dvcmQ/Hi	2	0	0	1
+5717	5717	\x20AND\x20[0-9]{6}\x3D[0-9]{4}	2	0	0	1
+5718	5718	Range\x3a\s?bytes=[-0-9,\x20]{100}/iH	2	0	0	1
+5719	5719	530\s+(Login|User|Failed|Not)	2	0	0	1
+5720	5720	^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{16}\/	2	0	0	1
+5721	5721	^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{16}\/	2	0	0	1
+5722	5722	Arachni\/v?\d\.\d\.\d$	2	0	0	1
+5723	5723	User-Agent\:[^\n]+WHCC	2	0	0	1
+5724	5724	^.+\x3a\s(test.)?C\:\/WINDOWS\/system32\/calc\.exe(.test)?\r$	2	0	0	1
+5725	5725	\x2Frandom\w+?\x2E(c(f[cm]|gi)|ht(ml?|r)|(ws|x)dl|a(sp|xd)|p(hp3|l)|bat|swf|vbs|do)	2	0	0	1
+5726	5726	^DEMONS((\/|\s)[0-9]\.0)?$	2	0	0	1
+5727	5727	^Hakai((\/|\s)[0-9]\.0)?$	2	0	0	1
+5728	5728	^Messiah((\/|\s)[0-9]\.0)?$	2	0	0	1
+5729	5729	^Liquor((\/|\s)[0-9]\.0)?$	2	0	0	1
+5730	5730	^Nija((\/|\s)[0-9]\.0)?$	2	0	0	1
+5731	5731	^Gemini((\/|\s)[0-9]\.0)?$	2	0	0	1
+5732	5732	^Sector((\/|\s)[0-9]\.0)?$	2	0	0	1
+5733	5733	^Kayla((\/|\s)[0-9]\.0)?$	2	0	0	1
+5734	5734	^OSIRIS((\/|\s)[0-9]\.0)?$	2	0	0	1
+5735	5735	^Hello, World((\/|\s)[0-9]\.0)?$	2	0	0	1
+5736	5736	(%U([0-9a-f]{2})){6}	2	0	0	1
+5737	5737	(%U([0-9a-f]{4})){6}	2	0	0	1
+5738	5738	writeByte\x280x[a-z,0-9]{2}.+writeByte\x280x[a-z,0-9]{2}.+writeByte\x280x[a-z,0-9]{2}	2	0	0	1
+5739	5739	\x5Cu[a-f,0-9]{2,4}\x5Cu[a-f,0-9]{2,4}\x5Cu[a-f,0-9]{2,4}	2	0	0	1
+5740	5740	var\x20[a-z,0-9]{1,30}\x20\x3D\x20unescape\x28.\x25u[a-f,0-9]{2,4}\x25u[a-f,0-9]{2,4}	2	0	0	1
+5741	5741	var\x20[a-z,0-9]{1,30}\x20\x3D\x20unescape\x28.\x5Cu[a-f,0-9]{2,4}\x5Cu[a-f,0-9]{2,4}	2	0	0	1
+5742	5742	\x220\x22\x20\x2B\x20\x22[a-d]\x22\x20\x2B\x20\x22	2	0	0	1
+5743	5743	\x7Cu0[a-d](\x7Cu0|0)[a-d]/\x7Cu0[a-d](\x7Cu0|0)[a-d]	2	0	0	1
+5744	5744	\x5Cu0[a-d](\x5Cu0|0)[a-d]/\x5Cu0[a-d](\x5Cu0|0)[a-d]	2	0	0	1
+5745	5745	var\x20[^\n\r]*\x3D[^\n\r]*heap\x2E	2	0	0	1
+5746	5746	u0[a-d]u0[a-d]u0[a-d]u0[a-d]	2	0	0	1
+5747	5747	u0[a-d]0[a-d]u0[a-d]0[a-d]	2	0	0	1
+5748	5748	unescape.+\x25u[0-9,a-f]{2,4}\x25u[0-9,a-f]{2,4}	2	0	0	1
+5749	5749	unescape\x28(\x22|\x27)\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}	2	0	0	1
+5750	5750	^[a-f0-9]{4}	2	0	0	1
+5751	5751	^[a-f0-9]{4}	2	0	0	1
+5752	5752	filename\s*=\s*.*?\.([abcdehijlmnoprsvwx])(a(d[ep]|s[dfx])|c([ho]m|li|md|pp)|d(iz|ll|ot)|e(m[fl]|xe)|h(lp|sq|ta)|jse?|m(d[abew]|s[ip])|p(p[st]|if|[lm]|ot)|r(eg|tf)|s(cr|[hy]s|wf)|v(b[es]?|cf|xd)|w(m[dfsz]|p[dmsz]|s[cfh])|xl[tw]|bat|ini|lnk|nws|ocx)[\x27\x22\n\r\s]	2	0	0	1
+5753	5753	^expn\s+\*@	2	0	0	1
+5754	5754	^expn\s+decode	2	0	0	1
+5755	5755	^expn\s+root	2	0	0	1
+5756	5756	^vrfy\s+decode	2	0	0	1
+5757	5757	^vrfy\s+root	2	0	0	1
+5758	5758	^RCPT TO\x3a\s[^\n]{300}	2	0	0	1
+5759	5759	^EXPN[^\n]{255}	2	0	0	1
+5760	5760	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnBpZ|5waW|ucGlm)	2	0	0	1
+5761	5761	^(<boundary>[\x20\x27-\x29\x2b-\x2f0-9\x3a\x3d\x3fA-Z\x5fa-z]{0,69}?[^\x2d])--(\x0d\x0a(--|\x2e|RSET)[^\r\n]*?)*\x0d\x0a--(=boundary)\x0d\x0a	2	0	0	1
+5762	5762	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*package_prefix[\r\n\s]*=>[\r\n\s]*|package_prefix\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*procedure_prefix[\r\n\s]*=>[\r\n\s]*|procedure_prefix\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5763	5763	TO_CHAR\s*\(\s*SYSTIMESTAMP\s*,\s*(\x27[^\x27]{256}|\x22[^\x22]{256})	2	0	0	1
+5764	5764	CREATE\s.*?FILE\s+((AS|MEMBER|TO)\s+)?(\x27[^\x27]{512}|\x22[^\x22]{512})	2	0	0	1
+5765	5765	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*logfile[\r\n\s]*=>[\r\n\s]*|logfile\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\d+\s*,\s*){3}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5766	5766	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5767	5767	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{512,}\x27|\x22[^\x22]{512,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*|layer\s*=>\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,})|\(\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,}))	2	0	0	1
+5768	5768	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{128,}\x27|\x22[^\x22]{128,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*|layer\s*=>\s*(\x27[^\x27]{128,}|\x22[^\x22]{128,})|\(\s*(\x27[^\x27]{128,}|\x22[^\x22]{128,}))	2	0	0	1
+5769	5769	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*|layer\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5770	5770	numtoyminterval\s*\(\s*\d+\s*,\s*(\x27[^\x27]{32}|\x22[^\x22]{32})	2	0	0	1
+5771	5771	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*qt_name[\r\n\s]*=>[\r\n\s]*|qt_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5772	5772	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5773	5773	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5774	5774	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5775	5775	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*destination[\r\n\s]*=>[\r\n\s]*|destination\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5776	5776	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*dblink[\r\n\s]*=>[\r\n\s]*|dblink\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5777	5777	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5778	5778	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5779	5779	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5780	5780	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*missing_rows_oname1[\r\n\s]*=>[\r\n\s]*|missing_rows_oname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname1[\r\n\s]*=>[\r\n\s]*|sname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5781	5781	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*missing_rows_oname1[\r\n\s]*=>[\r\n\s]*|missing_rows_oname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname1[\r\n\s]*=>[\r\n\s]*|sname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5782	5782	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5783	5783	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*|userid\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5784	5784	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*|userid\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5785	5785	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5786	5786	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5787	5787	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5788	5788	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5789	5789	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5790	5790	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5791	5791	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5792	5792	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5793	5793	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5794	5794	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5795	5795	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5796	5796	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5797	5797	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5798	5798	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5799	5799	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5800	5800	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5801	5801	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5802	5802	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5803	5803	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5804	5804	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5805	5805	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5806	5806	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5807	5807	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5808	5808	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5809	5809	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5810	5810	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5811	5811	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5812	5812	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5813	5813	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5814	5814	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5815	5815	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5816	5816	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5817	5817	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5818	5818	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5819	5819	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5820	5820	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5821	5821	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5822	5822	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5823	5823	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5824	5824	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5825	5825	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5826	5826	\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})	2	0	0	1
+5827	5827	(\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5828	5828	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5829	5829	(\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5830	5830	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5831	5831	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5832	5832	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5833	5833	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5834	5834	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5835	5835	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5836	5836	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5837	5837	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5838	5838	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5839	5839	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5840	5840	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5841	5841	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5842	5842	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5843	5843	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5844	5844	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5845	5845	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5846	5846	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5847	5847	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5848	5848	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5849	5849	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*SCHEMA_NAME[\r\n\s]*=>[\r\n\s]*|SCHEMA_NAME\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5850	5850	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5851	5851	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5852	5852	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname|gowner)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type|gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){7}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5853	5853	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5854	5854	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5855	5855	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5856	5856	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5857	5857	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5858	5858	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5859	5859	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5860	5860	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5861	5861	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5862	5862	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5863	5863	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5864	5864	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5865	5865	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5866	5866	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5867	5867	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5868	5868	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5869	5869	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5870	5870	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5871	5871	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5872	5872	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5873	5873	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5874	5874	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5875	5875	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5876	5876	(\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5877	5877	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*CANON_GNAME[\r\n\s]*=>[\r\n\s]*|CANON_GNAME\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5878	5878	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5879	5879	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*tst[\r\n\s]*=>[\r\n\s]*|tst\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*\d+\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5880	5880	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{512,}\x27|\x22[^\x22]{512,}\x22)[\r\n\s]*\x3b.*repgrpname[\r\n\s]*=>[\r\n\s]*|repgrpname\s*=>\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,})|\(\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,}))	2	0	0	1
+5881	5881	\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})	2	0	0	1
+5882	5882	TIME_ZONE\s*=\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))	2	0	0	1
+5883	5883	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5884	5884	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5885	5885	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))|((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22 ]{1000})))	2	0	0	1
+5886	5886	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5887	5887	\(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){4}\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+5888	5888	\((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){2}\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5889	5889	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))|((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+5890	5890	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5891	5891	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5892	5892	\(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+5893	5893	\((\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))|\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+5894	5894	\(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+5895	5895	\(\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,(\s*(true|false)\s*,\s*){3}((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5896	5896	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5897	5897	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5898	5898	\((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){2}\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5899	5899	\(\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5900	5900	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5901	5901	\(\s*TIMESTAMP\s*(\s*(\x27[^\x27]+'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5902	5902	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5903	5903	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5904	5904	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5905	5905	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5906	5906	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*logfile[\r\n\s]*=>[\r\n\s]*|logfile\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5907	5907	ALTER\s.*?FILE\s+((AS|MEMBER|TO)\s+)?(\x27[^\x27]{512}|\x22[^\x22]{512})	2	0	0	1
+5908	5908	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5909	5909	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5910	5910	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5911	5911	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5912	5912	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5913	5913	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5914	5914	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5915	5915	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5916	5916	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5917	5917	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(missing_rows_oname1|missing_rows_oname2)[\r\n\s]*=>[\r\n\s]*|(missing_rows_oname1|missing_rows_oname2)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){10}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5918	5918	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(missing_rows_oname1|missing_rows_oname2)[\r\n\s]*=>[\r\n\s]*|(missing_rows_oname1|missing_rows_oname2)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){8}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5919	5919	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5920	5920	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5921	5921	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5922	5922	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5923	5923	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5924	5924	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5925	5925	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5926	5926	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5927	5927	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5928	5928	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5929	5929	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5930	5930	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5931	5931	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5932	5932	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5933	5933	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5934	5934	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5935	5935	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5936	5936	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5937	5937	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5938	5938	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5939	5939	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5940	5940	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5941	5941	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5942	5942	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5943	5943	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5944	5944	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5945	5945	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5946	5946	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5947	5947	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5948	5948	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5949	5949	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5950	5950	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5951	5951	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gowner|gname)[\r\n\s]*=>[\r\n\s]*|(gowner|gname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5952	5952	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5953	5953	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5954	5954	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5955	5955	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5956	5956	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5957	5957	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5958	5958	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5959	5959	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*operation[\r\n\s]*=>[\r\n\s]*|operation\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5960	5960	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5961	5961	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5962	5962	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*fname[\r\n\s]*=>[\r\n\s]*|fname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5963	5963	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname|gowner)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type|gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){7}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5964	5964	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname)[\r\n\s]*=>[\r\n\s]*|(gname|fname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5965	5965	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type|gname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5966	5966	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5967	5967	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5968	5968	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5969	5969	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5970	5970	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5971	5971	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5972	5972	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5973	5973	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5974	5974	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5975	5975	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5976	5976	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gowner[\r\n\s]*=>[\r\n\s]*|gowner\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5977	5977	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5978	5978	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5979	5979	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5980	5980	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5981	5981	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5982	5982	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5983	5983	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5984	5984	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5985	5985	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5986	5986	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5987	5987	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5988	5988	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5989	5989	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5990	5990	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5991	5991	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5992	5992	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5993	5993	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5994	5994	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5995	5995	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5996	5996	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|gname)[\r\n\s]*=>[\r\n\s]*|(sname|oname|gname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5997	5997	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5998	5998	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5999	5999	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6000	6000	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6001	6001	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6002	6002	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6003	6003	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6004	6004	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gowner[\r\n\s]*=>[\r\n\s]*|gowner\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*(true|false)\s*,\s*(true|false)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6005	6005	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6006	6006	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6007	6007	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6008	6008	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6009	6009	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6010	6010	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6011	6011	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6012	6012	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gowner[\r\n\s]*=>[\r\n\s]*|gowner\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6013	6013	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6014	6014	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6015	6015	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*operation[\r\n\s]*=>[\r\n\s]*|operation\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6016	6016	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6017	6017	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6018	6018	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6019	6019	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6020	6020	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6021	6021	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1073,}\x27|\x22[^\x22]{1073,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1073,}|\x22[^\x22]{1073,})|\(\s*(\x27[^\x27]{1073,}|\x22[^\x22]{1073,}))	2	0	0	1
+6022	6022	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6023	6023	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6024	6024	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6025	6025	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6026	6026	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*privilege_type[\r\n\s]*=>[\r\n\s]*|privilege_type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6027	6027	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*privilege_type[\r\n\s]*=>[\r\n\s]*|privilege_type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6028	6028	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*|userid\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6029	6029	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6030	6030	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6031	6031	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6032	6032	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(object_type|user_name)[\r\n\s]*=>[\r\n\s]*|(object_type|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6033	6033	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6034	6034	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*privilege_type[\r\n\s]*=>[\r\n\s]*|privilege_type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6035	6035	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6036	6036	\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})	2	0	0	1
+6037	6037	\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})	2	0	0	1
+6038	6038	\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})	2	0	0	1
+6039	6039	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6040	6040	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6041	6041	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6042	6042	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6043	6043	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6044	6044	username=[^&\x3b\r\n]{250}	2	0	0	1
+6045	6045	^(\r\n)*	2	0	0	1
+6046	6046	^User-Agent\:[^\n]+WHCC/Hmi	2	0	0	1
+6047	6047	User-Agent\:[^\n]+http\:\/\/	2	0	0	1
+6048	6048	\(compatible[^\)]+\n	2	0	0	1
+6049	6049	User-Agent\:[^\n]+sgrunt/Hi	2	0	0	1
+6050	6050	[\/\?][a-z0-9]{60,66}[\;0-9]	2	0	0	1
+6051	6051	^[0-9][0-9]?\.[0-9][0-9]?$	2	0	0	1
+6052	6052	\)ver\d	2	0	0	1
+6053	6053	^\d	2	0	0	1
+6054	6054	^x\w\wx\w\w\!x\w\wx\w\wx\w\w	2	0	0	1
+6055	6055	^Downloader\d+\.\d	2	0	0	1
+6056	6056	^dBrowser\x20\d\x20CallGetResponse\x3a\d$/V	2	0	0	1
+6057	6057	00\d+$	2	0	0	1
+6058	6058	\r?\n\r?\n	2	0	0	1
+6059	6059	^a\x3D[^\n]{1000,}	2	0	0	1
+6060	6060	^\/g($|[?#])	2	0	0	1
+6061	6061	(launch\x28.+-J-jar -J|-J-jar -J.+launch\x28)	2	0	0	1
+6062	6062	<body\s+[^>]*onUnload\s*=\s*[\x22\x27]?\(\)	2	0	0	1
+6063	6063	<img\s+[^>]*onEnd\s*=\s*[\x22\x27]?\(\)	2	0	0	1
+6064	6064	<body\s+[^>]*onURLFlip\s*=\s*[\x22\x27]?\(\)	2	0	0	1
+6065	6065	<img\s+[^>]*onURLFlip\s*=\s*[\x22\x27]?\(\)	2	0	0	1
+6066	6066	<[^>%]*%	2	0	0	1
+6067	6067	(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*vbscript[\:]	2	0	0	1
+6068	6068	(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*j[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:]	2	0	0	1
+6069	6069	(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*b[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:]	2	0	0	1
+6070	6070	(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*h[\x09\x0a\x0b\x0c\x0d]*e[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*[\:]	2	0	0	1
+6071	6071	expression[\s]*\([\s]*eval[\s]*\([\s]*String\.fromCharCode[\s]*\(([\s]*[\d]+[\s]*,){20}	2	0	0	1
+6072	6072	expression[\s]*\([\s]*eval[\s]*\([\s]*String\.fromCharCode[\s]*\(([\s]*0x[\da-fA-F]+[\s]*,){20}	2	0	0	1
+6073	6073	ftp\://[^\' \"]*%0a	2	0	0	1
+6074	6074	String\x2EFromCharCode\x28[0-9]{1,3}	2	0	0	1
+6075	6075	(window|w)\x2Estop	2	0	0	1
+6076	6076	<object\s*[^>]*\s*classid\s*=\s*(\x22|\x27)\s*clsid\s*\x3a\s*{?\s*4E3770F4-1937-4F05-B9A2-959BE7321909\s*}?(.*)\>	2	0	0	1
+6077	6077	<object\s*[^>]*\s*classid\s*=\s*(\x22|\x27)\s*clsid\s*\x3a\s*{?\s*4E3770F4-1937-4F05-B9A2-959BE7321909\s*}?(.*)\>	2	0	0	1
+6078	6078	\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}	2	0	0	1
+6079	6079	String.fromCharCode|28|[a-z,0-9]{1,20}\x2EcharCodeAt\x28	2	0	0	1
+6080	6080	<object\s*[^>]*\s*classid\s*=\s*(\x22|\x27)\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\>	2	0	0	1
+6081	6081	src\s*\x3d\s*\x22res\x3a\x2f\x2fmshtml\x2edll	2	0	0	1
+6082	6082	stream(\x0D\x0A|\x0A)CWS	2	0	0	1
+6083	6083	\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^OpenAction](O|#4F)(p|#70)(e|#65)(n|#6E)(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|#6E)	2	0	0	1
+6084	6084	\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JS](J|#4A)(S|#53)	2	0	0	1
+6085	6085	\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^EmbeddedFile](E|#45)(m|#6D)(b|#62)(e|#65)(d|#64)(d|#64)(e|#65)(d#64)(F|#46)(i|#69)(l|#6C)(e|#65)	2	0	0	1
+6086	6086	\x3C\x3C[^>]*\x2F[^Type](T|#54)(y|#79)(p|#70)(e|#65)	2	0	0	1
+6087	6087	\x3C\x3C[^\n]*\x2F[^Javascript](J|#4A)(a|#61)(v|#76)(a|#61)(S|#73|#53)(c|#63)(r|#72)(i|#69)(p|#70)(t|#74)	2	0	0	1
+6088	6088	\x3C\x3C[^>]*\x2F[^URL](U|#55)(R|#52)(L|#4C)	2	0	0	1
+6089	6089	(\&lt\;).+(\&gt\;)	2	0	0	1
+6090	6090	(this|doc)\x2EprintSeps	2	0	0	1
+6091	6091	^Content-Type\x3a\s*application\x2fsmi.*?<area[\s\n\r]+href=[\x22\x27]file\x3ajavascript\x3a	2	0	0	1
+6092	6092	^BM	2	0	0	1
+6093	6093	IHDR(.*LTE).*?tRNS	2	0	0	1
+6094	6094	<OBJECT\s+[^>]*type\s*=[\x22\x27]\x2f{32}	2	0	0	1
+6095	6095	(\x5c[^\x5c]{16,}|\x2f[^\x2f]{16,})\.cda$	2	0	0	1
+6096	6096	^Location\x3a\s*URL\s*\x3a	2	0	0	1
+6097	6097	<<[^>]*\x2FU3D\x2FLength\x20172[0-5][0-9]{2}	2	0	0	1
+6098	6098	\x2F(Subtype)(S|#53)(u|#75)(b|#62)(t|#74)(y|#79)(p|#70)(e|#65)	2	0	0	1
+6099	6099	\x2F(Action)(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|#6E)	2	0	0	1
+6100	6100	\x2F(Pages)(P|#40)(a|#61)(g|#67)(e|#65)(s|#73)	2	0	0	1
+6101	6101	\x2F(Launch)(L|#4C)(a|#61)(u|#75)(n#6E)(c|#63)(h|#68).+\x2F(W|#57)(i|#69)(n|#6E).+\x2Eexe	2	0	0	1
+6102	6102	code=\"[a-z]\.[a-z][\.\"][ c]	2	0	0	1
+6103	6103	\/info.php\?n=\d	2	0	0	1
+6104	6104	\/n\.php\?h=\w*?&s=\w{1,5}$	2	0	0	1
+6105	6105	(\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(	2	0	0	1
+6106	6106	^\/50a[a-f0-9]{21}\/(((\d+,)+\d+)|null)\/	2	0	0	1
+6107	6107	\/[0-9]{6}\.js\?[0-9]{6}&[0-9a-f]{16}$	2	0	0	1
+6108	6108	^\s*?(<var>[a-z]{3,6})\s*[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((=var)\)\x3b<\/script>	2	0	0	1
+6109	6109	^[^\x22\x27\x3b]*?[\x22\x27](<space>[a-f0-9]{2})(<sep>[^0-9a-f])(<f>[a-f0-9]{2})(=sep)[a-f0-9]{2}(=sep)(<n>((=f))[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[a-f0-9]{2})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+6110	6110	^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+6111	6111	^[\r\n\s]*[\r\n\s]*?[\x22\x27]?[a-f0-9]{100}	2	0	0	1
+6112	6112	^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(<f>[a-f0-9]{2})(<sep>[^\x22\x27a-f0-9]{0,10})(<u>((=f))[a-f0-9]{2})(=sep)(<n>(((=f)|(=u)))[a-f0-9]{2})(=sep)(<c>(((=f)|(=u)|(=n)))[a-f0-9]{2})(=sep)(<t>(((=f)|(=u)|(=n)|(=c)))[a-f0-9]{2})(=sep)(<i>(((=f)|(=u)|(=n)|(=c)|(=t)))[a-f0-9]{2})(=sep)(<o>(((=f)|(=u)|(=n)|(=c)|(=t)|(=i)))[a-f0-9]{2})(=sep)(=n)(=sep)(<spc>[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){1,100}(=spc)	2	0	0	1
+6113	6113	^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(<f>[a-f0-9]{2})(<sep>[^\x22\x27a-f0-9]{0,10})(<u>((=f))[a-f0-9]{2})(=sep)(<n>(((=f)|(=u)))[a-f0-9]{2})(=sep)(<c>(((=f)|(=u)|(=n)))[a-f0-9]{2})(=sep)(<t>(((=f)|(=u)|(=n)|(=c)))[a-f0-9]{2})(=sep)(<i>(((=f)|(=u)|(=n)|(=c)|(=t)))[a-f0-9]{2})(=sep)(<o>(((=f)|(=u)|(=n)|(=c)|(=t)|(=i)))[a-f0-9]{2})(=sep)(=n)(=sep)(<spc>[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){1,100}(=spc)	2	0	0	1
+6114	6114	^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(<f>[a-f0-9]{2})(<sep>[^\x22\x27a-f0-9]{0,10})(<u>((=f))[a-f0-9]{2})(=sep)(<n>(((=f)|(=u)))[a-f0-9]{2})(=sep)(<c>(((=f)|(=u)|(=n)))[a-f0-9]{2})(=sep)(<t>(((=f)|(=u)|(=n)|(=c)))[a-f0-9]{2})(=sep)(<i>(((=f)|(=u)|(=n)|(=c)|(=t)))[a-f0-9]{2})(=sep)(<o>(((=f)|(=u)|(=n)|(=c)|(=t)|(=i)))[a-f0-9]{2})(=sep)(=n)(=sep)(<spc>[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){1,100}(=spc)	2	0	0	1
+6115	6115	\/(app|info)\.php\?message=[A-Za-z0-9\+\/]+={0,2}$	2	0	0	1
+6116	6116	filename=[^\x3b\x3a\r\n]*(\x2e\x2e|\x25\x32\x65)	2	0	0	1
+6117	6117	^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\r$	2	0	0	1
+6118	6118	Host\x3a\x20[a-z]{6}\.best.lt\.ua\r$/Hm	2	0	0	1
+6119	6119	^[\r\n\s]*?[\x22\x27](<sp>[^\x22\x27]+)[\x22\x27].+?eval\([^\)\(]+?\([\x22\x27]\d{2,3}(=sp)\d{2,3}(=sp)	2	0	0	1
+6120	6120	\/\?flow_id=\d+?&\d+\d+?\/case_id=\d+$	2	0	0	1
+6121	6121	^\s+?(<vname>[^\s=]+)\s*\s*?(<q>[\x22\x27])(((=q)).)+?\.exe(=q).+?<applet((<\/applet>).)+?value\s*\s*?(\x22\x27|\x27\x22)\s*?\+\s*?(=vname)\s*?\+\s*?(\x22\x27|\x27\x22)	2	0	0	1
+6122	6122	^\s*?\(	2	0	0	1
+6123	6123	\.php\?b=[A-F0-9]{6}&css=[a-z]+$	2	0	0	1
+6124	6124	^[A-Za-z0-9\+\/]+((LmVvdA=|5lb3Q)=|uZW90)[\x22\x27]	2	0	0	1
+6125	6125	Referer\x3a\x20[^\r\n]+?\/1\.html[\x3a\r]/Hi	2	0	0	1
+6126	6126	\x3Cvalue\x3D\x22([a-z0-9+/]{4})*([a-z0-9+/]{2}==|[a-z0-9+/]{3}=)	2	0	0	1
+6127	6127	^((<\/script>).)*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]+?\/[a-z0-9A-Z]{8}\.php\?id=\d{6,9}[\x22\x27]	2	0	0	1
+6128	6128	^Host\x3a\x20[^\r\n]+(\r\n)?\r\n$/Hi	2	0	0	1
+6129	6129	^\/assets\/js\/jquery-[0-9]\.[0-9]\.[0-9]\.min\.js\?ver=[0-9]+\.[0-9]+\.[0-9]+$	2	0	0	1
+6130	6130	^\/[0-9]{2,3}x[0-9]{2,3}\/[a-z]+\.php\?[a-z]{2}=[0-9a-z]+$	2	0	0	1
+6131	6131	^\/js\/metrika\/watch\.js\?ver=[0-9]+\.[0-9]+\.[0-9]+$	2	0	0	1
+6132	6132	^\s*?(<var>[a-z]{3,6})\s*[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((=var)\)\x3b<\/script>	2	0	0	1
+6133	6133	^((<table>).)+?<tr[\r\n\s\>]((<\/tr>).)*?<span[\r\n\s\>]((<\/span>).)*?<([QU]|S(TR(IKE|ONG)|U[BP]|MALL|AMP)?|B(LINK|DO|IG)?|A(CRONYM|BBR)|R([PT]|UBY)|(NOB|VA)R|C(IT|OD)E|D(EL|FN)|I(NS)?|KBD|EM|TT)[^>]*?\bid[\r\n\s]*	2	0	0	1
+6134	6134	^\s*?(<var>[a-z]{3,6})\s*[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((=var)\)\x3b<\/script>	2	0	0	1
+6135	6135	^\s*?(<var>[a-z]{3,6})\s*[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((=var)\)\x3b<\/script>	2	0	0	1
+6136	6136	(<e>\d{2})(<t>((=e))\d{2})(=e)\d{2}(=t)\d{6}(=e)\d{12}(<q>(((=e)|(=t)))\d{2})\d{2}(<dot>(((=e)|(=t)|(=q)))\d{2})\d{2}(=dot)\d{2}(=q)	2	0	0	1
+6137	6137	^\d+&w=\d+&ua=.+&e=1$	2	0	0	1
+6138	6138	^\s*?(<var1>[^\x29\x5b]+)\x5b\s*?(<cntr>[^\x5d]+)\s*?\x5d\s*?\+\s*?(=var1)\x5b\s*?(=cntr)\s*?\+\s*?1\s*?\x5d\s*?\x29\s*?,\s*?16\s*?\x29\s*?\^\s*?parseInt\x28\x28\s*?(<var2>[^\x29\x5b]+)\x5b\s*?(=cntr)\s*?\x5d\s*?\+\s*?(=var2)\x5b\s*?(=cntr)\s*?\+\s*?1\s*?\x5d\s*?\x29\s*?,\s*16\s*?\x29\x29\s*?\x3b\s*?(=cntr)\s*?\+=\s*?2\s*?\x3b	2	0	0	1
+6139	6139	^(687474703a2f2f)(<h>[a-f0-9]{2})(<t>[a-f0-9]{2})(=t)(<p>[a-f0-9]{2})(<colon>[a-f0-9]{2})(<slash>[a-f0-9]{2})(=slash)	2	0	0	1
+6140	6140	^(25)?20(\x25(25)?20|\s)*reserve	2	0	0	1
+6141	6141	\x3C\x3C[^>]*\x2FEmbeddedfile	2	0	0	1
+6142	6142	^\/[a-z]{10}\/[a-z]{10}\.html$	2	0	0	1
+6143	6143	^[^\x2f\x22]+?\x22>	2	0	0	1
+6144	6144	^\s*?\w+\s*\s*?[\x22\x27]UEsDB	2	0	0	1
+6145	6145	^[^\r\n]+?\.html?\r?$	2	0	0	1
+6146	6146	^[^\x27]*?2[^\x27]*?7[^\x27]*?c[^\x27]*?d[^\x27]*?b[^\x27]*?6[^\x27]*?e[^\x27]*?-[^\x27]*?a[^\x27]*?e[^\x27]*?6[^\x27]*?d[^\x27]*?-[^\x27]*?1[^\x27]*?1[^\x27]*?c[^\x27]*?f[^\x27]*?-[^\x27]*?9[^\x27]*?6[^\x27]*?b[^\x27]*?8[^\x27]*?-[^\x27]*?4[^\x27]*?4[^\x27]*?4[^\x27]*?5[^\x27]*?5[^\x27]*?3[^\x27]*?5[^\x27]*?4[^\x27]*?0[^\x27]*?0[^\x27]*?0[^\x27]*?0	2	0	0	1
+6147	6147	^([a-z]{0,7}[A-Z])([A-Z]{0,7}[a-z])[A-Za-z]{8}\x22[^>]+[A-Za-z]{70}	2	0	0	1
+6148	6148	^\s*?\(\s*?[\x22\x27]chrome\x3a\/\/	2	0	0	1
+6149	6149	http\x3a -J-jar -J\x5C\x5C\x5C\x5C\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x5C\x5C[^\n]*\.jar	2	0	0	1
+6150	6150	^[a-f0-9]{500}	2	0	0	1
+6151	6151	^[a-f0-9]{500}	2	0	0	1
+6152	6152	(obj.data|object.data).+file\x3A\x2F\x2F127\x2E[0-9]	2	0	0	1
+6153	6153	^\/in\/\?_BC=\d+,\d+,\d+,[0-9,-]+,$	2	0	0	1
+6154	6154	\x2A[a-z0-9]{10}\x2A\x2Fwindow\x2Eeval\x28String\x2EfromCharCode\x28[0-9]{1,3}\x2C[0-9]{1,3}\x2C	2	0	0	1
+6155	6155	<title>[a-f0-9]{10}<\/title>	2	0	0	1
+6156	6156	value=.[a-f0-9]{100}	2	0	0	1
+6157	6157	^\s*\([^\)]*\)\s*\.\s*prototype\s*\.\s*(hasFeature|isPrototypeOf)	2	0	0	1
+6158	6158	^[\x52\x5c\x64\x65\x90\x93]	2	0	0	1
+6159	6159	^\s*\(\s*function\s*\(\s*\)\s*\{\s*alert	2	0	0	1
+6160	6160	\x0d\x0aHost\x3a\x20[a-f0-9]{20}-[a-f0-9]{32}\.r[0-9]{1,2}\.cf[0-9]\.rackcdn\.com\x0d\x0a/H	2	0	0	1
+6161	6161	document\s*\.\s*location\s*?\x3d\s*?[\x27\x22]help\x3a\/\/\/[^\x3b]+?\%25252f\.\.\%25252f\.\.\%25252f\.\.\%25252f	2	0	0	1
+6162	6162	^Referer\x3a[^\r\n]+\/b.swf\r$/Hm	2	0	0	1
+6163	6163	^\s*?\(	2	0	0	1
+6164	6164	^\s*\.\s*cookie	2	0	0	1
+6165	6165	^\s*\(\s*force\s*\?\s*true\s*\x3a\s*false\s*,\s*\d+\s*,\s*\d+\s*,\s*[\x22\x27][^\x22\x27]+\.exe[\x22\x27]	2	0	0	1
+6166	6166	^(\]|, 3\.3\])\x3b	2	0	0	1
+6167	6167	^\s*?\[\s*?\d	2	0	0	1
+6168	6168	^[\x22\x27+\s]*\/[\x22\x27+\s]*s[\x22\x27+\s]*c[\x22\x27+\s]*r[\x22\x27+\s]*i[\x22\x27+\s]*p[\x22\x27+\s]*t[\x22\x27+\s]*>	2	0	0	1
+6169	6169	stream(\x0D\x0A|\x0A)FWS	2	0	0	1
+6170	6170	^\s*[^\s]+\x5b\s*?[^\x5d\x7c]+\x7c\s*?0\s*?\x5d\s*?\x7c\s*?0\s*?\x3b	2	0	0	1
+6171	6171	\s+?(<var2>[^\s\x3d]+?)\s*\s*?this\.addField.+?(=var2)\s*\x2e\s*setAction\s*?\x28\s*?[\x22\x27]\s*?OnFocus[^\x29]+popupOpen\s*\s*?true	2	0	0	1
+6172	6172	(<obj>[^\s]{1,25})\s*=\s*document\s*\.\s*createElement.*?(<func>[^\s]{1,25})\s*=\s*function\s*\x28\s*e\s*\x29\s*{[^}]*this\s*\.\s*style\s*\.\s*cssText.*?(=obj)\s*\.\s*addEventListener\s*\x28\s*[\x22\x27]\s*DOMAttrModified\s*[\x22\x27]\s*\x2c\s*(=func)	2	0	0	1
+6173	6173	\.php\?cid=[0-9]+?-w[A-Z0-9]{23}$	2	0	0	1
+6174	6174	&clickid=w[A-Z0-9]{23}$	2	0	0	1
+6175	6175	^\/scan[A-Z][a-z]?\/?$	2	0	0	1
+6176	6176	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\/$	2	0	0	1
+6177	6177	^\s*?\.\s*?decode\s*?\(\s*?msgencoded\s*?\)\s*?\.\s*?replace	2	0	0	1
+6178	6178	^\s*?\(\s*?[\x22\x27]ip[\x22\x27]	2	0	0	1
+6179	6179	&clickid=w[A-Z0-9]{23}$	2	0	0	1
+6180	6180	^\s*?\{\s*?setInterval\s*?\(\s*?function	2	0	0	1
+6181	6181	^[^\r\n]+autoplay=[\x22\x27]autoplay	2	0	0	1
+6182	6182	^[^\r\n]+autoplay=[\x22\x27]autoplay	2	0	0	1
+6183	6183	^\s*?\(\s*?function\s*?\(\s*?\)\s*?\{\s*?alert\s*?\(	2	0	0	1
+6184	6184	^\s*\(\s*function\s*\(\s*\)\s*\{\s*alert\s*\([\x22\x27]\s*Warning	2	0	0	1
+6185	6185	^\s*\(\s*0\s*,\s*0\s*,\s*total\s*\)	2	0	0	1
+6186	6186	\x2E\x2E\x2F\x2E\x2E\x2F.+C\x3A\x5C[a-z]	2	0	0	1
+6187	6187	\x3Clocation\x3D.+smb\x3A\x2F\x2F.{1000}.+\x3C\x2Flocation\x3E	2	0	0	1
+6188	6188	eval\x28(String\x2EfromCharCode\x28|[a-z,0-9]{1,20}\x28String\x2EfromCharCode\x28)	2	0	0	1
+6189	6189	util.printf\x28\x22\x25[^\x2C\x29]*f\x22\x2C	2	0	0	1
+6190	6190	<<[^>]*\x2FPredictor[^>]*\x2FColors\x201073741838	2	0	0	1
+6191	6191	\x5clistoverride\x5c((\x5cls\d{1,4}\s*\}).)+?\x5clistoverride\x5c	2	0	0	1
+6192	6192	^\s*?\(\s*?[\x22\x27]script[\x22\x27].+?\s(<vname>[^\s]+)\.onpropertychange\s*=.+?\s(<vname2>[^\s\x3d]+)\s*\s*?[^\s]*?createElement\s*?\(\s*?[\x22\x27]select[\x22\x27].+?(=vname)\.appendChild\(\s*?[\x22\x27]?(=vname2)[\x22\x27]?	2	0	0	1
+6193	6193	^.+?\bEMET\.DLL	2	0	0	1
+6194	6194	^\s*?(<var>[^\x3d\x3b\)\s]+)\s*\s*?0\s*?\x3b(=var)\s*?\<\s*?(0x)?\d{3,4}\s*?\x3b\s*?(=var)\+\+\s*?\)\s*?\x7b[^\x7d]+?\[\s*?(=var)\s*?\]\s*\s*?document\.createElement\([\x22]div[\x22]\)[^\x7d]+?\[\s*?(=var)\s*?\]	2	0	0	1
+6195	6195	^(0*?[19]\d|[^190])	2	0	0	1
+6196	6196	^(((?i:<\/object>)).)+?data\s*?\=\s*?[\x22\x27][^\x22\x27]*[?&]callback=CWS[a-zA-Z0-9_\.\x0d\x0a]{50,}[&\x22\x27]	2	0	0	1
+6197	6197	^(((?i:<\/object>)).)+?data\s*?\=\s*?[\x22\x27][^\x22\x27]*[?&]callback=FWS[a-zA-Z0-9_\.\x0d\x0a]{50,}[&\x22\x27]	2	0	0	1
+6198	6198	^(((?i:<\/object>)).)+?data\s*?\=\s*?[\x22\x27][^\x22\x27]*[?&]callback=ZWS[a-zA-Z0-9_\.\x0d\x0a]{50,}[&\x22\x27]	2	0	0	1
+6199	6199	^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text/vbscript[\x22\x27]((<\/script>).)+?\WShellExecute)	2	0	0	1
+6200	6200	^\W	2	0	0	1
+6201	6201	^\s*\s*?(undefined|false|null|-?0|NaN|\x22\x22|\x27\x27)	2	0	0	1
+6202	6202	[^.]*\.\s*src\s*\=[\x22\x27][^\x22\x27]*\.php\?[ -~]+?\=[\x22\x27]\s*\+localStorage\.	2	0	0	1
+6203	6203	\b(<varname>[^\s\x3d]+)\s*\x3d\s*open\s*\x28\s*[^\x29]+parent-tab:\/\/.+(=varname)\s*\.\s*document\s*\.\s*body\s*.\s*innerHTML\s*=	2	0	0	1
+6204	6204	(?<var1>[^=\s]*)\s*=\s*0x1000000.+?\x28\s*\x28\s*\x28\s*\w+\s*<<\s*12\s*\x29\s*\|\s*0\s*\x29\s*\+\s*(=var1)\s*\x29\s*\|\s*0	2	0	0	1
+6205	6205	\s*?Default\s+Property((end\s*property).)*?ReDim\s+Preserve\s+array	2	0	0	1
+6206	6206	^\/[a-z]+\.dill\/$	2	0	0	1
+6207	6207	^[\x22\x27]\s*content\s*=\s*[\x22\x27]\s*IE\s*=\s*10	2	0	0	1
+6208	6208	^[a-z]{2,3}\.dll	2	0	0	1
+6209	6209	\/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+6210	6210	^\s*\-\s*	2	0	0	1
+6211	6211	^\s*reserve\s*?(<var1>[a-z]\w{0,254})\s*?\x28\s*?[^\x29]+?\x29.*?redim\s*reserve\s*?(=var1)	2	0	0	1
+6212	6212	Shell.*%0a\s*IconFile\s*=\s*\x5c\x5c	2	0	0	1
+6213	6213	<iframe.*?src.*.*?<\/iframe>	2	0	0	1
+6214	6214	<iframe.*?src.*.*?<\/iframe>	2	0	0	1
+6215	6215	^\s*[\x22\x27]\s*file\x3a\x2f\x2f\x2f\x5c\x5c[^\x20]+\x5cC\$\x5c\s*[\x22\x27]	2	0	0	1
+6216	6216	^Referer\x3a[^\r\n]+\.swf/Hmi	2	0	0	1
+6217	6217	^[^>\r\n<]+>[A-Za-z]{70}	2	0	0	1
+6218	6218	^[^\r\n]+?\.html?\r?$/Hmi	2	0	0	1
+6219	6219	^[^\r\n]+\.html\r?$/Hmi	2	0	0	1
+6220	6220	^\s*=\s*\x5c\x5c	2	0	0	1
+6221	6221	^\s*\.\s*cookie	2	0	0	1
+6222	6222	^((<\/script>).)+?powershell\.exe	2	0	0	1
+6223	6223	^((<\/script>).)+?powershell\.exe	2	0	0	1
+6224	6224	^[^\r\n]+\/\?pcl=([a-zA-Z0-9_-]{86}|[a-zA-Z0-9_-]{43})\x2e{1,2}&cid=	2	0	0	1
+6225	6225	^[a-z0-9]{6,15}$	2	0	0	1
+6226	6226	^https\/\/	2	0	0	1
+6227	6227	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+6228	6228	^WWW-Authenticate\x3a\x20Basic\x20realm=[\x22\x27][^\r\n]*Error[^\r\n]*-	2	0	0	1
+6229	6229	^\/[a-z]{7,11}\.js\?[a-f0-9]{16}$	2	0	0	1
+6230	6230	\/([a-zA-Z\d]{0,6}[a-z][A-Z])[A-Za-z\d]{8}\.php\?id=\d{6,9}$	2	0	0	1
+6231	6231	^((<\/xsl).)+?src\s*=\s*[\x27\x22](<loc>[^\x22\x27]+?)[\x27\x22].+?Content-Location\x3a\s+(=loc)	2	0	0	1
+6232	6232	^[2'][2h'+][2hl'+][2hlY'+][2hlY2'+][2hlY2t'+][2hlY2tv'+][2hlY2tvd'+][2hlY2tvdX'+][2hlY2tvdXQ'+]([2hlY2tvdXQ='+]){1,10}	2	0	0	1
+6233	6233	&name=[a-z0-9\x20]+$	2	0	0	1
+6234	6234	^[A-Z0-9_\-.]{20,300}\x3b	2	0	0	1
+6235	6235	^\s*[a-f0-9]{32}\s*\x2a\x2f	2	0	0	1
+6236	6236	[A-Za-z0-9]{10,20}_14[0-9]{8,}\/index\.html$	2	0	0	1
+6237	6237	^[^\r\n\s>]+\/[a-z]{4,5}\.html\>\<\/iframe\>	2	0	0	1
+6238	6238	^((<\/iframe>).)*?[\r\n\s]+name[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])?(Twitter|Google\+)(=q)?[\r\n\s]+	2	0	0	1
+6239	6239	^((<\/iframe>).)*?[\r\n\s]+name[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])?(Twitter|Google\+)(=q)?[\r\n\s]+	2	0	0	1
+6240	6240	^[A-Z0-9_\-.]{20,300}\x3b	2	0	0	1
+6241	6241	<DIV\s*?id[\s\r\n]*?\x3d[\s\r\n]*?(<divid>[^>]+).+?<img\s*id=\s*?\x22(<imgid>[^\x22]+).+?\<a\s*?href=\x22javascript\x3a(<firstfunction>[^\x28]+)\(\).+?\>.*?\<div[^\>]+?id=\x22(=imgid)\x22[^>]+?on[A-Za-z]+?\s*\s*?\x22(<secondfunction>[^\x28]+)\(\)\x3b\s*?\x22.+?function[\s\r\n]*?(=firstfunction)[\s\r\n]*?\(.*?\).*?\x7b.*?(=divid)\x2einnerHTML\s*?\x3d\s*?(=divid)\x2einnerHTML[\s\r\n]*?\x3b.*?\x7d.*?function[\s\r\n]*?(=secondfunction)[\s\r\n]*?\(.*?\).*?\x7b.*?\x28\x22(=imgid)\x22\x29\x2esrc\s*?\x3d	2	0	0	1
+6242	6242	(\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(	2	0	0	1
+6243	6243	(\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(	2	0	0	1
+6244	6244	^[\r\n\s]*[\x22\x27]selectAll	2	0	0	1
+6245	6245	clsid\s*\x3a\s*\x7B?\s*f5078f3(2|3)-c551-11d3-89b9-0000f81fe221	2	0	0	1
+6246	6246	^[\x20-\x7f]*\(\?[sxXmUJ]*i[sxXmUJ]*(\-[sxXmUJ]*)?\)[\x20-\x7f]*\(\?[sxXmUJ]*\-[sxXmUJ]*i[sxXmUJ]*\)[\x20-\x7f]*\|\|	2	0	0	1
+6247	6247	^[\x20-\x7f]*\(\?[sxXmUJ]*i[sxXmUJ]*(\-[sxXmUJ]*)?\)[\x20-\x7f]*\(\?[sxXmUJ]*\-[sxXmUJ]*i[sxXmUJ]*\)[\x20-\x7f]*\|\|	2	0	0	1
+6248	6248	^[\r\n\s\+\>]((<\/bdo>).)*?<fieldset[\r\n\s\+\>]((<\/fieldset>).)*?<\/bdo>	2	0	0	1
+6249	6249	^[\r\n\s\+]+?(<var>[^\r\n\s\+\x3d]+)[\r\n\s\+]*[\r\n\s\+]*?[^\)]+\.createElement\(.+?\.body.appendChild\([\r\n\s]*?[\x22\x27]?(=var)[\x22\x27]?[\r\n\s]*?\).+\b(=var)\.innerHTML[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(=q)	2	0	0	1
+6250	6250	^(:?([\x22\x27][\r\n\s]*?\])?[\r\n\s]*|[\x22\x27][\r\n\s]*?\,)[\r\n\s]*?(function)(<func>[^\r\n\s]+)\b.+?function[\r\n\s]+(=func)[\r\n\s]*?\([^\)]*?\)[\r\n\s]*?\{((function).)*?(\b(<var>[^\r\n\s\=]+)[\r\n\s]*[\r\n\s]*?(\x22\x22|\x27\x27))?((function).)*?document\.write\([\r\n\s]*?(\x22\x22|\x27\x27|(=var))[\r\n\s]*?\)	2	0	0	1
+6251	6251	^(:?([\x22\x27][\r\n\s]*?\])?[\r\n\s]*|[\x22\x27][\r\n\s]*?\,)[\r\n\s]*?function[\r\n\s]*?\([^\)]*?\)[\r\n\s]*?\{.*?(\b(<var>[^\r\n\s\=]+)[\r\n\s]*[\r\n\s]*?(\x22\x22|\x27\x27))?.*?document\.write\([\r\n\s]*?(\x22\x22|\x27\x27|(=var))[\r\n\s]*?\)	2	0	0	1
+6252	6252	[\x22\x27\<]hr[\x22\x27\>]	2	0	0	1
+6253	6253	^[\r\n\s\+]+?(<var>[^\r\n\s\+\x3d]+)[\r\n\s\+]*[\r\n\s\+]*?[^\)]+\.createElement\(.+?\.appendChild\([\r\n\s]*?[\x22\x27]?(=var)[\x22\x27]?[\r\n\s]*?\).+\b(=var)\.innerHTML[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(=q).+?CollectGarbage\(.+?\b(=var)\.	2	0	0	1
+6254	6254	^[\r\n\s]+(<func>[^\r\n\s]+)[\r\n\s]*?\([^\)]*?\)[\r\n\s]*?\{((function).)*?(\b(<var>[^\r\n\s\=]+)[\r\n\s]*[\r\n\s]*?(\x22\x22|\x27\x27))?((function).)*?document\.write\([\r\n\s]*?(\x22\x22|\x27\x27|(=var))[\r\n\s]*?\).+?onlosecapture(:?([\x22\x27][\r\n\s]*?\])?[\r\n\s]*|[\x22\x27][\r\n\s]*?\,)[\r\n\s]*?(=func)\b	2	0	0	1
+6255	6255	^[\r\n\s]*?[\x27\x22]Unselect[\x27\x22]	2	0	0	1
+6256	6256	node=.*\|.+\|	2	0	0	1
+6257	6257	\x0a\x0dCookie\x3a[^\n]+UNION.+SELECT	2	0	0	1
+6258	6258	\x0d\x0aCookie\x3a[^\n]+SELECT.+FROM	2	0	0	1
+6259	6259	\x0a\x0dCookie\x3a[^\n]DELETE.+FROM	2	0	0	1
+6260	6260	\x0a\x0dCookie\x3a[^\n]INSERT.+INTO	2	0	0	1
+6261	6261	\x0a\x0dCookie\x3a[^\n]INTO.+OUTFILE	2	0	0	1
+6262	6262	\x0a\x0dCookie\x3a[^\n]SELECT.+INSTR	2	0	0	1
+6263	6263	\x0a\x0dCookie\x3a[^\n]SELECT.+SUBSTR	2	0	0	1
+6264	6264	\x2FOvCgi\x2FMain\x2FSnmp\x2Eexe.+id\x3D.{600}	2	0	0	1
+6265	6265	^Authorization|3A|\s*Basic\s+TERBUF9Bbm9ueW1vdXM6TGRhcFBhc3N3b3JkXzE=	2	0	0	1
+6266	6266	([\w\x25]+=[\w\x25]*&){500}/Psmi	2	0	0	1
+6267	6267	(\r\nContent-Disposition\x3a\s+form-data\x3b[^\r\n]+\r\n\r\n.+?){250}/Psmi	2	0	0	1
+6268	6268	\x0a\x0dCookie\x3a[^\n]+xp_cmdshell	2	0	0	1
+6269	6269	>.*?\'\s*?\)\s*?\)*?\s*?\;/P	2	0	0	1
+6270	6270	\bSELECT.*?\bPRIV	2	0	0	1
+6271	6271	^[^\x22\x27\x3b]*?[\x22\x27](<space>[a-f0-9]{2})(<sep>[^0-9a-f])(<f>[a-f0-9]{2})(=sep)[a-f0-9]{2}(=sep)(<n>((=f))[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[a-f0-9]{2})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+6272	6272	^Accept-Language\:[^\n]*?[^,\;\n]{17}	2	0	0	1
+6273	6273	^User-Agent\x3a[^\r\n]+?Googlebot[^\-].+?\r$/Hmi	2	0	0	1
+6274	6274	(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+6275	6275	[\?\=\x3a\s\x2f]	2	0	0	1
+6276	6276	[\?\=\x3a\s\x2f]	2	0	0	1
+6277	6277	[\?\=\x3a\s\x2f]	2	0	0	1
+6278	6278	[\?\=\x3a\s\x2f]	2	0	0	1
+6279	6279	[\?\=\x3a\s\x2f]	2	0	0	1
+6280	6280	[\?\=\x3a\s\x2f]	2	0	0	1
+6281	6281	[\?\=\x3a\s\x2f]	2	0	0	1
+6282	6282	[\?\=\x3a\s\x2f]	2	0	0	1
+6283	6283	[\?\=\x3a\s\x2f]	2	0	0	1
+6284	6284	[\?\=\x3a\s\x2f]	2	0	0	1
+6285	6285	[\?\=\x3a\s\x2f]	2	0	0	1
+6286	6286	[\?\=\x3a\s\x2f]	2	0	0	1
+6287	6287	[\?\=\x3a\s\x2f]	2	0	0	1
+6288	6288	[\?\=\x3a\s\x2f]	2	0	0	1
+6289	6289	[\?\=\x3a\s\x2f]	2	0	0	1
+6290	6290	[\?\=\x3a\s\x2f]	2	0	0	1
+6291	6291	[\?\=\x3a\s\x2f]	2	0	0	1
+6292	6292	[\?\=\x3a\s\x2f]	2	0	0	1
+6293	6293	[\?\=\x3a\s\x2f]	2	0	0	1
+6294	6294	[\?\=\x3a\s\x2f]	2	0	0	1
+6295	6295	[\?\=\x3a\s\x2f]	2	0	0	1
+6296	6296	[\?\=\x3a\s\x2f]	2	0	0	1
+6297	6297	[\?\=\x3a\s\x2f]	2	0	0	1
+6298	6298	[\?\=\x3a\s\x2f]	2	0	0	1
+6299	6299	[\?\=\x3a\s\x2f]	2	0	0	1
+6300	6300	[\?\=\x3a\s\x2f]	2	0	0	1
+6301	6301	[\?\=\x3a\s\x2f]	2	0	0	1
+6302	6302	[\?\=\x3a\s\x2f]	2	0	0	1
+6303	6303	[\?\=\x3a\s\x2f]	2	0	0	1
+6304	6304	[\?\=\x3a\s\x2f]	2	0	0	1
+6305	6305	http\x3A\/\/127\.0\.0\.1\/.*\.asp	2	0	0	1
+6306	6306	date=\d{8}\)\;.	2	0	0	1
+6307	6307	migrate\s*=\s*\|	2	0	0	1
+6308	6308	(f=.+\|)	2	0	0	1
+6309	6309	(f=\.\..+)	2	0	0	1
+6310	6310	file=.*\|	2	0	0	1
+6311	6311	file=.+\.\..+\|	2	0	0	1
+6312	6312	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6313	6313	BaseTarget=.*?\"	2	0	0	1
+6314	6314	src=.*\"><\/FRAMESET>.*<script>.*<\/script>	2	0	0	1
+6315	6315	(showenv|parsequery|rwservlet)\?.*CUSTOMIZE=\/	2	0	0	1
+6316	6316	(showenv|parsequery|rwservlet)\?.*destype=file.*desformat=\/	2	0	0	1
+6317	6317	(showenv|parsequery|rwservlet)\?.*report=.*\.(rdf|rep)	2	0	0	1
+6318	6318	\x2Ephp\x3F.{0,300}\x3Dhttp\x3A\x2F[^\x3F\x26]+\x3F	2	0	0	1
+6319	6319	\x2F\x2A.+\x2A\x2F	2	0	0	1
+6320	6320	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6321	6321	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6322	6322	<?(java|vb)?script>?	2	0	0	1
+6323	6323	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6324	6324	^[\r\n\s]*?\x28[\r\n\s]*?base64_decode	2	0	0	1
+6325	6325	^[\r\n\s]*?\x28[\r\n\s]*?gzinflate	2	0	0	1
+6326	6326	^[\r\n\s]*?\x28[\r\n\s]*?str_rot13	2	0	0	1
+6327	6327	^[\r\n\s]*?\x28[\r\n\s]*?gzuncompress	2	0	0	1
+6328	6328	^[\r\n\s]*?\x28[\r\n\s]*?convert_uudecode	2	0	0	1
+6329	6329	c99shcook	2	0	0	1
+6330	6330	^[^\r\n]*?HTTP\/1((\r?\n\r?\n)[\x20-\x7e\s]){1,50}\n[\x20-\x7e]{1,100}\x3a[\x20-\x7e]{0,50}\x28\x29\x20\x7b	2	0	0	1
+6331	6331	(\x2a\x3f){700}	2	0	0	1
+6332	6332	UserName\x3d[^\x26]+\x2500	2	0	0	1
+6333	6333	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+6334	6334	^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|javascript)	2	0	0	1
+6335	6335	name=(<q>[\x22\x27])a(=q)[^\r\n]*\r\n[\r\n\s]+(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php)	2	0	0	1
+6336	6336	\?id=[0-9]{13}&msg=[^&]+$	2	0	0	1
+6337	6337	(%3C%21|\<\!)--[\r\n\s]*?mfunc	2	0	0	1
+6338	6338	(%3C%21|\<\!)--[\r\n\s]*?mclude	2	0	0	1
+6339	6339	(%3C%21|\<\!)--[\r\n\s]*?dynamic-cached-content	2	0	0	1
+6340	6340	^[0-9]{2,3}\)char\([^\x0d\x0a\x20]{98}	2	0	0	1
+6341	6341	^\b	2	0	0	1
+6342	6342	<%[\x00-\x7f]{20}	2	0	0	1
+6343	6343	^\s*\s*?[\x22\x27]?(f(ile|tp)|gopher|https?|mailto)\s*?\x3a	2	0	0	1
+6344	6344	^[a-z0-9\.\_]{5}hC[a-z0-9\.\_]{50}	2	0	0	1
+6345	6345	[&?]cmd=[^\x26\x28]*(cd|\;|echo|cat|perl|curl|wget|id|uname|t?ftp)	2	0	0	1
+6346	6346	(%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))	2	0	0	1
+6347	6347	net(%(25)?20|\s)+user	2	0	0	1
+6348	6348	^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\x3a\d{1,5})?$	2	0	0	1
+6349	6349	^\s*\-\s*	2	0	0	1
+6350	6350	\${\s*?%{	2	0	0	1
+6351	6351	^If\x3a\x20\x3c[^\r\n>]+?([\x7f-\xff])	2	0	0	1
+6352	6352	^[^\n]+([^ -~\x0d\x0a]|,\x20*,)	2	0	0	1
+6353	6353	var wow\s*=\s*\x22[^\x22\n]+?\x22\x3b[^\x3b\n]*?Date[^\x3b\n]*?\x3b	2	0	0	1
+6354	6354	SELECT[^a-z]+USER	2	0	0	1
+6355	6355	\x2Fcgi\x2Dbin\x2F\x3B.+[a-z]	2	0	0	1
+6356	6356	\WUPDATE\s+[A-Za-z0-9_].*?\WSET\s+[A-Za-z0-9$_].*?\x3d	2	0	0	1
+6357	6357	ViewState\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+6358	6358	(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+6359	6359	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+6360	6360	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange).+Apply\x3DApply	2	0	0	1
+6361	6361	(start|stop|continue|pause|querystate)	2	0	0	1
+6362	6362	xp_reg(read|write|delete)	2	0	0	1
+6363	6363	(xp_enumdsn|xp_enumgroups|xp_ntsec_enumdomains)	2	0	0	1
+6364	6364	\x2Ephp\x3F.{0,300}\x3Dhttps\x3A\x2F[^\x3F\x26]+\x3F	2	0	0	1
+6365	6365	\x2Ephp\x3F.{0,300}\x3Dftp\x3A\x2F[^\x3F\x26]+\x3F	2	0	0	1
+6366	6366	\x2Ephp\x3F.{0,300}\x3Dftp\x3A\x2F[^\x3F\x26]+\x3F	2	0	0	1
+6367	6367	^\s+(database|procedure|table|column)	2	0	0	1
+6368	6368	^\s+(database|procedure|table|column)	2	0	0	1
+6369	6369	^\s+(database|procedure|table|column|directory)	2	0	0	1
+6370	6370	^(DATE|TIME)	2	0	0	1
+6371	6371	BENCHMARK\x28[0-9].+\x29	2	0	0	1
+6372	6372	SELECT.+CONCAT	2	0	0	1
+6373	6373	[^\w]REVERSE[^\w]?\(	2	0	0	1
+6374	6374	cid0\x3d.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+6375	6375	\x7C\x7C.+[a-z]	2	0	0	1
+6376	6376	SELECT.+INSTR	2	0	0	1
+6377	6377	SELECT.+SUBSTR	2	0	0	1
+6378	6378	([\*\?]~1|~1\.?[\*\?]|\/~1\/)	2	0	0	1
+6379	6379	^net[0-4]{2}net\.net$	2	0	0	1
+6380	6380	Transfer-Encoding\x3a[^\r\n]*?chunked	2	0	0	1
+6381	6381	\ballow_url_include\s*	2	0	0	1
+6382	6382	\bsafe_mode\s*	2	0	0	1
+6383	6383	\bopen_basedir\s*	2	0	0	1
+6384	6384	\bauto_prepend_file\s*	2	0	0	1
+6385	6385	\bsuhosin\.simulation\s*	2	0	0	1
+6386	6386	\bdisable_functions[\s\+]*	2	0	0	1
+6387	6387	\.asp\?action=(txt(edit|view)|upload|info|del)(&|$)	2	0	0	1
+6388	6388	[\n\r](content-(type|length)|set-cookie|location)\x3a	2	0	0	1
+6389	6389	\/\$\{[^\}\x2c]+	2	0	0	1
+6390	6390	filename[\r\n\s]*[\r\n\s]*?[\x22\x27]?[^\r\n\x22\x27\x3b]+?\.[\r\n\x3b\x22\x27]	2	0	0	1
+6391	6391	[&\?]_SERVER\[[^\]]+?\][^=]*	2	0	0	1
+6392	6392	[&\?]_GET\[[^\]]+?\][^=]*	2	0	0	1
+6393	6393	[&\?]_POST\[[^\]]+?\][^=]*	2	0	0	1
+6394	6394	[&\?]_COOKIE\[[^\]]+?\][^=]*	2	0	0	1
+6395	6395	[&\?]_SESSION\[[^\]]+?\][^=]*	2	0	0	1
+6396	6396	[&\?]_REQUEST\[[^\]]+?\][^=]*	2	0	0	1
+6397	6397	[&\?]_ENV\[[^\]]+?\][^=]*	2	0	0	1
+6398	6398	([&\?\r\n]|^)_SERVER\[[^\]]+?\][^=]*	2	0	0	1
+6399	6399	([&\?\r\n]|^)_GET\[[^\]]+?\][^=]*	2	0	0	1
+6400	6400	([&\?\r\n]|^)_POST\[[^\]]+?\][^=]*	2	0	0	1
+6401	6401	[&\?]_COOKIE\[[^\]]+?\][^=]*	2	0	0	1
+6402	6402	[&\?]_SESSION\[[^\]]+?\][^=]*	2	0	0	1
+6403	6403	[&\?]_REQUEST\[[^\]]+?\][^=]*	2	0	0	1
+6404	6404	[&\?]_ENV\[[^\]]+?\][^=]*	2	0	0	1
+6405	6405	[?&]isn_getlog	2	0	0	1
+6406	6406	^[^&]*?(%(25)?2e(%((25)?2e(%(25)?5c|\/|\\)|2e(25)?%(25)?2f)|\.(%(25)?(2f|5c)|\/|\\))|\.(%(25)?2e(%(25)?(2f|5c)|\/|\\)|\.(%(25)?(2f|5c)|\/|\\)))	2	0	0	1
+6407	6407	^\s+?[^\s\>]+?\s+?SYSTEM\s	2	0	0	1
+6408	6408	^[^\r\n]*?boundary\s*\s*?[^\r\n]	2	0	0	1
+6409	6409	[&?]c99shcook\[	2	0	0	1
+6410	6410	(^|&)c99shcook\[	2	0	0	1
+6411	6411	^[\r\n\s]*?\x28[\r\n\s]*?base64_decode	2	0	0	1
+6412	6412	\/server_sync.php\?(.+?&)?c=	2	0	0	1
+6413	6413	(:?(:?\x5e|%5e)|(:?[=?&]|\x25(:?3d|3f|26)))\s*?(:?%28|\x28)(:?%29|\x29)(:?%20|\x20)(:?%7b|\x7b)(:?%20|\x20)	2	0	0	1
+6414	6414	(^User-Agent\x3a)\bcurl\s[^\r\n]*?-([Oo]|-(remote-name|output))[^\r\n]+(\x3b|&&)	2	0	0	1
+6415	6415	(^User-Agent\x3a)\bwget\s[^\r\n]+(\x3b|&&)	2	0	0	1
+6416	6416	(^User-Agent\x3a)\blwp-download\s[^\r\n]+(\x3b|&&)	2	0	0	1
+6417	6417	[=?&\x2f]\s*?\x28\x29\x20\x7b	2	0	0	1
+6418	6418	(:?(\x5e|%5e)|([=?&]|\x25(3d|3f|26)))\s*?\(\)(%20|\x20)(%7b|\x7b)	2	0	0	1
+6419	6419	^User-Agent\x3a[^\r\n]*?Heimdallbot	2	0	0	1
+6420	6420	[?&]isn_logdel	2	0	0	1
+6421	6421	[?&]isn_logpath	2	0	0	1
+6422	6422	\.war\?cmd=[a-zA-Z0-9+/=]+&winurl=[a-zA-Z0-9+/=]*&linurl=[a-zA-Z0-9+/=]*	2	0	0	1
+6423	6423	^\s*https?\x3a\/\/	2	0	0	1
+6424	6424	^\s*\x3a\s*[./]	2	0	0	1
+6425	6425	^\s*\x3a\s*[./]	2	0	0	1
+6426	6426	^\s*\x3a\s*\x40	2	0	0	1
+6427	6427	https\x3a.+(\x5c)(:[\x22\x27]|\\x2[27])\s*?[\x3b&\x7c><].*?(:[\x22\x27]|\\x2[27])	2	0	0	1
+6428	6428	xlink\s*?\x3a\s*?href\s*\s*?(:[\x22\x27]|\\x2[27])https.+?&quot\s*?\x3b(\x7c|&([gl]t|amp)\s*?\x3b)	2	0	0	1
+6429	6429	^Range\x3a[^\r\n]*?18446744073709551615	2	0	0	1
+6430	6430	\x2Flevel\x2F15\x2Fexec\x2F\x2D\x2F[a-z]	2	0	0	1
+6431	6431	^\s*=\s*([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|[^\x26\x0D\x0A]*\x3B)	2	0	0	1
+6432	6432	^(set|get)	2	0	0	1
+6433	6433	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+6434	6434	^(1|on|true)	2	0	0	1
+6435	6435	(^|[=?&])\s*?\x28\x29\x20\x7b	2	0	0	1
+6436	6436	(is|mx|info|co)$	2	0	0	1
+6437	6437	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6438	6438	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6439	6439	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6440	6440	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6441	6441	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6442	6442	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6443	6443	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6444	6444	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6445	6445	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6446	6446	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6447	6447	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6448	6448	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6449	6449	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6450	6450	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6451	6451	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6452	6452	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6453	6453	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6454	6454	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6455	6455	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6456	6456	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6457	6457	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6458	6458	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6459	6459	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6460	6460	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6461	6461	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6462	6462	<(<tname>[^\s]+)[^>]*?\stype\s*=\s*(<q>[\x22\x27])yaml(=q)((<\/(=tname)).+?)!ruby	2	0	0	1
+6463	6463	^[^\r\n]*?[\x27\x22\t\\%\x00\x08\x26]	2	0	0	1
+6464	6464	[\?&]redirect\x3a	2	0	0	1
+6465	6465	[\?&]redirectAction\x3a	2	0	0	1
+6466	6466	[\?&]action\x3a	2	0	0	1
+6467	6467	(^|[\n\&])name=(%\d{2}|[^%&]){12}	2	0	0	1
+6468	6468	(^|[\n\&])pwd=(%\d{2}|[^%&]){25}	2	0	0	1
+6469	6469	(^|[\n\&])sess_sid=(%\d{2}|[^%&]){21}	2	0	0	1
+6470	6470	(^|[\n\&])ACT=(%\d{2}|[^%&]){21}	2	0	0	1
+6471	6471	\bredirect\x3a	2	0	0	1
+6472	6472	\bredirectAction\x3a	2	0	0	1
+6473	6473	\baction\x3a	2	0	0	1
+6474	6474	rdsPasswordAllowed[\r\n\s]*[\r\n\s]*?(true|1)	2	0	0	1
+6475	6475	\/proxy\.php(\?|.*[\x26\x3B])url=[^&\;\x0D\x0A]*[<>\"\']	2	0	0	1
+6476	6476	\<a href="[^"]*(script|about|applet|activex|chrome)\s*\:	2	0	0	1
+6477	6477	\<br \/\>_________________\<br \/\>\<a href="[^"]*(script|about|applet|activex|chrome)\s*\:	2	0	0	1
+6478	6478	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6479	6479	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6480	6480	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5622772D-6C27-11D3-95E5-006008D14F3B	2	0	0	1
+6481	6481	LICMGR_ADDLICENSE&[^\x00\n\r@&]{450}	2	0	0	1
+6482	6482	SELECT.+FROM	2	0	0	1
+6483	6483	UNION\s+SELECT	2	0	0	1
+6484	6484	INSERT.+INTO	2	0	0	1
+6485	6485	DELETE.+FROM	2	0	0	1
+6486	6486	ASCII\(.+SELECT	2	0	0	1
+6487	6487	UPDATE.+SET	2	0	0	1
+6488	6488	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6489	6489	.+UNION\s+SELECT	2	0	0	1
+6490	6490	.+INSERT.+INTO	2	0	0	1
+6491	6491	.+DELETE.+FROM	2	0	0	1
+6492	6492	.+ASCII\(.+SELECT	2	0	0	1
+6493	6493	.+UPDATE.+SET	2	0	0	1
+6494	6494	(art=\|.+\|)	2	0	0	1
+6495	6495	\/index\.php(\?|.*\x26)imgdir=([^\x26\x3B\x0D\x0A]*[\x2F\x5C])?\.\.[\x2F\x5C]	2	0	0	1
+6496	6496	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6497	6497	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6498	6498	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6499	6499	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6500	6500	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6501	6501	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6502	6502	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6503	6503	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6504	6504	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6505	6505	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6506	6506	page_include=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6507	6507	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6508	6508	theme_directory=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6509	6509	theme_directory=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6510	6510	forumspath=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6511	6511	sitepath=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6512	6512	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6513	6513	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6514	6514	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6515	6515	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6516	6516	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6517	6517	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6518	6518	loadadminpage=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6519	6519	SELECT.+FROM	2	0	0	1
+6520	6520	UNION\s+SELECT	2	0	0	1
+6521	6521	INSERT.+INTO	2	0	0	1
+6522	6522	DELETE.+FROM	2	0	0	1
+6523	6523	ASCII\(.+SELECT	2	0	0	1
+6524	6524	UPDATE.+SET	2	0	0	1
+6525	6525	UPDATE.+SET	2	0	0	1
+6526	6526	\+UNION\+SELECT	2	0	0	1
+6527	6527	class_dir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6528	6528	mj_config\[src_path\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6529	6529	page=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6530	6530	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6531	6531	dir\[plugins\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6532	6532	dir\[plugins\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6533	6533	sIncPath=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6534	6534	SELECT.+FROM	2	0	0	1
+6535	6535	UNION\s+SELECT	2	0	0	1
+6536	6536	INSERT.+INTO	2	0	0	1
+6537	6537	DELETE.+FROM	2	0	0	1
+6538	6538	ASCII\(.+SELECT	2	0	0	1
+6539	6539	UPDATE.+SET	2	0	0	1
+6540	6540	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6541	6541	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6542	6542	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6543	6543	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6544	6544	SELECT.+FROM	2	0	0	1
+6545	6545	UNION\s+SELECT	2	0	0	1
+6546	6546	INSERT.+INTO	2	0	0	1
+6547	6547	DELETE.+FROM	2	0	0	1
+6548	6548	ASCII\(.+SELECT	2	0	0	1
+6549	6549	UPDATE.+SET	2	0	0	1
+6550	6550	id_menu\x3d.+DELETE.+FROM	2	0	0	1
+6551	6551	id_menu\x3d.+UPDATE.+SET	2	0	0	1
+6552	6552	(file=\|.+\|)	2	0	0	1
+6553	6553	(graph_start=%0a.+%0a)	2	0	0	1
+6554	6554	UNION\s+SELECT	2	0	0	1
+6555	6555	INSERT.+INTO	2	0	0	1
+6556	6556	DELETE.+FROM	2	0	0	1
+6557	6557	UPDATE.+SET	2	0	0	1
+6558	6558	script>?.*<.*script	2	0	0	1
+6559	6559	script>?.*<.+\/script>?	2	0	0	1
+6560	6560	script>?.*<.+\/script>?	2	0	0	1
+6561	6561	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6562	6562	script>?.*<.+\/script>?	2	0	0	1
+6563	6563	script>?.*<.+\/script>?	2	0	0	1
+6564	6564	script>?.*<.+\/script>?	2	0	0	1
+6565	6565	script>?.*<.+\/script>?	2	0	0	1
+6566	6566	GLOBALS\[mosConfig_absolute_path\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6567	6567	mosConfig_absolute_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6568	6568	mosConfig_absolute_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6569	6569	GLOBALS\[mosConfig_absolute_path\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6570	6570	GLOBALS\[mosConfig_absolute_path\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6571	6571	GLOBALS\[mosConfig_absolute_path\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6572	6572	mosConfig_absolute_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6573	6573	minsoft_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6574	6574	minsoft_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6575	6575	DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6576	6576	DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6577	6577	DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6578	6578	DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6579	6579	DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6580	6580	script>?.*<.+\/script>?	2	0	0	1
+6581	6581	script>?.*<.+\/script>?	2	0	0	1
+6582	6582	script>?.*<.+\/script>?	2	0	0	1
+6583	6583	script>?.*<.+\/script>?	2	0	0	1
+6584	6584	sections_file=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6585	6585	INSERT.+INTO	2	0	0	1
+6586	6586	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6587	6587	SELECT.+FROM	2	0	0	1
+6588	6588	UNION\s+SELECT	2	0	0	1
+6589	6589	INSERT.+INTO	2	0	0	1
+6590	6590	ASCII\(.+SELECT	2	0	0	1
+6591	6591	UPDATE.+SET	2	0	0	1
+6592	6592	\/ping\?.+(script|alert|on(mouse[a-z]+|key[a-z]+|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+6593	6593	footer_file=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6594	6594	SELECT.+FROM	2	0	0	1
+6595	6595	UNION\s+SELECT	2	0	0	1
+6596	6596	INSERT.+INTO	2	0	0	1
+6597	6597	DELETE.+FROM	2	0	0	1
+6598	6598	ASCII\(.+SELECT	2	0	0	1
+6599	6599	UPDATE.+SET	2	0	0	1
+6600	6600	script>?.*<.+\/script>?	2	0	0	1
+6601	6601	SECURITY_FILE=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6602	6602	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6603	6603	SELECT.+FROM	2	0	0	1
+6604	6604	SELECT.+FROM	2	0	0	1
+6605	6605	UNION\s+SELECT	2	0	0	1
+6606	6606	INSERT.+INTO	2	0	0	1
+6607	6607	DELETE.+FROM	2	0	0	1
+6608	6608	ASCII\(.+SELECT	2	0	0	1
+6609	6609	UPDATE.+SET	2	0	0	1
+6610	6610	SELECT.+FROM	2	0	0	1
+6611	6611	&TYPEOF\:.+system\s*\(	2	0	0	1
+6612	6612	(..\\)	2	0	0	1
+6613	6613	script>?.*<.+\/script>?	2	0	0	1
+6614	6614	script>?.*<.+\/script>?	2	0	0	1
+6615	6615	dle_config_api\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6616	6616	script>?.*<.+\/script>?	2	0	0	1
+6617	6617	script>?.*<.+\/script>?	2	0	0	1
+6618	6618	script>?.*<.+\/script>?	2	0	0	1
+6619	6619	root=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6620	6620	=\s*(https?|ftps|php)\:\/	2	0	0	1
+6621	6621	SELECT.+FROM	2	0	0	1
+6622	6622	UNION\s+SELECT	2	0	0	1
+6623	6623	INSERT.+INTO	2	0	0	1
+6624	6624	DELETE.+FROM	2	0	0	1
+6625	6625	ASCII\(.+SELECT	2	0	0	1
+6626	6626	UPDATE.+SET	2	0	0	1
+6627	6627	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6628	6628	script>?.*<.+\/script>?	2	0	0	1
+6629	6629	script>?.*<.+\/script>?	2	0	0	1
+6630	6630	SELECT.+FROM	2	0	0	1
+6631	6631	SELECT.+FROM	2	0	0	1
+6632	6632	UNION\s+SELECT	2	0	0	1
+6633	6633	INSERT.+INTO	2	0	0	1
+6634	6634	DELETE.+FROM	2	0	0	1
+6635	6635	ASCII\(.+SELECT	2	0	0	1
+6636	6636	UPDATE.+SET	2	0	0	1
+6637	6637	FSPHP_LIB\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6638	6638	FSPHP_LIB\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6639	6639	dir\[classes\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6640	6640	SELECT.+FROM	2	0	0	1
+6641	6641	UNION\s+SELECT	2	0	0	1
+6642	6642	INSERT.+INTO	2	0	0	1
+6643	6643	DELETE.+FROM	2	0	0	1
+6644	6644	ASCII\(.+SELECT	2	0	0	1
+6645	6645	UPDATE.+SET	2	0	0	1
+6646	6646	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6647	6647	SELECT.+FROM	2	0	0	1
+6648	6648	UNION\s+SELECT	2	0	0	1
+6649	6649	INSERT.+INTO	2	0	0	1
+6650	6650	DELETE.+FROM	2	0	0	1
+6651	6651	ASCII\(.+SELECT	2	0	0	1
+6652	6652	UPDATE.+SET	2	0	0	1
+6653	6653	API_HOME_DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6654	6654	abspath=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6655	6655	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6656	6656	CFG\[PREPEND_FILE\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6657	6657	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6658	6658	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6659	6659	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6660	6660	SELECT.+FROM	2	0	0	1
+6661	6661	SELECT.+FROM	2	0	0	1
+6662	6662	UNION\s+SELECT	2	0	0	1
+6663	6663	INSERT.+INTO	2	0	0	1
+6664	6664	DELETE.+FROM	2	0	0	1
+6665	6665	ASCII\(.+SELECT	2	0	0	1
+6666	6666	UPDATE.+SET	2	0	0	1
+6667	6667	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6668	6668	root_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6669	6669	cur_module=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6670	6670	proxystylesheet=\s*(https?|ftps?|php)	2	0	0	1
+6671	6671	location=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6672	6672	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6673	6673	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6674	6674	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6675	6675	_settings\[pluginpath\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6676	6676	\/horde((2|3|-3\.(0\.[1-9]|1\.0)))?\/{1,2}README	2	0	0	1
+6677	6677	phpbb_root_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6678	6678	phpbb_root_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6679	6679	CONFIG\[LANGUAGE_CPATH\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6680	6680	CONFIG\[BASE_PATH\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6681	6681	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6682	6682	SELECT.+FROM	2	0	0	1
+6683	6683	UNION\s+SELECT	2	0	0	1
+6684	6684	INSERT.+INTO	2	0	0	1
+6685	6685	DELETE.+FROM	2	0	0	1
+6686	6686	ASCII\(.+SELECT	2	0	0	1
+6687	6687	UPDATE.+SET	2	0	0	1
+6688	6688	SELECT.+FROM	2	0	0	1
+6689	6689	UNION\s+SELECT	2	0	0	1
+6690	6690	INSERT.+INTO	2	0	0	1
+6691	6691	DELETE.+FROM	2	0	0	1
+6692	6692	ASCII\(.+SELECT	2	0	0	1
+6693	6693	UPDATE.+SET	2	0	0	1
+6694	6694	SELECT.+FROM	2	0	0	1
+6695	6695	UNION\s+SELECT	2	0	0	1
+6696	6696	INSERT.+INTO	2	0	0	1
+6697	6697	DELETE.+FROM	2	0	0	1
+6698	6698	ASCII\(.+SELECT	2	0	0	1
+6699	6699	UPDATE.+SET	2	0	0	1
+6700	6700	SELECT.+FROM	2	0	0	1
+6701	6701	UNION\s+SELECT	2	0	0	1
+6702	6702	INSERT.+INTO	2	0	0	1
+6703	6703	DELETE.+FROM	2	0	0	1
+6704	6704	ASCII\(.+SELECT	2	0	0	1
+6705	6705	UPDATE.+SET	2	0	0	1
+6706	6706	SELECT.+FROM	2	0	0	1
+6707	6707	UNION\s+SELECT	2	0	0	1
+6708	6708	INSERT.+INTO	2	0	0	1
+6709	6709	DELETE.+FROM	2	0	0	1
+6710	6710	ASCII\(.+SELECT	2	0	0	1
+6711	6711	UPDATE.+SET	2	0	0	1
+6712	6712	SELECT.+FROM	2	0	0	1
+6713	6713	UNION\s+SELECT	2	0	0	1
+6714	6714	INSERT.+INTO	2	0	0	1
+6715	6715	DELETE.+FROM	2	0	0	1
+6716	6716	ASCII\(.+SELECT	2	0	0	1
+6717	6717	UPDATE.+SET	2	0	0	1
+6718	6718	SELECT.+FROM	2	0	0	1
+6719	6719	UNION\s+SELECT	2	0	0	1
+6720	6720	INSERT.+INTO	2	0	0	1
+6721	6721	DELETE.+FROM	2	0	0	1
+6722	6722	ASCII\(.+SELECT	2	0	0	1
+6723	6723	UPDATE.+SET	2	0	0	1
+6724	6724	script>?.*<.+\/script>?	2	0	0	1
+6725	6725	SELECT.+FROM	2	0	0	1
+6726	6726	UNION\s+SELECT	2	0	0	1
+6727	6727	INSERT.+INTO	2	0	0	1
+6728	6728	DELETE.+FROM	2	0	0	1
+6729	6729	ASCII\(.+SELECT	2	0	0	1
+6730	6730	UPDATE.+SET	2	0	0	1
+6731	6731	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6732	6732	SELECT.+FROM	2	0	0	1
+6733	6733	UNION\s+SELECT	2	0	0	1
+6734	6734	INSERT.+INTO	2	0	0	1
+6735	6735	DELETE.+FROM	2	0	0	1
+6736	6736	ASCII\(.+SELECT	2	0	0	1
+6737	6737	UPDATE.+SET	2	0	0	1
+6738	6738	=\s*(https?|ftps|php)\:\/	2	0	0	1
+6739	6739	SELECT.+FROM	2	0	0	1
+6740	6740	UNION\s+SELECT	2	0	0	1
+6741	6741	INSERT.+INTO	2	0	0	1
+6742	6742	DELETE.+FROM	2	0	0	1
+6743	6743	ASCII\(.+SELECT	2	0	0	1
+6744	6744	UPDATE.+SET	2	0	0	1
+6745	6745	SELECT.+FROM	2	0	0	1
+6746	6746	UNION\s+SELECT	2	0	0	1
+6747	6747	INSERT.+INTO	2	0	0	1
+6748	6748	DELETE.+FROM	2	0	0	1
+6749	6749	ASCII\(.+SELECT	2	0	0	1
+6750	6750	UPDATE.+SET	2	0	0	1
+6751	6751	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6752	6752	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6753	6753	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6754	6754	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6755	6755	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6756	6756	mosConfig_absolute_path=(https?|ftps?|php)\:\/	2	0	0	1
+6757	6757	SELECT.+FROM	2	0	0	1
+6758	6758	UNION\s+SELECT	2	0	0	1
+6759	6759	INSERT.+INTO	2	0	0	1
+6760	6760	DELETE.+FROM	2	0	0	1
+6761	6761	ASCII\(.+SELECT	2	0	0	1
+6762	6762	UPDATE.+SET	2	0	0	1
+6763	6763	include_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6764	6764	processName\x3D.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+6765	6765	help\x2Findex\x2Ejsp.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+6766	6766	content\x2Ejsp.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+6767	6767	appMVCPath=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6768	6768	CURRENT_BLOG_PATH=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+6769	6769	appMVCPath=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+6770	6770	CURRENT_BLOG_PATH=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+6771	6771	ASCII\(.+SELECT	2	0	0	1
+6772	6772	_SESSION\[SCRIPT_PATH\]=\s*(https?|ftps?|php)\x3a\/	2	0	0	1
+6773	6773	top_graph_header\.php\?.*=(http|https)\x3a\/	2	0	0	1
+6774	6774	config_settings\.php\?.*=(http|https)\x3a\/	2	0	0	1
+6775	6775	UNION.+SELECT	2	0	0	1
+6776	6776	=\s*(https|ftps|php|http|ftp)\x3A\x2F	2	0	0	1
+6777	6777	\/filediff\?((&?v\d[\d.]+?)+?&f\x3d|f\x3d.+?(&v\d[\d.]+?)+?).+?\x3b.+?\x3b	2	0	0	1
+6778	6778	(configdir|update|pluginmode)=.*(\|.+\||system)	2	0	0	1
+6779	6779	template=[./]	2	0	0	1
+6780	6780	template=[./]	2	0	0	1
+6781	6781	_CONF\[.*\]=(data|https?|ftps?|php)\:\/	2	0	0	1
+6782	6782	(\.\.\/){1}	2	0	0	1
+6783	6783	IP=\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+6784	6784	commandId\x3D[a-z]	2	0	0	1
+6785	6785	search\?q=(ht|f)tp?\:\/	2	0	0	1
+6786	6786	module=[^\;]*\;.*\"	2	0	0	1
+6787	6787	ASCII\(.+SELECT	2	0	0	1
+6788	6788	UNION\s+SELECT	2	0	0	1
+6789	6789	^Host\x3a[^\r\n]+?[\x28\x29\x27\x22\x7b\x7d]/Hmi	2	0	0	1
+6790	6790	Cookie: .*admin-access=	2	0	0	1
+6791	6791	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+6792	6792	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+6793	6793	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+6794	6794	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6795	6795	FSPHP_LIB\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6796	6796	read_xml_include=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6797	6797	root=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6798	6798	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6799	6799	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6800	6800	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6801	6801	CLASSES_ROOT=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6802	6802	.*\[.*\].*\;	2	0	0	1
+6803	6803	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6804	6804	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6805	6805	oe_classpath=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6806	6806	GLOBALS\[preloc\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6807	6807	GLOBALS\[preloc\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6808	6808	.+SELECT.+FROM	2	0	0	1
+6809	6809	.+UNION\s+SELECT	2	0	0	1
+6810	6810	.+INSERT.+INTO	2	0	0	1
+6811	6811	.+DELETE.+FROM	2	0	0	1
+6812	6812	.+ASCII\(.+SELECT	2	0	0	1
+6813	6813	.+UPDATE.+SET	2	0	0	1
+6814	6814	.+SELECT.+FROM	2	0	0	1
+6815	6815	.+UNION\s+SELECT	2	0	0	1
+6816	6816	.+INSERT.+INTO	2	0	0	1
+6817	6817	.+DELETE.+FROM	2	0	0	1
+6818	6818	.+ASCII\(.+SELECT	2	0	0	1
+6819	6819	.+UPDATE.+SET	2	0	0	1
+6820	6820	.+SELECT.+FROM	2	0	0	1
+6821	6821	.+UNION\s+SELECT	2	0	0	1
+6822	6822	.+INSERT.+INTO	2	0	0	1
+6823	6823	.+DELETE.+FROM	2	0	0	1
+6824	6824	.+ASCII\(.+SELECT	2	0	0	1
+6825	6825	.+UPDATE.+SET	2	0	0	1
+6826	6826	include_path=\s*(ftps?|https?|php)\:/	2	0	0	1
+6827	6827	include_path=\s*(ftps?|https?|php)\:/	2	0	0	1
+6828	6828	include_path=\s*(ftps?|https?|php)\:/	2	0	0	1
+6829	6829	highlight=.*?(\'|\%[a-f0-9]{4})(\.|\/|\\|\%[a-f0-9]{4}).+?(\'|\%[a-f0-9]{4})	2	0	0	1
+6830	6830	phpbb_root_path=(ftps?|https?|php)	2	0	0	1
+6831	6831	(\?|&)id=	2	0	0	1
+6832	6832	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6833	6833	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6834	6834	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6835	6835	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6836	6836	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6837	6837	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6838	6838	(text\.ctrl\.php|common\.function\.php)\?level=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6839	6839	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6840	6840	DataDirectory=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6841	6841	.+SELECT.+FROM	2	0	0	1
+6842	6842	.+UNION\s+SELECT	2	0	0	1
+6843	6843	.+INSERT.+INTO	2	0	0	1
+6844	6844	.+DELETE.+FROM	2	0	0	1
+6845	6845	.+ASCII\(.+SELECT	2	0	0	1
+6846	6846	.+UPDATE.+SET	2	0	0	1
+6847	6847	.+SELECT.+FROM	2	0	0	1
+6848	6848	.+UNION\s+SELECT	2	0	0	1
+6849	6849	.+INSERT.+INTO	2	0	0	1
+6850	6850	.+DELETE.+FROM	2	0	0	1
+6851	6851	.+ASCII\(.+SELECT	2	0	0	1
+6852	6852	.+UPDATE.+SET	2	0	0	1
+6853	6853	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6854	6854	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6855	6855	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6856	6856	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6857	6857	confdir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6858	6858	(argv[1]=\|.+)	2	0	0	1
+6859	6859	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6860	6860	UNION.+SELECT	2	0	0	1
+6861	6861	<\s*SCRIPT\s*>	2	0	0	1
+6862	6862	file=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6863	6863	includedir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6864	6864	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6865	6865	GLOBALS\x5bFarmD\x5d\x3d	2	0	0	1
+6866	6866	SELECT.+FROM	2	0	0	1
+6867	6867	UNION\s+SELECT	2	0	0	1
+6868	6868	INSERT.+INTO	2	0	0	1
+6869	6869	DELETE.+FROM	2	0	0	1
+6870	6870	ASCII\(.+SELECT	2	0	0	1
+6871	6871	UPDATE.+SET	2	0	0	1
+6872	6872	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6873	6873	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6874	6874	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6875	6875	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6876	6876	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6877	6877	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6878	6878	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6879	6879	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6880	6880	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6881	6881	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6882	6882	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6883	6883	.+SELECT.+FROM	2	0	0	1
+6884	6884	.+UNION\s+SELECT	2	0	0	1
+6885	6885	.+INSERT.+INTO	2	0	0	1
+6886	6886	.+DELETE.+FROM	2	0	0	1
+6887	6887	.+ASCII\(.+SELECT	2	0	0	1
+6888	6888	.+UPDATE.+SET	2	0	0	1
+6889	6889	PATH_TO_CODE=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6890	6890	includepath=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6891	6891	lib=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6892	6892	_px_config\x5bmanager_path\x5d=(https?|ftps?|php)\:	2	0	0	1
+6893	6893	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6894	6894	sourceFolder=\s*(ftps?|https?|php)\:/	2	0	0	1
+6895	6895	CONFIG\[gameroot\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6896	6896	CONFIG\[gameroot\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6897	6897	qte_web_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6898	6898	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6899	6899	path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6900	6900	INC_DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6901	6901	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6902	6902	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6903	6903	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6904	6904	GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6905	6905	GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6906	6906	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6907	6907	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6908	6908	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6909	6909	.+SELECT.+FROM	2	0	0	1
+6910	6910	.+UNION\s+SELECT	2	0	0	1
+6911	6911	.+INSERT.+INTO	2	0	0	1
+6912	6912	.+DELETE.+FROM	2	0	0	1
+6913	6913	.+ASCII\(.+SELECT	2	0	0	1
+6914	6914	.+UPDATE.+SET	2	0	0	1
+6915	6915	(\.\.\/){1,}	2	0	0	1
+6916	6916	SELECT.+FROM	2	0	0	1
+6917	6917	UNION\s+SELECT	2	0	0	1
+6918	6918	INSERT.+INTO	2	0	0	1
+6919	6919	DELETE.+FROM	2	0	0	1
+6920	6920	ASCII\(.+SELECT	2	0	0	1
+6921	6921	UPDATE.+SET	2	0	0	1
+6922	6922	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6923	6923	.+SELECT.+FROM	2	0	0	1
+6924	6924	.+UNION\s+SELECT	2	0	0	1
+6925	6925	.+INSERT.+INTO	2	0	0	1
+6926	6926	.+DELETE.+FROM	2	0	0	1
+6927	6927	.+ASCII\(.+SELECT	2	0	0	1
+6928	6928	.+UPDATE.+SET	2	0	0	1
+6929	6929	.+SELECT.+FROM	2	0	0	1
+6930	6930	.+UNION\s+SELECT	2	0	0	1
+6931	6931	.+INSERT.+INTO	2	0	0	1
+6932	6932	.+DELETE.+FROM	2	0	0	1
+6933	6933	.+ASCII\(.+SELECT	2	0	0	1
+6934	6934	.+UPDATE.+SET	2	0	0	1
+6935	6935	_page_css=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6936	6936	_page_javascript=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6937	6937	_page_content=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6938	6938	SELECT.+FROM	2	0	0	1
+6939	6939	UNION\s+SELECT	2	0	0	1
+6940	6940	INSERT.+INTO	2	0	0	1
+6941	6941	DELETE.+FROM	2	0	0	1
+6942	6942	ASCII\(.+SELECT	2	0	0	1
+6943	6943	UPDATE.+SET	2	0	0	1
+6944	6944	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6945	6945	IP=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6946	6946	.+SELECT.+FROM	2	0	0	1
+6947	6947	.+UNION\s+SELECT	2	0	0	1
+6948	6948	.+INSERT.+INTO	2	0	0	1
+6949	6949	.+DELETE.+FROM	2	0	0	1
+6950	6950	.+ASCII\(.+SELECT	2	0	0	1
+6951	6951	.+UPDATE.+SET	2	0	0	1
+6952	6952	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6953	6953	slogin_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6954	6954	SELECT.+FROM	2	0	0	1
+6955	6955	UNION\s+SELECT	2	0	0	1
+6956	6956	INSERT.+INTO	2	0	0	1
+6957	6957	DELETE.+FROM	2	0	0	1
+6958	6958	ASCII\(.+SELECT	2	0	0	1
+6959	6959	UPDATE.+SET	2	0	0	1
+6960	6960	SELECT.+FROM	2	0	0	1
+6961	6961	UNION\s+SELECT	2	0	0	1
+6962	6962	DELETE.+FROM	2	0	0	1
+6963	6963	ASCII\(.+SELECT	2	0	0	1
+6964	6964	UPDATE.+SET	2	0	0	1
+6965	6965	SELECT.+FROM	2	0	0	1
+6966	6966	UNION\s+SELECT	2	0	0	1
+6967	6967	INSERT.+INTO	2	0	0	1
+6968	6968	DELETE.+FROM	2	0	0	1
+6969	6969	ASCII\(.+SELECT	2	0	0	1
+6970	6970	UPDATE.+SET	2	0	0	1
+6971	6971	SELECT.+FROM	2	0	0	1
+6972	6972	UNION\s+SELECT	2	0	0	1
+6973	6973	INSERT.+INTO	2	0	0	1
+6974	6974	DELETE.+FROM	2	0	0	1
+6975	6975	ASCII\(.+SELECT	2	0	0	1
+6976	6976	UPDATE.+SET	2	0	0	1
+6977	6977	g_pcltar_lib_dir=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6978	6978	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6979	6979	SELECT.+FROM	2	0	0	1
+6980	6980	UNION\s+SELECT	2	0	0	1
+6981	6981	INSERT.+INTO	2	0	0	1
+6982	6982	DELETE.+FROM	2	0	0	1
+6983	6983	ASCII\(.+SELECT	2	0	0	1
+6984	6984	UPDATE.+SET	2	0	0	1
+6985	6985	SELECT.+FROM	2	0	0	1
+6986	6986	UNION\s+SELECT	2	0	0	1
+6987	6987	INSERT.+INTO	2	0	0	1
+6988	6988	ASCII\(.+SELECT	2	0	0	1
+6989	6989	UPDATE.+SET	2	0	0	1
+6990	6990	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6991	6991	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6992	6992	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6993	6993	inc_dir=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6994	6994	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6995	6995	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6996	6996	UNION.+SELECT	2	0	0	1
+6997	6997	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6998	6998	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6999	6999	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7000	7000	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7001	7001	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7002	7002	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7003	7003	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7004	7004	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7005	7005	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7006	7006	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7007	7007	%INCLUDE\s*{.*rev=\"\d+\|.+\".*}\s*%	2	0	0	1
+7008	7008	UNION.+SELECT	2	0	0	1
+7009	7009	config\[include_dir\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7010	7010	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7011	7011	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7012	7012	vwar_root=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7013	7013	vwar_root=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7014	7014	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7015	7015	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7016	7016	.+SELECT.+FROM	2	0	0	1
+7017	7017	.+UNION\s+SELECT	2	0	0	1
+7018	7018	.+INSERT.+INTO	2	0	0	1
+7019	7019	.+DELETE.+FROM	2	0	0	1
+7020	7020	.+ASCII\(.+SELECT	2	0	0	1
+7021	7021	plancia=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7022	7022	include_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7023	7023	include_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7024	7024	include_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7025	7025	include_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7026	7026	\/ws\/(login|get_reminders|get_events)\.php	2	0	0	1
+7027	7027	SELECT.+FROM	2	0	0	1
+7028	7028	UNION\s+SELECT	2	0	0	1
+7029	7029	INSERT.+INTO	2	0	0	1
+7030	7030	DELETE.+FROM	2	0	0	1
+7031	7031	ASCII\(.+SELECT	2	0	0	1
+7032	7032	UPDATE.+SET	2	0	0	1
+7033	7033	GLOBALS\[RootPath\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7034	7034	GLOBALS\[RootPath\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7035	7035	GLOBALS\[RootPath\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7036	7036	config_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7037	7037	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7038	7038	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7039	7039	redirect_to=(ht|f)tps?\:\/	2	0	0	1
+7040	7040	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7041	7041	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7042	7042	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7043	7043	web_root=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7044	7044	web_root=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7045	7045	id=-?\d+.+UNION.+SELECT	2	0	0	1
+7046	7046	set_menu=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7047	7047	context\[path_to_root\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7048	7048	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7049	7049	.+SELECT.+FROM	2	0	0	1
+7050	7050	.+UNION\s+SELECT	2	0	0	1
+7051	7051	.+INSERT.+INTO	2	0	0	1
+7052	7052	.+DELETE.+FROM	2	0	0	1
+7053	7053	.+ASCII\(.+SELECT	2	0	0	1
+7054	7054	.+UPDATE.+SET	2	0	0	1
+7055	7055	cct_base=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7056	7056	cct_base=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7057	7057	cct_base=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7058	7058	cct_base=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7059	7059	cct_base=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7060	7060	mod_root=\s*(https?|ftps?|php)	2	0	0	1
+7061	7061	GLOBALS\[prefix\]=\s*(ftps?|https?|php)\:/	2	0	0	1
+7062	7062	.+SELECT.+FROM	2	0	0	1
+7063	7063	.+UNION\s+SELECT	2	0	0	1
+7064	7064	.+INSERT.+INTO	2	0	0	1
+7065	7065	.+DELETE.+FROM	2	0	0	1
+7066	7066	.+ASCII\(.+SELECT	2	0	0	1
+7067	7067	.+UPDATE.+SET	2	0	0	1
+7068	7068	.+SELECT.+FROM	2	0	0	1
+7069	7069	.+UNION\s+SELECT	2	0	0	1
+7070	7070	.+DELETE.+FROM	2	0	0	1
+7071	7071	.+ASCII\(.+SELECT	2	0	0	1
+7072	7072	.+UPDATE.+SET	2	0	0	1
+7073	7073	.+SELECT.+FROM	2	0	0	1
+7074	7074	.+UNION\s+SELECT	2	0	0	1
+7075	7075	.+INSERT.+INTO	2	0	0	1
+7076	7076	.+DELETE.+FROM	2	0	0	1
+7077	7077	.+ASCII\(.+SELECT	2	0	0	1
+7078	7078	.+UPDATE.+SET	2	0	0	1
+7079	7079	e107path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7080	7080	inc_ordner=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7081	7081	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7082	7082	dirDepth=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7083	7083	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7084	7084	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7085	7085	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7086	7086	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7087	7087	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7088	7088	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7089	7089	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7090	7090	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7091	7091	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7092	7092	fs_jVroot\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7093	7093	fs_jVroot\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7094	7094	fs_jVroot\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7095	7095	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7096	7096	UPDATE\s+SELECT	2	0	0	1
+7097	7097	INSERT.+INTO	2	0	0	1
+7098	7098	DELETE.+FROM	2	0	0	1
+7099	7099	ASCII\(.+SELECT	2	0	0	1
+7100	7100	UPDATE.+SET	2	0	0	1
+7101	7101	SELECT.+FROM	2	0	0	1
+7102	7102	UNION\s+SELECT	2	0	0	1
+7103	7103	INSERT.+INTO	2	0	0	1
+7104	7104	DELETE.+FROM	2	0	0	1
+7105	7105	ASCII\(.+SELECT	2	0	0	1
+7106	7106	UPDATE.+SET	2	0	0	1
+7107	7107	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7108	7108	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7109	7109	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7110	7110	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7111	7111	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7112	7112	content=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7113	7113	.+SELECT.+FROM	2	0	0	1
+7114	7114	.+UNION\s+SELECT	2	0	0	1
+7115	7115	.+INSERT.+INTO	2	0	0	1
+7116	7116	.+DELETE.+FROM	2	0	0	1
+7117	7117	.+ASCII\(.+SELECT	2	0	0	1
+7118	7118	.+UPDATE.+SET	2	0	0	1
+7119	7119	_path\[counter\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7120	7120	CFG\[txtsql\]\[class\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7121	7121	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7122	7122	SELECT.+FROM	2	0	0	1
+7123	7123	UNION\s+SELECT	2	0	0	1
+7124	7124	INSERT.+INTO	2	0	0	1
+7125	7125	DELETE.+FROM	2	0	0	1
+7126	7126	ASCII\(.+SELECT	2	0	0	1
+7127	7127	UPDATE.+SET	2	0	0	1
+7128	7128	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7129	7129	target=\w*\;	2	0	0	1
+7130	7130	SELECT.+FROM	2	0	0	1
+7131	7131	INSERT.+INTO	2	0	0	1
+7132	7132	DELETE.+FROM	2	0	0	1
+7133	7133	.+SELECT.+FROM	2	0	0	1
+7134	7134	DELETE.+FROM	2	0	0	1
+7135	7135	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7136	7136	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7137	7137	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7138	7138	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7139	7139	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7140	7140	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7141	7141	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7142	7142	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7143	7143	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7144	7144	GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7145	7145	apps_path\[themes\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7146	7146	apps_path\[libs\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7147	7147	UPDATE.+SET	2	0	0	1
+7148	7148	site_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7149	7149	(\.\.\/){1}	2	0	0	1
+7150	7150	(\.\.\/){1}	2	0	0	1
+7151	7151	\/[a-z_]+\.php\/[a-z_]+\.php	2	0	0	1
+7152	7152	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x0d\x0a	2	0	0	1
+7153	7153	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*952E3F80-0C34-48CD-829B-A45913B29670	2	0	0	1
+7154	7154	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7155	7155	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7156	7156	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7157	7157	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7158	7158	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7159	7159	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7160	7160	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7161	7161	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7162	7162	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7163	7163	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7164	7164	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7165	7165	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7166	7166	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7167	7167	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7168	7168	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7169	7169	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7170	7170	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7171	7171	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7172	7172	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7173	7173	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7174	7174	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7175	7175	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7176	7176	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7177	7177	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7178	7178	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7179	7179	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7180	7180	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7181	7181	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7182	7182	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7183	7183	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7184	7184	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7185	7185	^\s*(https?|ftps?|php)\:\/	2	0	0	1
+7186	7186	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7187	7187	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7188	7188	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7189	7189	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7190	7190	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7191	7191	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7192	7192	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7193	7193	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7194	7194	^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7195	7195	^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7196	7196	cmd\x3D(filterHelper|getDeviceData\x26group\x3D).+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7197	7197	\x2Ejsp\x3F(clusterName|deviceName)\x3D.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7198	7198	^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7199	7199	^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7200	7200	^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7201	7201	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7202	7202	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7203	7203	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7204	7204	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7205	7205	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7206	7206	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7207	7207	^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+7208	7208	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7209	7209	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7210	7210	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7211	7211	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7212	7212	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7213	7213	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7214	7214	^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+7215	7215	^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+7216	7216	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7217	7217	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7218	7218	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7219	7219	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7220	7220	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7221	7221	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7222	7222	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7223	7223	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7224	7224	^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+7225	7225	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D)	2	0	0	1
+7226	7226	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D)	2	0	0	1
+7227	7227	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D)	2	0	0	1
+7228	7228	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D)	2	0	0	1
+7229	7229	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7230	7230	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7231	7231	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset onselect|onchange|style\x3D)	2	0	0	1
+7232	7232	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset onselect|onchange|style\x3D)	2	0	0	1
+7233	7233	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7234	7234	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7235	7235	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D)	2	0	0	1
+7236	7236	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D)	2	0	0	1
+7237	7237	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7238	7238	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7239	7239	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7240	7240	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7241	7241	(Loging|Hidden)Password\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+7242	7242	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7243	7243	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7244	7244	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7245	7245	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7246	7246	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7247	7247	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7248	7248	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7249	7249	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7250	7250	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7251	7251	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7252	7252	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7253	7253	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7254	7254	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7255	7255	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7256	7256	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7257	7257	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7258	7258	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7259	7259	abspath=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7260	7260	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7261	7261	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7262	7262	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7263	7263	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7264	7264	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7265	7265	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7266	7266	basedir_save=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7267	7267	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7268	7268	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|marquee|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7269	7269	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7270	7270	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7271	7271	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7272	7272	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7273	7273	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7274	7274	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7275	7275	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7276	7276	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7277	7277	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7278	7278	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7279	7279	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7280	7280	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7281	7281	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7282	7282	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7283	7283	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7284	7284	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7285	7285	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7286	7286	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7287	7287	^.{0,300}=(https|ftps)	2	0	0	1
+7288	7288	^-?\d+ 	2	0	0	1
+7289	7289	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7290	7290	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7291	7291	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7292	7292	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7293	7293	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7294	7294	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset onselect|onchange|style\x3D)	2	0	0	1
+7295	7295	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange style\x3D)	2	0	0	1
+7296	7296	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7297	7297	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7298	7298	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7299	7299	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7300	7300	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7301	7301	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7302	7302	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7303	7303	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7304	7304	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7305	7305	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7306	7306	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7307	7307	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7308	7308	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7309	7309	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7310	7310	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7311	7311	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7312	7312	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7313	7313	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7314	7314	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7315	7315	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7316	7316	^.*(ftps?|https?|php)\:\/	2	0	0	1
+7317	7317	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7318	7318	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7319	7319	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7320	7320	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7321	7321	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7322	7322	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7323	7323	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7324	7324	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7325	7325	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7326	7326	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7327	7327	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7328	7328	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7329	7329	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7330	7330	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7331	7331	^.+?(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change|error))	2	0	0	1
+7332	7332	^.+?(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7333	7333	^.+?(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7334	7334	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7335	7335	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7336	7336	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7337	7337	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7338	7338	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7339	7339	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7340	7340	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7341	7341	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7342	7342	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7343	7343	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7344	7344	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7345	7345	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7346	7346	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7347	7347	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7348	7348	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7349	7349	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7350	7350	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7351	7351	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7352	7352	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7353	7353	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7354	7354	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7355	7355	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7356	7356	id=-?\d+\s+UNION\s	2	0	0	1
+7357	7357	output=\w	2	0	0	1
+7358	7358	^\w	2	0	0	1
+7359	7359	^\w	2	0	0	1
+7360	7360	^\w	2	0	0	1
+7361	7361	^\w	2	0	0	1
+7362	7362	^\w	2	0	0	1
+7363	7363	^\w	2	0	0	1
+7364	7364	cmd=\w	2	0	0	1
+7365	7365	(\?|&)(host|service|opt|end|start)=[^&]+?\x60.+?\x60	2	0	0	1
+7366	7366	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7367	7367	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7368	7368	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7369	7369	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7370	7370	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7371	7371	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7372	7372	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7373	7373	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7374	7374	(\x3c|\x253c)dbInfo(\x3e|\x253e)[\r\n\s]*?(\x3c|\x253c)dbInfoRequest(\x3e|\x253e).+?(\x3c|\x253c)searchStr(\x3e|\x253e)(((\x3c|\x253c)(\/|\x252f)searchStr(\x3e|\x253e)).)+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)).+?(\x3c|\x253c)(\/|\x252f)searchStr(\x3e|\x253e)	2	0	0	1
+7375	7375	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7376	7376	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7377	7377	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7378	7378	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7379	7379	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7380	7380	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7381	7381	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7382	7382	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|error|focus|blur)|s(cript|tyle=))	2	0	0	1
+7383	7383	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7384	7384	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7385	7385	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|error|focus|blur)|s(cript|tyle=))	2	0	0	1
+7386	7386	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7387	7387	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7388	7388	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7389	7389	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7390	7390	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7391	7391	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7392	7392	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7393	7393	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7394	7394	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7395	7395	^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=))	2	0	0	1
+7396	7396	^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=))	2	0	0	1
+7397	7397	^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=))	2	0	0	1
+7398	7398	^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=))	2	0	0	1
+7399	7399	^\/?$	2	0	0	1
+7400	7400	^\/?$	2	0	0	1
+7401	7401	^\/?$	2	0	0	1
+7402	7402	^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=))	2	0	0	1
+7403	7403	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7404	7404	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7405	7405	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7406	7406	^.+\)\)\}catch\(.+\)\{	2	0	0	1
+7407	7407	a\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7408	7408	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7409	7409	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7410	7410	^(-lncthumb|-sq_button)?\.php	2	0	0	1
+7411	7411	[&?]f=	2	0	0	1
+7412	7412	^\s*\s*?[\x22\x27]?[^&]*?(%(25)?2e(%((25)?2e(%(25)?5c|\/|\\)|2e(25)?%(25)?2f)|\.(%(25)?(2f|5c)|\/|\\))|\.(%(25)?2e(%(25)?(2f|5c)|\/|\\)|\.(%(25)?(2f|5c)|\/|\\)))	2	0	0	1
+7413	7413	^((ht|f)tps?|data|php)	2	0	0	1
+7414	7414	[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+7415	7415	[&?]highlight=[^&]*?\x2525[a-f0-9]{2}	2	0	0	1
+7416	7416	btask\x3d.+?(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change|error))	2	0	0	1
+7417	7417	&list\[select\]=[^\r\n&]*((S(HOW (C(UR(DAT|TIM)E|HARACTER SET)|(VARI|T)ABLES)|ELECT (FROM|USER))|U(NION SELEC|PDATE SE)T|DELETE FROM|INSERT INTO)|S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/)?	2	0	0	1
+7418	7418	^\{\d(\|\d){1,}\}\.\{\d(\|\d){1,}\}\{\d(\|\d){1,}\}	2	0	0	1
+7419	7419	^[^\r\n]*filename\s*=\s*[^\x3b\x3a\r\n]*[\x25\x24]\s*\{[^\r\n]{20,}\}	2	0	0	1
+7420	7420	^Host\x3a[^\r\n]+?[\x28\x29\x27\x22\x7b\x7d]	2	0	0	1
+7421	7421	^Host\x3a[^\r\n]+?[\x28\x29\x27\x22\x7b\x7d]	2	0	0	1
+7422	7422	sort\x3D.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7423	7423	orderby\x3D.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7424	7424	UNION\s+SELECT	2	0	0	1
+7425	7425	((S(HOW (C(UR(DAT|TIM)E|HARACTER SET)|(VARI|T)ABLES)|ELECT (FROM|USER))|U(NION SELEC|PDATE SE)T|DELETE FROM|INSERT INTO)|S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO)	2	0	0	1
+7426	7426	((S(HOW (C(UR(DAT|TIM)E|HARACTER SET)|(VARI|T)ABLES)|ELECT (FROM|USER))|U(NION SELEC|PDATE SE)T|DELETE FROM|INSERT INTO)|S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO)/Pmi	2	0	0	1
+7427	7427	((S(HOW (C(UR(DAT|TIM)E|HARACTER SET)|(VARI|T)ABLES)|ELECT (FROM|USER))|U(NION SELEC|PDATE SE)T|DELETE FROM|INSERT INTO)|S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO)	2	0	0	1
+7428	7428	(%23|#)(access_callback|pre_render|post_render|lazy_builder)	2	0	0	1
+7429	7429	(%(25)?23|#)	2	0	0	1
+7430	7430	(%(25)?23|#)\s*(access_callback|pre_render|post_render|lazy_builder)	2	0	0	1
+7431	7431	&orderby=([a-zA-Z0-9_])*[\x2c\x22\x27\x28]	2	0	0	1
+7432	7432	^([a-zA-Z0-9_])*[\x2c\x22\x27\x28]	2	0	0	1
+7433	7433	^([a-zA-Z0-9_])*[\x2c\x22\x27\x28]	2	0	0	1
+7434	7434	^([a-zA-Z0-9_%+])*([\x2c\x22\x27\x28]|\x252[c278])	2	0	0	1
+7435	7435	^([a-zA-Z0-9_%+])*([\x2c\x22\x27\x28]|\x252[c278])	2	0	0	1
+7436	7436	^([a-zA-Z0-9_])*[\x2c\x22\x27\x28]	2	0	0	1
+7437	7437	^[a-z0-9A-Z]+[^&]+[\x27\x22]	2	0	0	1
+7438	7438	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7439	7439	^[^&]*[\x22\x27\x28]	2	0	0	1
+7440	7440	^\[(%(25)?23|#)\s*(access_callback|pre_render|post_render|lazy_builder)	2	0	0	1
+7441	7441	(Y21kIC9jIHBvd2Vyc2hlbGwuZXhl|NtZCAvYyBwb3dlcnNoZWxsLmV4Z|jbWQgL2MgcG93ZXJzaGVsbC5leG)	2	0	0	1
+7442	7442	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7443	7443	(f0VM|9FT|\/RU)	2	0	0	1
+7444	7444	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7445	7445	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7446	7446	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7447	7447	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7448	7448	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7449	7449	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7450	7450	^[a-z0-9A-Z]+\x252[270]	2	0	0	1
+7451	7451	^(\.\.\/){2,}	2	0	0	1
+7452	7452	action\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7453	7453	url\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7454	7454	fm_includes_special=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7455	7455	UNION\s+SELECT	2	0	0	1
+7456	7456	UNION\s+SELECT	2	0	0	1
+7457	7457	INSERT.+INTO	2	0	0	1
+7458	7458	DELETE.+FROM	2	0	0	1
+7459	7459	ASCII\(.+SELECT	2	0	0	1
+7460	7460	UPDATE.+SET	2	0	0	1
+7461	7461	SELECT.+FROM	2	0	0	1
+7462	7462	UNION\s+SELECT	2	0	0	1
+7463	7463	INSERT.+INTO	2	0	0	1
+7464	7464	DELETE.+FROM	2	0	0	1
+7465	7465	ASCII\(.+SELECT	2	0	0	1
+7466	7466	UPDATE.+SET	2	0	0	1
+7467	7467	SELECT.+FROM	2	0	0	1
+7468	7468	UNION\s+SELECT	2	0	0	1
+7469	7469	INSERT.+INTO	2	0	0	1
+7470	7470	DELETE.+FROM	2	0	0	1
+7471	7471	ASCII\(.+SELECT	2	0	0	1
+7472	7472	UPDATE.+SET	2	0	0	1
+7473	7473	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7474	7474	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7475	7475	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7476	7476	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7477	7477	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7478	7478	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7479	7479	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7480	7480	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7481	7481	SELECT.+FROM	2	0	0	1
+7482	7482	UNION\s+SELECT	2	0	0	1
+7483	7483	INSERT.+INTO	2	0	0	1
+7484	7484	DELETE.+FROM	2	0	0	1
+7485	7485	ASCII\(.+SELECT	2	0	0	1
+7486	7486	UPDATE.+SET	2	0	0	1
+7487	7487	UNION\s+SELECT	2	0	0	1
+7488	7488	UNION\s+SELECT	2	0	0	1
+7489	7489	INSERT.+INTO	2	0	0	1
+7490	7490	DELETE.+FROM	2	0	0	1
+7491	7491	ASCII\(.+SELECT	2	0	0	1
+7492	7492	UPDATE.+SET	2	0	0	1
+7493	7493	SELECT.+FROM	2	0	0	1
+7494	7494	UNION\s+SELECT	2	0	0	1
+7495	7495	INSERT.+INTO	2	0	0	1
+7496	7496	DELETE.+FROM	2	0	0	1
+7497	7497	ASCII\(.+SELECT	2	0	0	1
+7498	7498	UPDATE.+SET	2	0	0	1
+7499	7499	DELETE.+FROM	2	0	0	1
+7500	7500	UNION\s+SELECT	2	0	0	1
+7501	7501	DELETE.+FROM	2	0	0	1
+7502	7502	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+7503	7503	UNION\s+SELECT	2	0	0	1
+7504	7504	INSERT.+INTO	2	0	0	1
+7505	7505	SELECT.+FROM	2	0	0	1
+7506	7506	UNION\s+SELECT	2	0	0	1
+7507	7507	DELETE.+FROM	2	0	0	1
+7508	7508	ASCII\(.+SELECT	2	0	0	1
+7509	7509	UPDATE.+SET	2	0	0	1
+7510	7510	SELECT.+FROM	2	0	0	1
+7511	7511	UNION\s+SELECT	2	0	0	1
+7512	7512	SELECT.+FROM	2	0	0	1
+7513	7513	UNION\s+SELECT	2	0	0	1
+7514	7514	INSERT.+INTO	2	0	0	1
+7515	7515	DELETE.+FROM	2	0	0	1
+7516	7516	ASCII\(.+SELECT	2	0	0	1
+7517	7517	UPDATE.+SET	2	0	0	1
+7518	7518	SELECT.+FROM	2	0	0	1
+7519	7519	UNION\s+SELECT	2	0	0	1
+7520	7520	INSERT.+INTO	2	0	0	1
+7521	7521	DELETE.+FROM	2	0	0	1
+7522	7522	ASCII\(.+SELECT	2	0	0	1
+7523	7523	UPDATE.+SET	2	0	0	1
+7524	7524	SELECT.+FROM	2	0	0	1
+7525	7525	UNION\s+SELECT	2	0	0	1
+7526	7526	INSERT.+INTO	2	0	0	1
+7527	7527	DELETE.+FROM	2	0	0	1
+7528	7528	ASCII\(.+SELECT	2	0	0	1
+7529	7529	UPDATE.+SET	2	0	0	1
+7530	7530	SELECT.+FROM	2	0	0	1
+7531	7531	UNION\s+SELECT	2	0	0	1
+7532	7532	INSERT.+INTO	2	0	0	1
+7533	7533	DELETE.+FROM	2	0	0	1
+7534	7534	ASCII\(.+SELECT	2	0	0	1
+7535	7535	UPDATE.+SET	2	0	0	1
+7536	7536	SELECT.+FROM	2	0	0	1
+7537	7537	UNION\s+SELECT	2	0	0	1
+7538	7538	INSERT.+INTO	2	0	0	1
+7539	7539	DELETE.+FROM	2	0	0	1
+7540	7540	ASCII\(.+SELECT	2	0	0	1
+7541	7541	UPDATE.+SET	2	0	0	1
+7542	7542	SELECT.+FROM	2	0	0	1
+7543	7543	UNION\s+SELECT	2	0	0	1
+7544	7544	INSERT.+INTO	2	0	0	1
+7545	7545	DELETE.+FROM	2	0	0	1
+7546	7546	ASCII\(.+SELECT	2	0	0	1
+7547	7547	UPDATE.+SET	2	0	0	1
+7548	7548	customer_login.*\">	2	0	0	1
+7549	7549	UNION\s+SELECT	2	0	0	1
+7550	7550	SELECT.+FROM	2	0	0	1
+7551	7551	UNION\s+SELECT	2	0	0	1
+7552	7552	INSERT.+INTO	2	0	0	1
+7553	7553	DELETE.+FROM	2	0	0	1
+7554	7554	ASCII\(.+SELECT	2	0	0	1
+7555	7555	UPDATE.+SET	2	0	0	1
+7556	7556	(\.\.\/){1,}	2	0	0	1
+7557	7557	INSERT.+INTO	2	0	0	1
+7558	7558	SELECT.+FROM	2	0	0	1
+7559	7559	site_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7560	7560	mosConfig_live_site=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7561	7561	SELECT.+FROM	2	0	0	1
+7562	7562	UNION.+SELECT	2	0	0	1
+7563	7563	UPDATE.+SET	2	0	0	1
+7564	7564	INSERT.+INTO	2	0	0	1
+7565	7565	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7566	7566	intPassedLocationID\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7567	7567	task=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7568	7568	bn\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7569	7569	cat=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7570	7570	gid\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7571	7571	SELECT.+FROM	2	0	0	1
+7572	7572	DELETE.+FROM	2	0	0	1
+7573	7573	INSERT.+INTO	2	0	0	1
+7574	7574	UPDATE.+SET	2	0	0	1
+7575	7575	theme_file=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7576	7576	lang_file=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7577	7577	theme_file=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7578	7578	UNION.+SELECT	2	0	0	1
+7579	7579	UNION\s+SELECT	2	0	0	1
+7580	7580	GLOBALS\[MM_ROOT_DIRECTORY\]=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7581	7581	skin_file=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7582	7582	i\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7583	7583	fm_id\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7584	7584	mosConfig_absolute_path=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7585	7585	doc_root=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7586	7586	HomeCurrent_Date\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7587	7587	newlangsel=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7588	7588	UNION.+SELECT	2	0	0	1
+7589	7589	INSERT.+INTO	2	0	0	1
+7590	7590	UPDATE.+SET	2	0	0	1
+7591	7591	idart\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7592	7592	INSERT.+INTO	2	0	0	1
+7593	7593	Login=[^\r\n]{300}	2	0	0	1
+7594	7594	UNION\s+SELECT	2	0	0	1
+7595	7595	(\?|&)pid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+7596	7596	(\?|&)Itemid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+7597	7597	SELECT.+FROM	2	0	0	1
+7598	7598	UNION\s+SELECT	2	0	0	1
+7599	7599	INSERT.+INTO	2	0	0	1
+7600	7600	DELETE.+FROM	2	0	0	1
+7601	7601	ASCII\(.+SELECT	2	0	0	1
+7602	7602	UPDATE.+SET	2	0	0	1
+7603	7603	UNION\s+SELECT	2	0	0	1
+7604	7604	(script|img|src|onmouse|onkey|onload)	2	0	0	1
+7605	7605	UNION\s+SELECT	2	0	0	1
+7606	7606	UNION\s+SELECT	2	0	0	1
+7607	7607	UNION\s+SELECT	2	0	0	1
+7608	7608	INSERT.+INTO	2	0	0	1
+7609	7609	DELETE.+FROM	2	0	0	1
+7610	7610	ASCII\(.+SELECT	2	0	0	1
+7611	7611	UPDATE.+SET	2	0	0	1
+7612	7612	SELECT.+FROM	2	0	0	1
+7613	7613	UNION\s+SELECT	2	0	0	1
+7614	7614	INSERT.+INTO	2	0	0	1
+7615	7615	DELETE.+FROM	2	0	0	1
+7616	7616	ASCII\(.+SELECT	2	0	0	1
+7617	7617	UPDATE.+SET	2	0	0	1
+7618	7618	UNION\s+SELECT	2	0	0	1
+7619	7619	chemin_lib\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7620	7620	SELECT.+FROM	2	0	0	1
+7621	7621	DELETE.+FROM	2	0	0	1
+7622	7622	UNION.+SELECT	2	0	0	1
+7623	7623	INSERT.+INTO	2	0	0	1
+7624	7624	UPDATE.+SET	2	0	0	1
+7625	7625	Tipo=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7626	7626	UNION\s+SELECT	2	0	0	1
+7627	7627	INSERT.+INTO	2	0	0	1
+7628	7628	DELETE.+FROM	2	0	0	1
+7629	7629	ASCII\(.+SELECT	2	0	0	1
+7630	7630	UPDATE.+SET	2	0	0	1
+7631	7631	SELECT.+FROM	2	0	0	1
+7632	7632	UNION\s+SELECT	2	0	0	1
+7633	7633	INSERT.+INTO	2	0	0	1
+7634	7634	DELETE.+FROM	2	0	0	1
+7635	7635	ASCII\(.+SELECT	2	0	0	1
+7636	7636	UPDATE.+SET	2	0	0	1
+7637	7637	UNION\s+SELECT	2	0	0	1
+7638	7638	INSERT.+INTO	2	0	0	1
+7639	7639	DELETE.+FROM	2	0	0	1
+7640	7640	ASCII\(.+SELECT	2	0	0	1
+7641	7641	UPDATE.+SET	2	0	0	1
+7642	7642	phpAds_geoPlugin=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7643	7643	SELECT.+FROM	2	0	0	1
+7644	7644	DELETE.+FROM	2	0	0	1
+7645	7645	UNION.+SELECT	2	0	0	1
+7646	7646	INSERT.+INTO	2	0	0	1
+7647	7647	UPDATE.+SET	2	0	0	1
+7648	7648	context\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7649	7649	SELECT.+FROM	2	0	0	1
+7650	7650	UNION\s+SELECT	2	0	0	1
+7651	7651	INSERT.+INTO	2	0	0	1
+7652	7652	DELETE.+FROM	2	0	0	1
+7653	7653	ASCII\(.+SELECT	2	0	0	1
+7654	7654	UPDATE.+SET	2	0	0	1
+7655	7655	SELECT.+FROM	2	0	0	1
+7656	7656	UNION\s+SELECT	2	0	0	1
+7657	7657	INSERT.+INTO	2	0	0	1
+7658	7658	DELETE.+FROM	2	0	0	1
+7659	7659	ASCII\(.+SELECT	2	0	0	1
+7660	7660	UPDATE.+SET	2	0	0	1
+7661	7661	UNION.+SELECT	2	0	0	1
+7662	7662	UNION.+SELECT	2	0	0	1
+7663	7663	UNION.+SELECT	2	0	0	1
+7664	7664	SELECT.+FROM	2	0	0	1
+7665	7665	UNION\s+SELECT	2	0	0	1
+7666	7666	INSERT.+INTO	2	0	0	1
+7667	7667	DELETE.+FROM	2	0	0	1
+7668	7668	ASCII\(.+SELECT	2	0	0	1
+7669	7669	UPDATE.+SET	2	0	0	1
+7670	7670	UNION.+SELECT	2	0	0	1
+7671	7671	UNION.+SELECT	2	0	0	1
+7672	7672	.+UPDATE.+SET	2	0	0	1
+7673	7673	.+UNION\s+SELECT	2	0	0	1
+7674	7674	UNION\s+SELECT	2	0	0	1
+7675	7675	INSERT.+INTO	2	0	0	1
+7676	7676	DELETE.+FROM	2	0	0	1
+7677	7677	ASCII\(.+SELECT	2	0	0	1
+7678	7678	UPDATE.+SET	2	0	0	1
+7679	7679	.+SELECT.+FROM	2	0	0	1
+7680	7680	.+UNION\s+SELECT	2	0	0	1
+7681	7681	.+INSERT.+INTO	2	0	0	1
+7682	7682	.+DELETE.+FROM	2	0	0	1
+7683	7683	.+ASCII\(.+SELECT	2	0	0	1
+7684	7684	.+UPDATE.+SET	2	0	0	1
+7685	7685	UNION\s+SELECT	2	0	0	1
+7686	7686	UNION\s+SELECT	2	0	0	1
+7687	7687	UNION\s+SELECT	2	0	0	1
+7688	7688	(\.\.\/){1,}	2	0	0	1
+7689	7689	PHPOF_INCLUDE_PATH=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7690	7690	UNION\s+SELECT	2	0	0	1
+7691	7691	UNION\s+SELECT	2	0	0	1
+7692	7692	UNION\s+SELECT	2	0	0	1
+7693	7693	UNION\s+SELECT	2	0	0	1
+7694	7694	UNION\s+SELECT	2	0	0	1
+7695	7695	UNION\s+SELECT	2	0	0	1
+7696	7696	UNION\s+SELECT	2	0	0	1
+7697	7697	UNION\s+SELECT	2	0	0	1
+7698	7698	UNION\s+SELECT	2	0	0	1
+7699	7699	UNION\s+SELECT	2	0	0	1
+7700	7700	INSERT.+INTO	2	0	0	1
+7701	7701	DELETE.+FROM	2	0	0	1
+7702	7702	ASCII\(.+SELECT	2	0	0	1
+7703	7703	UPDATE.+SET	2	0	0	1
+7704	7704	UNION\s+SELECT	2	0	0	1
+7705	7705	UNION\s+SELECT	2	0	0	1
+7706	7706	UNION\s+SELECT	2	0	0	1
+7707	7707	(\?|&)category_id=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+7708	7708	SELECT.+FROM	2	0	0	1
+7709	7709	DELETE.+FROM	2	0	0	1
+7710	7710	UNION.+SELECT	2	0	0	1
+7711	7711	INSERT.+INTO	2	0	0	1
+7712	7712	UPDATE.+SET	2	0	0	1
+7713	7713	SELECT.+FROM	2	0	0	1
+7714	7714	DELETE.+FROM	2	0	0	1
+7715	7715	UNION.+SELECT	2	0	0	1
+7716	7716	INSERT.+INTO	2	0	0	1
+7717	7717	UPDATE.+SET	2	0	0	1
+7718	7718	UNION.+SELECT	2	0	0	1
+7719	7719	UNION.+SELECT	2	0	0	1
+7720	7720	SELECT.+FROM	2	0	0	1
+7721	7721	UNION\s+SELECT	2	0	0	1
+7722	7722	INSERT.+INTO	2	0	0	1
+7723	7723	DELETE.+FROM	2	0	0	1
+7724	7724	ASCII\(.+SELECT	2	0	0	1
+7725	7725	UPDATE.+SET	2	0	0	1
+7726	7726	SELECT.+FROM	2	0	0	1
+7727	7727	UNION\s+SELECT	2	0	0	1
+7728	7728	INSERT.+INTO	2	0	0	1
+7729	7729	DELETE.+FROM	2	0	0	1
+7730	7730	ASCII\(.+SELECT	2	0	0	1
+7731	7731	UPDATE.+SET	2	0	0	1
+7732	7732	SELECT.+FROM	2	0	0	1
+7733	7733	UNION\s+SELECT	2	0	0	1
+7734	7734	INSERT.+INTO	2	0	0	1
+7735	7735	DELETE.+FROM	2	0	0	1
+7736	7736	ASCII\(.+SELECT	2	0	0	1
+7737	7737	UPDATE.+SET	2	0	0	1
+7738	7738	SELECT.+FROM	2	0	0	1
+7739	7739	UNION\s+SELECT	2	0	0	1
+7740	7740	INSERT.+INTO	2	0	0	1
+7741	7741	DELETE.+FROM	2	0	0	1
+7742	7742	ASCII\(.+SELECT	2	0	0	1
+7743	7743	UPDATE.+SET	2	0	0	1
+7744	7744	SELECT.+FROM	2	0	0	1
+7745	7745	UNION\s+SELECT	2	0	0	1
+7746	7746	INSERT.+INTO	2	0	0	1
+7747	7747	DELETE.+FROM	2	0	0	1
+7748	7748	ASCII\(.+SELECT	2	0	0	1
+7749	7749	UPDATE.+SET	2	0	0	1
+7750	7750	.+SELECT.+FROM	2	0	0	1
+7751	7751	.+UNION\s+SELECT	2	0	0	1
+7752	7752	.+INSERT.+INTO	2	0	0	1
+7753	7753	.+DELETE.+FROM	2	0	0	1
+7754	7754	.+ASCII\(.+SELECT	2	0	0	1
+7755	7755	.+UPDATE.+SET	2	0	0	1
+7756	7756	UNION.+SELECT	2	0	0	1
+7757	7757	SELECT.+FROM	2	0	0	1
+7758	7758	UNION\s+SELECT	2	0	0	1
+7759	7759	INSERT.+INTO	2	0	0	1
+7760	7760	DELETE.+FROM	2	0	0	1
+7761	7761	ASCII\(.+SELECT	2	0	0	1
+7762	7762	UPDATE.+SET	2	0	0	1
+7763	7763	SELECT.+FROM	2	0	0	1
+7764	7764	UNION\s+SELECT	2	0	0	1
+7765	7765	INSERT.+INTO	2	0	0	1
+7766	7766	DELETE.+FROM	2	0	0	1
+7767	7767	ASCII\(.+SELECT	2	0	0	1
+7768	7768	UPDATE.+SET	2	0	0	1
+7769	7769	SELECT.+FROM	2	0	0	1
+7770	7770	UNION\s+SELECT	2	0	0	1
+7771	7771	INSERT.+INTO	2	0	0	1
+7772	7772	DELETE.+FROM	2	0	0	1
+7773	7773	ASCII\(.+SELECT	2	0	0	1
+7774	7774	UPDATE.+SET	2	0	0	1
+7775	7775	SELECT.+FROM	2	0	0	1
+7776	7776	UNION\s+SELECT	2	0	0	1
+7777	7777	INSERT.+INTO	2	0	0	1
+7778	7778	DELETE.+FROM	2	0	0	1
+7779	7779	ASCII\(.+SELECT	2	0	0	1
+7780	7780	UPDATE.+SET	2	0	0	1
+7781	7781	UNION.+SELECT	2	0	0	1
+7782	7782	UNION.+SELECT	2	0	0	1
+7783	7783	UNION.+SELECT	2	0	0	1
+7784	7784	UNION.+SELECT	2	0	0	1
+7785	7785	pcConfig\[smartyPath\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7786	7786	SELECT.+FROM	2	0	0	1
+7787	7787	UNION\s+SELECT	2	0	0	1
+7788	7788	INSERT.+INTO	2	0	0	1
+7789	7789	DELETE.+FROM	2	0	0	1
+7790	7790	ASCII\(.+SELECT	2	0	0	1
+7791	7791	UPDATE.+SET	2	0	0	1
+7792	7792	SELECT.+FROM	2	0	0	1
+7793	7793	UNION\s+SELECT	2	0	0	1
+7794	7794	INSERT.+INTO	2	0	0	1
+7795	7795	DELETE.+FROM	2	0	0	1
+7796	7796	ASCII\(.+SELECT	2	0	0	1
+7797	7797	UPDATE.+SET	2	0	0	1
+7798	7798	SELECT.+FROM	2	0	0	1
+7799	7799	UNION\s+SELECT	2	0	0	1
+7800	7800	INSERT.+INTO	2	0	0	1
+7801	7801	DELETE.+FROM	2	0	0	1
+7802	7802	ASCII\(.+SELECT	2	0	0	1
+7803	7803	UPDATE.+SET	2	0	0	1
+7804	7804	SELECT.+FROM	2	0	0	1
+7805	7805	UNION\s+SELECT	2	0	0	1
+7806	7806	INSERT.+INTO	2	0	0	1
+7807	7807	DELETE.+FROM	2	0	0	1
+7808	7808	ASCII\(.+SELECT	2	0	0	1
+7809	7809	UPDATE.+SET	2	0	0	1
+7810	7810	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7811	7811	UNION.+SELECT	2	0	0	1
+7812	7812	UNION.+SELECT	2	0	0	1
+7813	7813	(\?|&)id=[^\x26\x3B]*[^\d\x2D]	2	0	0	1
+7814	7814	UNION.+SELECT	2	0	0	1
+7815	7815	DELETE.+FROM	2	0	0	1
+7816	7816	ASCII\(.+SELECT	2	0	0	1
+7817	7817	UPDATE.+SET	2	0	0	1
+7818	7818	sPath\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7819	7819	UNION.+SELECT	2	0	0	1
+7820	7820	SELECT.+FROM	2	0	0	1
+7821	7821	DELETE.+FROM	2	0	0	1
+7822	7822	UNION.+SELECT	2	0	0	1
+7823	7823	INSERT.+INTO	2	0	0	1
+7824	7824	UPDATE.+SET	2	0	0	1
+7825	7825	UNION.+SELECT	2	0	0	1
+7826	7826	config\[library_path\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7827	7827	UNION.+SELECT	2	0	0	1
+7828	7828	SELECT.+FROM	2	0	0	1
+7829	7829	UNION\s+SELECT	2	0	0	1
+7830	7830	INSERT.+INTO	2	0	0	1
+7831	7831	DELETE.+FROM	2	0	0	1
+7832	7832	ASCII\(.+SELECT	2	0	0	1
+7833	7833	UPDATE.+SET	2	0	0	1
+7834	7834	SELECT.+FROM	2	0	0	1
+7835	7835	UNION\s+SELECT	2	0	0	1
+7836	7836	INSERT.+INTO	2	0	0	1
+7837	7837	DELETE.+FROM	2	0	0	1
+7838	7838	ASCII\(.+SELECT	2	0	0	1
+7839	7839	UPDATE.+SET	2	0	0	1
+7840	7840	SELECT.+FROM	2	0	0	1
+7841	7841	UNION\s+SELECT	2	0	0	1
+7842	7842	INSERT.+INTO	2	0	0	1
+7843	7843	DELETE.+FROM	2	0	0	1
+7844	7844	ASCII\(.+SELECT	2	0	0	1
+7845	7845	UPDATE.+SET	2	0	0	1
+7846	7846	SELECT.+FROM	2	0	0	1
+7847	7847	UNION\s+SELECT	2	0	0	1
+7848	7848	INSERT.+INTO	2	0	0	1
+7849	7849	DELETE.+FROM	2	0	0	1
+7850	7850	ASCII\(.+SELECT	2	0	0	1
+7851	7851	UPDATE.+SET	2	0	0	1
+7852	7852	SELECT.+FROM	2	0	0	1
+7853	7853	UNION\s+SELECT	2	0	0	1
+7854	7854	INSERT.+INTO	2	0	0	1
+7855	7855	DELETE.+FROM	2	0	0	1
+7856	7856	ASCII\(.+SELECT	2	0	0	1
+7857	7857	UPDATE.+SET	2	0	0	1
+7858	7858	UNION.+SELECT	2	0	0	1
+7859	7859	UNION.+SELECT	2	0	0	1
+7860	7860	UNION.+SELECT	2	0	0	1
+7861	7861	.+SELECT.+FROM	2	0	0	1
+7862	7862	.+UNION\s+SELECT	2	0	0	1
+7863	7863	.+INSERT.+INTO	2	0	0	1
+7864	7864	.+DELETE.+FROM	2	0	0	1
+7865	7865	.+ASCII\(.+SELECT	2	0	0	1
+7866	7866	.+UPDATE.+SET	2	0	0	1
+7867	7867	.+SELECT.+FROM	2	0	0	1
+7868	7868	.+UNION\s+SELECT	2	0	0	1
+7869	7869	.+INSERT.+INTO	2	0	0	1
+7870	7870	.+DELETE.+FROM	2	0	0	1
+7871	7871	.+ASCII\(.+SELECT	2	0	0	1
+7872	7872	.+UPDATE.+SET	2	0	0	1
+7873	7873	REX\[INCLUDE_PATH\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7874	7874	REX\[INCLUDE_PATH\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7875	7875	UNION.+SELECT	2	0	0	1
+7876	7876	UNION.+SELECT	2	0	0	1
+7877	7877	SELECT.+FROM	2	0	0	1
+7878	7878	UNION\s+SELECT	2	0	0	1
+7879	7879	INSERT.+INTO	2	0	0	1
+7880	7880	DELETE.+FROM	2	0	0	1
+7881	7881	ASCII\(.+SELECT	2	0	0	1
+7882	7882	UPDATE.+SET	2	0	0	1
+7883	7883	SELECT.+FROM	2	0	0	1
+7884	7884	UNION\s+SELECT	2	0	0	1
+7885	7885	INSERT.+INTO	2	0	0	1
+7886	7886	DELETE.+FROM	2	0	0	1
+7887	7887	ASCII\(.+SELECT	2	0	0	1
+7888	7888	UPDATE.+SET	2	0	0	1
+7889	7889	SELECT.+FROM	2	0	0	1
+7890	7890	UNION\s+SELECT	2	0	0	1
+7891	7891	INSERT.+INTO	2	0	0	1
+7892	7892	DELETE.+FROM	2	0	0	1
+7893	7893	ASCII\(.+SELECT	2	0	0	1
+7894	7894	UPDATE.+SET	2	0	0	1
+7895	7895	SELECT.+FROM	2	0	0	1
+7896	7896	UNION\s+SELECT	2	0	0	1
+7897	7897	INSERT.+INTO	2	0	0	1
+7898	7898	DELETE.+FROM	2	0	0	1
+7899	7899	ASCII\(.+SELECT	2	0	0	1
+7900	7900	UPDATE.+SET	2	0	0	1
+7901	7901	SELECT.+FROM	2	0	0	1
+7902	7902	UNION\s+SELECT	2	0	0	1
+7903	7903	INSERT.+INTO	2	0	0	1
+7904	7904	DELETE.+FROM	2	0	0	1
+7905	7905	ASCII\(.+SELECT	2	0	0	1
+7906	7906	UPDATE.+SET	2	0	0	1
+7907	7907	SELECT.+FROM	2	0	0	1
+7908	7908	UNION\s+SELECT	2	0	0	1
+7909	7909	INSERT.+INTO	2	0	0	1
+7910	7910	DELETE.+FROM	2	0	0	1
+7911	7911	ASCII\(.+SELECT	2	0	0	1
+7912	7912	UPDATE.+SET	2	0	0	1
+7913	7913	SELECT.+FROM	2	0	0	1
+7914	7914	UNION\s+SELECT	2	0	0	1
+7915	7915	INSERT.+INTO	2	0	0	1
+7916	7916	DELETE.+FROM	2	0	0	1
+7917	7917	ASCII\(.+SELECT	2	0	0	1
+7918	7918	UPDATE.+SET	2	0	0	1
+7919	7919	SELECT.+FROM	2	0	0	1
+7920	7920	UNION\s+SELECT	2	0	0	1
+7921	7921	INSERT.+INTO	2	0	0	1
+7922	7922	DELETE.+FROM	2	0	0	1
+7923	7923	ASCII\(.+SELECT	2	0	0	1
+7924	7924	UPDATE.+SET	2	0	0	1
+7925	7925	SELECT.+FROM	2	0	0	1
+7926	7926	UNION\s+SELECT	2	0	0	1
+7927	7927	INSERT.+INTO	2	0	0	1
+7928	7928	DELETE.+FROM	2	0	0	1
+7929	7929	ASCII\(.+SELECT	2	0	0	1
+7930	7930	UPDATE.+SET	2	0	0	1
+7931	7931	SELECT.+FROM	2	0	0	1
+7932	7932	UNION\s+SELECT	2	0	0	1
+7933	7933	INSERT.+INTO	2	0	0	1
+7934	7934	DELETE.+FROM	2	0	0	1
+7935	7935	ASCII\(.+SELECT	2	0	0	1
+7936	7936	UPDATE.+SET	2	0	0	1
+7937	7937	SELECT.+FROM	2	0	0	1
+7938	7938	UNION\s+SELECT	2	0	0	1
+7939	7939	INSERT.+INTO	2	0	0	1
+7940	7940	DELETE.+FROM	2	0	0	1
+7941	7941	ASCII\(.+SELECT	2	0	0	1
+7942	7942	UPDATE.+SET	2	0	0	1
+7943	7943	SELECT.+FROM	2	0	0	1
+7944	7944	UNION\s+SELECT	2	0	0	1
+7945	7945	INSERT.+INTO	2	0	0	1
+7946	7946	DELETE.+FROM	2	0	0	1
+7947	7947	ASCII\(.+SELECT	2	0	0	1
+7948	7948	UPDATE.+SET	2	0	0	1
+7949	7949	SELECT.+FROM	2	0	0	1
+7950	7950	UNION\s+SELECT	2	0	0	1
+7951	7951	INSERT.+INTO	2	0	0	1
+7952	7952	DELETE.+FROM	2	0	0	1
+7953	7953	ASCII\(.+SELECT	2	0	0	1
+7954	7954	UPDATE.+SET	2	0	0	1
+7955	7955	SELECT.+FROM	2	0	0	1
+7956	7956	UNION\s+SELECT	2	0	0	1
+7957	7957	INSERT.+INTO	2	0	0	1
+7958	7958	DELETE.+FROM	2	0	0	1
+7959	7959	ASCII\(.+SELECT	2	0	0	1
+7960	7960	UPDATE.+SET	2	0	0	1
+7961	7961	SELECT.+FROM	2	0	0	1
+7962	7962	DELETE.+FROM	2	0	0	1
+7963	7963	UNION.+SELECT	2	0	0	1
+7964	7964	(\?|&)admin=[^\x26\x3B]*([\x2F\x5C\x00]|\x2E\x2E)	2	0	0	1
+7965	7965	_SERWEB\[configdir\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7966	7966	_SERWEB\[functionsdir\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7967	7967	UNION.+SELECT	2	0	0	1
+7968	7968	UNION.+SELECT	2	0	0	1
+7969	7969	cs_base_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7970	7970	SELECT.+FROM	2	0	0	1
+7971	7971	UNION\s+SELECT	2	0	0	1
+7972	7972	INSERT.+INTO	2	0	0	1
+7973	7973	DELETE.+FROM	2	0	0	1
+7974	7974	ASCII\(.+SELECT	2	0	0	1
+7975	7975	UPDATE.+SET	2	0	0	1
+7976	7976	class_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7977	7977	class_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7978	7978	SELECT.+FROM	2	0	0	1
+7979	7979	UNION\s+SELECT	2	0	0	1
+7980	7980	INSERT.+INTO	2	0	0	1
+7981	7981	DELETE.+FROM	2	0	0	1
+7982	7982	ASCII\(.+SELECT	2	0	0	1
+7983	7983	UPDATE.+SET	2	0	0	1
+7984	7984	SELECT.+FROM	2	0	0	1
+7985	7985	UNION\s+SELECT	2	0	0	1
+7986	7986	INSERT.+INTO	2	0	0	1
+7987	7987	DELETE.+FROM	2	0	0	1
+7988	7988	ASCII\(.+SELECT	2	0	0	1
+7989	7989	UPDATE.+SET	2	0	0	1
+7990	7990	SELECT.+FROM	2	0	0	1
+7991	7991	UNION\s+SELECT	2	0	0	1
+7992	7992	INSERT.+INTO	2	0	0	1
+7993	7993	DELETE.+FROM	2	0	0	1
+7994	7994	ASCII\(.+SELECT	2	0	0	1
+7995	7995	UPDATE.+SET	2	0	0	1
+7996	7996	SELECT.+FROM	2	0	0	1
+7997	7997	UNION\s+SELECT	2	0	0	1
+7998	7998	INSERT.+INTO	2	0	0	1
+7999	7999	DELETE.+FROM	2	0	0	1
+8000	8000	ASCII\(.+SELECT	2	0	0	1
+8001	8001	UPDATE.+SET	2	0	0	1
+8002	8002	SELECT.+FROM	2	0	0	1
+8003	8003	UNION\s+SELECT	2	0	0	1
+8004	8004	INSERT.+INTO	2	0	0	1
+8005	8005	DELETE.+FROM	2	0	0	1
+8006	8006	ASCII\(.+SELECT	2	0	0	1
+8007	8007	UPDATE.+SET	2	0	0	1
+8008	8008	SELECT.+FROM	2	0	0	1
+8009	8009	DELETE.+FROM	2	0	0	1
+8010	8010	UNION.+SELECT	2	0	0	1
+8011	8011	INSERT.+INTO	2	0	0	1
+8012	8012	UPDATE.+SET	2	0	0	1
+8013	8013	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8014	8014	SELECT.+FROM	2	0	0	1
+8015	8015	UNION\s+SELECT	2	0	0	1
+8016	8016	INSERT.+INTO	2	0	0	1
+8017	8017	DELETE.+FROM	2	0	0	1
+8018	8018	ASCII\(.+SELECT	2	0	0	1
+8019	8019	UPDATE.+SET	2	0	0	1
+8020	8020	UNION.+SELECT	2	0	0	1
+8021	8021	UNION.+SELECT	2	0	0	1
+8022	8022	SELECT.+FROM	2	0	0	1
+8023	8023	UNION\s+SELECT	2	0	0	1
+8024	8024	INSERT.+INTO	2	0	0	1
+8025	8025	DELETE.+FROM	2	0	0	1
+8026	8026	ASCII\(.+SELECT	2	0	0	1
+8027	8027	UPDATE.+SET	2	0	0	1
+8028	8028	UNION.+SELECT	2	0	0	1
+8029	8029	UNION\s+SELECT	2	0	0	1
+8030	8030	SELECT.+FROM	2	0	0	1
+8031	8031	UNION\s+SELECT	2	0	0	1
+8032	8032	INSERT.+INTO	2	0	0	1
+8033	8033	DELETE.+FROM	2	0	0	1
+8034	8034	ASCII\(.+SELECT	2	0	0	1
+8035	8035	UPDATE.+SET	2	0	0	1
+8036	8036	UNION\s+SELECT	2	0	0	1
+8037	8037	SELECT.+FROM	2	0	0	1
+8038	8038	UNION\s+SELECT	2	0	0	1
+8039	8039	INSERT.+INTO	2	0	0	1
+8040	8040	DELETE.+FROM	2	0	0	1
+8041	8041	ASCII\(.+SELECT	2	0	0	1
+8042	8042	UPDATE.+SET	2	0	0	1
+8043	8043	SELECT.+FROM	2	0	0	1
+8044	8044	UNION\s+SELECT	2	0	0	1
+8045	8045	INSERT.+INTO	2	0	0	1
+8046	8046	DELETE.+FROM	2	0	0	1
+8047	8047	ASCII\(.+SELECT	2	0	0	1
+8048	8048	UPDATE.+SET	2	0	0	1
+8049	8049	SELECT.+FROM	2	0	0	1
+8050	8050	UNION\s+SELECT	2	0	0	1
+8051	8051	INSERT.+INTO	2	0	0	1
+8052	8052	DELETE.+FROM	2	0	0	1
+8053	8053	ASCII\(.+SELECT	2	0	0	1
+8054	8054	UPDATE.+SET	2	0	0	1
+8055	8055	site_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8056	8056	theme=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8057	8057	UNION.+SELECT	2	0	0	1
+8058	8058	SELECT.+FROM	2	0	0	1
+8059	8059	UNION\s+SELECT	2	0	0	1
+8060	8060	INSERT.+INTO	2	0	0	1
+8061	8061	DELETE.+FROM	2	0	0	1
+8062	8062	ASCII\(.+SELECT	2	0	0	1
+8063	8063	UPDATE.+SET	2	0	0	1
+8064	8064	SELECT.+FROM	2	0	0	1
+8065	8065	UNION\s+SELECT	2	0	0	1
+8066	8066	INSERT.+INTO	2	0	0	1
+8067	8067	DELETE.+FROM	2	0	0	1
+8068	8068	ASCII\(.+SELECT	2	0	0	1
+8069	8069	UPDATE.+SET	2	0	0	1
+8070	8070	SELECT.+FROM	2	0	0	1
+8071	8071	UNION\s+SELECT	2	0	0	1
+8072	8072	INSERT.+INTO	2	0	0	1
+8073	8073	DELETE.+FROM	2	0	0	1
+8074	8074	ASCII\(.+SELECT	2	0	0	1
+8075	8075	UPDATE.+SET	2	0	0	1
+8076	8076	SELECT.+FROM	2	0	0	1
+8077	8077	UNION\s+SELECT	2	0	0	1
+8078	8078	INSERT.+INTO	2	0	0	1
+8079	8079	DELETE.+FROM	2	0	0	1
+8080	8080	ASCII\(.+SELECT	2	0	0	1
+8081	8081	UPDATE.+SET	2	0	0	1
+8082	8082	SELECT.+FROM	2	0	0	1
+8083	8083	UNION\s+SELECT	2	0	0	1
+8084	8084	INSERT.+INTO	2	0	0	1
+8085	8085	DELETE.+FROM	2	0	0	1
+8086	8086	ASCII\(.+SELECT	2	0	0	1
+8087	8087	UPDATE.+SET	2	0	0	1
+8088	8088	UNION.+SELECT	2	0	0	1
+8089	8089	objects_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8090	8090	objects_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8091	8091	SELECT.+FROM	2	0	0	1
+8092	8092	UNION\s+SELECT	2	0	0	1
+8093	8093	INSERT.+INTO	2	0	0	1
+8094	8094	DELETE.+FROM	2	0	0	1
+8095	8095	ASCII\(.+SELECT	2	0	0	1
+8096	8096	UPDATE.+SET	2	0	0	1
+8097	8097	.+SELECT.+FROM	2	0	0	1
+8098	8098	.+UNION\s+SELECT	2	0	0	1
+8099	8099	.+INSERT.+INTO	2	0	0	1
+8100	8100	.+DELETE.+FROM	2	0	0	1
+8101	8101	.+ASCII\(.+SELECT	2	0	0	1
+8102	8102	.+UPDATE.+SET	2	0	0	1
+8103	8103	\/servlet\/dea\/register\?fwReg=[>\"]	2	0	0	1
+8104	8104	\/sgms\/caption\.jsp\?.*scrn_name=.*[>\"]	2	0	0	1
+8105	8105	neededFiles\[patForms\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8106	8106	SELECT.+FROM	2	0	0	1
+8107	8107	UNION\s+SELECT	2	0	0	1
+8108	8108	INSERT.+INTO	2	0	0	1
+8109	8109	DELETE.+FROM	2	0	0	1
+8110	8110	ASCII\(.+SELECT	2	0	0	1
+8111	8111	UPDATE.+SET	2	0	0	1
+8112	8112	SELECT.+FROM	2	0	0	1
+8113	8113	UNION\s+SELECT	2	0	0	1
+8114	8114	INSERT.+INTO	2	0	0	1
+8115	8115	DELETE.+FROM	2	0	0	1
+8116	8116	ASCII\(.+SELECT	2	0	0	1
+8117	8117	UPDATE.+SET	2	0	0	1
+8118	8118	UNION.+SELECT	2	0	0	1
+8119	8119	UNION.+SELECT	2	0	0	1
+8120	8120	SELECT.+FROM	2	0	0	1
+8121	8121	UNION\s+SELECT	2	0	0	1
+8122	8122	INSERT.+INTO	2	0	0	1
+8123	8123	DELETE.+FROM	2	0	0	1
+8124	8124	ASCII\(.+SELECT	2	0	0	1
+8125	8125	UPDATE.+SET	2	0	0	1
+8126	8126	.+SELECT.+FROM	2	0	0	1
+8127	8127	.+UNION\s+SELECT	2	0	0	1
+8128	8128	.+INSERT.+INTO	2	0	0	1
+8129	8129	.+DELETE.+FROM	2	0	0	1
+8130	8130	.+ASCII\(.+SELECT	2	0	0	1
+8131	8131	.+UPDATE.+SET	2	0	0	1
+8132	8132	.+SELECT.+FROM	2	0	0	1
+8133	8133	.+UNION\s+SELECT	2	0	0	1
+8134	8134	.+INSERT.+INTO	2	0	0	1
+8135	8135	.+DELETE.+FROM	2	0	0	1
+8136	8136	.+ASCII\(.+SELECT	2	0	0	1
+8137	8137	.+UPDATE.+SET	2	0	0	1
+8138	8138	.+SELECT.+FROM	2	0	0	1
+8139	8139	.+UNION\s+SELECT	2	0	0	1
+8140	8140	.+INSERT.+INTO	2	0	0	1
+8141	8141	.+DELETE.+FROM	2	0	0	1
+8142	8142	.+ASCII\(.+SELECT	2	0	0	1
+8143	8143	.+SELECT.+FROM	2	0	0	1
+8144	8144	.+UNION\s+SELECT	2	0	0	1
+8145	8145	.+INSERT.+INTO	2	0	0	1
+8146	8146	.+DELETE.+FROM	2	0	0	1
+8147	8147	.+ASCII\(.+SELECT	2	0	0	1
+8148	8148	.+UPDATE.+SET	2	0	0	1
+8149	8149	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8150	8150	UNION.+SELECT	2	0	0	1
+8151	8151	SELECT.+FROM	2	0	0	1
+8152	8152	UNION\s+SELECT	2	0	0	1
+8153	8153	INSERT.+INTO	2	0	0	1
+8154	8154	DELETE.+FROM	2	0	0	1
+8155	8155	ASCII\(.+SELECT	2	0	0	1
+8156	8156	UPDATE.+SET	2	0	0	1
+8157	8157	SELECT.+FROM	2	0	0	1
+8158	8158	UNION\s+SELECT	2	0	0	1
+8159	8159	INSERT.+INTO	2	0	0	1
+8160	8160	DELETE.+FROM	2	0	0	1
+8161	8161	ASCII\(.+SELECT	2	0	0	1
+8162	8162	UPDATE.+SET	2	0	0	1
+8163	8163	SELECT.+FROM	2	0	0	1
+8164	8164	UNION\s+SELECT	2	0	0	1
+8165	8165	INSERT.+INTO	2	0	0	1
+8166	8166	DELETE.+FROM	2	0	0	1
+8167	8167	ASCII\(.+SELECT	2	0	0	1
+8168	8168	UPDATE.+SET	2	0	0	1
+8169	8169	SELECT.+FROM	2	0	0	1
+8170	8170	INSERT.+INTO	2	0	0	1
+8171	8171	DELETE.+FROM	2	0	0	1
+8172	8172	ASCII\(.+SELECT	2	0	0	1
+8173	8173	UPDATE.+SET	2	0	0	1
+8174	8174	SELECT.+FROM	2	0	0	1
+8175	8175	UNION\s+SELECT	2	0	0	1
+8176	8176	INSERT.+INTO	2	0	0	1
+8177	8177	DELETE.+FROM	2	0	0	1
+8178	8178	ASCII\(.+SELECT	2	0	0	1
+8179	8179	UPDATE.+SET	2	0	0	1
+8180	8180	SELECT.+FROM	2	0	0	1
+8181	8181	UNION\s+SELECT	2	0	0	1
+8182	8182	INSERT.+INTO	2	0	0	1
+8183	8183	DELETE.+FROM	2	0	0	1
+8184	8184	ASCII\(.+SELECT	2	0	0	1
+8185	8185	UPDATE.+SET	2	0	0	1
+8186	8186	SELECT.+FROM	2	0	0	1
+8187	8187	UNION\s+SELECT	2	0	0	1
+8188	8188	INSERT.+INTO	2	0	0	1
+8189	8189	DELETE.+FROM	2	0	0	1
+8190	8190	ASCII\(.+SELECT	2	0	0	1
+8191	8191	UPDATE.+SET	2	0	0	1
+8192	8192	SELECT.+FROM	2	0	0	1
+8193	8193	UNION\s+SELECT	2	0	0	1
+8194	8194	INSERT.+INTO	2	0	0	1
+8195	8195	DELETE.+FROM	2	0	0	1
+8196	8196	ASCII\(.+SELECT	2	0	0	1
+8197	8197	UPDATE.+SET	2	0	0	1
+8198	8198	SELECT.+FROM	2	0	0	1
+8199	8199	UNION\s+SELECT	2	0	0	1
+8200	8200	INSERT.+INTO	2	0	0	1
+8201	8201	DELETE.+FROM	2	0	0	1
+8202	8202	ASCII\(.+SELECT	2	0	0	1
+8203	8203	UPDATE.+SET	2	0	0	1
+8204	8204	SELECT.+FROM	2	0	0	1
+8205	8205	UNION\s+SELECT	2	0	0	1
+8206	8206	INSERT.+INTO	2	0	0	1
+8207	8207	DELETE.+FROM	2	0	0	1
+8208	8208	ASCII\(.+SELECT	2	0	0	1
+8209	8209	UPDATE.+SET	2	0	0	1
+8210	8210	SELECT.+FROM	2	0	0	1
+8211	8211	UNION\s+SELECT	2	0	0	1
+8212	8212	INSERT.+INTO	2	0	0	1
+8213	8213	DELETE.+FROM	2	0	0	1
+8214	8214	ASCII\(.+SELECT	2	0	0	1
+8215	8215	UPDATE.+SET	2	0	0	1
+8216	8216	SELECT.+FROM	2	0	0	1
+8217	8217	UNION\s+SELECT	2	0	0	1
+8218	8218	INSERT.+INTO	2	0	0	1
+8219	8219	DELETE.+FROM	2	0	0	1
+8220	8220	ASCII\(.+SELECT	2	0	0	1
+8221	8221	UPDATE.+SET	2	0	0	1
+8222	8222	SELECT.+FROM	2	0	0	1
+8223	8223	UNION\s+SELECT	2	0	0	1
+8224	8224	INSERT.+INTO	2	0	0	1
+8225	8225	DELETE.+FROM	2	0	0	1
+8226	8226	ASCII\(.+SELECT	2	0	0	1
+8227	8227	UPDATE.+SET	2	0	0	1
+8228	8228	UNION.+SELECT	2	0	0	1
+8229	8229	UNION.+SELECT	2	0	0	1
+8230	8230	UNION.+SELECT	2	0	0	1
+8231	8231	UNION.+SELECT	2	0	0	1
+8232	8232	UNION.+SELECT	2	0	0	1
+8233	8233	UNION.+SELECT	2	0	0	1
+8234	8234	SELECT.+FROM	2	0	0	1
+8235	8235	UNION\s+SELECT	2	0	0	1
+8236	8236	INSERT.+INTO	2	0	0	1
+8237	8237	DELETE.+FROM	2	0	0	1
+8238	8238	ASCII\(.+SELECT	2	0	0	1
+8239	8239	UPDATE.+SET	2	0	0	1
+8240	8240	SELECT.+FROM	2	0	0	1
+8241	8241	UNION\s+SELECT	2	0	0	1
+8242	8242	INSERT.+INTO	2	0	0	1
+8243	8243	DELETE.+FROM	2	0	0	1
+8244	8244	ASCII\(.+SELECT	2	0	0	1
+8245	8245	UPDATE.+SET	2	0	0	1
+8246	8246	SELECT.+FROM	2	0	0	1
+8247	8247	UNION\s+SELECT	2	0	0	1
+8248	8248	INSERT.+INTO	2	0	0	1
+8249	8249	DELETE.+FROM	2	0	0	1
+8250	8250	ASCII\(.+SELECT	2	0	0	1
+8251	8251	UPDATE.+SET	2	0	0	1
+8252	8252	SELECT.+FROM	2	0	0	1
+8253	8253	UNION\s+SELECT	2	0	0	1
+8254	8254	INSERT.+INTO	2	0	0	1
+8255	8255	DELETE.+FROM	2	0	0	1
+8256	8256	ASCII\(.+SELECT	2	0	0	1
+8257	8257	UPDATE.+SET	2	0	0	1
+8258	8258	.+SELECT.+FROM	2	0	0	1
+8259	8259	.+UNION\s+SELECT	2	0	0	1
+8260	8260	.+INSERT.+INTO	2	0	0	1
+8261	8261	.+DELETE.+FROM	2	0	0	1
+8262	8262	.+ASCII\(.+SELECT	2	0	0	1
+8263	8263	.+UPDATE.+SET	2	0	0	1
+8264	8264	.+SELECT.+FROM	2	0	0	1
+8265	8265	.+UNION\s+SELECT	2	0	0	1
+8266	8266	.+INSERT.+INTO	2	0	0	1
+8267	8267	.+DELETE.+FROM	2	0	0	1
+8268	8268	.+ASCII\(.+SELECT	2	0	0	1
+8269	8269	.+UPDATE.+SET	2	0	0	1
+8270	8270	SELECT.+FROM	2	0	0	1
+8271	8271	UNION\s+SELECT	2	0	0	1
+8272	8272	INSERT.+INTO	2	0	0	1
+8273	8273	DELETE.+FROM	2	0	0	1
+8274	8274	ASCII\(.+SELECT	2	0	0	1
+8275	8275	UPDATE.+SET	2	0	0	1
+8276	8276	.+SELECT.+FROM	2	0	0	1
+8277	8277	.+UNION\s+SELECT	2	0	0	1
+8278	8278	.+INSERT.+INTO	2	0	0	1
+8279	8279	.+DELETE.+FROM	2	0	0	1
+8280	8280	.+ASCII\(.+SELECT	2	0	0	1
+8281	8281	.+UPDATE.+SET	2	0	0	1
+8282	8282	.+SELECT.+FROM	2	0	0	1
+8283	8283	.+UNION\s+SELECT	2	0	0	1
+8284	8284	.+INSERT.+INTO	2	0	0	1
+8285	8285	.+DELETE.+FROM	2	0	0	1
+8286	8286	.+ASCII\(.+SELECT	2	0	0	1
+8287	8287	.+UPDATE.+SET	2	0	0	1
+8288	8288	SELECT.+FROM	2	0	0	1
+8289	8289	UNION\s+SELECT	2	0	0	1
+8290	8290	INSERT.+INTO	2	0	0	1
+8291	8291	DELETE.+FROM	2	0	0	1
+8292	8292	ASCII\(.+SELECT	2	0	0	1
+8293	8293	UPDATE.+SET	2	0	0	1
+8294	8294	UNION.+SELECT	2	0	0	1
+8295	8295	.+SELECT.+FROM	2	0	0	1
+8296	8296	.+UNION\s+SELECT	2	0	0	1
+8297	8297	.+INSERT.+INTO	2	0	0	1
+8298	8298	.+DELETE.+FROM	2	0	0	1
+8299	8299	.+ASCII\(.+SELECT	2	0	0	1
+8300	8300	.+UPDATE.+SET	2	0	0	1
+8301	8301	highlighter\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8302	8302	UNION.+SELECT	2	0	0	1
+8303	8303	SELECT.+FROM	2	0	0	1
+8304	8304	UNION\s+SELECT	2	0	0	1
+8305	8305	INSERT.+INTO	2	0	0	1
+8306	8306	DELETE.+FROM	2	0	0	1
+8307	8307	ASCII\(.+SELECT	2	0	0	1
+8308	8308	UPDATE.+SET	2	0	0	1
+8309	8309	SELECT.+FROM	2	0	0	1
+8310	8310	UNION\s+SELECT	2	0	0	1
+8311	8311	INSERT.+INTO	2	0	0	1
+8312	8312	DELETE.+FROM	2	0	0	1
+8313	8313	ASCII\(.+SELECT	2	0	0	1
+8314	8314	UPDATE.+SET	2	0	0	1
+8315	8315	SELECT.+FROM	2	0	0	1
+8316	8316	UNION\s+SELECT	2	0	0	1
+8317	8317	INSERT.+INTO	2	0	0	1
+8318	8318	DELETE.+FROM	2	0	0	1
+8319	8319	ASCII\(.+SELECT	2	0	0	1
+8320	8320	UPDATE.+SET	2	0	0	1
+8321	8321	SELECT.+FROM	2	0	0	1
+8322	8322	UNION\s+SELECT	2	0	0	1
+8323	8323	INSERT.+INTO	2	0	0	1
+8324	8324	DELETE.+FROM	2	0	0	1
+8325	8325	ASCII\(.+SELECT	2	0	0	1
+8326	8326	UPDATE.+SET	2	0	0	1
+8327	8327	UNION.+SELECT	2	0	0	1
+8328	8328	SELECT.+FROM	2	0	0	1
+8329	8329	UNION\s+SELECT	2	0	0	1
+8330	8330	INSERT.+INTO	2	0	0	1
+8331	8331	DELETE.+FROM	2	0	0	1
+8332	8332	ASCII\(.+SELECT	2	0	0	1
+8333	8333	UPDATE.+SET	2	0	0	1
+8334	8334	SELECT.+FROM	2	0	0	1
+8335	8335	UNION\s+SELECT	2	0	0	1
+8336	8336	INSERT.+INTO	2	0	0	1
+8337	8337	DELETE.+FROM	2	0	0	1
+8338	8338	ASCII\(.+SELECT	2	0	0	1
+8339	8339	UPDATE.+SET	2	0	0	1
+8340	8340	SELECT.+FROM	2	0	0	1
+8341	8341	UNION\s+SELECT	2	0	0	1
+8342	8342	INSERT.+INTO	2	0	0	1
+8343	8343	DELETE.+FROM	2	0	0	1
+8344	8344	ASCII\(.+SELECT	2	0	0	1
+8345	8345	UPDATE.+SET	2	0	0	1
+8346	8346	SELECT.+FROM	2	0	0	1
+8347	8347	UNION\s+SELECT	2	0	0	1
+8348	8348	INSERT.+INTO	2	0	0	1
+8349	8349	DELETE.+FROM	2	0	0	1
+8350	8350	ASCII\(.+SELECT	2	0	0	1
+8351	8351	UPDATE.+SET	2	0	0	1
+8352	8352	UNION.+SELECT	2	0	0	1
+8353	8353	.+SELECT.+FROM	2	0	0	1
+8354	8354	.+UNION\s+SELECT	2	0	0	1
+8355	8355	.+INSERT.+INTO	2	0	0	1
+8356	8356	.+DELETE.+FROM	2	0	0	1
+8357	8357	.+ASCII\(.+SELECT	2	0	0	1
+8358	8358	.+UPDATE.+SET	2	0	0	1
+8359	8359	.+SELECT.+FROM	2	0	0	1
+8360	8360	.+UNION\s+SELECT	2	0	0	1
+8361	8361	.+INSERT.+INTO	2	0	0	1
+8362	8362	.+DELETE.+FROM	2	0	0	1
+8363	8363	.+ASCII\(.+SELECT	2	0	0	1
+8364	8364	.+UPDATE.+SET	2	0	0	1
+8365	8365	.+SELECT.+FROM	2	0	0	1
+8366	8366	.+UNION\s+SELECT	2	0	0	1
+8367	8367	.+INSERT.+INTO	2	0	0	1
+8368	8368	.+DELETE.+FROM	2	0	0	1
+8369	8369	.+ASCII\(.+SELECT	2	0	0	1
+8370	8370	.+UPDATE.+SET	2	0	0	1
+8371	8371	.+SELECT.+FROM	2	0	0	1
+8372	8372	.+UNION\s+SELECT	2	0	0	1
+8373	8373	.+INSERT.+INTO	2	0	0	1
+8374	8374	.+DELETE.+FROM	2	0	0	1
+8375	8375	.+ASCII\(.+SELECT	2	0	0	1
+8376	8376	.+UPDATE.+SET	2	0	0	1
+8377	8377	.+SELECT.+FROM	2	0	0	1
+8378	8378	.+UNION\s+SELECT	2	0	0	1
+8379	8379	.+INSERT.+INTO	2	0	0	1
+8380	8380	.+DELETE.+FROM	2	0	0	1
+8381	8381	.+ASCII\(.+SELECT	2	0	0	1
+8382	8382	.+UPDATE.+SET	2	0	0	1
+8383	8383	.+SELECT.+FROM	2	0	0	1
+8384	8384	.+UNION\s+SELECT	2	0	0	1
+8385	8385	.+INSERT.+INTO	2	0	0	1
+8386	8386	.+DELETE.+FROM	2	0	0	1
+8387	8387	.+ASCII\(.+SELECT	2	0	0	1
+8388	8388	.+UPDATE.+SET	2	0	0	1
+8389	8389	SELECT.+FROM	2	0	0	1
+8390	8390	UNION\s+SELECT	2	0	0	1
+8391	8391	INSERT.+INTO	2	0	0	1
+8392	8392	DELETE.+FROM	2	0	0	1
+8393	8393	.+SELECT.+FROM	2	0	0	1
+8394	8394	.+UNION\s+SELECT	2	0	0	1
+8395	8395	.+INSERT.+INTO	2	0	0	1
+8396	8396	.+ASCII\(.+SELECT	2	0	0	1
+8397	8397	.+UPDATE.+SET	2	0	0	1
+8398	8398	.+SELECT.+FROM	2	0	0	1
+8399	8399	.+UNION\s+SELECT	2	0	0	1
+8400	8400	.+INSERT.+INTO	2	0	0	1
+8401	8401	.+DELETE.+FROM	2	0	0	1
+8402	8402	.+ASCII\(.+SELECT	2	0	0	1
+8403	8403	.+UPDATE.+SET	2	0	0	1
+8404	8404	.+SELECT.+FROM	2	0	0	1
+8405	8405	.+UNION\s+SELECT	2	0	0	1
+8406	8406	.+INSERT.+INTO	2	0	0	1
+8407	8407	.+DELETE.+FROM	2	0	0	1
+8408	8408	.+ASCII\(.+SELECT	2	0	0	1
+8409	8409	.+UPDATE.+SET	2	0	0	1
+8410	8410	.+SELECT.+FROM	2	0	0	1
+8411	8411	.+UNION\s+SELECT	2	0	0	1
+8412	8412	.+INSERT.+INTO	2	0	0	1
+8413	8413	.+DELETE.+FROM	2	0	0	1
+8414	8414	.+ASCII\(.+SELECT	2	0	0	1
+8415	8415	.+UPDATE.+SET	2	0	0	1
+8416	8416	.+SELECT.+FROM	2	0	0	1
+8417	8417	.+UNION\s+SELECT	2	0	0	1
+8418	8418	.+INSERT.+INTO	2	0	0	1
+8419	8419	.+DELETE.+FROM	2	0	0	1
+8420	8420	.+ASCII\(.+SELECT	2	0	0	1
+8421	8421	.+UPDATE.+SET	2	0	0	1
+8422	8422	UNION.+SELECT	2	0	0	1
+8423	8423	UNION.+SELECT	2	0	0	1
+8424	8424	SELECT.+FROM	2	0	0	1
+8425	8425	UNION\s+SELECT	2	0	0	1
+8426	8426	INSERT.+INTO	2	0	0	1
+8427	8427	DELETE.+FROM	2	0	0	1
+8428	8428	ASCII\(.+SELECT	2	0	0	1
+8429	8429	UPDATE.+SET	2	0	0	1
+8430	8430	UNION.+SELECT	2	0	0	1
+8431	8431	UNION.+SELECT	2	0	0	1
+8432	8432	UNION.+SELECT	2	0	0	1
+8433	8433	UNION.+SELECT	2	0	0	1
+8434	8434	UNION.+SELECT	2	0	0	1
+8435	8435	SELECT.+FROM	2	0	0	1
+8436	8436	UNION\s+SELECT	2	0	0	1
+8437	8437	INSERT.+INTO	2	0	0	1
+8438	8438	DELETE.+FROM	2	0	0	1
+8439	8439	ASCII\(.+SELECT	2	0	0	1
+8440	8440	UPDATE.+SET	2	0	0	1
+8441	8441	SELECT.+FROM	2	0	0	1
+8442	8442	UNION\s+SELECT	2	0	0	1
+8443	8443	INSERT.+INTO	2	0	0	1
+8444	8444	DELETE.+FROM	2	0	0	1
+8445	8445	ASCII\(.+SELECT	2	0	0	1
+8446	8446	UPDATE.+SET	2	0	0	1
+8447	8447	SELECT.+FROM	2	0	0	1
+8448	8448	UNION\s+SELECT	2	0	0	1
+8449	8449	INSERT.+INTO	2	0	0	1
+8450	8450	DELETE.+FROM	2	0	0	1
+8451	8451	ASCII\(.+SELECT	2	0	0	1
+8452	8452	UPDATE.+SET	2	0	0	1
+8453	8453	SELECT.+FROM	2	0	0	1
+8454	8454	UNION\s+SELECT	2	0	0	1
+8455	8455	INSERT.+INTO	2	0	0	1
+8456	8456	DELETE.+FROM	2	0	0	1
+8457	8457	ASCII\(.+SELECT	2	0	0	1
+8458	8458	UPDATE.+SET	2	0	0	1
+8459	8459	SELECT.+FROM	2	0	0	1
+8460	8460	UNION\s+SELECT	2	0	0	1
+8461	8461	INSERT.+INTO	2	0	0	1
+8462	8462	DELETE.+FROM	2	0	0	1
+8463	8463	ASCII\(.+SELECT	2	0	0	1
+8464	8464	UPDATE.+SET	2	0	0	1
+8465	8465	page=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8466	8466	page=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8467	8467	Queue\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8468	8468	Filename\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8469	8469	IsolatedMessageID\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8470	8470	ServerName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8471	8471	FileName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8472	8472	IsolatedMessageID\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8473	8473	ServerName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8474	8474	Dictionary\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8475	8475	Scoring\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8476	8476	MessagePart\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8477	8477	Queue\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8478	8478	FileName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8479	8479	IsolatedMessageID\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8480	8480	ServerName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8481	8481	SELECT.+FROM	2	0	0	1
+8482	8482	UNION\s+SELECT	2	0	0	1
+8483	8483	INSERT.+INTO	2	0	0	1
+8484	8484	DELETE.+FROM	2	0	0	1
+8485	8485	ASCII\(.+SELECT	2	0	0	1
+8486	8486	UPDATE.+SET	2	0	0	1
+8487	8487	SELECT.+FROM	2	0	0	1
+8488	8488	UNION\s+SELECT	2	0	0	1
+8489	8489	INSERT.+INTO	2	0	0	1
+8490	8490	DELETE.+FROM	2	0	0	1
+8491	8491	ASCII\(.+SELECT	2	0	0	1
+8492	8492	UPDATE.+SET	2	0	0	1
+8493	8493	SELECT.+FROM	2	0	0	1
+8494	8494	UNION\s+SELECT	2	0	0	1
+8495	8495	INSERT.+INTO	2	0	0	1
+8496	8496	DELETE.+FROM	2	0	0	1
+8497	8497	ASCII\(.+SELECT	2	0	0	1
+8498	8498	UPDATE.+SET	2	0	0	1
+8499	8499	SELECT.+FROM	2	0	0	1
+8500	8500	UNION\s+SELECT	2	0	0	1
+8501	8501	INSERT.+INTO	2	0	0	1
+8502	8502	DELETE.+FROM	2	0	0	1
+8503	8503	ASCII\(.+SELECT	2	0	0	1
+8504	8504	UPDATE.+SET	2	0	0	1
+8505	8505	SELECT.+FROM	2	0	0	1
+8506	8506	UNION\s+SELECT	2	0	0	1
+8507	8507	INSERT.+INTO	2	0	0	1
+8508	8508	DELETE.+FROM	2	0	0	1
+8509	8509	ASCII\(.+SELECT	2	0	0	1
+8510	8510	UPDATE.+SET	2	0	0	1
+8511	8511	SELECT.+FROM	2	0	0	1
+8512	8512	UNION\s+SELECT	2	0	0	1
+8513	8513	INSERT.+INTO	2	0	0	1
+8514	8514	DELETE.+FROM	2	0	0	1
+8515	8515	ASCII\(.+SELECT	2	0	0	1
+8516	8516	UPDATE.+SET	2	0	0	1
+8517	8517	.+SELECT.+FROM	2	0	0	1
+8518	8518	.+UNION\s+SELECT	2	0	0	1
+8519	8519	.+INSERT.+INTO	2	0	0	1
+8520	8520	.+DELETE.+FROM	2	0	0	1
+8521	8521	.+ASCII\(.+SELECT	2	0	0	1
+8522	8522	.+UPDATE.+SET	2	0	0	1
+8523	8523	SELECT.+FROM	2	0	0	1
+8524	8524	UNION\s+SELECT	2	0	0	1
+8525	8525	INSERT.+INTO	2	0	0	1
+8526	8526	DELETE.+FROM	2	0	0	1
+8527	8527	ASCII\(.+SELECT	2	0	0	1
+8528	8528	UPDATE.+SET	2	0	0	1
+8529	8529	SELECT.+FROM	2	0	0	1
+8530	8530	UNION\s+SELECT	2	0	0	1
+8531	8531	INSERT.+INTO	2	0	0	1
+8532	8532	DELETE.+FROM	2	0	0	1
+8533	8533	ASCII\(.+SELECT	2	0	0	1
+8534	8534	UPDATE.+SET	2	0	0	1
+8535	8535	SELECT.+FROM	2	0	0	1
+8536	8536	UNION\s+SELECT	2	0	0	1
+8537	8537	INSERT.+INTO	2	0	0	1
+8538	8538	DELETE.+FROM	2	0	0	1
+8539	8539	ASCII\(.+SELECT	2	0	0	1
+8540	8540	UPDATE.+SET	2	0	0	1
+8541	8541	UNION\s+SELECT	2	0	0	1
+8542	8542	ABSPATH\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8543	8543	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8544	8544	SELECT.+FROM	2	0	0	1
+8545	8545	DELETE.+FROM	2	0	0	1
+8546	8546	UNION.+SELECT	2	0	0	1
+8547	8547	INSERT.+INTO	2	0	0	1
+8548	8548	UPDATE.+SET	2	0	0	1
+8549	8549	tagcloud\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8550	8550	SELECT.+FROM	2	0	0	1
+8551	8551	UNION\s+SELECT	2	0	0	1
+8552	8552	INSERT.+INTO	2	0	0	1
+8553	8553	DELETE.+FROM	2	0	0	1
+8554	8554	ASCII\(.+SELECT	2	0	0	1
+8555	8555	UPDATE.+SET	2	0	0	1
+8556	8556	SELECT.+FROM	2	0	0	1
+8557	8557	UNION\s+SELECT	2	0	0	1
+8558	8558	INSERT.+INTO	2	0	0	1
+8559	8559	DELETE.+FROM	2	0	0	1
+8560	8560	ASCII\(.+SELECT	2	0	0	1
+8561	8561	UPDATE.+SET	2	0	0	1
+8562	8562	SELECT.+FROM	2	0	0	1
+8563	8563	UNION\s+SELECT	2	0	0	1
+8564	8564	INSERT.+INTO	2	0	0	1
+8565	8565	DELETE.+FROM	2	0	0	1
+8566	8566	ASCII\(.+SELECT	2	0	0	1
+8567	8567	UPDATE.+SET	2	0	0	1
+8568	8568	SELECT.+FROM	2	0	0	1
+8569	8569	UNION\s+SELECT	2	0	0	1
+8570	8570	INSERT.+INTO	2	0	0	1
+8571	8571	DELETE.+FROM	2	0	0	1
+8572	8572	ASCII\(.+SELECT	2	0	0	1
+8573	8573	UPDATE.+SET	2	0	0	1
+8574	8574	(onmouse|onkey|onload=|onblur=|ondragdrop=|onclick=|alert|<script|<img|<src)	2	0	0	1
+8575	8575	(onmouse|onkey|onload=|onblur=|ondragdrop=|onclick=|alert|<script|<img|<src)	2	0	0	1
+8576	8576	UNION.+SELECT	2	0	0	1
+8577	8577	SELECT.+FROM	2	0	0	1
+8578	8578	UNION\s+SELECT	2	0	0	1
+8579	8579	INSERT.+INTO	2	0	0	1
+8580	8580	DELETE.+FROM	2	0	0	1
+8581	8581	ASCII\(.+SELECT	2	0	0	1
+8582	8582	UPDATE.+SET	2	0	0	1
+8583	8583	include_directory=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8584	8584	SELECT.+FROM	2	0	0	1
+8585	8585	UNION\s+SELECT	2	0	0	1
+8586	8586	INSERT.+INTO	2	0	0	1
+8587	8587	DELETE.+FROM	2	0	0	1
+8588	8588	ASCII\(.+SELECT	2	0	0	1
+8589	8589	UPDATE.+SET	2	0	0	1
+8590	8590	SELECT.+FROM	2	0	0	1
+8591	8591	UNION\s+SELECT	2	0	0	1
+8592	8592	INSERT.+INTO	2	0	0	1
+8593	8593	DELETE.+FROM	2	0	0	1
+8594	8594	ASCII\(.+SELECT	2	0	0	1
+8595	8595	UPDATE.+SET	2	0	0	1
+8596	8596	.+SELECT.+FROM	2	0	0	1
+8597	8597	.+UNION\s+SELECT	2	0	0	1
+8598	8598	.+INSERT.+INTO	2	0	0	1
+8599	8599	.+DELETE.+FROM	2	0	0	1
+8600	8600	.+ASCII\(.+SELECT	2	0	0	1
+8601	8601	.+UPDATE.+SET	2	0	0	1
+8602	8602	UNION\s+SELECT	2	0	0	1
+8603	8603	UNION.+SELECT	2	0	0	1
+8604	8604	(\?|&)id=[^\x26\x3B]*[^\d\x2D]	2	0	0	1
+8605	8605	SELECT.+FROM	2	0	0	1
+8606	8606	UNION\s+SELECT	2	0	0	1
+8607	8607	INSERT.+INTO	2	0	0	1
+8608	8608	DELETE.+FROM	2	0	0	1
+8609	8609	ASCII\(.+SELECT	2	0	0	1
+8610	8610	UPDATE.+SET	2	0	0	1
+8611	8611	SELECT.+FROM	2	0	0	1
+8612	8612	UNION\s+SELECT	2	0	0	1
+8613	8613	INSERT.+INTO	2	0	0	1
+8614	8614	DELETE.+FROM	2	0	0	1
+8615	8615	ASCII\(.+SELECT	2	0	0	1
+8616	8616	UPDATE.+SET	2	0	0	1
+8617	8617	YAPIG_PATH=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8618	8618	cfgIncludeDirectory=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8619	8619	UNION.+SELECT	2	0	0	1
+8620	8620	UNION.+SELECT	2	0	0	1
+8621	8621	UNION.+SELECT	2	0	0	1
+8622	8622	UNION.+SELECT	2	0	0	1
+8623	8623	SELECT.+FROM	2	0	0	1
+8624	8624	UNION\s+SELECT	2	0	0	1
+8625	8625	INSERT.+INTO	2	0	0	1
+8626	8626	DELETE.+FROM	2	0	0	1
+8627	8627	ASCII\(.+SELECT	2	0	0	1
+8628	8628	UPDATE.+SET	2	0	0	1
+8629	8629	SELECT.+FROM	2	0	0	1
+8630	8630	UNION\s+SELECT	2	0	0	1
+8631	8631	INSERT.+INTO	2	0	0	1
+8632	8632	DELETE.+FROM	2	0	0	1
+8633	8633	ASCII\(.+SELECT	2	0	0	1
+8634	8634	UPDATE.+SET	2	0	0	1
+8635	8635	SELECT.+FROM	2	0	0	1
+8636	8636	UNION\s+SELECT	2	0	0	1
+8637	8637	INSERT.+INTO	2	0	0	1
+8638	8638	DELETE.+FROM	2	0	0	1
+8639	8639	ASCII\(.+SELECT	2	0	0	1
+8640	8640	UPDATE.+SET	2	0	0	1
+8641	8641	SELECT.+FROM	2	0	0	1
+8642	8642	UNION\s+SELECT	2	0	0	1
+8643	8643	INSERT.+INTO	2	0	0	1
+8644	8644	DELETE.+FROM	2	0	0	1
+8645	8645	ASCII\(.+SELECT	2	0	0	1
+8646	8646	UPDATE.+SET	2	0	0	1
+8647	8647	SELECT.+FROM	2	0	0	1
+8648	8648	UNION\s+SELECT	2	0	0	1
+8649	8649	INSERT.+INTO	2	0	0	1
+8650	8650	DELETE.+FROM	2	0	0	1
+8651	8651	ASCII\(.+SELECT	2	0	0	1
+8652	8652	UPDATE.+SET	2	0	0	1
+8653	8653	SELECT.+FROM	2	0	0	1
+8654	8654	UNION\s+SELECT	2	0	0	1
+8655	8655	INSERT.+INTO	2	0	0	1
+8656	8656	DELETE.+FROM	2	0	0	1
+8657	8657	ASCII\(.+SELECT	2	0	0	1
+8658	8658	UPDATE.+SET	2	0	0	1
+8659	8659	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8660	8660	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8661	8661	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8662	8662	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8663	8663	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8664	8664	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8665	8665	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8666	8666	SELECT.+FROM	2	0	0	1
+8667	8667	UNION\s+SELECT	2	0	0	1
+8668	8668	INSERT.+INTO	2	0	0	1
+8669	8669	DELETE.+FROM	2	0	0	1
+8670	8670	ASCII\(.+SELECT	2	0	0	1
+8671	8671	UPDATE.+SET	2	0	0	1
+8672	8672	UNION.+SELECT	2	0	0	1
+8673	8673	SELECT.+FROM	2	0	0	1
+8674	8674	UNION\s+SELECT	2	0	0	1
+8675	8675	INSERT.+INTO	2	0	0	1
+8676	8676	DELETE.+FROM	2	0	0	1
+8677	8677	ASCII\(.+SELECT	2	0	0	1
+8678	8678	UPDATE.+SET	2	0	0	1
+8679	8679	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8680	8680	UNION.+SELECT	2	0	0	1
+8681	8681	SELECT.+FROM	2	0	0	1
+8682	8682	UNION\s+SELECT	2	0	0	1
+8683	8683	INSERT.+INTO	2	0	0	1
+8684	8684	DELETE.+FROM	2	0	0	1
+8685	8685	ASCII\(.+SELECT	2	0	0	1
+8686	8686	UPDATE.+SET	2	0	0	1
+8687	8687	SELECT.+FROM	2	0	0	1
+8688	8688	UNION\s+SELECT	2	0	0	1
+8689	8689	INSERT.+INTO	2	0	0	1
+8690	8690	DELETE.+FROM	2	0	0	1
+8691	8691	ASCII\(.+SELECT	2	0	0	1
+8692	8692	UPDATE.+SET	2	0	0	1
+8693	8693	controller\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8694	8694	.+SELECT.+FROM	2	0	0	1
+8695	8695	.+UNION\s+SELECT	2	0	0	1
+8696	8696	.+INSERT.+INTO	2	0	0	1
+8697	8697	.+DELETE.+FROM	2	0	0	1
+8698	8698	.+ASCII\(.+SELECT	2	0	0	1
+8699	8699	.+UPDATE.+SET	2	0	0	1
+8700	8700	.+SELECT.+FROM	2	0	0	1
+8701	8701	.+UNION\s+SELECT	2	0	0	1
+8702	8702	.+INSERT.+INTO	2	0	0	1
+8703	8703	.+DELETE.+FROM	2	0	0	1
+8704	8704	.+ASCII\(.+SELECT	2	0	0	1
+8705	8705	.+UPDATE.+SET	2	0	0	1
+8706	8706	SELECT.+FROM	2	0	0	1
+8707	8707	UNION\s+SELECT	2	0	0	1
+8708	8708	INSERT.+INTO	2	0	0	1
+8709	8709	DELETE.+FROM	2	0	0	1
+8710	8710	ASCII\(.+SELECT	2	0	0	1
+8711	8711	UPDATE.+SET	2	0	0	1
+8712	8712	.+SELECT.+FROM	2	0	0	1
+8713	8713	.+UNION\s+SELECT	2	0	0	1
+8714	8714	.+INSERT.+INTO	2	0	0	1
+8715	8715	.+DELETE.+FROM	2	0	0	1
+8716	8716	.+ASCII\(.+SELECT	2	0	0	1
+8717	8717	.+UPDATE.+SET	2	0	0	1
+8718	8718	.+SELECT.+FROM	2	0	0	1
+8719	8719	.+UNION\s+SELECT	2	0	0	1
+8720	8720	.+INSERT.+INTO	2	0	0	1
+8721	8721	.+DELETE.+FROM	2	0	0	1
+8722	8722	.+ASCII\(.+SELECT	2	0	0	1
+8723	8723	.+UPDATE.+SET	2	0	0	1
+8724	8724	a_name='	2	0	0	1
+8725	8725	UNION.+SELECT	2	0	0	1
+8726	8726	UNION.+SELECT	2	0	0	1
+8727	8727	UNION.+SELECT	2	0	0	1
+8728	8728	\x2Ephp\x3F.{0,300}\x3D(http\x3A|ftp\x3A|https\x3A|ftps\x3A)	2	0	0	1
+8729	8729	SELECT.+FROM	2	0	0	1
+8730	8730	UNION\s+SELECT	2	0	0	1
+8731	8731	INSERT.+INTO	2	0	0	1
+8732	8732	DELETE.+FROM	2	0	0	1
+8733	8733	ASCII\(.+SELECT	2	0	0	1
+8734	8734	UPDATE.+SET	2	0	0	1
+8735	8735	SELECT.+FROM	2	0	0	1
+8736	8736	UNION\s+SELECT	2	0	0	1
+8737	8737	INSERT.+INTO	2	0	0	1
+8738	8738	DELETE.+FROM	2	0	0	1
+8739	8739	ASCII\(.+SELECT	2	0	0	1
+8740	8740	UPDATE.+SET	2	0	0	1
+8741	8741	(\.\.\/){1,}	2	0	0	1
+8742	8742	(\.\.\/){1,}	2	0	0	1
+8743	8743	(\.\.\/){1,}	2	0	0	1
+8744	8744	(\.\.\/){1,}	2	0	0	1
+8745	8745	(\.\.\/){1,}	2	0	0	1
+8746	8746	(\.\.\/){1,}	2	0	0	1
+8747	8747	(\.\.\/){1,}	2	0	0	1
+8748	8748	(\.\.\/){1,}	2	0	0	1
+8749	8749	(\.\.\/){1,}	2	0	0	1
+8750	8750	(\.\.\/){1,}	2	0	0	1
+8751	8751	_REQUEST\[read\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8752	8752	.+SELECT.+FROM	2	0	0	1
+8753	8753	.+UNION\s+SELECT	2	0	0	1
+8754	8754	.+INSERT.+INTO	2	0	0	1
+8755	8755	.+DELETE.+FROM	2	0	0	1
+8756	8756	.+ASCII\(.+SELECT	2	0	0	1
+8757	8757	.+UPDATE.+SET	2	0	0	1
+8758	8758	.+SELECT.+FROM	2	0	0	1
+8759	8759	.+UNION\s+SELECT	2	0	0	1
+8760	8760	.+INSERT.+INTO	2	0	0	1
+8761	8761	.+DELETE.+FROM	2	0	0	1
+8762	8762	.+ASCII\(.+SELECT	2	0	0	1
+8763	8763	.+UPDATE.+SET	2	0	0	1
+8764	8764	.+SELECT.+FROM	2	0	0	1
+8765	8765	.+UNION\s+SELECT	2	0	0	1
+8766	8766	.+INSERT.+INTO	2	0	0	1
+8767	8767	.+DELETE.+FROM	2	0	0	1
+8768	8768	.+ASCII\(.+SELECT	2	0	0	1
+8769	8769	.+UPDATE.+SET	2	0	0	1
+8770	8770	.+SELECT.+FROM	2	0	0	1
+8771	8771	.+INSERT.+INTO	2	0	0	1
+8772	8772	.+DELETE.+FROM	2	0	0	1
+8773	8773	.+UPDATE.+SET	2	0	0	1
+8774	8774	SELECT.+FROM	2	0	0	1
+8775	8775	UNION\s+SELECT	2	0	0	1
+8776	8776	INSERT.+INTO	2	0	0	1
+8777	8777	(\?|&)GID=[^\x26\x3B]*[^\d\x2D]	2	0	0	1
+8778	8778	net2ftp_globals\[application_skinsdir\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8779	8779	UNION\s+SELECT	2	0	0	1
+8780	8780	icerikyolu=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8781	8781	sayfaid=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8782	8782	uzanti=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8783	8783	SELECT.+FROM	2	0	0	1
+8784	8784	DELETE.+FROM	2	0	0	1
+8785	8785	INSERT.+INTO	2	0	0	1
+8786	8786	UPDATE.+SET	2	0	0	1
+8787	8787	rootagenda=(https?|ftps?|php)	2	0	0	1
+8788	8788	(\.\.\/){1,}	2	0	0	1
+8789	8789	GLOBALS\[BASE\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8790	8790	[\?&]name=[^&\;\?]+\x27	2	0	0	1
+8791	8791	id_livello\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8792	8792	page\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8793	8793	input_file=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8794	8794	lang_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8795	8795	INSERT.+INTO	2	0	0	1
+8796	8796	UPDATE.+SET	2	0	0	1
+8797	8797	SELECT.+FROM	2	0	0	1
+8798	8798	DELETE.+FROM	2	0	0	1
+8799	8799	current_user_id=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8800	8800	current_user_id=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8801	8801	SELECT.+FROM	2	0	0	1
+8802	8802	fingerprint=\w*\;	2	0	0	1
+8803	8803	class_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8804	8804	filter\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8805	8805	SELECT.+FROM	2	0	0	1
+8806	8806	DELETE.+FROM	2	0	0	1
+8807	8807	INSERT.+INTO	2	0	0	1
+8808	8808	UPDATE.+SET	2	0	0	1
+8809	8809	date\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8810	8810	db_servertype=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8811	8811	(\.\.\/){1,}	2	0	0	1
+8812	8812	(\.\.\/){1,}	2	0	0	1
+8813	8813	(\.\.\/){1,}	2	0	0	1
+8814	8814	mosConfig_absolute_path=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+8815	8815	UPDATE.+SET	2	0	0	1
+8816	8816	ABTPV_BLOQUE_CENTRAL=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8817	8817	forum=.*'	2	0	0	1
+8818	8818	shop_this_skin_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8819	8819	pathForArdeaCore=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8820	8820	LibDir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8821	8821	LibDir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8822	8822	SELECT.+FROM	2	0	0	1
+8823	8823	UNION\s+SELECT	2	0	0	1
+8824	8824	INSERT.+INTO	2	0	0	1
+8825	8825	DELETE.+FROM	2	0	0	1
+8826	8826	ASCII\(.+SELECT	2	0	0	1
+8827	8827	UPDATE.+SET	2	0	0	1
+8828	8828	SELECT.+FROM	2	0	0	1
+8829	8829	UNION\s+SELECT	2	0	0	1
+8830	8830	INSERT.+INTO	2	0	0	1
+8831	8831	DELETE.+FROM	2	0	0	1
+8832	8832	ASCII\(.+SELECT	2	0	0	1
+8833	8833	UPDATE.+SET	2	0	0	1
+8834	8834	SELECT.+FROM	2	0	0	1
+8835	8835	DELETE.+FROM	2	0	0	1
+8836	8836	INSERT.+INTO	2	0	0	1
+8837	8837	UPDATE.+SET	2	0	0	1
+8838	8838	LibDir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8839	8839	LibDir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8840	8840	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8841	8841	&CONFIG\x5bpath\x5d=(https?|ftps?|php)\:	2	0	0	1
+8842	8842	SELECT.+FROM	2	0	0	1
+8843	8843	UNION\s+SELECT	2	0	0	1
+8844	8844	INSERT.+INTO	2	0	0	1
+8845	8845	DELETE.+FROM	2	0	0	1
+8846	8846	ASCII\(.+SELECT	2	0	0	1
+8847	8847	UPDATE.+SET	2	0	0	1
+8848	8848	SELECT.+FROM	2	0	0	1
+8849	8849	UPDATE.+SET	2	0	0	1
+8850	8850	config_atkroot\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8851	8851	index.template.html.+(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8852	8852	pathtoserverdata\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8853	8853	(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8854	8854	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8855	8855	UNION\s+SELECT	2	0	0	1
+8856	8856	master\[currentskin\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8857	8857	UNION.+SELECT	2	0	0	1
+8858	8858	(onmouse|onkey|onload=|onblur=|ondragdrop=|onclick=|alert|<script|<img|<src)	2	0	0	1
+8859	8859	UNION\s+SELECT	2	0	0	1
+8860	8860	\/cgi-mod\/index\.cgi\?.*backup_username=[^&\;]*[>\"]	2	0	0	1
+8861	8861	\/cgi-mod\/index\.cgi\?.*backup_server=[^&\;]*[>\"]	2	0	0	1
+8862	8862	\/cgi-mod\/index\.cgi\?.*backup_path=[^&\;]*[>\"]	2	0	0	1
+8863	8863	\/cgi-mod\/index\.cgi\?.*backup_password=[^&\;]*[>\"]	2	0	0	1
+8864	8864	(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8865	8865	UNION.+SELECT	2	0	0	1
+8866	8866	(alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8867	8867	UNION.+SELECT	2	0	0	1
+8868	8868	UNION.+SELECT	2	0	0	1
+8869	8869	dest\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8870	8870	(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8871	8871	(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8872	8872	(onmouse|onkey|onload=|onblur=|ondragdrop=|onclick=|alert|<script|<img|<src)	2	0	0	1
+8873	8873	(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8874	8874	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8875	8875	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8876	8876	SELECT.+FROM	2	0	0	1
+8877	8877	lgsl_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8878	8878	lgsl_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8879	8879	app_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8880	8880	app_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8881	8881	(modname=meta_certificate|modname=certificate|modname=link).+UPTDATE.+SET	2	0	0	1
+8882	8882	(modname=meta_certificate|modname=certificate|modname=link).+UNION.+SELECT	2	0	0	1
+8883	8883	(modname=meta_certificate|modname=certificate|modname=link).+SELECT.+FROM	2	0	0	1
+8884	8884	(modname=meta_certificate|modname=certificate|modname=link).+DELETE.+FROM	2	0	0	1
+8885	8885	smarty\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8886	8886	smarty\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8887	8887	_compile_file\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8888	8888	UNION.+SELECT	2	0	0	1
+8889	8889	tpl_base_dir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8890	8890	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8891	8891	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8892	8892	(\.\.\/){1,}	2	0	0	1
+8893	8893	path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8894	8894	(\?|&)GLOBALS\[nlang\]=[^\x26\x3B\x2f\x5c]*[\x2f\x5c]	2	0	0	1
+8895	8895	(\?|&)GLOBALS\[nlang\]=[^\x26\x3B\x2f\x5c]*[\x2f\x5c]	2	0	0	1
+8896	8896	kal_class_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8897	8897	kal_class_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8898	8898	edit\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8899	8899	edit\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8900	8900	site_id\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8901	8901	BASE_DIR\[jax_formmailer\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8902	8902	(\.\.\/){1,}	2	0	0	1
+8903	8903	ADODB_LANG\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8904	8904	config\[gfwroot\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8905	8905	(\.\.\/){1,}	2	0	0	1
+8906	8906	servercert\x3D.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8907	8907	c_temp_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8908	8908	c_temp_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8909	8909	(\?|&)article_id=[^\x26\x3B]*[^\d\x2D]	2	0	0	1
+8910	8910	colorpicker\x2Ephp\x3F[^\x0A\x0D]*(form|target)\x3D[^\x0A\x0D\x26]*[\x3E\x3C\x29\x22\x27\x3B]	2	0	0	1
+8911	8911	test\x2Ephp\x3F[^\x0A\x0D]*ext\x3D[^\x0A\x0D\x26]*[\x3E\x3C\x22\x27]	2	0	0	1
+8912	8912	passwd/main\x2Ephp\x3F[^\x0A\x0D]*backend\x3D[^\x0A\x0D\x26]*\x22	2	0	0	1
+8913	8913	colorpicker\x2Ephp\x3F[^\x0A\x0D]*(form|target)\x3D[^\x0A\x0D\x26]*[\x3E\x3C\x29\x22\x27\x3B]	2	0	0	1
+8914	8914	test\x2Ephp\x3F[^\x0A\x0D]*ext\x3D[^\x0A\x0D\x26]*[\x3E\x3C\x22\x27]	2	0	0	1
+8915	8915	passwd/main\x2Ephp\x3F[^\x0A\x0D]*backend\x3D[^\x0A\x0D\x26]*\x22	2	0	0	1
+8916	8916	(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8917	8917	searchWord\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8918	8918	maxHits\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8919	8919	scopedSearch\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8920	8920	scope\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8921	8921	BaseTarget\x3D.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8922	8922	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8923	8923	INDEX\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8924	8924	domain\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8925	8925	slot\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8926	8926	slot\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8927	8927	WEBINDEX\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8928	8928	SLOT\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8929	8929	UNION.+SELECT	2	0	0	1
+8930	8930	mosConfig_live_site=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8931	8931	\x2Ephp\x3F.{0,300}\x3D(http\x3A|ftp\x3A|https\x3A|ftps\x3A)	2	0	0	1
+8932	8932	GLOBALS\[mosConfig_absolute_path\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8933	8933	GLOBALS\[mosConfig_absolute_path\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8934	8934	user_id=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8935	8935	newsid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8936	8936	(\?|&)Itemid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8937	8937	(\?|&)id=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8938	8938	(\?|&)eid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8939	8939	(\?|&)Itemid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8940	8940	(\?|&)id=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8941	8941	(\?|&)secid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8942	8942	(\?|&)catID=[^\x26\x3B]*[^\d\x2D]	2	0	0	1
+8943	8943	mosConfig_absolute_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8944	8944	mosConfig_absolute_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8945	8945	mosConfig_absolute_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8946	8946	user_id\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8947	8947	mosConfig_absolute_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8948	8948	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8949	8949	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8950	8950	GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8951	8951	mosConfig_absolute_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8952	8952	DOCUMENT_ROOT\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8953	8953	CONFIG\[AdminPath\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8954	8954	cwd=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8955	8955	cfile\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8956	8956	\.php(\?|.*\x26)pathToIndex=(https?|ftps?)\:\/\/[^\x26\x3B]+\?\?	2	0	0	1
+8957	8957	name=.+(IMG|SCRIPT|SRC|onkey|onmouse|onload)	2	0	0	1
+8958	8958	SELECT.+FROM	2	0	0	1
+8959	8959	db_type\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8960	8960	v1\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8961	8961	SELECT.+FROM	2	0	0	1
+8962	8962	SELECT.+FROM	2	0	0	1
+8963	8963	reflect_base=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8964	8964	(\.\.\/){1,}	2	0	0	1
+8965	8965	determined_format\[include\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8966	8966	determined_format\[include\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8967	8967	(\?|&)listing_id=[^\x26\x3B]*[^\d\x2D]	2	0	0	1
+8968	8968	fm_includes_special=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8969	8969	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8970	8970	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8971	8971	SELECT.+FROM	2	0	0	1
+8972	8972	SELECT.+FROM	2	0	0	1
+8973	8973	SELECT.+FROM	2	0	0	1
+8974	8974	SELECT.+FROM	2	0	0	1
+8975	8975	SELECT.+FROM	2	0	0	1
+8976	8976	SELECT.+FROM	2	0	0	1
+8977	8977	UNION\s+SELECT	2	0	0	1
+8978	8978	UNION.+SELECT	2	0	0	1
+8979	8979	mybloggie_root_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8980	8980	email\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8981	8981	DIR_FILES_BLOCK_TYPES_CORE=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8982	8982	AND.*IF\(	2	0	0	1
+8983	8983	DIR_LIBS=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+8984	8984	DIR_LIBS=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+8985	8985	DIR_LIBS=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+8986	8986	DIR_LIBS=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+8987	8987	f_srch\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8988	8988	client\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8989	8989	file\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8990	8990	tagcloud\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8991	8991	tagcloud\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8992	8992	id=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8993	8993	and.*substring\(	2	0	0	1
+8994	8994	lang\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8995	8995	basedir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8996	8996	k\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8997	8997	and.*substring\(	2	0	0	1
+8998	8998	showfile\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8999	8999	PHPCOVERAGE_HOME\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9000	9000	param\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9001	9001	ORDER.+BY	2	0	0	1
+9002	9002	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+9003	9003	explain\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9004	9004	relocate\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9005	9005	and.*substring\(	2	0	0	1
+9006	9006	L_failedopentheme\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9007	9007	and.*substring\(	2	0	0	1
+9008	9008	messageString\x3D.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9009	9009	stconf.nsf.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D).+unescape	2	0	0	1
+9010	9010	\&(width|height)\=([2-9][0-9][0-9][0-9]*)	2	0	0	1
+9011	9011	post_id\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9012	9012	form\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9013	9013	form\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9014	9014	f\x3Dvsr\x27\x7C\x7C.+(or|and|select|delete|union|delete|update|insert)	2	0	0	1
+9015	9015	\x2Ephp\x3F.{0,300}\x3D(http\x3A|ftp\x3A|https\x3A|ftps\x3A)	2	0	0	1
+9016	9016	(\.\.\/){1}	2	0	0	1
+9017	9017	modname=((meta_)?certificate|link).+?\bINSERT\b.*?INTO\b	2	0	0	1
+9018	9018	modname=((meta_)?certificate|link).+?\bUPDATE\b.*?SET\b	2	0	0	1
+9019	9019	UNION\s+?SELECT	2	0	0	1
+9020	9020	UNION\s+?SELECT	2	0	0	1
+9021	9021	ccf_((clear|merge)_im|ex)port	2	0	0	1
+9022	9022	and.*substring\(	2	0	0	1
+9023	9023	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+9024	9024	^[^>]+\x22\s*http\x3a\x2f\x2f.+\.dtd	2	0	0	1
+9025	9025	^[^>]+\x22\s*ftp\x3a\x2f\x2f	2	0	0	1
+9026	9026	^[^>]+\x22\s*http\x3a\x2f\x2f.+\.dtd	2	0	0	1
+9027	9027	lien_2=\s*(ftps?|https?|php)\:\/	2	0	0	1
+9028	9028	root\_folder\_path=\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+9029	9029	root\_folder\_path=\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+9030	9030	root\_folder\_path=\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+9031	9031	fact_num\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9032	9032	sn\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9033	9033	ref\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9034	9034	userId\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9035	9035	having\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9036	9036	view\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9037	9037	query\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9038	9038	[&?]cmd=	2	0	0	1
+9039	9039	[&?]src=https?[^&]+\x24\x28	2	0	0	1
+9040	9040	^[^\r\n]*(%2(52e(%2(52e(%(c(0%af|1%9c)|(25)?2f)|5c|\/)|e(%(c(0%af|1%9c)|(25)?2f)|5c|\/))|\.(%(c(0%af|1%9c)|(25)?2f)|5c|\/))|e(%2(52e(%(c(0%af|1%9c)|(25)?2f)|5c|\/)|e(%(c(0%af|1%9c)|(25)?2f)|5c|\/))|\.(%(c(0%af|1%9c)|(25)?2f)|5c|\/)))|\.(%2(52e(%(c(0%af|1%9c)|(25)?2f)|5c|\/)|e(%(c(0%af|1%9c)|(25)?2f)|5c|\/))|\.(%(c(0%af|1%9c)|(25)?2f)|5c|\/)))	2	0	0	1
+9041	9041	^\d[\d\x2e]{255}	2	0	0	1
+9042	9042	[?&]id=\d*?[^\d]\d*?(&|$)	2	0	0	1
+9043	9043	&list\[fullordering\]=([a-zA-Z0-9])*[\x22\x27\x28]	2	0	0	1
+9044	9044	\.jsp\/[^\x2f]*$	2	0	0	1
+9045	9045	\.jspx\/[^\x2f]*$	2	0	0	1
+9046	9046	\.shtml\/[^\x2f]*$	2	0	0	1
+9047	9047	\.jsp\/[^\x2f]*$	2	0	0	1
+9048	9048	\.jspx\/[^\x2f]*$	2	0	0	1
+9049	9049	\.shtml\/[^\x2f]*$	2	0	0	1
+9050	9050	new\s+(java|org|sun)	2	0	0	1
+9051	9051	\/sem\/\w+\.php.*(\?|&)uniqueid=\d*\;	2	0	0	1
+9052	9052	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+9053	9053	^\s+SELECT	2	0	0	1
+9054	9054	(\.\.\/){1,}	2	0	0	1
+9055	9055	(\.\.\/){1,}	2	0	0	1
+9056	9056	^([a-zA-Z0-9_])*[\x2c\x22\x27\x28]	2	0	0	1
+9057	9057	.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9058	9058	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9059	9059	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+9060	9060	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9061	9061	\x2Fwp\x2Dadmin\x2Fadmin\x2Ephp.+page\x3D(\x2Fcollapsing\x2Darchives\x2Foptions\x2Etxt|akismet\x2Freadme\x2Etxt|related\x2Dways\x2Dto\x2Dtake\x2Daction\x2Foptions\x2Ephp|wp\x2Dsecurity\x2Dscan\x2Fsecurityscan\x2Ephp)	2	0	0	1
+9062	9062	id\x3d.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+9063	9063	^[^\r]*?name=[\x22\x27]image_file"\x3b[^(\r\n|\n|\r)]*?(\r\n|\n|\r)(\r\n|\n|\r)?Content-Type: application\/x-httpd-php	2	0	0	1
+9064	9064	^(\x28|%28)	2	0	0	1
+9065	9065	^\x22[^\x22]*\x7b[^\x22]*\x7d[^\x22]*\x22[^\x22]*\x22{2}	2	0	0	1
+9066	9066	^%(3B|0A|26|60|7C|24)	2	0	0	1
+9067	9067	^\s?.{0,100}(SELECT|UNION|CHAR|LONGVARCHAR|SCHEMA|FROM|WHERE|IFNULL|INSERT|UPDATE)	2	0	0	1
+9068	9068	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9069	9069	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+9070	9070	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+9071	9071	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+9072	9072	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+9073	9073	UPDATE.+SET	2	0	0	1
+9074	9074	source(\x22\x3b\w\x3a|%22%3b\w%3a)\d+(\x3a\x22|%3a%22)((ftps?|%66%74%70(%73)?)|(https?|%68%74%74%70(%73)?)|(php|%70%68%70))(\x3a|%3A)(\x2f|%2f)	2	0	0	1
+9075	9075	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+9076	9076	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5	2	0	0	1
+9077	9077	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980	2	0	0	1
+9078	9078	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E	2	0	0	1
+9079	9079	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333	2	0	0	1
+9080	9080	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C	2	0	0	1
+9081	9081	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E	2	0	0	1
+9082	9082	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+9083	9083	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+9084	9084	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+9085	9085	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08	2	0	0	1
+9086	9086	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42	2	0	0	1
+9087	9087	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4	2	0	0	1
+9088	9088	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980	2	0	0	1
+9089	9089	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3	2	0	0	1
+9090	9090	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980	2	0	0	1
+9091	9091	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB	2	0	0	1
+9092	9092	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+9093	9093	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+9094	9094	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664	2	0	0	1
+9095	9095	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C	2	0	0	1
+9096	9096	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980	2	0	0	1
+9097	9097	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+9098	9098	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+9099	9099	(EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters)	2	0	0	1
+9100	9100	(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+9101	9101	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+9102	9102	(ReadMolFile|SaveasMolFile)	2	0	0	1
+9103	9103	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+9104	9104	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+9105	9105	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C	2	0	0	1
+9106	9106	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+9107	9107	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+9108	9108	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000	2	0	0	1
+9109	9109	file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+9110	9110	[0-9]{3,}	2	0	0	1
+9111	9111	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194	2	0	0	1
+9112	9112	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2	2	0	0	1
+9113	9113	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510	2	0	0	1
+9114	9114	(setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch)	2	0	0	1
+9115	9115	param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20}	2	0	0	1
+9116	9116	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C	2	0	0	1
+9117	9117	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+9118	9118	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79	2	0	0	1
+9119	9119	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD	2	0	0	1
+9120	9120	(Text|EditSelText|EditText|CellFontName|Archive)	2	0	0	1
+9121	9121	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+9122	9122	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c	2	0	0	1
+9123	9123	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B	2	0	0	1
+9124	9124	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA	2	0	0	1
+9125	9125	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted)	2	0	0	1
+9126	9126	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam)	2	0	0	1
+9127	9127	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+9128	9128	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8	2	0	0	1
+9129	9129	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E	2	0	0	1
+9130	9130	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726	2	0	0	1
+9131	9131	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598	2	0	0	1
+9132	9132	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E	2	0	0	1
+9133	9133	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E	2	0	0	1
+9134	9134	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E	2	0	0	1
+9135	9135	(exe|bat|com|dll|ini)	2	0	0	1
+9136	9136	(exe|bat|com|dll|ini)	2	0	0	1
+9137	9137	(exe|bat|com|dll|ini)	2	0	0	1
+9138	9138	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E	2	0	0	1
+9139	9139	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7	2	0	0	1
+9140	9140	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91	2	0	0	1
+9141	9141	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980	2	0	0	1
+9142	9142	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02	2	0	0	1
+9143	9143	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3	2	0	0	1
+9144	9144	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90	2	0	0	1
+9145	9145	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E	2	0	0	1
+9146	9146	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E	2	0	0	1
+9147	9147	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112	2	0	0	1
+9148	9148	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1	2	0	0	1
+9149	9149	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6	2	0	0	1
+9150	9150	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F	2	0	0	1
+9151	9151	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+9152	9152	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA	2	0	0	1
+9153	9153	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258	2	0	0	1
+9154	9154	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B	2	0	0	1
+9155	9155	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1	2	0	0	1
+9156	9156	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7	2	0	0	1
+9157	9157	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D	2	0	0	1
+9158	9158	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61	2	0	0	1
+9159	9159	(Src|Background|PackageXml)	2	0	0	1
+9160	9160	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters)	2	0	0	1
+9161	9161	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+9162	9162	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+9163	9163	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+9164	9164	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+9165	9165	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755	2	0	0	1
+9166	9166	(Save|SaveLayoutChanges|SaveMenuUsageData)	2	0	0	1
+9167	9167	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61	2	0	0	1
+9168	9168	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+9169	9169	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+9170	9170	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+9171	9171	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+9172	9172	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0	2	0	0	1
+9173	9173	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3	2	0	0	1
+9174	9174	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679	2	0	0	1
+9175	9175	(SaveFile|ExportToXML)	2	0	0	1
+9176	9176	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE	2	0	0	1
+9177	9177	(SnapShotToFile|SnapShotX)	2	0	0	1
+9178	9178	(SnapShotToFile|SnapShotX)	2	0	0	1
+9179	9179	(SnapShotToFile|SnapShotX)	2	0	0	1
+9180	9180	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+9181	9181	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28	2	0	0	1
+9182	9182	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003	2	0	0	1
+9183	9183	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+9184	9184	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+9185	9185	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+9186	9186	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+9187	9187	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE	2	0	0	1
+9188	9188	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB	2	0	0	1
+9189	9189	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile)	2	0	0	1
+9190	9190	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD	2	0	0	1
+9191	9191	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA	2	0	0	1
+9192	9192	(Run|SetRegistryValueAsString|PerformUpdateAsync)	2	0	0	1
+9193	9193	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+9194	9194	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+9195	9195	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084	2	0	0	1
+9196	9196	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6	2	0	0	1
+9197	9197	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF	2	0	0	1
+9198	9198	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5	2	0	0	1
+9199	9199	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C	2	0	0	1
+9200	9200	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA	2	0	0	1
+9201	9201	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020	2	0	0	1
+9202	9202	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020	2	0	0	1
+9203	9203	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B	2	0	0	1
+9204	9204	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356	2	0	0	1
+9205	9205	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520	2	0	0	1
+9206	9206	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C	2	0	0	1
+9207	9207	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26	2	0	0	1
+9208	9208	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0	2	0	0	1
+9209	9209	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF	2	0	0	1
+9210	9210	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142	2	0	0	1
+9211	9211	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB	2	0	0	1
+9212	9212	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7	2	0	0	1
+9213	9213	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747	2	0	0	1
+9214	9214	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456	2	0	0	1
+9215	9215	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0	2	0	0	1
+9216	9216	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999	2	0	0	1
+9217	9217	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899	2	0	0	1
+9218	9218	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5	2	0	0	1
+9219	9219	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E	2	0	0	1
+9220	9220	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F	2	0	0	1
+9221	9221	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9	2	0	0	1
+9222	9222	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F	2	0	0	1
+9223	9223	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448	2	0	0	1
+9224	9224	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92	2	0	0	1
+9225	9225	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F	2	0	0	1
+9226	9226	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED	2	0	0	1
+9227	9227	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB	2	0	0	1
+9228	9228	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305	2	0	0	1
+9229	9229	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7	2	0	0	1
+9230	9230	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B	2	0	0	1
+9231	9231	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C	2	0	0	1
+9232	9232	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627	2	0	0	1
+9233	9233	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E	2	0	0	1
+9234	9234	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE	2	0	0	1
+9235	9235	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496	2	0	0	1
+9236	9236	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0	2	0	0	1
+9237	9237	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E	2	0	0	1
+9238	9238	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C	2	0	0	1
+9239	9239	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53	2	0	0	1
+9240	9240	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014	2	0	0	1
+9241	9241	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+9242	9242	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+9243	9243	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741	2	0	0	1
+9244	9244	(SaveToBMP|SaveToFile)	2	0	0	1
+9245	9245	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2	2	0	0	1
+9246	9246	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667	2	0	0	1
+9247	9247	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+9248	9248	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+9249	9249	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+9250	9250	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D	2	0	0	1
+9251	9251	(SaveBarCode|SaveEnhWMF)	2	0	0	1
+9252	9252	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B	2	0	0	1
+9253	9253	<object\s*[^>]*\s*classid\s*=\s*(.+<q1>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>)	2	0	0	1
+9254	9254	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000	2	0	0	1
+9255	9255	(exe|bat|com|dll|ini)	2	0	0	1
+9256	9256	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E	2	0	0	1
+9257	9257	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E	2	0	0	1
+9258	9258	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87	2	0	0	1
+9259	9259	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+9260	9260	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+9261	9261	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+9262	9262	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+9263	9263	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+9264	9264	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E	2	0	0	1
+9265	9265	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344	2	0	0	1
+9266	9266	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C	2	0	0	1
+9267	9267	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30	2	0	0	1
+9268	9268	(Packagefiles|SaveDna|SetIdentity|AddFile)	2	0	0	1
+9269	9269	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9	2	0	0	1
+9270	9270	(_DOWText)|(_MonthText)	2	0	0	1
+9271	9271	(SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour)	2	0	0	1
+9272	9272	classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE	2	0	0	1
+9273	9273	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+9274	9274	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+9275	9275	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F	2	0	0	1
+9276	9276	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5	2	0	0	1
+9277	9277	[\w\W]{2500,}	2	0	0	1
+9278	9278	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3	2	0	0	1
+9279	9279	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8	2	0	0	1
+9280	9280	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04	2	0	0	1
+9281	9281	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue)	2	0	0	1
+9282	9282	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356	2	0	0	1
+9283	9283	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E	2	0	0	1
+9284	9284	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574	2	0	0	1
+9285	9285	(WriteIniFileString|ShellExecute)	2	0	0	1
+9286	9286	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906	2	0	0	1
+9287	9287	(txt|ini|com|exe|bat|dll|dat)	2	0	0	1
+9288	9288	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8	2	0	0	1
+9289	9289	42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733	2	0	0	1
+9290	9290	(Save|ExportImage)	2	0	0	1
+9291	9291	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790	2	0	0	1
+9292	9292	(DeleteFile|write)	2	0	0	1
+9293	9293	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+9294	9294	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+9295	9295	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+9296	9296	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+9297	9297	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967	2	0	0	1
+9298	9298	WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext)	2	0	0	1
+9299	9299	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9	2	0	0	1
+9300	9300	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5	2	0	0	1
+9301	9301	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6	2	0	0	1
+9302	9302	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+9303	9303	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+9304	9304	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24	2	0	0	1
+9305	9305	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9	2	0	0	1
+9306	9306	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA	2	0	0	1
+9307	9307	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec)	2	0	0	1
+9308	9308	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5	2	0	0	1
+9309	9309	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+9310	9310	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+9311	9311	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+9312	9312	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83	2	0	0	1
+9313	9313	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA	2	0	0	1
+9314	9314	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566	2	0	0	1
+9315	9315	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+9316	9316	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+9317	9317	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B	2	0	0	1
+9318	9318	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F	2	0	0	1
+9319	9319	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+9320	9320	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+9321	9321	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED	2	0	0	1
+9322	9322	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619	2	0	0	1
+9323	9323	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E	2	0	0	1
+9324	9324	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258	2	0	0	1
+9325	9325	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196	2	0	0	1
+9326	9326	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E	2	0	0	1
+9327	9327	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD	2	0	0	1
+9328	9328	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4	2	0	0	1
+9329	9329	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118	2	0	0	1
+9330	9330	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616	2	0	0	1
+9331	9331	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+9332	9332	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+9333	9333	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+9334	9334	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11	2	0	0	1
+9335	9335	(ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1	2	0	0	1
+9336	9336	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020	2	0	0	1
+9337	9337	(PostURL|AddSeperator|AddString|Post)	2	0	0	1
+9338	9338	(SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF)	2	0	0	1
+9339	9339	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>)	2	0	0	1
+9340	9340	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\>	2	0	0	1
+9341	9341	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\>	2	0	0	1
+9342	9342	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\>	2	0	0	1
+9343	9343	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\>	2	0	0	1
+9344	9344	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+9345	9345	(Buildpath|GetDriveName|DriveExists|DeleteFile)	2	0	0	1
+9346	9346	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+9347	9347	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+9348	9348	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+9349	9349	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>)	2	0	0	1
+9350	9350	\x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission]	2	0	0	1
+9351	9351	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\>	2	0	0	1
+9352	9352	000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F	2	0	0	1
+9353	9353	(javascript|http|ftp|vbscript)	2	0	0	1
+9354	9354	(SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen)	2	0	0	1
+9355	9355	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000	2	0	0	1
+9356	9356	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407	2	0	0	1
+9357	9357	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414	2	0	0	1
+9358	9358	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+9359	9359	(AddAttachment|SubmitToExpress)	2	0	0	1
+9360	9360	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6	2	0	0	1
+9361	9361	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0	2	0	0	1
+9362	9362	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D	2	0	0	1
+9363	9363	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile)	2	0	0	1
+9364	9364	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\>	2	0	0	1
+9365	9365	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\>	2	0	0	1
+9366	9366	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC	2	0	0	1
+9367	9367	src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape	2	0	0	1
+9368	9368	(LogFile|ClearLogFile|SaveToFile)	2	0	0	1
+9369	9369	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)	2	0	0	1
+9370	9370	^User-Agent\x3a Downloader \d\.\d\r?$/Hm	2	0	0	1
+9371	9371	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P	2	0	0	1
+9372	9372	^((\r?\n\r?\n).)*?\r?\n\r?\nMZ	2	0	0	1
+9373	9373	instructions\/\d{2}\.xml	2	0	0	1
+9374	9374	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp	2	0	0	1
+9375	9375	\/updatestats\/update\d+?\.xml$	2	0	0	1
+9376	9376	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab	2	0	0	1
+9377	9377	ctxad-\d+\.sig	2	0	0	1
+9378	9378	/user\d+/counter\.htm	2	0	0	1
+9379	9379	(cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr	2	0	0	1
+9380	9380	(discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe	2	0	0	1
+9381	9381	loaderadv\d+\.jar	2	0	0	1
+9382	9382	\/adv\/\d+\/win32\.exe	2	0	0	1
+9383	9383	\/Message\/\S+\/\S+\.xml	2	0	0	1
+9384	9384	\/abt\?data=\S{150}	2	0	0	1
+9385	9385	^User-Agent\x3a.+ZangoToolbar.+\r$/Hmi	2	0	0	1
+9386	9386	User-Agent\:[^\n]+wbi_v\d/iH	2	0	0	1
+9387	9387	User-Agent\x3a[^\n]+AskBar/iH	2	0	0	1
+9388	9388	\/tbrequest\d+\.php	2	0	0	1
+9389	9389	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+9390	9390	sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+9391	9391	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+9392	9392	cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+9393	9393	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+9394	9394	UID=\d	2	0	0	1
+9395	9395	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+9396	9396	REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P	2	0	0	1
+9397	9397	victim\.php\?\d\d\d\d\d	2	0	0	1
+9398	9398	\/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d	2	0	0	1
+9399	9399	\/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+	2	0	0	1
+9400	9400	&ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d	2	0	0	1
+9401	9401	\/sd\?s=\d+&f=\d&C=\d	2	0	0	1
+9402	9402	\.txt$	2	0	0	1
+9403	9403	\.cfg$	2	0	0	1
+9404	9404	User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H	2	0	0	1
+9405	9405	^Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r?$/Hi	2	0	0	1
+9406	9406	\x00[\x02-\x1E][0-9]{2,30}\x02cn\x00	2	0	0	1
+9407	9407	\x00[\x02-\x1E][0-9]{2,30}\x02ru\x00	2	0	0	1
+9408	9408	^[A-F0-9]+$	2	0	0	1
+9409	9409	\/sd\?s=\d+&f=\d	2	0	0	1
+9410	9410	loadadv\d+\.exe	2	0	0	1
+9411	9411	\/ms\d\d\dcfg\.jsp	2	0	0	1
+9412	9412	^0x[0-9a-f]+$	2	0	0	1
+9413	9413	^[^a-z]*?[0-9]{2,30}\.ru$	2	0	0	1
+9414	9414	filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe	2	0	0	1
+9415	9415	^MM \d\.\d+$	2	0	0	1
+9416	9416	^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4}	2	0	0	1
+9417	9417	^\w+pcsetup_\w+	2	0	0	1
+9418	9418	\x2Fv[0-9]{3,4}[\x2F\x3F]	2	0	0	1
+9419	9419	[a-f0-9]{32}\?v=	2	0	0	1
+9420	9420	^\/[a-z]{2}\x3Fv\x3D[0-9]$	2	0	0	1
+9421	9421	^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$	2	0	0	1
+9422	9422	^\/entrance\?s1=[a-f0-9]{100,}$	2	0	0	1
+9423	9423	^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=	2	0	0	1
+9424	9424	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+9425	9425	^[0-9][a-z]+	2	0	0	1
+9426	9426	\.php$	2	0	0	1
+9427	9427	^\/([^\x2f]+\/)*log\/\?[bc]=	2	0	0	1
+9428	9428	^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/))	2	0	0	1
+9429	9429	^\/\?pcrc=\d+&v=[\d.]+$	2	0	0	1
+9430	9430	^\/\?v=[\d.]+&pcrc=\d+$	2	0	0	1
+9431	9431	\/v\d\/[^.]+\.asp$	2	0	0	1
+9432	9432	\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$	2	0	0	1
+9433	9433	\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$	2	0	0	1
+9434	9434	^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$	2	0	0	1
+9435	9435	^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$	2	0	0	1
+9436	9436	\?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})	2	0	0	1
+9437	9437	^Downloader\s\d+\.\d+$	2	0	0	1
+9438	9438	^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100}	2	0	0	1
+9439	9439	\/get_xml\?(file_id|stb)=	2	0	0	1
+9440	9440	(_[a-z]{2}){1,3}_[a-z]{3}_install\.exe	2	0	0	1
+9441	9441	\d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows	2	0	0	1
+9442	9442	^[a-zA-Z0-9_-]+$	2	0	0	1
+9443	9443	^\/([a-zA-Z0-9]|%2[fb]){400,}$	2	0	0	1
+9444	9444	User-Agent\:[^\n]+searchengine	2	0	0	1
+9445	9445	User-Agent\:[^\n]+SurferPlugin	2	0	0	1
+9446	9446	User-Agent\:[^\n]+THNALL[^\n]+\.EXE	2	0	0	1
+9447	9447	User-Agent\:[^\n]+XupiterToolbar	2	0	0	1
+9448	9448	User-Agent\:[^\n]+spywareaxe	2	0	0	1
+9449	9449	User-Agent\:[^\n]+iMeshBar	2	0	0	1
+9450	9450	User-Agent\:[^\n]+Oemji	2	0	0	1
+9451	9451	^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$	2	0	0	1
+9452	9452	^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$	2	0	0	1
+9453	9453	^\/(get|install)\/\?q=	2	0	0	1
+9454	9454	^\/[a-f0-9]{50,}$	2	0	0	1
+9455	9455	^\/[\w-]{50,}$	2	0	0	1
+9456	9456	^\/\?pcrc=[0-9]{7,10}$	2	0	0	1
+9457	9457	^Downloader \d\.\d$	2	0	0	1
+9458	9458	\/Socks[45]\.txt$	2	0	0	1
+9459	9459	^Feat[^\r\n]+(Install|Updat)er	2	0	0	1
+9460	9460	User-Agent\:[^\n]+host(ie|oe|oi|ol)	2	0	0	1
+9461	9461	User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}	2	0	0	1
+9462	9462	^BWL(\sToplist|\d_UPDATE)	2	0	0	1
+9463	9463	^\x2F[A-F0-9]{25,40}$	2	0	0	1
+9464	9464	^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$	2	0	0	1
+9465	9465	^\d+\sHTTP/1.1$	2	0	0	1
+9466	9466	^[a-zA-Z0-9_-]+	2	0	0	1
+9467	9467	[a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12}	2	0	0	1
+9468	9468	\/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id=	2	0	0	1
+9469	9469	\{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\}	2	0	0	1
+9470	9470	CN=([^\r\n]+?\.)?showmypc\.com(\.)	2	0	0	1
+9471	9471	^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$	2	0	0	1
+9472	9472	(SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk)	2	0	0	1
+9473	9473	(DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog)	2	0	0	1
+9474	9474	\d{13}$	2	0	0	1
+9475	9475	^[a-f0-9]{32}	2	0	0	1
+9476	9476	^[a-f0-9]{32}\"	2	0	0	1
+9477	9477	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+9478	9478	^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}	2	0	0	1
+9479	9479	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+9480	9480	^[A-F0-9]{12}	2	0	0	1
+9481	9481	^[A-Z0-9]{9}	2	0	0	1
+9482	9482	^\d+[^\r\n\s]+	2	0	0	1
+9483	9483	^ SQL[-_ ]Server	2	0	0	1
+9484	9484	^ \d+ Driver	2	0	0	1
+9485	9485	ORA-\d{4}	2	0	0	1
+9486	9486	Warning.*\Woci_	2	0	0	1
+9487	9487	Warning.*\Wora_	2	0	0	1
+9488	9488	CLI Driver.*DB2	2	0	0	1
+9489	9489	bdb2_\w+\(	2	0	0	1
+9490	9490	Exception.*Informix	2	0	0	1
+9491	9491	Warning.*SQLite3::	2	0	0	1
+9492	9492	SQL error.*POS\([0-9]+\)	2	0	0	1
+9493	9493	Warning.*maxdb	2	0	0	1
+9494	9494	i?Warning.*sybase	2	0	0	1
+9495	9495	Warning.*ingres_	2	0	0	1
+9496	9496	Warning.*sqlite_	2	0	0	1
+9497	9497	Ingres\W.*Driver	2	0	0	1
+9498	9498	Exception (condition )\d+\. Transaction rollback\.	2	0	0	1
+9499	9499	SQL Server.*?error \x27[0-9a-f]{8}	2	0	0	1
+9500	9500	^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$	2	0	0	1
+9501	9501	^(<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll	2	0	0	1
+9502	9502	^...\x30\x82..\x02\x82...{256,257}	2	0	0	1
+9503	9503	\/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php	2	0	0	1
+9504	9504	\/notify\/(single|mass)$	2	0	0	1
+9505	9505	a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php)	2	0	0	1
+9506	9506	Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a	2	0	0	1
+9507	9507	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+9508	9508	[-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10}	2	0	0	1
+9509	9509	^\d+(\+|\-|\\|\*)\d+	2	0	0	1
+9510	9510	^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9	2	0	0	1
+9511	9511	^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u	2	0	0	1
+9512	9512	ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b	2	0	0	1
+9513	9513	^\d{4}[01]	2	0	0	1
+9514	9514	^\d{4}[01]	2	0	0	1
+9515	9515	^\d{4}[01]	2	0	0	1
+9516	9516	^\d{4}[01]	2	0	0	1
+9517	9517	^\d{4}[01]	2	0	0	1
+9518	9518	^\d{4}[01]	2	0	0	1
+9519	9519	^\d{4}[01]	2	0	0	1
+9520	9520	^\d{4}[01]	2	0	0	1
+9521	9521	^\d{4}[01]	2	0	0	1
+9522	9522	^\d{4}[01]	2	0	0	1
+9523	9523	^\d{4}[01]	2	0	0	1
+9524	9524	^\d{4}[01]	2	0	0	1
+9525	9525	^\d{4}[01]	2	0	0	1
+9526	9526	^\d{4}[01]	2	0	0	1
+9527	9527	^\d{4}[01]	2	0	0	1
+9528	9528	^\d{4}[01]	2	0	0	1
+9529	9529	^\d{4}[01]	2	0	0	1
+9530	9530	^\d{4}[01]	2	0	0	1
+9531	9531	^\d{4}[01]	2	0	0	1
+9532	9532	^\d{4}[01]	2	0	0	1
+9533	9533	^\d{4}[01]	2	0	0	1
+9534	9534	^\d{4}[01]	2	0	0	1
+9535	9535	^\d{4}[01]	2	0	0	1
+9536	9536	^\d{4}[01]	2	0	0	1
+9537	9537	^\d{4}[01]	2	0	0	1
+9538	9538	^\d{4}[01]	2	0	0	1
+9539	9539	^\d{4}[01]	2	0	0	1
+9540	9540	^\d{4}[01]	2	0	0	1
+9541	9541	^\d{4}[01]	2	0	0	1
+9542	9542	^\d{4}[01]	2	0	0	1
+9543	9543	^\d{4}[01]	2	0	0	1
+9544	9544	^\d{4}[01]	2	0	0	1
+9545	9545	^\d{4}[01]	2	0	0	1
+9546	9546	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9547	9547	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9548	9548	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9549	9549	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9550	9550	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9551	9551	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9552	9552	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9553	9553	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9554	9554	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9555	9555	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9556	9556	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9557	9557	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9558	9558	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9559	9559	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9560	9560	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9561	9561	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9562	9562	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9563	9563	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9564	9564	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9565	9565	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9566	9566	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9567	9567	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9568	9568	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9569	9569	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9570	9570	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9571	9571	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9572	9572	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9573	9573	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9574	9574	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9575	9575	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9576	9576	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9577	9577	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9578	9578	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9579	9579	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9580	9580	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9581	9581	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9582	9582	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9583	9583	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9584	9584	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9585	9585	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9586	9586	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9587	9587	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9588	9588	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9589	9589	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9590	9590	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9591	9591	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9592	9592	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9593	9593	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9594	9594	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9595	9595	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9596	9596	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9597	9597	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9598	9598	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9599	9599	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9600	9600	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9601	9601	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9602	9602	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9603	9603	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9604	9604	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9605	9605	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9606	9606	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9607	9607	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9608	9608	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9609	9609	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9610	9610	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9611	9611	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9612	9612	^\d{4}[01]	2	0	0	1
+9613	9613	^\d{4}[01]	2	0	0	1
+9614	9614	^\d{4}[01]	2	0	0	1
+9615	9615	^\d{4}[01]	2	0	0	1
+9616	9616	^\d{4}[01]	2	0	0	1
+9617	9617	^\d{4}[01]	2	0	0	1
+9618	9618	^\d{4}[01]	2	0	0	1
+9619	9619	^\d{4}[01]	2	0	0	1
+9620	9620	^\d{4}[01]	2	0	0	1
+9621	9621	^\d{4}[01]	2	0	0	1
+9622	9622	^\d{4}[01]	2	0	0	1
+9623	9623	^\d{4}[01]	2	0	0	1
+9624	9624	^\d{4}[01]	2	0	0	1
+9625	9625	^\d{4}[01]	2	0	0	1
+9626	9626	^\d{4}[01]	2	0	0	1
+9627	9627	^\d{4}[01]	2	0	0	1
+9628	9628	^\d{4}[01]	2	0	0	1
+9629	9629	^\d{4}[01]	2	0	0	1
+9630	9630	^\d{4}[01]	2	0	0	1
+9631	9631	^\d{4}[01]	2	0	0	1
+9632	9632	^\d{4}[01]	2	0	0	1
+9633	9633	^\d{4}[01]	2	0	0	1
+9634	9634	^\d{4}[01]	2	0	0	1
+9635	9635	^\d{4}[01]	2	0	0	1
+9636	9636	^\d{4}[01]	2	0	0	1
+9637	9637	^\d{4}[01]	2	0	0	1
+9638	9638	^\d{4}[01]	2	0	0	1
+9639	9639	^\d{4}[01]	2	0	0	1
+9640	9640	^\d{4}[01]	2	0	0	1
+9641	9641	^\d{4}[01]	2	0	0	1
+9642	9642	^\d{4}[01]	2	0	0	1
+9643	9643	^\d{4}[01]	2	0	0	1
+9644	9644	^\d{4}[01]	2	0	0	1
+9645	9645	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9646	9646	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9647	9647	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9648	9648	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9649	9649	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9650	9650	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9651	9651	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9652	9652	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9653	9653	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9654	9654	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9655	9655	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9656	9656	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9657	9657	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9658	9658	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9659	9659	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9660	9660	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9661	9661	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9662	9662	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9663	9663	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9664	9664	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9665	9665	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9666	9666	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9667	9667	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9668	9668	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9669	9669	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9670	9670	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9671	9671	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9672	9672	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9673	9673	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9674	9674	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9675	9675	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9676	9676	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9677	9677	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9678	9678	^\d{4}[01]	2	0	0	1
+9679	9679	^\d{4}[01]	2	0	0	1
+9680	9680	^\d{4}[01]	2	0	0	1
+9681	9681	^\d{4}[01]	2	0	0	1
+9682	9682	^\d{4}[01]	2	0	0	1
+9683	9683	^\d{4}[01]	2	0	0	1
+9684	9684	^\d{4}[01]	2	0	0	1
+9685	9685	^\d{4}[01]	2	0	0	1
+9686	9686	^\d{4}[01]	2	0	0	1
+9687	9687	^\d{4}[01]	2	0	0	1
+9688	9688	^\d{4}[01]	2	0	0	1
+9689	9689	^\d{4}[01]	2	0	0	1
+9690	9690	^\d{4}[01]	2	0	0	1
+9691	9691	^\d{4}[01]	2	0	0	1
+9692	9692	^\d{4}[01]	2	0	0	1
+9693	9693	^\d{4}[01]	2	0	0	1
+9694	9694	^\d{4}[01]	2	0	0	1
+9695	9695	^\d{4}[01]	2	0	0	1
+9696	9696	^\d{4}[01]	2	0	0	1
+9697	9697	^\d{4}[01]	2	0	0	1
+9698	9698	^\d{4}[01]	2	0	0	1
+9699	9699	^\d{4}[01]	2	0	0	1
+9700	9700	^\d{4}[01]	2	0	0	1
+9701	9701	^\d{4}[01]	2	0	0	1
+9702	9702	^\d{4}[01]	2	0	0	1
+9703	9703	^\d{4}[01]	2	0	0	1
+9704	9704	^\d{4}[01]	2	0	0	1
+9705	9705	^\d{4}[01]	2	0	0	1
+9706	9706	^\d{4}[01]	2	0	0	1
+9707	9707	^\d{4}[01]	2	0	0	1
+9708	9708	^\d{4}[01]	2	0	0	1
+9709	9709	^\d{4}[01]	2	0	0	1
+9710	9710	^\d{4}[01]	2	0	0	1
+9711	9711	^\d{4}[01]	2	0	0	1
+9712	9712	^\d{4}[01]	2	0	0	1
+9713	9713	^\d{4}[01]	2	0	0	1
+9714	9714	^\d{4}[01]	2	0	0	1
+9715	9715	^\d{4}[01]	2	0	0	1
+9716	9716	^\d{4}[01]	2	0	0	1
+9717	9717	^\d{4}[01]	2	0	0	1
+9718	9718	^\d{4}[01]	2	0	0	1
+9719	9719	^\d{4}[01]	2	0	0	1
+9720	9720	^\d{4}[01]	2	0	0	1
+9721	9721	^\d{4}[01]	2	0	0	1
+9722	9722	^\d{4}[01]	2	0	0	1
+9723	9723	^\d{4}[01]	2	0	0	1
+9724	9724	^\d{4}[01]	2	0	0	1
+9725	9725	^\d{4}[01]	2	0	0	1
+9726	9726	^\d{4}[01]	2	0	0	1
+9727	9727	^\d{4}[01]	2	0	0	1
+9728	9728	^\d{4}[01]	2	0	0	1
+9729	9729	^\d{4}[01]	2	0	0	1
+9730	9730	^\d{4}[01]	2	0	0	1
+9731	9731	^\d{4}[01]	2	0	0	1
+9732	9732	^\d{4}[01]	2	0	0	1
+9733	9733	^\d{4}[01]	2	0	0	1
+9734	9734	^\d{4}[01]	2	0	0	1
+9735	9735	^\d{4}[01]	2	0	0	1
+9736	9736	^\d{4}[01]	2	0	0	1
+9737	9737	^\d{4}[01]	2	0	0	1
+9738	9738	^\d{4}[01]	2	0	0	1
+9739	9739	^\d{4}[01]	2	0	0	1
+9740	9740	^\d{4}[01]	2	0	0	1
+9741	9741	^\d{4}[01]	2	0	0	1
+9742	9742	^\d{4}[01]	2	0	0	1
+9743	9743	^\d{4}[01]	2	0	0	1
+9744	9744	^\d{4}[01]	2	0	0	1
+9745	9745	^\d{4}[01]	2	0	0	1
+9746	9746	^\d{4}[01]	2	0	0	1
+9747	9747	^\d{4}[01]	2	0	0	1
+9748	9748	^\d{4}[01]	2	0	0	1
+9749	9749	^\d{4}[01]	2	0	0	1
+9750	9750	^\d{4}[01]	2	0	0	1
+9751	9751	^\d{4}[01]	2	0	0	1
+9752	9752	^\d{4}[01]	2	0	0	1
+9753	9753	^\d{4}[01]	2	0	0	1
+9754	9754	^\d{4}[01]	2	0	0	1
+9755	9755	^\d{4}[01]	2	0	0	1
+9756	9756	^\d{4}[01]	2	0	0	1
+9757	9757	^\d{4}[01]	2	0	0	1
+9758	9758	^\d{4}[01]	2	0	0	1
+9759	9759	^\d{4}[01]	2	0	0	1
+9760	9760	^\d{4}[01]	2	0	0	1
+9761	9761	^\d{4}[01]	2	0	0	1
+9762	9762	^\d{4}[01]	2	0	0	1
+9763	9763	^\d{4}[01]	2	0	0	1
+9764	9764	^\d{4}[01]	2	0	0	1
+9765	9765	^\d{4}[01]	2	0	0	1
+9766	9766	^\d{4}[01]	2	0	0	1
+9767	9767	^\d{4}[01]	2	0	0	1
+9768	9768	^\d{4}[01]	2	0	0	1
+9769	9769	^\d{4}[01]	2	0	0	1
+9770	9770	^\d{4}[01]	2	0	0	1
+9771	9771	^\d{4}[01]	2	0	0	1
+9772	9772	^\d{4}[01]	2	0	0	1
+9773	9773	^\d{4}[01]	2	0	0	1
+9774	9774	^\d{4}[01]	2	0	0	1
+9775	9775	^\d{4}[01]	2	0	0	1
+9776	9776	^\d{4}[01]	2	0	0	1
+9777	9777	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9778	9778	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9779	9779	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9780	9780	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9781	9781	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9782	9782	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9783	9783	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9784	9784	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9785	9785	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9786	9786	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9787	9787	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9788	9788	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9789	9789	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9790	9790	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9791	9791	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9792	9792	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9793	9793	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9794	9794	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9795	9795	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9796	9796	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9797	9797	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9798	9798	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9799	9799	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9800	9800	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9801	9801	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9802	9802	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9803	9803	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9804	9804	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9805	9805	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9806	9806	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9807	9807	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9808	9808	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9809	9809	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9810	9810	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9811	9811	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9812	9812	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9813	9813	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9814	9814	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9815	9815	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9816	9816	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9817	9817	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9818	9818	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9819	9819	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9820	9820	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9821	9821	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9822	9822	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9823	9823	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9824	9824	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9825	9825	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9826	9826	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9827	9827	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9828	9828	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9829	9829	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9830	9830	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9831	9831	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9832	9832	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9833	9833	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9834	9834	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9835	9835	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9836	9836	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9837	9837	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9838	9838	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9839	9839	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9840	9840	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9841	9841	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9842	9842	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9843	9843	^\d{4}[01]	2	0	0	1
+9844	9844	^\d{4}[01]	2	0	0	1
+9845	9845	^\d{4}[01]	2	0	0	1
+9846	9846	^\d{4}[01]	2	0	0	1
+9847	9847	^\d{4}[01]	2	0	0	1
+9848	9848	^\d{4}[01]	2	0	0	1
+9849	9849	^\d{4}[01]	2	0	0	1
+9850	9850	^\d{4}[01]	2	0	0	1
+9851	9851	^\d{4}[01]	2	0	0	1
+9852	9852	^\d{4}[01]	2	0	0	1
+9853	9853	^\d{4}[01]	2	0	0	1
+9854	9854	^\d{4}[01]	2	0	0	1
+9855	9855	^\d{4}[01]	2	0	0	1
+9856	9856	^\d{4}[01]	2	0	0	1
+9857	9857	^\d{4}[01]	2	0	0	1
+9858	9858	^\d{4}[01]	2	0	0	1
+9859	9859	^\d{4}[01]	2	0	0	1
+9860	9860	^\d{4}[01]	2	0	0	1
+9861	9861	^\d{4}[01]	2	0	0	1
+9862	9862	^\d{4}[01]	2	0	0	1
+9863	9863	^\d{4}[01]	2	0	0	1
+9864	9864	^\d{4}[01]	2	0	0	1
+9865	9865	^\d{4}[01]	2	0	0	1
+9866	9866	^\d{4}[01]	2	0	0	1
+9867	9867	^\d{4}[01]	2	0	0	1
+9868	9868	^\d{4}[01]	2	0	0	1
+9869	9869	^\d{4}[01]	2	0	0	1
+9870	9870	^\d{4}[01]	2	0	0	1
+9871	9871	^\d{4}[01]	2	0	0	1
+9872	9872	^\d{4}[01]	2	0	0	1
+9873	9873	^\d{4}[01]	2	0	0	1
+9874	9874	^\d{4}[01]	2	0	0	1
+9875	9875	^\d{4}[01]	2	0	0	1
+9876	9876	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9877	9877	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9878	9878	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9879	9879	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9880	9880	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9881	9881	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9882	9882	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9883	9883	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9884	9884	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9885	9885	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9886	9886	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9887	9887	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9888	9888	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9889	9889	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9890	9890	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9891	9891	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9892	9892	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9893	9893	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9894	9894	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9895	9895	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9896	9896	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9897	9897	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9898	9898	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9899	9899	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9900	9900	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9901	9901	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9902	9902	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9903	9903	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9904	9904	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9905	9905	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9906	9906	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9907	9907	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9908	9908	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9909	9909	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9910	9910	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9911	9911	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9912	9912	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9913	9913	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9914	9914	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9915	9915	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9916	9916	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9917	9917	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9918	9918	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9919	9919	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9920	9920	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9921	9921	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9922	9922	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9923	9923	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9924	9924	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9925	9925	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9926	9926	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9927	9927	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9928	9928	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9929	9929	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9930	9930	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9931	9931	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9932	9932	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9933	9933	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9934	9934	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9935	9935	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9936	9936	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9937	9937	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9938	9938	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9939	9939	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9940	9940	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9941	9941	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9942	9942	^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+9943	9943	^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+9944	9944	\x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,}	2	0	0	1
+9945	9945	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+9946	9946	appid\x3a\s+2	2	0	0	1
+9947	9947	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+9948	9948	\x22mining\x2E(subscribe|authorize)\x22	2	0	0	1
+9949	9949	^\s*(<var>[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start	2	0	0	1
+9950	9950	^\/api\/(bit|lite)coin\/balance\/	2	0	0	1
+9951	9951	miner[^a-z]	2	0	0	1
+9952	9952	(\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22)	2	0	0	1
+9953	9953	(\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22)	2	0	0	1
+9954	9954	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+9955	9955	\/tmp\/[^\/]+\.swf$	2	0	0	1
+9956	9956	name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22	2	0	0	1
+9957	9957	name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22	2	0	0	1
+9958	9958	=[0-9a-f]{8}\.jar/H	2	0	0	1
+9959	9959	^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\?	2	0	0	1
+9960	9960	^\/[a-z0-9]{32}\?s=1$	2	0	0	1
+9961	9961	^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))	2	0	0	1
+9962	9962	^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>]	2	0	0	1
+9963	9963	^(mous)?\.class	2	0	0	1
+9964	9964	\/chrome\/google_chrome_(update|installer)\.exe$	2	0	0	1
+9965	9965	^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+9966	9966	^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P	2	0	0	1
+9967	9967	findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$	2	0	0	1
+9968	9968	^[^=]+[^\x22\x27\x3b]*?(<q>[\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m	2	0	0	1
+9969	9969	\.php\?cashe=\d+$	2	0	0	1
+9970	9970	\.jar\?m=[1-2]$	2	0	0	1
+9971	9971	\.pdf\?p=1&s=[1-2]$	2	0	0	1
+9972	9972	^Host\x3a [^\r\n]+?\.bit\r\n$/Hmi	2	0	0	1
+9973	9973	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[^\/\.]+$	2	0	0	1
+9974	9974	\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$	2	0	0	1
+9975	9975	\/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+9976	9976	\/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+9977	9977	\/tds\/[a-f0-9]{32}$	2	0	0	1
+9978	9978	^[a-f0-9]{32}[\x22\x27]	2	0	0	1
+9979	9979	Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi	2	0	0	1
+9980	9980	(\.\.\/)+kboxwww\/tmp\/	2	0	0	1
+9981	9981	^(<var>.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22	2	0	0	1
+9982	9982	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+9983	9983	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+9984	9984	\/\?[0-9a-f]{60,66}[\;\d\x2c]*$	2	0	0	1
+9985	9985	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15}	2	0	0	1
+9986	9986	\/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php	2	0	0	1
+9987	9987	debugenableplugins=[a-zA-Z0-9]+?\x3b	2	0	0	1
+9988	9988	^\/[a-z0-9]+\/load\.php$	2	0	0	1
+9989	9989	^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H	2	0	0	1
+9990	9990	^\/xteas\/code$	2	0	0	1
+9991	9991	\/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash=	2	0	0	1
+9992	9992	=\w{8}\.pdf/Hi	2	0	0	1
+9993	9993	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[A-Za-z0-9]+$	2	0	0	1
+9994	9994	^User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$/H	2	0	0	1
+9995	9995	^Host\x3a\s.+\.in\r?$/Hmi	2	0	0	1
+9996	9996	name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22	2	0	0	1
+9997	9997	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+9998	9998	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+9999	9999	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+10000	10000	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
\ No newline at end of file
diff --git a/test/benchmark/regex_rules/REGEX_15K b/test/benchmark/regex_rules/REGEX_15K
new file mode 100644
index 0000000..28fe790
--- /dev/null
+++ b/test/benchmark/regex_rules/REGEX_15K
@@ -0,0 +1,15001 @@
+150000
+1	1	User-Agent:\s.*.abc.net	2	0	0	1
+2	2	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5	2	0	0	1
+3	3	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980	2	0	0	1
+4	4	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E	2	0	0	1
+5	5	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333	2	0	0	1
+6	6	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C	2	0	0	1
+7	7	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E	2	0	0	1
+8	8	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+9	9	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+10	10	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+11	11	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08	2	0	0	1
+12	12	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42	2	0	0	1
+13	13	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4	2	0	0	1
+14	14	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980	2	0	0	1
+15	15	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3	2	0	0	1
+16	16	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980	2	0	0	1
+17	17	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB	2	0	0	1
+18	18	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+19	19	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+20	20	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664	2	0	0	1
+21	21	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C	2	0	0	1
+22	22	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980	2	0	0	1
+23	23	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+24	24	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+25	25	(EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters)	2	0	0	1
+26	26	(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+27	27	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+28	28	(ReadMolFile|SaveasMolFile)	2	0	0	1
+29	29	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+30	30	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+31	31	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C	2	0	0	1
+32	32	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+33	33	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+34	34	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000	2	0	0	1
+35	35	file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+36	36	[0-9]{3,}	2	0	0	1
+37	37	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194	2	0	0	1
+38	38	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2	2	0	0	1
+39	39	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510	2	0	0	1
+40	40	(setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch)	2	0	0	1
+41	41	param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20}	2	0	0	1
+42	42	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C	2	0	0	1
+43	43	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+44	44	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79	2	0	0	1
+45	45	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD	2	0	0	1
+46	46	(Text|EditSelText|EditText|CellFontName|Archive)	2	0	0	1
+47	47	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+48	48	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c	2	0	0	1
+49	49	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B	2	0	0	1
+50	50	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA	2	0	0	1
+51	51	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted)	2	0	0	1
+52	52	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam)	2	0	0	1
+53	53	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+54	54	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8	2	0	0	1
+55	55	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E	2	0	0	1
+56	56	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726	2	0	0	1
+57	57	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598	2	0	0	1
+58	58	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E	2	0	0	1
+59	59	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E	2	0	0	1
+60	60	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E	2	0	0	1
+61	61	(exe|bat|com|dll|ini)	2	0	0	1
+62	62	(exe|bat|com|dll|ini)	2	0	0	1
+63	63	(exe|bat|com|dll|ini)	2	0	0	1
+64	64	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E	2	0	0	1
+65	65	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7	2	0	0	1
+66	66	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91	2	0	0	1
+67	67	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980	2	0	0	1
+68	68	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02	2	0	0	1
+69	69	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3	2	0	0	1
+70	70	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90	2	0	0	1
+71	71	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E	2	0	0	1
+72	72	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E	2	0	0	1
+73	73	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112	2	0	0	1
+74	74	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1	2	0	0	1
+75	75	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6	2	0	0	1
+76	76	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F	2	0	0	1
+77	77	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+78	78	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA	2	0	0	1
+79	79	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258	2	0	0	1
+80	80	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B	2	0	0	1
+81	81	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1	2	0	0	1
+82	82	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7	2	0	0	1
+83	83	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D	2	0	0	1
+84	84	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61	2	0	0	1
+85	85	(Src|Background|PackageXml)	2	0	0	1
+86	86	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters)	2	0	0	1
+87	87	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+88	88	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+89	89	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+90	90	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+91	91	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755	2	0	0	1
+92	92	(Save|SaveLayoutChanges|SaveMenuUsageData)	2	0	0	1
+93	93	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61	2	0	0	1
+94	94	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+95	95	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+96	96	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+97	97	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+98	98	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0	2	0	0	1
+99	99	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3	2	0	0	1
+100	100	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679	2	0	0	1
+101	101	(SaveFile|ExportToXML)	2	0	0	1
+102	102	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE	2	0	0	1
+103	103	(SnapShotToFile|SnapShotX)	2	0	0	1
+104	104	(SnapShotToFile|SnapShotX)	2	0	0	1
+105	105	(SnapShotToFile|SnapShotX)	2	0	0	1
+106	106	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+107	107	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28	2	0	0	1
+108	108	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003	2	0	0	1
+109	109	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+110	110	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+111	111	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+112	112	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+113	113	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE	2	0	0	1
+114	114	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB	2	0	0	1
+115	115	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile)	2	0	0	1
+116	116	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD	2	0	0	1
+117	117	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA	2	0	0	1
+118	118	(Run|SetRegistryValueAsString|PerformUpdateAsync)	2	0	0	1
+119	119	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+120	120	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+121	121	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084	2	0	0	1
+122	122	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6	2	0	0	1
+123	123	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF	2	0	0	1
+124	124	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5	2	0	0	1
+125	125	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C	2	0	0	1
+126	126	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA	2	0	0	1
+127	127	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020	2	0	0	1
+128	128	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020	2	0	0	1
+129	129	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B	2	0	0	1
+130	130	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356	2	0	0	1
+131	131	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520	2	0	0	1
+132	132	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C	2	0	0	1
+133	133	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26	2	0	0	1
+134	134	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0	2	0	0	1
+135	135	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF	2	0	0	1
+136	136	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142	2	0	0	1
+137	137	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB	2	0	0	1
+138	138	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7	2	0	0	1
+139	139	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747	2	0	0	1
+140	140	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456	2	0	0	1
+141	141	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0	2	0	0	1
+142	142	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999	2	0	0	1
+143	143	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899	2	0	0	1
+144	144	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5	2	0	0	1
+145	145	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E	2	0	0	1
+146	146	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F	2	0	0	1
+147	147	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9	2	0	0	1
+148	148	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F	2	0	0	1
+149	149	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448	2	0	0	1
+150	150	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92	2	0	0	1
+151	151	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F	2	0	0	1
+152	152	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED	2	0	0	1
+153	153	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB	2	0	0	1
+154	154	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305	2	0	0	1
+155	155	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7	2	0	0	1
+156	156	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B	2	0	0	1
+157	157	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C	2	0	0	1
+158	158	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627	2	0	0	1
+159	159	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E	2	0	0	1
+160	160	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE	2	0	0	1
+161	161	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496	2	0	0	1
+162	162	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0	2	0	0	1
+163	163	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E	2	0	0	1
+164	164	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C	2	0	0	1
+165	165	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53	2	0	0	1
+166	166	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014	2	0	0	1
+167	167	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+168	168	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+169	169	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741	2	0	0	1
+170	170	(SaveToBMP|SaveToFile)	2	0	0	1
+171	171	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2	2	0	0	1
+172	172	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667	2	0	0	1
+173	173	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+174	174	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+175	175	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+176	176	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D	2	0	0	1
+177	177	(SaveBarCode|SaveEnhWMF)	2	0	0	1
+178	178	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B	2	0	0	1
+179	179	<object\s*[^>]*\s*classid\s*=\s*(.+<q1>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>)	2	0	0	1
+180	180	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000	2	0	0	1
+181	181	(exe|bat|com|dll|ini)	2	0	0	1
+182	182	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E	2	0	0	1
+183	183	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E	2	0	0	1
+184	184	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87	2	0	0	1
+185	185	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+186	186	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+187	187	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+188	188	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+189	189	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+190	190	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E	2	0	0	1
+191	191	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344	2	0	0	1
+192	192	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C	2	0	0	1
+193	193	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30	2	0	0	1
+194	194	(Packagefiles|SaveDna|SetIdentity|AddFile)	2	0	0	1
+195	195	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9	2	0	0	1
+196	196	(_DOWText)|(_MonthText)	2	0	0	1
+197	197	(SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour)	2	0	0	1
+198	198	classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE	2	0	0	1
+199	199	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+200	200	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+201	201	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F	2	0	0	1
+202	202	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5	2	0	0	1
+203	203	[\w\W]{2500,}	2	0	0	1
+204	204	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3	2	0	0	1
+205	205	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8	2	0	0	1
+206	206	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04	2	0	0	1
+207	207	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue)	2	0	0	1
+208	208	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356	2	0	0	1
+209	209	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E	2	0	0	1
+210	210	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574	2	0	0	1
+211	211	(WriteIniFileString|ShellExecute)	2	0	0	1
+212	212	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906	2	0	0	1
+213	213	(txt|ini|com|exe|bat|dll|dat)	2	0	0	1
+214	214	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8	2	0	0	1
+215	215	42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733	2	0	0	1
+216	216	(Save|ExportImage)	2	0	0	1
+217	217	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790	2	0	0	1
+218	218	(DeleteFile|write)	2	0	0	1
+219	219	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+220	220	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+221	221	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+222	222	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+223	223	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967	2	0	0	1
+224	224	WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext)	2	0	0	1
+225	225	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9	2	0	0	1
+226	226	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5	2	0	0	1
+227	227	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6	2	0	0	1
+228	228	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+229	229	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+230	230	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24	2	0	0	1
+231	231	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9	2	0	0	1
+232	232	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA	2	0	0	1
+233	233	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec)	2	0	0	1
+234	234	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5	2	0	0	1
+235	235	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+236	236	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+237	237	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+238	238	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83	2	0	0	1
+239	239	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA	2	0	0	1
+240	240	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566	2	0	0	1
+241	241	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+242	242	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+243	243	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B	2	0	0	1
+244	244	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F	2	0	0	1
+245	245	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+246	246	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+247	247	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED	2	0	0	1
+248	248	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619	2	0	0	1
+249	249	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E	2	0	0	1
+250	250	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258	2	0	0	1
+251	251	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196	2	0	0	1
+252	252	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E	2	0	0	1
+253	253	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD	2	0	0	1
+254	254	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4	2	0	0	1
+255	255	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118	2	0	0	1
+256	256	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616	2	0	0	1
+257	257	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+258	258	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+259	259	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+260	260	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11	2	0	0	1
+261	261	(ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1	2	0	0	1
+262	262	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020	2	0	0	1
+263	263	(PostURL|AddSeperator|AddString|Post)	2	0	0	1
+264	264	(SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF)	2	0	0	1
+265	265	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>)	2	0	0	1
+266	266	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\>	2	0	0	1
+267	267	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\>	2	0	0	1
+268	268	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\>	2	0	0	1
+269	269	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\>	2	0	0	1
+270	270	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+271	271	(Buildpath|GetDriveName|DriveExists|DeleteFile)	2	0	0	1
+272	272	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+273	273	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+274	274	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+275	275	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>)	2	0	0	1
+276	276	\x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission]	2	0	0	1
+277	277	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\>	2	0	0	1
+278	278	000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F	2	0	0	1
+279	279	(javascript|http|ftp|vbscript)	2	0	0	1
+280	280	(SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen)	2	0	0	1
+281	281	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000	2	0	0	1
+282	282	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407	2	0	0	1
+283	283	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414	2	0	0	1
+284	284	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+285	285	(AddAttachment|SubmitToExpress)	2	0	0	1
+286	286	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6	2	0	0	1
+287	287	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0	2	0	0	1
+288	288	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D	2	0	0	1
+289	289	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile)	2	0	0	1
+290	290	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\>	2	0	0	1
+291	291	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\>	2	0	0	1
+292	292	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC	2	0	0	1
+293	293	src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape	2	0	0	1
+294	294	(LogFile|ClearLogFile|SaveToFile)	2	0	0	1
+295	295	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)	2	0	0	1
+296	296	^User-Agent\x3a Downloader \d\.\d\r?$/Hm	2	0	0	1
+297	297	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P	2	0	0	1
+298	298	^((\r?\n\r?\n).)*?\r?\n\r?\nMZ	2	0	0	1
+299	299	instructions\/\d{2}\.xml	2	0	0	1
+300	300	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp	2	0	0	1
+301	301	\/updatestats\/update\d+?\.xml$	2	0	0	1
+302	302	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab	2	0	0	1
+303	303	ctxad-\d+\.sig	2	0	0	1
+304	304	/user\d+/counter\.htm	2	0	0	1
+305	305	(cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr	2	0	0	1
+306	306	(discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe	2	0	0	1
+307	307	loaderadv\d+\.jar	2	0	0	1
+308	308	\/adv\/\d+\/win32\.exe	2	0	0	1
+309	309	\/Message\/\S+\/\S+\.xml	2	0	0	1
+310	310	\/abt\?data=\S{150}	2	0	0	1
+311	311	^User-Agent\x3a.+ZangoToolbar.+\r$/Hmi	2	0	0	1
+312	312	User-Agent\:[^\n]+wbi_v\d/iH	2	0	0	1
+313	313	User-Agent\x3a[^\n]+AskBar/iH	2	0	0	1
+314	314	\/tbrequest\d+\.php	2	0	0	1
+315	315	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+316	316	sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+317	317	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+318	318	cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+319	319	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+320	320	UID=\d	2	0	0	1
+321	321	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+322	322	REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P	2	0	0	1
+323	323	victim\.php\?\d\d\d\d\d	2	0	0	1
+324	324	\/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d	2	0	0	1
+325	325	\/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+	2	0	0	1
+326	326	&ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d	2	0	0	1
+327	327	\/sd\?s=\d+&f=\d&C=\d	2	0	0	1
+328	328	\.txt$	2	0	0	1
+329	329	\.cfg$	2	0	0	1
+330	330	User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H	2	0	0	1
+331	331	^Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r?$/Hi	2	0	0	1
+332	332	\x00[\x02-\x1E][0-9]{2,30}\x02cn\x00	2	0	0	1
+333	333	\x00[\x02-\x1E][0-9]{2,30}\x02ru\x00	2	0	0	1
+334	334	^[A-F0-9]+$	2	0	0	1
+335	335	\/sd\?s=\d+&f=\d	2	0	0	1
+336	336	loadadv\d+\.exe	2	0	0	1
+337	337	\/ms\d\d\dcfg\.jsp	2	0	0	1
+338	338	^0x[0-9a-f]+$	2	0	0	1
+339	339	^[^a-z]*?[0-9]{2,30}\.ru$	2	0	0	1
+340	340	filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe	2	0	0	1
+341	341	^MM \d\.\d+$	2	0	0	1
+342	342	^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4}	2	0	0	1
+343	343	^\w+pcsetup_\w+	2	0	0	1
+344	344	\x2Fv[0-9]{3,4}[\x2F\x3F]	2	0	0	1
+345	345	[a-f0-9]{32}\?v=	2	0	0	1
+346	346	^\/[a-z]{2}\x3Fv\x3D[0-9]$	2	0	0	1
+347	347	^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$	2	0	0	1
+348	348	^\/entrance\?s1=[a-f0-9]{100,}$	2	0	0	1
+349	349	^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=	2	0	0	1
+350	350	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+351	351	^[0-9][a-z]+	2	0	0	1
+352	352	\.php$	2	0	0	1
+353	353	^\/([^\x2f]+\/)*log\/\?[bc]=	2	0	0	1
+354	354	^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/))	2	0	0	1
+355	355	^\/\?pcrc=\d+&v=[\d.]+$	2	0	0	1
+356	356	^\/\?v=[\d.]+&pcrc=\d+$	2	0	0	1
+357	357	\/v\d\/[^.]+\.asp$	2	0	0	1
+358	358	\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$	2	0	0	1
+359	359	\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$	2	0	0	1
+360	360	^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$	2	0	0	1
+361	361	^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$	2	0	0	1
+362	362	\?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})	2	0	0	1
+363	363	^Downloader\s\d+\.\d+$	2	0	0	1
+364	364	^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100}	2	0	0	1
+365	365	\/get_xml\?(file_id|stb)=	2	0	0	1
+366	366	(_[a-z]{2}){1,3}_[a-z]{3}_install\.exe	2	0	0	1
+367	367	\d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows	2	0	0	1
+368	368	^[a-zA-Z0-9_-]+$	2	0	0	1
+369	369	^\/([a-zA-Z0-9]|%2[fb]){400,}$	2	0	0	1
+370	370	User-Agent\:[^\n]+searchengine	2	0	0	1
+371	371	User-Agent\:[^\n]+SurferPlugin	2	0	0	1
+372	372	User-Agent\:[^\n]+THNALL[^\n]+\.EXE	2	0	0	1
+373	373	User-Agent\:[^\n]+XupiterToolbar	2	0	0	1
+374	374	User-Agent\:[^\n]+spywareaxe	2	0	0	1
+375	375	User-Agent\:[^\n]+iMeshBar	2	0	0	1
+376	376	User-Agent\:[^\n]+Oemji	2	0	0	1
+377	377	^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$	2	0	0	1
+378	378	^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$	2	0	0	1
+379	379	^\/(get|install)\/\?q=	2	0	0	1
+380	380	^\/[a-f0-9]{50,}$	2	0	0	1
+381	381	^\/[\w-]{50,}$	2	0	0	1
+382	382	^\/\?pcrc=[0-9]{7,10}$	2	0	0	1
+383	383	^Downloader \d\.\d$	2	0	0	1
+384	384	\/Socks[45]\.txt$	2	0	0	1
+385	385	^Feat[^\r\n]+(Install|Updat)er	2	0	0	1
+386	386	User-Agent\:[^\n]+host(ie|oe|oi|ol)	2	0	0	1
+387	387	User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}	2	0	0	1
+388	388	^BWL(\sToplist|\d_UPDATE)	2	0	0	1
+389	389	^\x2F[A-F0-9]{25,40}$	2	0	0	1
+390	390	^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$	2	0	0	1
+391	391	^\d+\sHTTP/1.1$	2	0	0	1
+392	392	^[a-zA-Z0-9_-]+	2	0	0	1
+393	393	[a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12}	2	0	0	1
+394	394	\/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id=	2	0	0	1
+395	395	\{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\}	2	0	0	1
+396	396	CN=([^\r\n]+?\.)?showmypc\.com(\.)	2	0	0	1
+397	397	^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$	2	0	0	1
+398	398	(SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk)	2	0	0	1
+399	399	(DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog)	2	0	0	1
+400	400	\d{13}$	2	0	0	1
+401	401	^[a-f0-9]{32}	2	0	0	1
+402	402	^[a-f0-9]{32}\"	2	0	0	1
+403	403	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+404	404	^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}	2	0	0	1
+405	405	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+406	406	^[A-F0-9]{12}	2	0	0	1
+407	407	^[A-Z0-9]{9}	2	0	0	1
+408	408	^\d+[^\r\n\s]+	2	0	0	1
+409	409	^ SQL[-_ ]Server	2	0	0	1
+410	410	^ \d+ Driver	2	0	0	1
+411	411	ORA-\d{4}	2	0	0	1
+412	412	Warning.*\Woci_	2	0	0	1
+413	413	Warning.*\Wora_	2	0	0	1
+414	414	CLI Driver.*DB2	2	0	0	1
+415	415	bdb2_\w+\(	2	0	0	1
+416	416	Exception.*Informix	2	0	0	1
+417	417	Warning.*SQLite3::	2	0	0	1
+418	418	SQL error.*POS\([0-9]+\)	2	0	0	1
+419	419	Warning.*maxdb	2	0	0	1
+420	420	i?Warning.*sybase	2	0	0	1
+421	421	Warning.*ingres_	2	0	0	1
+422	422	Warning.*sqlite_	2	0	0	1
+423	423	Ingres\W.*Driver	2	0	0	1
+424	424	Exception (condition )\d+\. Transaction rollback\.	2	0	0	1
+425	425	SQL Server.*?error \x27[0-9a-f]{8}	2	0	0	1
+426	426	^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$	2	0	0	1
+427	427	^(<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll	2	0	0	1
+428	428	^...\x30\x82..\x02\x82...{256,257}	2	0	0	1
+429	429	\/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php	2	0	0	1
+430	430	\/notify\/(single|mass)$	2	0	0	1
+431	431	a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php)	2	0	0	1
+432	432	Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a	2	0	0	1
+433	433	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+434	434	[-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10}	2	0	0	1
+435	435	^\d+(\+|\-|\\|\*)\d+	2	0	0	1
+436	436	^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9	2	0	0	1
+437	437	^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u	2	0	0	1
+438	438	ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b	2	0	0	1
+439	439	^\d{4}[01]	2	0	0	1
+440	440	^\d{4}[01]	2	0	0	1
+441	441	^\d{4}[01]	2	0	0	1
+442	442	^\d{4}[01]	2	0	0	1
+443	443	^\d{4}[01]	2	0	0	1
+444	444	^\d{4}[01]	2	0	0	1
+445	445	^\d{4}[01]	2	0	0	1
+446	446	^\d{4}[01]	2	0	0	1
+447	447	^\d{4}[01]	2	0	0	1
+448	448	^\d{4}[01]	2	0	0	1
+449	449	^\d{4}[01]	2	0	0	1
+450	450	^\d{4}[01]	2	0	0	1
+451	451	^\d{4}[01]	2	0	0	1
+452	452	^\d{4}[01]	2	0	0	1
+453	453	^\d{4}[01]	2	0	0	1
+454	454	^\d{4}[01]	2	0	0	1
+455	455	^\d{4}[01]	2	0	0	1
+456	456	^\d{4}[01]	2	0	0	1
+457	457	^\d{4}[01]	2	0	0	1
+458	458	^\d{4}[01]	2	0	0	1
+459	459	^\d{4}[01]	2	0	0	1
+460	460	^\d{4}[01]	2	0	0	1
+461	461	^\d{4}[01]	2	0	0	1
+462	462	^\d{4}[01]	2	0	0	1
+463	463	^\d{4}[01]	2	0	0	1
+464	464	^\d{4}[01]	2	0	0	1
+465	465	^\d{4}[01]	2	0	0	1
+466	466	^\d{4}[01]	2	0	0	1
+467	467	^\d{4}[01]	2	0	0	1
+468	468	^\d{4}[01]	2	0	0	1
+469	469	^\d{4}[01]	2	0	0	1
+470	470	^\d{4}[01]	2	0	0	1
+471	471	^\d{4}[01]	2	0	0	1
+472	472	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+473	473	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+474	474	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+475	475	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+476	476	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+477	477	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+478	478	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+479	479	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+480	480	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+481	481	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+482	482	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+483	483	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+484	484	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+485	485	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+486	486	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+487	487	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+488	488	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+489	489	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+490	490	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+491	491	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+492	492	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+493	493	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+494	494	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+495	495	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+496	496	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+497	497	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+498	498	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+499	499	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+500	500	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+501	501	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+502	502	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+503	503	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+504	504	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+505	505	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+506	506	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+507	507	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+508	508	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+509	509	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+510	510	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+511	511	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+512	512	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+513	513	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+514	514	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+515	515	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+516	516	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+517	517	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+518	518	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+519	519	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+520	520	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+521	521	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+522	522	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+523	523	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+524	524	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+525	525	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+526	526	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+527	527	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+528	528	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+529	529	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+530	530	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+531	531	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+532	532	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+533	533	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+534	534	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+535	535	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+536	536	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+537	537	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+538	538	^\d{4}[01]	2	0	0	1
+539	539	^\d{4}[01]	2	0	0	1
+540	540	^\d{4}[01]	2	0	0	1
+541	541	^\d{4}[01]	2	0	0	1
+542	542	^\d{4}[01]	2	0	0	1
+543	543	^\d{4}[01]	2	0	0	1
+544	544	^\d{4}[01]	2	0	0	1
+545	545	^\d{4}[01]	2	0	0	1
+546	546	^\d{4}[01]	2	0	0	1
+547	547	^\d{4}[01]	2	0	0	1
+548	548	^\d{4}[01]	2	0	0	1
+549	549	^\d{4}[01]	2	0	0	1
+550	550	^\d{4}[01]	2	0	0	1
+551	551	^\d{4}[01]	2	0	0	1
+552	552	^\d{4}[01]	2	0	0	1
+553	553	^\d{4}[01]	2	0	0	1
+554	554	^\d{4}[01]	2	0	0	1
+555	555	^\d{4}[01]	2	0	0	1
+556	556	^\d{4}[01]	2	0	0	1
+557	557	^\d{4}[01]	2	0	0	1
+558	558	^\d{4}[01]	2	0	0	1
+559	559	^\d{4}[01]	2	0	0	1
+560	560	^\d{4}[01]	2	0	0	1
+561	561	^\d{4}[01]	2	0	0	1
+562	562	^\d{4}[01]	2	0	0	1
+563	563	^\d{4}[01]	2	0	0	1
+564	564	^\d{4}[01]	2	0	0	1
+565	565	^\d{4}[01]	2	0	0	1
+566	566	^\d{4}[01]	2	0	0	1
+567	567	^\d{4}[01]	2	0	0	1
+568	568	^\d{4}[01]	2	0	0	1
+569	569	^\d{4}[01]	2	0	0	1
+570	570	^\d{4}[01]	2	0	0	1
+571	571	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+572	572	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+573	573	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+574	574	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+575	575	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+576	576	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+577	577	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+578	578	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+579	579	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+580	580	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+581	581	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+582	582	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+583	583	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+584	584	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+585	585	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+586	586	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+587	587	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+588	588	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+589	589	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+590	590	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+591	591	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+592	592	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+593	593	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+594	594	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+595	595	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+596	596	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+597	597	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+598	598	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+599	599	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+600	600	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+601	601	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+602	602	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+603	603	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+604	604	^\d{4}[01]	2	0	0	1
+605	605	^\d{4}[01]	2	0	0	1
+606	606	^\d{4}[01]	2	0	0	1
+607	607	^\d{4}[01]	2	0	0	1
+608	608	^\d{4}[01]	2	0	0	1
+609	609	^\d{4}[01]	2	0	0	1
+610	610	^\d{4}[01]	2	0	0	1
+611	611	^\d{4}[01]	2	0	0	1
+612	612	^\d{4}[01]	2	0	0	1
+613	613	^\d{4}[01]	2	0	0	1
+614	614	^\d{4}[01]	2	0	0	1
+615	615	^\d{4}[01]	2	0	0	1
+616	616	^\d{4}[01]	2	0	0	1
+617	617	^\d{4}[01]	2	0	0	1
+618	618	^\d{4}[01]	2	0	0	1
+619	619	^\d{4}[01]	2	0	0	1
+620	620	^\d{4}[01]	2	0	0	1
+621	621	^\d{4}[01]	2	0	0	1
+622	622	^\d{4}[01]	2	0	0	1
+623	623	^\d{4}[01]	2	0	0	1
+624	624	^\d{4}[01]	2	0	0	1
+625	625	^\d{4}[01]	2	0	0	1
+626	626	^\d{4}[01]	2	0	0	1
+627	627	^\d{4}[01]	2	0	0	1
+628	628	^\d{4}[01]	2	0	0	1
+629	629	^\d{4}[01]	2	0	0	1
+630	630	^\d{4}[01]	2	0	0	1
+631	631	^\d{4}[01]	2	0	0	1
+632	632	^\d{4}[01]	2	0	0	1
+633	633	^\d{4}[01]	2	0	0	1
+634	634	^\d{4}[01]	2	0	0	1
+635	635	^\d{4}[01]	2	0	0	1
+636	636	^\d{4}[01]	2	0	0	1
+637	637	^\d{4}[01]	2	0	0	1
+638	638	^\d{4}[01]	2	0	0	1
+639	639	^\d{4}[01]	2	0	0	1
+640	640	^\d{4}[01]	2	0	0	1
+641	641	^\d{4}[01]	2	0	0	1
+642	642	^\d{4}[01]	2	0	0	1
+643	643	^\d{4}[01]	2	0	0	1
+644	644	^\d{4}[01]	2	0	0	1
+645	645	^\d{4}[01]	2	0	0	1
+646	646	^\d{4}[01]	2	0	0	1
+647	647	^\d{4}[01]	2	0	0	1
+648	648	^\d{4}[01]	2	0	0	1
+649	649	^\d{4}[01]	2	0	0	1
+650	650	^\d{4}[01]	2	0	0	1
+651	651	^\d{4}[01]	2	0	0	1
+652	652	^\d{4}[01]	2	0	0	1
+653	653	^\d{4}[01]	2	0	0	1
+654	654	^\d{4}[01]	2	0	0	1
+655	655	^\d{4}[01]	2	0	0	1
+656	656	^\d{4}[01]	2	0	0	1
+657	657	^\d{4}[01]	2	0	0	1
+658	658	^\d{4}[01]	2	0	0	1
+659	659	^\d{4}[01]	2	0	0	1
+660	660	^\d{4}[01]	2	0	0	1
+661	661	^\d{4}[01]	2	0	0	1
+662	662	^\d{4}[01]	2	0	0	1
+663	663	^\d{4}[01]	2	0	0	1
+664	664	^\d{4}[01]	2	0	0	1
+665	665	^\d{4}[01]	2	0	0	1
+666	666	^\d{4}[01]	2	0	0	1
+667	667	^\d{4}[01]	2	0	0	1
+668	668	^\d{4}[01]	2	0	0	1
+669	669	^\d{4}[01]	2	0	0	1
+670	670	^\d{4}[01]	2	0	0	1
+671	671	^\d{4}[01]	2	0	0	1
+672	672	^\d{4}[01]	2	0	0	1
+673	673	^\d{4}[01]	2	0	0	1
+674	674	^\d{4}[01]	2	0	0	1
+675	675	^\d{4}[01]	2	0	0	1
+676	676	^\d{4}[01]	2	0	0	1
+677	677	^\d{4}[01]	2	0	0	1
+678	678	^\d{4}[01]	2	0	0	1
+679	679	^\d{4}[01]	2	0	0	1
+680	680	^\d{4}[01]	2	0	0	1
+681	681	^\d{4}[01]	2	0	0	1
+682	682	^\d{4}[01]	2	0	0	1
+683	683	^\d{4}[01]	2	0	0	1
+684	684	^\d{4}[01]	2	0	0	1
+685	685	^\d{4}[01]	2	0	0	1
+686	686	^\d{4}[01]	2	0	0	1
+687	687	^\d{4}[01]	2	0	0	1
+688	688	^\d{4}[01]	2	0	0	1
+689	689	^\d{4}[01]	2	0	0	1
+690	690	^\d{4}[01]	2	0	0	1
+691	691	^\d{4}[01]	2	0	0	1
+692	692	^\d{4}[01]	2	0	0	1
+693	693	^\d{4}[01]	2	0	0	1
+694	694	^\d{4}[01]	2	0	0	1
+695	695	^\d{4}[01]	2	0	0	1
+696	696	^\d{4}[01]	2	0	0	1
+697	697	^\d{4}[01]	2	0	0	1
+698	698	^\d{4}[01]	2	0	0	1
+699	699	^\d{4}[01]	2	0	0	1
+700	700	^\d{4}[01]	2	0	0	1
+701	701	^\d{4}[01]	2	0	0	1
+702	702	^\d{4}[01]	2	0	0	1
+703	703	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+704	704	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+705	705	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+706	706	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+707	707	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+708	708	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+709	709	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+710	710	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+711	711	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+712	712	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+713	713	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+714	714	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+715	715	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+716	716	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+717	717	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+718	718	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+719	719	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+720	720	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+721	721	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+722	722	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+723	723	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+724	724	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+725	725	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+726	726	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+727	727	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+728	728	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+729	729	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+730	730	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+731	731	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+732	732	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+733	733	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+734	734	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+735	735	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+736	736	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+737	737	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+738	738	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+739	739	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+740	740	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+741	741	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+742	742	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+743	743	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+744	744	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+745	745	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+746	746	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+747	747	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+748	748	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+749	749	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+750	750	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+751	751	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+752	752	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+753	753	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+754	754	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+755	755	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+756	756	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+757	757	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+758	758	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+759	759	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+760	760	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+761	761	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+762	762	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+763	763	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+764	764	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+765	765	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+766	766	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+767	767	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+768	768	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+769	769	^\d{4}[01]	2	0	0	1
+770	770	^\d{4}[01]	2	0	0	1
+771	771	^\d{4}[01]	2	0	0	1
+772	772	^\d{4}[01]	2	0	0	1
+773	773	^\d{4}[01]	2	0	0	1
+774	774	^\d{4}[01]	2	0	0	1
+775	775	^\d{4}[01]	2	0	0	1
+776	776	^\d{4}[01]	2	0	0	1
+777	777	^\d{4}[01]	2	0	0	1
+778	778	^\d{4}[01]	2	0	0	1
+779	779	^\d{4}[01]	2	0	0	1
+780	780	^\d{4}[01]	2	0	0	1
+781	781	^\d{4}[01]	2	0	0	1
+782	782	^\d{4}[01]	2	0	0	1
+783	783	^\d{4}[01]	2	0	0	1
+784	784	^\d{4}[01]	2	0	0	1
+785	785	^\d{4}[01]	2	0	0	1
+786	786	^\d{4}[01]	2	0	0	1
+787	787	^\d{4}[01]	2	0	0	1
+788	788	^\d{4}[01]	2	0	0	1
+789	789	^\d{4}[01]	2	0	0	1
+790	790	^\d{4}[01]	2	0	0	1
+791	791	^\d{4}[01]	2	0	0	1
+792	792	^\d{4}[01]	2	0	0	1
+793	793	^\d{4}[01]	2	0	0	1
+794	794	^\d{4}[01]	2	0	0	1
+795	795	^\d{4}[01]	2	0	0	1
+796	796	^\d{4}[01]	2	0	0	1
+797	797	^\d{4}[01]	2	0	0	1
+798	798	^\d{4}[01]	2	0	0	1
+799	799	^\d{4}[01]	2	0	0	1
+800	800	^\d{4}[01]	2	0	0	1
+801	801	^\d{4}[01]	2	0	0	1
+802	802	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+803	803	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+804	804	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+805	805	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+806	806	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+807	807	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+808	808	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+809	809	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+810	810	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+811	811	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+812	812	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+813	813	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+814	814	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+815	815	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+816	816	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+817	817	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+818	818	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+819	819	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+820	820	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+821	821	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+822	822	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+823	823	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+824	824	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+825	825	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+826	826	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+827	827	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+828	828	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+829	829	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+830	830	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+831	831	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+832	832	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+833	833	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+834	834	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+835	835	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+836	836	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+837	837	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+838	838	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+839	839	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+840	840	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+841	841	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+842	842	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+843	843	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+844	844	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+845	845	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+846	846	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+847	847	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+848	848	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+849	849	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+850	850	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+851	851	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+852	852	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+853	853	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+854	854	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+855	855	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+856	856	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+857	857	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+858	858	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+859	859	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+860	860	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+861	861	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+862	862	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+863	863	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+864	864	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+865	865	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+866	866	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+867	867	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+868	868	^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+869	869	^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+870	870	\x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,}	2	0	0	1
+871	871	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+872	872	appid\x3a\s+2	2	0	0	1
+873	873	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+874	874	\x22mining\x2E(subscribe|authorize)\x22	2	0	0	1
+875	875	^\s*(<var>[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start	2	0	0	1
+876	876	^\/api\/(bit|lite)coin\/balance\/	2	0	0	1
+877	877	miner[^a-z]	2	0	0	1
+878	878	(\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22)	2	0	0	1
+879	879	(\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22)	2	0	0	1
+880	880	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+881	881	\/tmp\/[^\/]+\.swf$	2	0	0	1
+882	882	name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22	2	0	0	1
+883	883	name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22	2	0	0	1
+884	884	=[0-9a-f]{8}\.jar/H	2	0	0	1
+885	885	^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\?	2	0	0	1
+886	886	^\/[a-z0-9]{32}\?s=1$	2	0	0	1
+887	887	^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))	2	0	0	1
+888	888	^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>]	2	0	0	1
+889	889	^(mous)?\.class	2	0	0	1
+890	890	\/chrome\/google_chrome_(update|installer)\.exe$	2	0	0	1
+891	891	^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+892	892	^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P	2	0	0	1
+893	893	findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$	2	0	0	1
+894	894	^[^=]+[^\x22\x27\x3b]*?(<q>[\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m	2	0	0	1
+895	895	\.php\?cashe=\d+$	2	0	0	1
+896	896	\.jar\?m=[1-2]$	2	0	0	1
+897	897	\.pdf\?p=1&s=[1-2]$	2	0	0	1
+898	898	^Host\x3a [^\r\n]+?\.bit\r\n$/Hmi	2	0	0	1
+899	899	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[^\/\.]+$	2	0	0	1
+900	900	\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$	2	0	0	1
+901	901	\/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+902	902	\/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+903	903	\/tds\/[a-f0-9]{32}$	2	0	0	1
+904	904	^[a-f0-9]{32}[\x22\x27]	2	0	0	1
+905	905	Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi	2	0	0	1
+906	906	(\.\.\/)+kboxwww\/tmp\/	2	0	0	1
+907	907	^(<var>.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22	2	0	0	1
+908	908	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+909	909	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+910	910	\/\?[0-9a-f]{60,66}[\;\d\x2c]*$	2	0	0	1
+911	911	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15}	2	0	0	1
+912	912	\/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php	2	0	0	1
+913	913	debugenableplugins=[a-zA-Z0-9]+?\x3b	2	0	0	1
+914	914	^\/[a-z0-9]+\/load\.php$	2	0	0	1
+915	915	^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H	2	0	0	1
+916	916	^\/xteas\/code$	2	0	0	1
+917	917	\/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash=	2	0	0	1
+918	918	=\w{8}\.pdf/Hi	2	0	0	1
+919	919	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[A-Za-z0-9]+$	2	0	0	1
+920	920	^User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$/H	2	0	0	1
+921	921	^Host\x3a\s.+\.in\r?$/Hmi	2	0	0	1
+922	922	name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22	2	0	0	1
+923	923	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+924	924	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+925	925	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+926	926	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+927	927	^Location\x3a\x20[a-f0-9]{32}\/e\.html\r$/Hm	2	0	0	1
+928	928	^\/(v(1\/buckets\/default\/ext-5dkJ19tFufpMZjVJbsWCiqDcclDw\/records|4\/links\/activity-stream|3\/links\/ping-centre)|gp\/(aj\/private\/reviewsGallery\/get-(application-resource|image-gallery-asset)s|cerberus\/gv)|en-us\/(p\/(onerf\/MeSilentPassport|book-2\/8MCPZJJCC98C)|store\/api\/checkproductinwishlist)|wp-(content\/themes\/am43-6\/dist\/records|includes\/js\/script\/indigo-migrate)|api2\/json\/(cluster\/(resource|task)s|access\/ticket))	2	0	0	1
+929	929	^(\/updates|\/license\/eula|\/docs\/office|\/software-activation)	2	0	0	1
+930	930	^GET\s(\/((v(i-assets\/static-asset|[12]\/preference)|idcta\/translation)s|ads\/google))	2	0	0	1
+931	931	^([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9_\/\+\-]{2}==|[a-zA-Z0-9_\/\+\-]{3}=|[a-zA-Z0-9_\/\+\-]{4})\x3b	2	0	0	1
+932	932	^(\/track|\/api\/v1\/survey\/embed|\/svc\/weather\/v2)	2	0	0	1
+933	933	\/api\/v1\/user\/(512|124)\/avatar	2	0	0	1
+934	934	^GET [^\r\n]{0,256}&parent_request_id=([A-Za-z0-9_\/\+\-%]{128,1024})={0,2}[^\r\n]{0,256} HTTP\/1\.[01]	2	0	0	1
+935	935	^\/v1\/(queue|profile|docs\/wsdl|pull)	2	0	0	1
+936	936	^GET\s(\/USAT-GUP\/user\/|\/entertainment\/|\/entertainment\/navdd-q1a2z3Z6TET4gv2PNfXpaJAniOzOajK7M\.min\.json|\/global-q1a2z3C4M2nNlQYzWhCC0oMSEFjQbW1KA\.min\.json|\/life\/|\/news\/weather\/|\/opinion\/|\/sports\/|\/sports\/navdd-q1a2z3JHa8KzCRLOQAnDoVywVWF7UwxJs\.min\.json|\/tangstatic\/js\/main-q1a2z3b37df2b1\.min\.js|\/tangstatic\/js\/pbjsandwich-q1a2z300ab4198\.min\.js|\/tangstatic\/js\/pg-q1a2z3bbc110a4\.min\.js|\/tangsvc\/pg\/3221104001\/|\/tangsvc\/pg\/5059005002\/|\/tangsvc\/pg\/5066496002\/|\/tech\/|\/travel\/)	2	0	0	1
+937	937	^POST\s(\/v4\/links\/check-activity\/check|\/v1\/stats|\/gql|\/api2\/json\/check\/ticket|\/1.5\/95648064\/storage\/history|\/1.5\/95648064\/storage\/tabs|\/u\/0\/_\/og\/botguard\/get|\/ev\/prd001001|\/ev\/ext001001|\/gp\/aw\/ybh\/handlers|\/v3\/links\/ping-beat\/check)	2	0	0	1
+938	938	^[^\n]*[\x00-\x08\x0e-\x1f]	2	0	0	1
+939	939	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+940	940	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+941	941	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+942	942	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+943	943	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+944	944	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(IMCON|IMC)[\s\w,/-]*(//(X1|MR))	2	0	0	1
+945	945	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+946	946	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+947	947	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+948	948	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+949	949	(TOP\s|T)(SECRET|S)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+950	950	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+951	951	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+952	952	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+953	953	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+954	954	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+955	955	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+956	956	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+957	957	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+958	958	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+959	959	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+960	960	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+961	961	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+962	962	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+963	963	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+964	964	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+965	965	\[\[\d{1,3}\,\[\\\"\w\\\"\,\\\"[email protected].+\\\"\,\\\"	2	0	0	1
+966	966	User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER	2	0	0	1
+967	967	\x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20)	2	0	0	1
+968	968	PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20)	2	0	0	1
+969	969	\x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\s*\x29\x3Aend\s+function\x3A	2	0	0	1
+970	970	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000	2	0	0	1
+971	971	filename\s*=\s*"WU_Details_.....\.zip	2	0	0	1
+972	972	filename\s*=\s*MySpace_document_[0-9]{5}\.zip	2	0	0	1
+973	973	filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22	2	0	0	1
+974	974	filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22	2	0	0	1
+975	975	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E	2	0	0	1
+976	976	MyValue=[a-f0-9]{32}	2	0	0	1
+977	977	\x0d\x0aUser-Agent\: 0\:0\:[^\n]{120}	2	0	0	1
+978	978	User-Agent\: 0\:0\:[^\x0a|\x0d]{128}	2	0	0	1
+979	979	01E04581-4EEE-11D0-BFE9-00AA005B4383|AF604EFE-8897-11D1-B944-00A0C90312E1|7849596A-48EA-486E-8937-A2A3009F31A9|FBEB8A05-BEEE-4442-804E-409D6C4515E9|3050F391-98B5-11CF-BB82-00AA00BDCE0B|8EE42293-C315-11D0-8D6F-00A0C9A06E1F|2A6EB050-7F1C-11CE-BE57-00AA0051FE20|510A4910-7F1C-11CE-BE57-00AA0051FE20|6D36CE10-7F1C-11CE-BE57-00AA0051FE20|860D28D0-8BF4-11CE-BE59-00AA0051FE20|9478F640-7F1C-11CE-BE57-00AA0051FE20|B0516FF0-7F1C-11CE-BE57-00AA0051FE20|D99F7670-7F1A-11CE-BE57-00AA0051FE20	2	0	0	1
+980	980	(\.\.\/){1,}	2	0	0	1
+981	981	\/cgi-bin\/pr2\.cgi\?[a-zA-Z0-9]{172}	2	0	0	1
+982	982	03D9F3F2-B0E3-11D2-B081-006008039BF0|860BB310-5D01-11D0-BD3B-00A0C911CE86|E0F158E1-CB04-11D0-BD4E-00A0C911CE86|33D9A761-90C8-11D0-BD43-00A0C911CE86|4EFE2452-168A-11D1-BC76-00C04FB9453B|33D9A760-90C8-11D0-BD43-00A0C911CE86|33D9A762-90C8-11D0-BD43-00A0C911CE86|083863F1-70DE-11D0-BD40-00A0C911CE86|18AB439E-FCF4-40D4-90DA-F79BAA3B0655|31087270-D348-432C-899E-2D2F38FF29A0|D2923B86-15F1-46FF-A19A-DE825F919576|FD78D554-4C6E-11D0-970D-00A0C9191601|52CA3BCF-3B9B-419E-A3D6-5D28C0B0B50C	2	0	0	1
+983	983	4FAAB301-CEF6-477C-9F58-F601039E9B78|6CBE0382-A879-4D2A-8EC3-1F2A43611BA8|F117831B-C052-11D1-B1C0-00C04FC2F3EF|3050F667-98B5-11CF-BB82-00AA00BDCE0B|1AA06BA1-0E88-11D1-8391-00C04FBD7C09|F28D867A-DDB1-11D3-B8E8-00A0C981AEEB|6B7F1602-D44C-11D0-A7D9-AE3D17000000|7007ACCF-3202-11D1-AAD2-00805FC1270E|992CFFA0-F557-101A-88EC-00DD010CCC48|00020420-0000-0000-C000-000000000046|0006F02A-0000-0000-C000-000000000046|ABBA001B-3075-11D6-88A4-00B0D0200F88|CE292861-FC88-11D0-9E69-00C04FD7C15B	2	0	0	1
+984	984	php\?r=\d+&p=	2	0	0	1
+985	985	\/socks\.php\?name=[^&]+&port=\d{1,5}$	2	0	0	1
+986	986	SELECT.+FROM	2	0	0	1
+987	987	UNION\s+SELECT	2	0	0	1
+988	988	INSERT.+INTO	2	0	0	1
+989	989	DELETE.+FROM	2	0	0	1
+990	990	ASCII\(.+SELECT	2	0	0	1
+991	991	UPDATE.+SET	2	0	0	1
+992	992	EEED4C20-7F1B-11CE-BE57-00AA0051FE20|C7B6C04A-CBB5-11D0-BB4C-00C04FC2F410|85BBD920-42A0-1069-A2E4-08002B30309D|E846F0A0-D367-11D1-8286-00A0C9231C29|B4B3AECB-DFD6-11D1-9DAA-00805F85CFE3|ECABB0BF-7F19-11D2-978E-0000F8757E2A|466D66FA-9616-11D2-9342-0000F875AE17|67DCC487-AA48-11D1-8F4F-00C04FB611C7|00022613-0000-0000-C000-000000000046|D2D588B5-D081-11D0-99E0-00C04FC2F8EC|5D08B586-343A-11D0-AD46-00C04FD8FDFF|CC7BFB42-F175-11D1-A392-00E0291F3959|CC7BFB43-F175-11D1-A392-00E0291F3959|3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5	2	0	0	1
+993	993	BC5F1E51-5110-11D1-AFF5-006097C9A284|F27CE930-4CA3-11D1-AFF2-006097C9A284|3BC4F3A7-652A-11D1-B4D4-00C04FC2DB8D|ECABAFC2-7F19-11D2-978E-0000F8757E2A|283807B8-2C60-11D0-A31D-00AA00B92C03|250770F3-6AF2-11CF-A915-008029E31FCD|D24D4453-1F01-11D1-8E63-006097D2DF48|03CB9467-FD9D-42A8-82F9-8615B4223E6E|598EBA02-B49A-11D2-A1C1-00609778EA66|8FE7E181-BB96-11D2-A1CB-00609778EA66|4CFB5280-800B-4367-848F-5A13EBF27F1D|B3E0E785-BD78-4366-9560-B7DABE2723BE|208DD6A3-E12B-4755-9607-2E39EF84CFC5	2	0	0	1
+994	994	6E227101-F799-11CF-9227-00AA00A1EB95|7057E952-BD1B-11D1-8919-00C04FC2C836|7007ACC7-3202-11D1-AAD2-00805FC1270E|4622AD11-FF23-11D0-8D34-00A0C90F2719|98CB4060-D3E7-42A1-8D65-949D34EBFE14|47C6C527-6204-4F91-849D-66E234DEE015|35CEC8A3-2BE6-11D2-8773-92E220524153|730F6CDC-2C86-11D2-8773-92E220524153|2C10A98F-D64F-43B4-BED6-DD0E1BF2074C|6F9F3481-84DD-4B14-B09C-6B4288ECCDE8|8E26BFC1-AFD6-11CF-BFFC-00AA003CFDFC|F0975AFE-5C7F-11D2-8B74-00104B2AFB41	2	0	0	1
+995	995	index\.php\?q=(uggc|jjj|http|www|aHR0c|d3d3)	2	0	0	1
+996	996	(file=\|.+\|)	2	0	0	1
+997	997	SELECT.+FROM	2	0	0	1
+998	998	UNION\s+SELECT	2	0	0	1
+999	999	INSERT.+INTO	2	0	0	1
+1000	1000	DELETE.+FROM	2	0	0	1
+1001	1001	ASCII\(.+SELECT	2	0	0	1
+1002	1002	UPDATE.+SET	2	0	0	1
+1003	1003	SELECT.+FROM	2	0	0	1
+1004	1004	UNION\s+SELECT	2	0	0	1
+1005	1005	INSERT.+INTO	2	0	0	1
+1006	1006	DELETE.+FROM	2	0	0	1
+1007	1007	ASCII\(.+SELECT	2	0	0	1
+1008	1008	UPDATE.+SET	2	0	0	1
+1009	1009	SELECT.+FROM	2	0	0	1
+1010	1010	UNION\s+SELECT	2	0	0	1
+1011	1011	INSERT.+INTO	2	0	0	1
+1012	1012	DELETE.+FROM	2	0	0	1
+1013	1013	ASCII\(.+SELECT	2	0	0	1
+1014	1014	UPDATE.+SET	2	0	0	1
+1015	1015	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+1016	1016	filename=\x22Facebook_(Password|Support|Document)_[A-Z0-9]{4,7}\.zip\x22	2	0	0	1
+1017	1017	\x2FU3D\x2FLength\x20172[0-5][0-9]{2}	2	0	0	1
+1018	1018	\/000[a-z][0-9]{3}\x2Eso	2	0	0	1
+1019	1019	\/000[a-z][0-9]{3}\x2Eexe	2	0	0	1
+1020	1020	UPDATE.+SET	2	0	0	1
+1021	1021	PDF-.+[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F]	2	0	0	1
+1022	1022	^FOLD\s[^\n]{256}	2	0	0	1
+1023	1023	^FOLD\s+\/	2	0	0	1
+1024	1024	^Username\:[^\n]{100}	2	0	0	1
+1025	1025	^http\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1026	1026	^http\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1027	1027	^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\}	2	0	0	1
+1028	1028	^file\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1029	1029	\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JBIG2Decode](J|#4A)(B|#42)(I|#49)(G|#47)(2|#32)(D|#44)(e|#65)(c|#63)(o|#6F)(d|#64)(e|#65)	2	0	0	1
+1030	1030	OS 4_[0-3]_[1-4] like/H	2	0	0	1
+1031	1031	[a-f0-9]{16}$	2	0	0	1
+1032	1032	mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+1033	1033	(/joomla/admin|/joomla/administrator|/joomla/manage|/joomla/administration)	2	0	0	1
+1034	1034	\x3A\x02\x5B(Atk33|Exploiting|Finished|GOOGLE.*|HTTP.{0,8}|PKS-SCAN.{0,20}|Results|RSH|SCAN|TCP.{0,8}|UDP.{0,8}|v6.{0,12}|VERSION)\x5D\x02	2	0	0	1
+1035	1035	\x3A\x02(Alvo dos Pacotes|Conectando-se em|M.dia de envio|Tempo.*|Total .*)\x02	2	0	0	1
+1036	1036	NICK\x20\S+\x0AUSER\x20\S+localhost\x20localhost\x20\x3A	2	0	0	1
+1037	1037	\x3a.4\x7c.12.\x3a.4	2	0	0	1
+1038	1038	(cheguei gazelas|meh que tao|Status|Tempo|Total pacotes|Total bytes|M?dia de envio|portas? aberta)	2	0	0	1
+1039	1039	keepalive([0-9]{4}|\x7c[0-9]{4})	2	0	0	1
+1040	1040	User-Agent\x3a[^\n]+sbu-hb-	2	0	0	1
+1041	1041	User-Agent\:[^\n]+Peer Points/iH	2	0	0	1
+1042	1042	User-Agent\:[^\n]+zbu-hb-/Hi	2	0	0	1
+1043	1043	User-Agent\:[^\n]+HSN/iH	2	0	0	1
+1044	1044	User-Agent\:[^\n]+Wildtangent/iH	2	0	0	1
+1045	1045	^RMD\s+\x2f$	2	0	0	1
+1046	1046	User-Agent\x3A[^\n]+TheWorld/H	2	0	0	1
+1047	1047	^Max-dotdot[\s\r\n]*\d{3,}	2	0	0	1
+1048	1048	^Authorization\x3a Basic\s+=	2	0	0	1
+1049	1049	^Authorization\x3a Basic\s+=	2	0	0	1
+1050	1050	Host\x3a\s[a-z]{16}\.ru/H	2	0	0	1
+1051	1051	CREATE.+ENDPOINT	2	0	0	1
+1052	1052	\/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir=	2	0	0	1
+1053	1053	MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w	2	0	0	1
+1054	1054	MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w	2	0	0	1
+1055	1055	\x00[0-9]{4,7}\x02co\x00	2	0	0	1
+1056	1056	\x2fsogou(config)?\x2f	2	0	0	1
+1057	1057	\/\d{8,}\/\d{4,}\/\d{4,}\.jsp	2	0	0	1
+1058	1058	adv\d+\.php	2	0	0	1
+1059	1059	a=\%[0-9a-fA-F]{2}\&b	2	0	0	1
+1060	1060	\Wcustomer\slist(s)?\W	2	0	0	1
+1061	1061	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1062	1062	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1063	1063	\Wannual\sincome(s)?\W	2	0	0	1
+1064	1064	\Wpayment\shistory\W	2	0	0	1
+1065	1065	\Waccount\sbalance(s)?\W	2	0	0	1
+1066	1066	\Wappraisal(s)?\W	2	0	0	1
+1067	1067	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1068	1068	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1069	1069	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1070	1070	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1071	1071	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1072	1072	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1073	1073	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1074	1074	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1075	1075	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1076	1076	\Winternal\suse\sonly\W	2	0	0	1
+1077	1077	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1078	1078	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1079	1079	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1080	1080	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1081	1081	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1082	1082	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1083	1083	(//)\Wconfidential[^\w/]	2	0	0	1
+1084	1084	(//)\Wrestricted[^\w/]	2	0	0	1
+1085	1085	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1086	1086	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1087	1087	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1088	1088	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1089	1089	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1090	1090	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1091	1091	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1092	1092	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1093	1093	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1094	1094	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1095	1095	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1096	1096	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1097	1097	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1098	1098	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1099	1099	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1100	1100	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1101	1101	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1102	1102	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1103	1103	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1104	1104	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1105	1105	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1106	1106	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1107	1107	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1108	1108	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1109	1109	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1110	1110	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1111	1111	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1112	1112	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1113	1113	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1114	1114	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1115	1115	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1116	1116	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1117	1117	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1118	1118	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1119	1119	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1120	1120	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1121	1121	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1122	1122	(//)\Wrestricted[^\w/]	2	0	0	1
+1123	1123	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1124	1124	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1125	1125	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1126	1126	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1127	1127	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1128	1128	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1129	1129	\Winternal\suse\sonly\W	2	0	0	1
+1130	1130	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1131	1131	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1132	1132	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1133	1133	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1134	1134	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1135	1135	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1136	1136	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1137	1137	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1138	1138	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1139	1139	\Wappraisal(s)?\W	2	0	0	1
+1140	1140	\Waccount\sbalance(s)?\W	2	0	0	1
+1141	1141	\Wannual\sincome(s)?\W	2	0	0	1
+1142	1142	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1143	1143	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1144	1144	\Wcustomer\slist(s)?\W	2	0	0	1
+1145	1145	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1146	1146	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1147	1147	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1148	1148	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1149	1149	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1150	1150	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1151	1151	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1152	1152	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1153	1153	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1154	1154	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1155	1155	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1156	1156	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1157	1157	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1158	1158	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1159	1159	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1160	1160	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1161	1161	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1162	1162	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1163	1163	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1164	1164	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1165	1165	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1166	1166	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1167	1167	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1168	1168	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1169	1169	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1170	1170	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1171	1171	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1172	1172	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1173	1173	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1174	1174	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1175	1175	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1176	1176	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1177	1177	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1178	1178	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1179	1179	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1180	1180	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1181	1181	(//)\Wrestricted[^\w/]	2	0	0	1
+1182	1182	(//)\Wconfidential[^\w/]	2	0	0	1
+1183	1183	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1184	1184	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1185	1185	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1186	1186	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1187	1187	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1188	1188	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1189	1189	\Winternal\suse\sonly\W	2	0	0	1
+1190	1190	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1191	1191	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1192	1192	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1193	1193	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1194	1194	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1195	1195	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1196	1196	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1197	1197	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1198	1198	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1199	1199	\Wappraisal(s)?\W	2	0	0	1
+1200	1200	\Waccount\sbalance(s)?\W	2	0	0	1
+1201	1201	\Wpayment\shistory\W	2	0	0	1
+1202	1202	\Wannual\sincome(s)?\W	2	0	0	1
+1203	1203	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1204	1204	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1205	1205	\Wcustomer\slist(s)?\W	2	0	0	1
+1206	1206	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1207	1207	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1208	1208	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1209	1209	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1210	1210	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1211	1211	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1212	1212	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1213	1213	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1214	1214	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1215	1215	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1216	1216	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1217	1217	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1218	1218	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1219	1219	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1220	1220	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1221	1221	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1222	1222	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1223	1223	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1224	1224	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1225	1225	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1226	1226	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1227	1227	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1228	1228	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1229	1229	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1230	1230	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1231	1231	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1232	1232	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1233	1233	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1234	1234	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1235	1235	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1236	1236	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1237	1237	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1238	1238	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1239	1239	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1240	1240	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1241	1241	User-Agent\x3a \d{6}\x0d\x0a/H	2	0	0	1
+1242	1242	(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/s\/l\/firstping	2	0	0	1
+1243	1243	\.dyndns\.((biz|info|org|tv))\x0d\x0a/iH	2	0	0	1
+1244	1244	\.dyndns-((at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work))\.com\x0d\x0a/iH	2	0	0	1
+1245	1245	\.jpg\?t\x3d\d\.\d	2	0	0	1
+1246	1246	[0-9]{1,16}[a-f]{1,16}[0-9]{1,16}$	2	0	0	1
+1247	1247	^Content-Length\x3a\s*-\d+	2	0	0	1
+1248	1248	\W[0-9]{5}\.jar	2	0	0	1
+1249	1249	machine_id={[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+}	2	0	0	1
+1250	1250	[0-9]{1,8}[a-f]{1,8}[0-9]{1,8}$	2	0	0	1
+1251	1251	^[a-z0-9]{6}..\x00\x00	2	0	0	1
+1252	1252	^[a-z0-9]{7}..\x00\x00	2	0	0	1
+1253	1253	\sLOGIN\s[^\n]*?%	2	0	0	1
+1254	1254	({(\d+}[^\n]*?\sAUTH)|AUTH\s[^\n]*?{(\d+}))	2	0	0	1
+1255	1255	^\/\?[a-f0-9]{32}$	2	0	0	1
+1256	1256	[a-z]{9}[0-9]\.exe/H	2	0	0	1
+1257	1257	\.php\?inst_result=.+&hwid=	2	0	0	1
+1258	1258	^.{1,5}[a-f0-9]{100}	2	0	0	1
+1259	1259	\/scr5\.php\?p=\d+&id=\d	2	0	0	1
+1260	1260	^User-Agent\: App\d/Hmi	2	0	0	1
+1261	1261	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$	2	0	0	1
+1262	1262	\x00\x07[a-z]{7}\x02eu\x00	2	0	0	1
+1263	1263	REGISTER.{400}	2	0	0	1
+1264	1264	\/content\/jav\d?\.jar$	2	0	0	1
+1265	1265	^\/\?[a-f0-9]{32}$	2	0	0	1
+1266	1266	\.php\?[a-z]+=[a-f0-9]{64}&[^\?]+=[a-f0-9]{20}&	2	0	0	1
+1267	1267	^HTTP\x2f1\.[01] 200	2	0	0	1
+1268	1268	\.php\?[a-z]+=(([1-2][a-z]|3[0-9])\x3a){3,}([1-2][a-z]|3[0-9])&	2	0	0	1
+1269	1269	IP\:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+1270	1270	^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$	2	0	0	1
+1271	1271	\.(jpg|png|gif|cgi)\?pr=	2	0	0	1
+1272	1272	^\/\?affid=\d+&promo_type=\d+&promo_opt=\d+$	2	0	0	1
+1273	1273	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1274	1274	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1275	1275	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1276	1276	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1277	1277	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1278	1278	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1279	1279	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1280	1280	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1281	1281	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1282	1282	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1283	1283	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1284	1284	(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/.*perl\/fr\.pl	2	0	0	1
+1285	1285	\x2F[a-z\x2D]{60,120}.+\x2D\x2Ephp$	2	0	0	1
+1286	1286	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1287	1287	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1288	1288	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1289	1289	^\/[a-z0-9A-Z]{25,35}\/(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+(_[e7uxMhp1Kt]+)?|a2\.\.)Z(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+|a2\.\.)\/	2	0	0	1
+1290	1290	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$	2	0	0	1
+1291	1291	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$	2	0	0	1
+1292	1292	applet\/code=[\x22\x27](<val1>[a-zA-Z0-9]+)[a-z]\.(=val1)[a-z][\x22\x27][^\x3e]+\.jar[\x22\x27]	2	0	0	1
+1293	1293	code\x3D\x22[a-z]{4}\x2E[a-z]{4}\x22	2	0	0	1
+1294	1294	\x7B\x22e(v|x22\x2B\x22)(v|x22\x2B\x22|a)(a|v|x22\x2B\x22)[^\x5D]*?l\x22\x5D	2	0	0	1
+1295	1295	\x2Fgo\x2Ephp\x3Dd\x3D[a-f0-9]{16}$	2	0	0	1
+1296	1296	^[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}=	2	0	0	1
+1297	1297	\.php\?\w{2,9}\=(0[0-9a-b]|3[0-9]){5}\&\w{3,9}\=(3[0-9a-f]|4[0-9a-f])\&\w{3,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{3,9}\=(0[0-9a-b]{1,8})00020002$	2	0	0	1
+1298	1298	^\d+?.\x00\x00\x00	2	0	0	1
+1299	1299	\/[0-9a-f]{32}\.jar$	2	0	0	1
+1300	1300	\/[a-f0-9]{5,}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1301	1301	^[^OGHPDTCMLUVRBAS]	2	0	0	1
+1302	1302	&s=\{[A-Z0-9]{8}-([A-Z0-9]{4}-){3}[A-Z0-9]{12}\}&w=(\d{1,2}\.){2}\d{1,2}&b=(32|64)$/Pi	2	0	0	1
+1303	1303	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$	2	0	0	1
+1304	1304	AjaxHandler\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+1305	1305	DELETE.+FROM	2	0	0	1
+1306	1306	UNION.+SELECT	2	0	0	1
+1307	1307	UPDATE.+SET	2	0	0	1
+1308	1308	ASCII\(.+SELECT	2	0	0	1
+1309	1309	DELETE.+FROM	2	0	0	1
+1310	1310	INSERT.+INTO	2	0	0	1
+1311	1311	UNION\s+SELECT	2	0	0	1
+1312	1312	SELECT.+FROM	2	0	0	1
+1313	1313	UPDATE.+SET	2	0	0	1
+1314	1314	ASCII\(.+SELECT	2	0	0	1
+1315	1315	DELETE.+FROM	2	0	0	1
+1316	1316	INSERT.+INTO	2	0	0	1
+1317	1317	SELECT.+FROM	2	0	0	1
+1318	1318	\/\S+\.cab	2	0	0	1
+1319	1319	User-Agent\x3a[^\n]+AskTB/iH	2	0	0	1
+1320	1320	(<p>[0-7]{3})(<d>[0-7]{3})(=p)(=d)([0-7]{3}){10}(<q>[0-7]{3})[0-7]{3}(<dot>[0-7]{3})[0-7]{3}(=dot)[0-7]{3}(=q)	2	0	0	1
+1321	1321	(<p>[0-7]{2,4})(<sep>[^0-7])(<d>((=p))[0-7]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-7]{2,4}(=sep)){10}(<q>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(<dot>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(=dot)(=sep)[0-7]{2,4}(=sep)(=q)	2	0	0	1
+1322	1322	^\/(p(a(rs|g)e|rocess)|(securit|quer)y|(defaul|abou)t|index|login|user)\.jsp\?[a-z]{2}\x3d[a-z0-9]{9}[A-F0-9]{9}$	2	0	0	1
+1323	1323	\/gate\.php\?cmd=urls$	2	0	0	1
+1324	1324	\/gate\.php\?cmd=getexe$	2	0	0	1
+1325	1325	^User-Agent\x3a[^\r\n]*?\sMSIE\s/H	2	0	0	1
+1326	1326	^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email)	2	0	0	1
+1327	1327	[^a-z0-9\-\.][a-z0-9]{32,48}\x02ru\x00\x00	2	0	0	1
+1328	1328	[^a-z0-9\-\.][a-z0-9]{32,48}\x04info\x00\x00	2	0	0	1
+1329	1329	[^a-z0-9\-\.][a-z0-9]{32,48}\x03biz\x00\x00	2	0	0	1
+1330	1330	\x2flogo\x2egif\x3f([0-9a-z]){5}\x3d\d{6,7}	2	0	0	1
+1331	1331	\.php\?label=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1332	1332	\.php\?id=[A-F0-9]+\-[A-F0-9]+&v1=[A-F0-9]+&v2=[A-F0-9]+&q=[A-F0-9]+$	2	0	0	1
+1333	1333	^\/[A-Za-z0-9]{7,8}\/index\.html?$	2	0	0	1
+1334	1334	^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/js\.js$	2	0	0	1
+1335	1335	^Host\x3a\x20www\d+?\.[^\.]+?\.[^\.]+?\.([^\.]+\.)*?[a-z]{2,4}(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1336	1336	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1337	1337	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1338	1338	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1339	1339	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1340	1340	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(refresh_template_name|user_name)[\r\n\s]*=>[\r\n\s]*|(refresh_template_name|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1341	1341	^\/b\/(eve|opt|req)\/[\-f0-9A-F]{24}$	2	0	0	1
+1342	1342	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+1343	1343	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+1344	1344	\/[a-z]{1,6}\.html\?0\.[0-9]+[a-z]?$	2	0	0	1
+1345	1345	^[^\r\n]{15}\x5f[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}	2	0	0	1
+1346	1346	^Host\x3a[^\r\n]+\.passinggas\.net(\x3a\d{1,5})?\r?$/Hmi	2	0	0	1
+1347	1347	Server\: nginx/[a-zA-Z]	2	0	0	1
+1348	1348	^\x23\d\d\d\x2f\x21	2	0	0	1
+1349	1349	XPantivirus20\d{2}_v\d{6}\.exe	2	0	0	1
+1350	1350	\d\d\d\d\d\d\x0a	2	0	0	1
+1351	1351	PASS\s.*?\x0d\x0aNICK\s.*?\x0d\x0aUSER\s.*?\s\d\s\d\s\:\S	2	0	0	1
+1352	1352	[0-9A-Z]{240,}	2	0	0	1
+1353	1353	\x26[\x00-\xff]\x09\x00	2	0	0	1
+1354	1354	\x26[\x00-\xff]\x09\x00	2	0	0	1
+1355	1355	\.php\?id=\d+_[0-9a-f]{8}-[0-9a-f]+-[0-9a-f]{8}&cnt=	2	0	0	1
+1356	1356	OS 4_[0-3]_[1-4] like/H	2	0	0	1
+1357	1357	\.php\?f=\d+$	2	0	0	1
+1358	1358	Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H	2	0	0	1
+1359	1359	User-Agent\x3a We[a-z0-9]{4}\x0d\x0a/H	2	0	0	1
+1360	1360	\.php\?t=\d{2,7}$	2	0	0	1
+1361	1361	filename=.*facebook.*\.(rar|exe|zip)	2	0	0	1
+1362	1362	filename\s*[^\n]*?(UPS|United Parcel Service)[^\n]*?\.(rar|exe|zip)	2	0	0	1
+1363	1363	flash-[A-Z0-9]+-plugin\.[A-Z0-9]+\.exe	2	0	0	1
+1364	1364	\x2Fget\x5Fdr\x2Ephp\x3F(e|ini)\x3D	2	0	0	1
+1365	1365	MalvRem_\d{3,4}\.exe	2	0	0	1
+1366	1366	avdistr_\d{3,4}\.exe	2	0	0	1
+1367	1367	RunAV_\d{3,4}\.exe	2	0	0	1
+1368	1368	installer\.\d{4}\.exe	2	0	0	1
+1369	1369	\/stetement_id\.\d+\/	2	0	0	1
+1370	1370	^\/stream\?\d$	2	0	0	1
+1371	1371	loads2\.php\?r=[0-9]{2}\.[0-9]	2	0	0	1
+1372	1372	^[\x20-\x7e]{5}.{4}\x7c\x01	2	0	0	1
+1373	1373	(\/[a-z-]+)+\.php\?[a-z]+=[0-9]+[^\r\n]+HTTP\/1\.1	2	0	0	1
+1374	1374	&cid=\d+$	2	0	0	1
+1375	1375	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+1376	1376	^Content-Disposition\x3a\x20attachment\x3b\x20filename=[^\r\n]+?\.[a-z]{2,4}\.exe\r?$/Hmi	2	0	0	1
+1377	1377	^\/[a-z0-9A-Z]{15,35}\/((\d+[A-Z]){3}\d+|null)\/	2	0	0	1
+1378	1378	^Content-Length\x3a 2\d{2}\r?$/Hmi	2	0	0	1
+1379	1379	\/[a-z]{2,9}\.php\?([a-z0-9]{2,4}|[cktw])=[a-zA-Z0-9\x2b\x2f\x5c]{43,56}=?$	2	0	0	1
+1380	1380	\.((testdlls|threads|netstatp|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|stats|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\x|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r])	2	0	0	1
+1381	1381	\x2B\x22l\x22(\x3B|\x5D)	2	0	0	1
+1382	1382	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1383	1383	^Referer\x3a[^\r\n]+\.swf/Hmi	2	0	0	1
+1384	1384	\.jpg\?id=\d+$	2	0	0	1
+1385	1385	^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){3,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$	2	0	0	1
+1386	1386	^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$	2	0	0	1
+1387	1387	^\/[a-z]{4}\.html?(\?[h-j]=\d+)?$	2	0	0	1
+1388	1388	^\/h[a-z]{3}\.html?$	2	0	0	1
+1389	1389	^\/[0-9]{8}\.html$	2	0	0	1
+1390	1390	^\/lists\/\d{15}(\d{5})?$	2	0	0	1
+1391	1391	^\/[a-z0-9]{2}\.jar$	2	0	0	1
+1392	1392	^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$	2	0	0	1
+1393	1393	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+1394	1394	^([a-zA-Z]{0,119}[0-9])(<var>[a-zA-Z0-9]{9,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+1395	1395	^\/0[a-z0-9]{13}$	2	0	0	1
+1396	1396	^\/[-a-zA-Z0-9_]{70,75}==?$	2	0	0	1
+1397	1397	^User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)/Hmi	2	0	0	1
+1398	1398	\/[a-f0-9]{32}\.eot$	2	0	0	1
+1399	1399	^\/0[a-z0-9]{13}$	2	0	0	1
+1400	1400	^\/([a-z0-9_-]{0,47}?[A-Z][a-z0-9_-]{0,46}?[A-Z])([A-Z0-9_-]{0,47}?[a-z][A-Z0-9_-]{0,46}?[a-z])([A-Za-z_-]{0,47}?[0-9][A-Za-z_-]{0,46}?[0-9])[A-Za-z0-9_-]{48}\.[a-z]{2,25}\d?\??	2	0	0	1
+1401	1401	^[\x00-\x0c]\x00\x00\x00[a-z0-9]{6,12}\x00	2	0	0	1
+1402	1402	^(\x62|\x1b)	2	0	0	1
+1403	1403	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])3((=sep)|\d)*?$	2	0	0	1
+1404	1404	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])4((=sep)|\d)*?$	2	0	0	1
+1405	1405	^(\x8b|\xf2)	2	0	0	1
+1406	1406	^[a-z0-9\x02-\x50]{100,}\x00\x00\x01\x00\x01$	2	0	0	1
+1407	1407	^Host\x3a\x20[^\r\n]+\.pw\r?$/Hmi	2	0	0	1
+1408	1408	GRANT.{1,5}TO	2	0	0	1
+1409	1409	^\/\?[a-f0-9]{32}$	2	0	0	1
+1410	1410	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])0((=sep)|\d)*?$	2	0	0	1
+1411	1411	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])1((=sep)|\d)*?$	2	0	0	1
+1412	1412	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])2((=sep)|\d)*?$	2	0	0	1
+1413	1413	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])5((=sep)|\d)*?$	2	0	0	1
+1414	1414	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])6((=sep)|\d)*?$	2	0	0	1
+1415	1415	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])7((=sep)|\d)*?$	2	0	0	1
+1416	1416	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])8((=sep)|\d)*?$	2	0	0	1
+1417	1417	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])9((=sep)|\d)*?$	2	0	0	1
+1418	1418	\/\w{1,2}\/\w{1,2}\.class$	2	0	0	1
+1419	1419	User-Agent\:[^\n]+zb-hb-/Hi	2	0	0	1
+1420	1420	^[^\r\n]*\/[0-9a-f]{78}\sHTTP	2	0	0	1
+1421	1421	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20((=refhost))/Hsi	2	0	0	1
+1422	1422	Host\x3a\x20(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1423	1423	^\/index\.php\?[a-z]{8,80}=(\d{10,13}|\d{15,20})$	2	0	0	1
+1424	1424	Host\x3a\x20([0-9]{0,22}[a-z])([a-z]*?[0-9][a-z]{0,22}[0-9])[a-z0-9]{23}\x2e[^\x2e\r\n]+\x2e[^\x2e\r\n]/H	2	0	0	1
+1425	1425	&id=\d+(\x3a([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{10,}\.{0,2})?&catid=\d+&itemid=\d+$	2	0	0	1
+1426	1426	\/pd\.php\?id=[a-f0-9]+$	2	0	0	1
+1427	1427	^\x2Fsearch\x2F\x3F[a-z]{2,5}\x3D	2	0	0	1
+1428	1428	^Referer\x3a\x20http\x3a\/\/[^\x2f]+\/[a-z0-9]{6}\/[a-z0-9]{5}\.html\r?$/Hm	2	0	0	1
+1429	1429	^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text\/vbscript[\x22\x27])	2	0	0	1
+1430	1430	filename=\x22\d+?\x22/P	2	0	0	1
+1431	1431	^\/log\.php\?f=[0-1](\.[a-z]+)?$	2	0	0	1
+1432	1432	(<p>[0-9a-f]{2,4})(<sep>[\x2e\x2c\x3b\x3a])(<d>((=p))[0-9a-f]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-9a-f]{2,4}(=sep)){10}(<q>(((=p)|(=d)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(<dot>(((=p)|(=d)|(=q)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(=dot)(=sep)[0-9a-f]{2,4}(=sep)(=q)	2	0	0	1
+1433	1433	^Host\x3a[^\r\n]+craigslist\.org[^\r\n]{20,}\r\n/Hmi	2	0	0	1
+1434	1434	^Host\x3a[^\r\n]+\r\nConnection\x3a\x20Keep-Alive\r\n(\r\n)?$/H	2	0	0	1
+1435	1435	^Content-Length\x3a[^\r\n]*?\{([^\r\n]*java\.)[^\r\n]*\.ognl[^\r\n]*\}	2	0	0	1
+1436	1436	\/j[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1437	1437	\/j[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1438	1438	\/j[a-z]+?\?f[a-z]+[a-z]+$	2	0	0	1
+1439	1439	\/f[a-z]+?\?f[a-z]+[a-z]+$	2	0	0	1
+1440	1440	\.php$	2	0	0	1
+1441	1441	\.php$	2	0	0	1
+1442	1442	GET\s[^\r\n]*?(<name>\/[^\.\/]+\.html)\?id\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(:?\d{1,5})?\r\n	2	0	0	1
+1443	1443	^\d{4}\r$	2	0	0	1
+1444	1444	^Host\x3a\x20[^\r\n]+\-login\.id\-107sbtd9cbhsbt[^\r]+$/Hmi	2	0	0	1
+1445	1445	\/form\/submit\/$	2	0	0	1
+1446	1446	pch\.php\?f=\d+$	2	0	0	1
+1447	1447	hcp_vbs\.php\?f=\d+&d=\d+$	2	0	0	1
+1448	1448	\.php\?e=\w+&f=\w+$	2	0	0	1
+1449	1449	pch2.php?c=\d+$	2	0	0	1
+1450	1450	\.jar\?t=\d+&h=[^&]+$	2	0	0	1
+1451	1451	\/adp\d\.php\[0-9a-z]{2,6}	2	0	0	1
+1452	1452	attachment\x3b[^\r\n]*?info\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1453	1453	attachment\x3b[^\r\n]*?contacts\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1454	1454	attachment\x3b[^\r\n]*?calc\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1455	1455	attachment\x3b[^\r\n]*?about\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1456	1456	hhcp.php?c=[a-f0-9]{5}$	2	0	0	1
+1457	1457	attachment\x3b[^\r\n]*?readme\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1458	1458	\/content\/jav\d?\.jar$	2	0	0	1
+1459	1459	\.php\?[^&]{1,8}=[a-f0-9]{16}[\x22\x27\x3b\x20\x0a\x0d]	2	0	0	1
+1460	1460	=.*[a-f].*$	2	0	0	1
+1461	1461	<title>[a-f0-9]{10}<\/title>	2	0	0	1
+1462	1462	=[0-9a-f]{8}\.jar/H	2	0	0	1
+1463	1463	\x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}$	2	0	0	1
+1464	1464	\x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}\x3A\x3A[0-9]{1,5}$	2	0	0	1
+1465	1465	display\x3Anone\x3B\x22\x3E[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}[^\r\n]*\x3C\x2Fpre\x3E\x3Cscript\x3E	2	0	0	1
+1466	1466	(\x3D|\x5B\x22])e\x22\x2B\x22va	2	0	0	1
+1467	1467	(\x3D|\x5B\x22])e\x22\x2B\x22v\x22\x2B\x22a	2	0	0	1
+1468	1468	(\x3D|\x5B\x22])ev\x22\x2B\x22a	2	0	0	1
+1469	1469	\x2B\x22al\x22(\x3B|\x5D)	2	0	0	1
+1470	1470	\x2B\x22val\x22(\x3B|\x5D)	2	0	0	1
+1471	1471	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jnlp(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1472	1472	\.php\?[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}=	2	0	0	1
+1473	1473	^.{1,5}[a-f0-9]{100}	2	0	0	1
+1474	1474	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.eot(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1475	1475	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jar(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1476	1476	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.exe(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1477	1477	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.php(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1478	1478	\.php\?\w{2,8}\=(0[0-9a-b]|3[0-9]){5,32}\&\w{2,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{1,8}\=\d{2}\&\w{1,8}\=\w{1,8}\&\w{1,8}\=\w{1,8}$	2	0	0	1
+1479	1479	\/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php$	2	0	0	1
+1480	1480	\/news\/enter\/2012-1[0-2]-([0-2][0-9]|3[0-1])\.php	2	0	0	1
+1481	1481	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.txt(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1482	1482	\/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php	2	0	0	1
+1483	1483	^\/[0-9a-f]{16}\/q\.php$	2	0	0	1
+1484	1484	^\/[0-9a-f]{16}\/q\.php	2	0	0	1
+1485	1485	^\/[0-9a-f]{32}\/ff\.php$	2	0	0	1
+1486	1486	^\/[0-9a-f]{32}\/ff\.php	2	0	0	1
+1487	1487	^\/[0-9a-f]{16}\/ff\.php$	2	0	0	1
+1488	1488	^\/[0-9a-f]{16}\/ff\.php	2	0	0	1
+1489	1489	^\/closest\/(([a-z]{1,16}[-_]){1,4}[a-z]{1,16}|[a-z0-9]{20,})\.php	2	0	0	1
+1490	1490	&jopa=\d+$	2	0	0	1
+1491	1491	\.php\?jnlp=[a-f0-9]{10}(,|$)	2	0	0	1
+1492	1492	\/[0-9a-f]{32}\/a\.php$	2	0	0	1
+1493	1493	\/[0-9a-f]{32}\/a\.php	2	0	0	1
+1494	1494	\/[0-9a-f]{16}\/a\.php$	2	0	0	1
+1495	1495	\/[0-9a-f]{16}\/a\.php	2	0	0	1
+1496	1496	\.php\?[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){5}&[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){10}&	2	0	0	1
+1497	1497	\/([^\/]+?\/[a-z]{2,16}[_-][a-z]{2,16}([_-][a-z]{2,16})*?|[a-z]{16,20}\/[a-z]{16,20}|closest\/[a-z0-9]+)\.php\?[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+&[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+$	2	0	0	1
+1498	1498	^([0-9a-z]{8})?(<p>[0-9a-z]{2})(<d>((=p))[0-9a-z]{2})(=p)(=d)([0-9a-z]{2}){10}(<q>[0-9a-z]{2})[0-9a-z]{2}(<dot>[0-9a-z]{2})[0-9a-z]{2}(=dot)[0-9a-z]{2}(=q)	2	0	0	1
+1499	1499	\.php\?[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){5}&[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){10}&	2	0	0	1
+1500	1500	\.php\?[^=]+=([^&](5[5-9a-e]|8[9a-e])){5}[^=]+=[^&]+&[^=]+=([^&](5[5-9a-f]|8[9a-e])){10}([^&]60[^&]60([^&](5[5-9a-f]|8[9a-e])){10})*?&	2	0	0	1
+1501	1501	\.php\?[^=]+=[^&]{10}&[^=]+=[^&]+&[^=]+=[^&]{20}((<sep>[^&]{2})(=sep)[^&]{20})*?&	2	0	0	1
+1502	1502	^\/[a-z0-9]{6,10}\/\?[0-9]{1,2}$	2	0	0	1
+1503	1503	@\x00i\x00m\x00p\x00o\x00r\x00t\x00\x20.{4,20}[^\x00\w\s.]	2	0	0	1
+1504	1504	^\s*?\(\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27]	2	0	0	1
+1505	1505	^\s*?\(\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27]	2	0	0	1
+1506	1506	^Referer\x3a[^\r\n]+\x3a\d+\/([a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,3}|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3})/Hm	2	0	0	1
+1507	1507	^\s*?value\s*\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27]	2	0	0	1
+1508	1508	^\s*?value\s*\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27]	2	0	0	1
+1509	1509	^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$	2	0	0	1
+1510	1510	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1511	1511	Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=refhost)/Hsi	2	0	0	1
+1512	1512	^Host\x3a[^\r\n]*?\x3a((80(80)|312[89]))\d+\r$/Hm	2	0	0	1
+1513	1513	^(((<\/object>).)*?<param([^>]*?name\s*\s*?\x22bgcolor\x22)[^>]*?value\s*\s*?\x22#ffffff\x22)((<\/object>).)*?<param([^>]*?name\s*\s*?\x22movie\x22)[^>]*?value\s*\s*?\x22([^\x22]+\.[Ss][Ww][Ff])[^\x22]*?\x22	2	0	0	1
+1514	1514	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1515	1515	Host\x3a\x20(<host>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?Referer\x3a\x20http\x3a\x2f\x2f(=host)\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n/Hsi	2	0	0	1
+1516	1516	Referer\x3a\x20http\x3a\x2f\x2f(<host>[^\r\n\x3a\x2f]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=host)(\x3a\d{1,5})?\r\n/Hsi	2	0	0	1
+1517	1517	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1518	1518	^\s*=\s*(<var1>[\x22\x27][a-z]+[\x22\x27]).+?\sid\s*=\s*(=var1)	2	0	0	1
+1519	1519	^([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$	2	0	0	1
+1520	1520	^(\s*var\s[a-z]+\s*=\s*\d+\x3b\s*\n)*\s*<\/script>\s*<object([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$	2	0	0	1
+1521	1521	^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27]	2	0	0	1
+1522	1522	^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|([a-z]*\d+[a-z]+\d)(\d*[a-z]+\d+[a-z])[a-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27]	2	0	0	1
+1523	1523	^\s*=\s*[\x22\x27][a-z]+[\x22\x27]	2	0	0	1
+1524	1524	^\s*=\s*[\x22\x27][a-z]+[\x22\x27]	2	0	0	1
+1525	1525	^\s*=\s*[\x22\x27]\/[^\x22\x27]*\.html\.swf[\x22\x27]	2	0	0	1
+1526	1526	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1527	1527	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1528	1528	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)	2	0	0	1
+1529	1529	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1530	1530	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)	2	0	0	1
+1531	1531	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27]	2	0	0	1
+1532	1532	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)	2	0	0	1
+1533	1533	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)	2	0	0	1
+1534	1534	\/m[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1535	1535	^h[a-z0-9]{0,10}\x3d[a-f0-9]{24}&p[a-z0-9]{0,10}\x3d[a-z0-9]{1,11}&i/P	2	0	0	1
+1536	1536	^p[a-z0-9]{0,20}\x3d[a-z0-9]{1,20}&i[a-z0-9]{0,20}\x3d%[0-9A-F]{2}/P	2	0	0	1
+1537	1537	\x28[\r\n\s]*?(<qa1>[\x22\x27]?)[a-f0-9]{24}(=qa1)[\r\n\s]*?,[\r\n\s]*?(<qa2>[\x22\x27]?)[a-z0-9]{1,20}(=qa2)[\r\n\s]*?	2	0	0	1
+1538	1538	=%25[0-9A-F]{2}%25[0-9A-F]{2}/P	2	0	0	1
+1539	1539	^\/a[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?q[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1540	1540	^\/s[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?d[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1541	1541	^\/k[a-z]{4,13}\?e[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1542	1542	^\/g[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?t[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1543	1543	\/r[a-z]+?\?j[a-z]+[a-z]+$	2	0	0	1
+1544	1544	\/f[a-z]+?\?j[a-z]+[a-z]+$	2	0	0	1
+1545	1545	^\/o[a-z]{4,13}\?h[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1546	1546	\/b[a-z]+?\?n[a-z]+[a-z]+$	2	0	0	1
+1547	1547	\/v[a-z]+?\?n[a-z]+[a-z]+$	2	0	0	1
+1548	1548	^\/[a-z]{5,14}\?[a-z]{5,12}=\d{6,7}$	2	0	0	1
+1549	1549	^\/[a-z]{5,14}\?[a-z]{5,12}=[a-z]{6,11}$	2	0	0	1
+1550	1550	^[\r\n\s]*?\,	2	0	0	1
+1551	1551	\bdig\.dll\b	2	0	0	1
+1552	1552	^\/[a-z]+?\?[a-z]+[a-z]+$	2	0	0	1
+1553	1553	^Host\x3a\x20[^\r\n]+\.(d(yndns\.[a-z]{2,3}|esi)|c(ricket|a?fe?)|(lin|wor)k|s(u|pace)|accountant|t(k|op)|g[aq]|xyz|ml|pw)(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1554	1554	^\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)$	2	0	0	1
+1555	1555	^(<windname>[a-z0-9]+)(<plug1>([sj]|f1))=true.+?window\.(=windname)(<plug2>(((=plug1))([sj]|f1)))=true.+?window\.(=windname)(((=plug1)|(=plug2)))([sj]|f1)=true	2	0	0	1
+1556	1556	^\/1[a-z0-9]{13}$	2	0	0	1
+1557	1557	^GET \/0(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n	2	0	0	1
+1558	1558	^\/1[a-z0-9]{13}$	2	0	0	1
+1559	1559	^GET \/4(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n	2	0	0	1
+1560	1560	^\/3[a-z0-9]{13}$	2	0	0	1
+1561	1561	\/4[a-z0-9]{13}\?&xkey=	2	0	0	1
+1562	1562	^[a-zA-Z0-9\/\+]+?ODAvM[a-zA-Z0-9\/\+]{18}(=|%3D)[\x22\x27]	2	0	0	1
+1563	1563	^[a-zA-Z0-9\/\+]+?4MC8x[a-zA-Z0-9\/\+]{18}(=|%3D){2}[\x22\x27]	2	0	0	1
+1564	1564	^[a-zA-Z0-9\/\+]+?OjgwL[a-zA-Z0-9\/\+]{19}[\x22\x27]	2	0	0	1
+1565	1565	^(\s*?|\/\*((\*\/).)*?\*\/)*?\((\s*?|\/\*((\*\/).)*?\*\/)*?(<vname>[^\s>=]+)(\s*?|\/\*((\*\/).)*?\*\/)*?<(\s*?|\/\*((\*\/).)*?\*\/)*?32\b.{0,200}(=vname)(\s*?|\/\*((\*\/).)*?\*\/)*?\x3d(\s*?|\/\*((\*\/).)*?\*\/)*?63\b.{1,200}\+=.{0,200}\((\s*?|\/\*((\*\/).)*?\*\/)*?(=vname)	2	0	0	1
+1566	1566	^[a-zA-Z0-9]+\*\/	2	0	0	1
+1567	1567	[a-z0-9]+?\*\/	2	0	0	1
+1568	1568	^\s*?<script>\s*?(<func>[A-Za-z0-9]+)\s*?\(\s*?[\x22\x27](<var>[^1\x22\x27]+)1[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)2[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)3[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>	2	0	0	1
+1569	1569	^\s*?\n\s*?(<func>[^\x28\r\n\s]+)\s*?\(\s*?(<var>[^\+\x29]+)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+	2	0	0	1
+1570	1570	^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$	2	0	0	1
+1571	1571	^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$	2	0	0	1
+1572	1572	^Referer\x3a[^\r\n]+\/([a-z0-9]+\.php|\d+)\r$/Hm	2	0	0	1
+1573	1573	Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2039/H	2	0	0	1
+1574	1574	Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2040/H	2	0	0	1
+1575	1575	^\W	2	0	0	1
+1576	1576	^\W	2	0	0	1
+1577	1577	^\/[a-z]{3}\?[A-F0-9]{8}$	2	0	0	1
+1578	1578	^Referer\x3a\x20http\x3a\x2f\x2f?[^\x2f]+\/[a-z]{3,20}((<sep>[_-]?)[a-z]{3,20}(=sep)([a-z]{3,20}(=sep))?)?[a-z]{3,20}\/\d{10,20}(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+1579	1579	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi	2	0	0	1
+1580	1580	Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1581	1581	^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}\r$/Hmi	2	0	0	1
+1582	1582	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi	2	0	0	1
+1583	1583	Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1584	1584	^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1585	1585	^((<\/body).)+?Content\s*?loading.*lease wait.*?<iframe	2	0	0	1
+1586	1586	^(\x4c|\x35)	2	0	0	1
+1587	1587	^(\x76|\x0f)	2	0	0	1
+1588	1588	\/wp-(content|admin|includes)\/	2	0	0	1
+1589	1589	^\d\x00\d	2	0	0	1
+1590	1590	\.php\?$	2	0	0	1
+1591	1591	\?showforum=$	2	0	0	1
+1592	1592	^\s*5a\s*90\s*00\s*03\s*00\s*00\s*00	2	0	0	1
+1593	1593	\x2Fphp-calendar-1.1\x2Fupdate(08|10)\x2Ephp(\x3F|.*(\x26|\x3B))configfile=[^\x26\x3B]*[^a-zA-Z0-9_]	2	0	0	1
+1594	1594	(\.\.\/){1,}	2	0	0	1
+1595	1595	(\.\.\/){1,}	2	0	0	1
+1596	1596	=(https?|ftps?|php)\:\/.{0,100}cmd=	2	0	0	1
+1597	1597	MEAS\.TYPE=((link|class)&)	2	0	0	1
+1598	1598	url=.{8000}	2	0	0	1
+1599	1599	\/ssp\/files\/annonce\.pdf$	2	0	0	1
+1600	1600	\/ssp\/loadjavad\.php$	2	0	0	1
+1601	1601	\/wywg\/[a-z0-9]{2,5}\/[a-z0-9]+\.exe$	2	0	0	1
+1602	1602	\/xml\/p\.php\?id=\d{2,}	2	0	0	1
+1603	1603	ts\/in\.cgi\?pepsi\d+	2	0	0	1
+1604	1604	cs_base_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+1605	1605	\x0d\x0aHost\: (www\.)?nacha\.org\.	2	0	0	1
+1606	1606	\x26n\x3d[a-z]{5}\d{4}	2	0	0	1
+1607	1607	name=(https?|ftps?|php)	2	0	0	1
+1608	1608	\/script\.php?\d{8}	2	0	0	1
+1609	1609	Host\: \d+\.\d+\.\d+\.\d+\x0d\x0a	2	0	0	1
+1610	1610	\/[a-z]+\/[a-z0-9]{120,}\/[a-z0-9]+\/.+\.com$	2	0	0	1
+1611	1611	UPDATE.+SET	2	0	0	1
+1612	1612	ASCII\(.+SELECT	2	0	0	1
+1613	1613	DELETE.+FROM	2	0	0	1
+1614	1614	INSERT.+INTO	2	0	0	1
+1615	1615	UNION\s+SELECT	2	0	0	1
+1616	1616	SELECT.+FROM	2	0	0	1
+1617	1617	UPDATE.+SET	2	0	0	1
+1618	1618	ASCII\(.+SELECT	2	0	0	1
+1619	1619	DELETE.+FROM	2	0	0	1
+1620	1620	INSERT.+INTO	2	0	0	1
+1621	1621	UNION\s+SELECT	2	0	0	1
+1622	1622	SELECT.+FROM	2	0	0	1
+1623	1623	ver=[v\d]+	2	0	0	1
+1624	1624	\/Setup_[0-9]{3}([A-Z][0-9])?\.exe$	2	0	0	1
+1625	1625	\/\d+\/installer\/Installer(Clean)?\.exe$	2	0	0	1
+1626	1626	\/(nte|ld)\/[0-9A-Z]*trest1[0-9](\.php|\s\.asp|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$	2	0	0	1
+1627	1627	^[a-z0-9\x40\x2d\x5f]{5,12}..\x00\x00..\x00\x00\x78\x9c	2	0	0	1
+1628	1628	=sent$	2	0	0	1
+1629	1629	\.php\?get[^=]*=\d_\d{5,}$	2	0	0	1
+1630	1630	\.php\?[a-z]_info=[a-z0-9]{1,4}_\d+?$	2	0	0	1
+1631	1631	Host\x3A\x20[^\r\n]*.rr.nu/H	2	0	0	1
+1632	1632	^(.{0,63}\x00.{0,62}\x00.{0,61}\x00.{0,60}\x00)(.{0,62}\x00{2})(.{0,59}[A-Za-z0-9]{5})((<b1>.).{0,63}(=b1).{0,62}(=b1).{0,61}(=b1).{0,60}(=b1))(.(<b2>.).{0,62}(=b2).{0,61}(=b2).{0,60}(=b2).{0,59}(=b2))(..(<b3>.).{0,61}(=b3).{0,60}(=b3).{0,59}(=b3).{0,58}(=b3))(...(<b4>.).{0,60}(=b4).{0,59}(=b4).{0,58}(=b4).{0,57}(=b4))(....(<b5>.).{0,59}(=b5).{0,58}(=b5).{0,57}(=b5).{0,56}(=b5))(.....(<b6>.).{0,58}(=b6).{0,57}(=b6).{0,56}(=b6).{0,55}(=b6))(......(<b7>.).{0,57}(=b7).{0,56}(=b7).{0,55}(=b7).{0,54}(=b7))(.......(<b8>.).{0,56}(=b8).{0,55}(=b8).{0,54}(=b8).{0,53}(=b8))(........(<b9>.).{0,55}(=b9).{0,54}(=b9).{0,53}(=b9).{0,52}(=b9))(.........(<b10>.).{0,54}(=b10).{0,53}(=b10).{0,52}(=b10).{0,51}(=b10))	2	0	0	1
+1633	1633	\.tar$	2	0	0	1
+1634	1634	\x2Fjs\x2F[\r\n]*\x2Eexe$	2	0	0	1
+1635	1635	^(<mac_addr>[\x00-\xff]{6})(=mac_addr){2,}$	2	0	0	1
+1636	1636	^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED)	2	0	0	1
+1637	1637	^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED)	2	0	0	1
+1638	1638	^(\\r\\n|\x0d\x0a)C	2	0	0	1
+1639	1639	\/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+1640	1640	<iframe.*?src.*.*?<\/iframe>	2	0	0	1
+1641	1641	[a-z]{4,10}\x08velodrivve\x03biz\x00	2	0	0	1
+1642	1642	PRIVMSG.*@(portscan|nmap|back|udpflood|tcpflood|httpflood|linuxhelp|rfi|system|milw0rm|logcleaner|sendmail|join|part|help)	2	0	0	1
+1643	1643	\/[A-Z]Setup_[0-9]{4}\.exe$	2	0	0	1
+1644	1644	\.php.+?(c((onfi|f)g|alendar)|p(a(ge|th)|rog)|l(ang(uage)?|ib)|f(older|ile|ad)|d(omain|ir|f)|s(ettings|bp)|a(genda|uth)|i(con|ncl|d)|n(ame|ews)|r(oot|f)|gallery|type|ext|mod|[a-z](\[.*\])+?)\s*=\s*https?	2	0	0	1
+1645	1645	\/[a-f0-9]{16}\/.+?\.(exe|zip)$	2	0	0	1
+1646	1646	^\s?\+x=[0-9]*\;\ +y=[0-9]	2	0	0	1
+1647	1647	User-Agent\:[^\n]+\; UA\d\d\d\d\d\;/H	2	0	0	1
+1648	1648	^\/load.php\?showforum=(ato|obe|rhino|lib)$	2	0	0	1
+1649	1649	^[a-z]{5}\d=\x5f\d\x5f	2	0	0	1
+1650	1650	index.php\?[0-9a-f]{32}$	2	0	0	1
+1651	1651	o/\d{9}\/[0-9a-f]{32}\/[0-9]$	2	0	0	1
+1652	1652	\/out.php\?id=\d$	2	0	0	1
+1653	1653	\/\?[a-z0-9]{5,}=[a-zA-Z0-9\x25]{40,}\x253D$	2	0	0	1
+1654	1654	^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$	2	0	0	1
+1655	1655	\/((article|contact|new)s|read|(fo|tu)r)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.eot|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.EOT)$	2	0	0	1
+1656	1656	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})1\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}1\.PDF)$	2	0	0	1
+1657	1657	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})2\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}2\.PDF)$	2	0	0	1
+1658	1658	^(\/[a-z]{3,20})?\/([a-z]{3,20}[-_])+[a-z]{3,20}\.jar$	2	0	0	1
+1659	1659	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})3\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}3\.PDF)$	2	0	0	1
+1660	1660	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/foto\.png$	2	0	0	1
+1661	1661	\.png$	2	0	0	1
+1662	1662	^\/[a-zA-Z0-9_\x2f-]{300,}\.html?$	2	0	0	1
+1663	1663	\/\d+\.mp3\x3frnd\x3d\d+$	2	0	0	1
+1664	1664	(Is|CheckRemote)DebuggerPresent	2	0	0	1
+1665	1665	(Create|Connect|Peek)NamedPipe	2	0	0	1
+1666	1666	ftp(open|get)file	2	0	0	1
+1667	1667	^\/r\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1668	1668	^\/t\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1669	1669	^\/[a-f0-9]{32}\.eot$	2	0	0	1
+1670	1670	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/new\.png$	2	0	0	1
+1671	1671	\.gif$	2	0	0	1
+1672	1672	\/(w(hite|orld)|step)\/\d+$	2	0	0	1
+1673	1673	\.psd$	2	0	0	1
+1674	1674	\.jpeg$	2	0	0	1
+1675	1675	\/(w(hite|orld)|step)\/mypic\.dll$	2	0	0	1
+1676	1676	getqq\.jpg$	2	0	0	1
+1677	1677	^[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(((=q)).)+?\.txt\?e=\d+(&[fh]=\d+)?(=q)	2	0	0	1
+1678	1678	\.php\?t[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1679	1679	([a-z+-]{0,4}[0-9.*]+[a-z$+-]{0,4},){24}	2	0	0	1
+1680	1680	[\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]+	2	0	0	1
+1681	1681	\.php\?spl=[A-Z]{3}	2	0	0	1
+1682	1682	\.php\?b[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1683	1683	\.php\?n[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1684	1684	^[^?#]+?\.php\?page[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1685	1685	\.php\?v[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1686	1686	\.php\?doit[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1687	1687	^[^?#]+?\.php\?id[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1688	1688	(-?\d+\x3a-?\d+\x3a){100}	2	0	0	1
+1689	1689	\x2Fsrc\x2Ephp\x3Fcase\x3D[a-f0-9]{16}$	2	0	0	1
+1690	1690	[\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]	2	0	0	1
+1691	1691	value\x3D\x22\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23	2	0	0	1
+1692	1692	\x2Fredirect\x2Ephp\x3Fd\x3D[0-9a-f]{8}$	2	0	0	1
+1693	1693	\/\d+\.js\?\d+&[a-f0-9]{16}$	2	0	0	1
+1694	1694	^\/[a-z0-9_\-]{48}$	2	0	0	1
+1695	1695	\.php\?e=[^&]+?$	2	0	0	1
+1696	1696	\/[a-z]\/[0-9]\/[0-9a-f]{32}$	2	0	0	1
+1697	1697	archive=[^\x3e]+?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+1698	1698	^\/[a-z]+\/$	2	0	0	1
+1699	1699	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/image\.gif$	2	0	0	1
+1700	1700	\/w(hite|orld|step)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.PDF)$	2	0	0	1
+1701	1701	\/(w(hite|orld)|step)\/get(a+|n+)\.jpg	2	0	0	1
+1702	1702	\.php\?usernms=[^@]+@[^\r\n]+$	2	0	0	1
+1703	1703	^(\x3a\d{1,5})?$	2	0	0	1
+1704	1704	^[^\r\n]+?\.(c(o(l(leg(e((confidential|-station|prowler)\.net|s?explained\.com)|iate(explained|info)\.com)|(o(rado-springs-jobs|nexplained)|umnexplore)\.com)|m(p(uter(explained\.com|themes\.net)|assiondefinition\.com)|m(oditylingerie|unesinfo|ercekid)\.com)|n(ce(rtparis\.net|ptsets\.com)|trolwedding\.com)|((rnell|upon)explained|peguide)\.com|7\.us)|a(((mpaign|talog|det)explained|n(cersexplained|adadaycore)|p(itali[sz]eguide|ricornhi)|b(leexplained|indynamic))\.com|r((tograph(yanalysis|erwhat)|cinomas?explained|scratch-remover|eblack)\.com|insurance-compare\.net)|ce\.us)|h((a(r(med-episodes|les-proxy|tpixel)|p(elsinfo|terball)|nnelexplained)|ristmas(gift-ideas|motion)|inesenewyearboom|eckingwatch)\.com|(orizo|urros)\.es)|(e(l(lularexplained|iac-diet)|ntigrade(explained|info))|(li(nical|ck)|ustomized)explained|r(uiseshipdating|iticsmart)|pu-benchmark|nc-cs)\.com|8\.biz|z\.cc)|a((ll(about(((collegi|gradu)at|yal)e|s(eminary|tudent)|(facul|varsi)ty|bestsellers|academic|teaching|harvard|ucla|pro)|babyours)|n((tip	2	0	0	1
+1705	1705	desbi|alyzelan)d|onymous-film)|(mericas-nexttopmode|gentsbal)l|r(chitectureice|lingtonwriter)|c(ademicexplaine|tionmo)d|ero(flotinfo|bicfund))\.com|u((toma(tedexplained|kers24)|stralia-airlines|xiliaryverb)\.com|di(t(jewellery\.com|report\.net)|o-planet\.com))|p((rilfools(hotel|spin)|ple-airport)\.com|[fh]i\.biz)|ir((bnb-coupon|waysinfo)\.com|portshuttleseattle\.net)|v(enue(domain|hello)\.com|li\.biz)|\.e\.gy)|b((a(c(helorexplained|kpackscope)|by(online-shop|revision)|(rcelonarea|ggagecoo)l|s(icexplained|escope)|ttle-field-3)|e((st-hoteldeal|er-calorie|t-award)s|nefitexplained)|u(y-invite|dgetyep)|logger-com)\.com|r((o(adbandinternet-providers|king(explained|guide))|unomarsalbum|yan-college)\.com|ea(st(cancertattoos\.net|explained\.com)|dmachine-recipes\.com))|o(((om(ing|s)|nd)explained|tany(explained|info)|dybuildingdomains|rrowings?24)\.com|stoncolleges\.net)|irthcertificatetemplate\.net|3g\.biz)|d(e((((benture|posit)explaine|alershipislan)d|n(guefevertreatment|verhowto)|ductguide|veloptea)\.com|(xterstre	2	0	0	1
+1706	1706	ming|ciduoustrees)\.net)|o((ctorate(s?explained|info)|llar-converter|gwalking-jobs|texplained|mainsknow)\.com|wnload(starcraft|-films|ubuntu)\.net)|(a(ncecentralsonglist|rtmouthexplained)|na-replication|hcp-server|vd-codec|rivewww)\.com|i((s(count|ease)explained|nnerparty-recipes|walifile)\.com|rect-golf\.net))|e((a(r(fulexplained|th-clinic)|sy(-costumes|repayment))|conomic(save|24))\.com|\.gy)|4((4qs|h5)\.com|[jp]\.org|ql\.biz)|3(vt\.info|gb\.biz|q\.org)|2(eat\.com|sf\.biz|u\.se)|8(c1\.net|x\.biz)|7(c\.org|p\.biz)|11r\.(biz|us))(\x3a\d{1,5})?$	2	0	0	1
+1707	1707	^[^\r\n]+?\.(f((a(c(ultyexplained|e-bok)|(ncy-font|ke-nail)s|ir(explained|fuse)|shion-wallpaper|lterguide)|i(nanc(i(al|ng)explained|epets)|rm(explained|s24)|lter-coffee)|o(r(umexplained|ecastbooks|ceestate)|x-drama)|udaninfo)\.com|re(e(-(((foodcoupon|angrybird)s|s(oundclips|tock)|photoeditor)\.com|music-download\.net)|(p(owerpointthem|roduct-sampl)es|dom-ofspeech)\.com|fileconverter\.net)|snoever\.com)|l(a(shplayerdownload\.net|tbelly-diet\.com)|oridaunemploymentclaim\.com|v-downloader\.net)|e(rtility-calculator\.net|stivalexplained\.com)|b(-smileys\.com|skins\.net))|l((i(n(k(explained|master)|colnsbirthdaytea)|(ability|ver)explained|(berty-saf|ftmov)e|stings(biz|red)|teraturemulti)|u(ng(explained|abscess)|ggageboom)|o(cationssecure|ndon-riots|gback))\.com|e((a(singexplained|ther-trousers)|(edsunited-new|d-candle)s|cturer(explained|info)|nd(ing|er)explained|isure-diving)\.com|u(kemiaexplained\.com|e\.biz)|tup\.org)|a(guay\.(com|es)|-gazzetta\.com)|6\.org)|i(n(s((ur(er(s(explained|24)|explained)|ancesexplain	2	0	0	1
+1708	1708	d)|ide-film)\.com|(pection-camera|taflex)\.net)|d(e(pendenceday(portal|realty)|mnityexplained)\.com|ividual-healthinsurance\.net)|t(er(estexplained\.com|trigo\.net)|ranet(explained|pm)\.com)|((vestment|centive)explained|expensivehyper)\.com|f(ections?explained\.com|o\.se))|((mmersio|sd)nexplained|ronmancom|pone-5)\.com|i(nkai|lg)\.biz)|m((e(tropolis((cruis|fac|mov)e|pixel)|(lanoma|dical)explained|r(idiantotal|cedes-cls)|ntal-healthjobs|morialdaycon|ssenger-mac|ansgift)|i(ami(-holidays|what)|di-editor)|baexplained)\.com|a(r((tial-empires|ket-hq)\.com|iogames-online\.net)|n((agejoin|ualzap)\.com|ipal-university\.net)|(lignanthypertension|gazinedownload)\.net|s(on(wave|car)|tersexplained)\.com|c2\.org))|e((s(ta(tes(mob|fx)|blishstyle)|lexplained)|mploy(e(eexplained|r24)|mentexplained))\.com|n(((gagement-photo|able-cookie)s|rollexplained)\.com|trepreneur-ideas\.net)|x(((hibition|po)explained|ecutive-decision)\.com|tremedeal\.net)|l(ect(ronicexplained|orate123)\.com|guay\.(com|es))|q(uityexplained\.com|8\.biz))|	2	0	0	1
+1709	1709	((o(a(d(minister|vertize|just)|cademic|llocate)|(thic-literatur|handl)e|(bailou|conduc)t|govern)|r(a(duate(explained|sinfo)|ndparentsdayplan)|oceryexplained|4)|ym(glas|car)s|m[69])\.com|a(((llaudet|te)explained|mevelocity|rnerguide)\.com|511\.net)|cwsa\.org)|h(o((me(made-biscuits|pageexplained)|(nours|tline|using)explained|6)\.com|stel-barcelona\.net)|a(r(dback(city|yoga)|vardexplained)|n(dlechange|ukkahbio)|lloweenorange)\.com|y(perthyroidsymptoms\.net|d\.me)|ellokittypictures\.net)|j((o(urnalism(explained|info)|hn-grisham|ker-tattoo)|query-examples)\.com|a(cksonvillepath\.com|vacollection\.net)|(vvg|6)\.org)|k(ilometersreach|udosexplained|jyg)\.com)(\x3a\d{1,5})?$	2	0	0	1
+1710	1710	^[^\r\n]+?\.(p(r(o(pert(ies(-forsale\.net|winters\.com)|y-(singapore|rental)\.net)|(fessors|state)explained\.com)|e(miums(e(xplained|ek)|guide)|(acher|cinct|late)sinfo|pexplained)\.com|i(va(te(car-sales|explained)\.com|do\.info)|nceton\.me))|e((n(sionexplained|thousepal|cetruck)|diatricsexplained)\.com|rsonal(trainer-certification\.net|-injuryclaims\.com)|tardo\.es)|o((wer(borrowings?|repayment|debts)|rt(land-holidays|alexplained)|intexplained|litical24)\.com|kertexas-holdem\.net)|a((ss(engersinfo|agepix)|ge(explained|as)|cemaker-surgery|ttinson-robert|rk-edu)\.com|loaltocollege\.net)|(u(blicationgift|pils?info)|ickups(articles|gen)|neumoniaexplained|sychologyquotes|lus-sign)\.com|h(o(toedit(orfreedownload\.net|ingsite\.com)|neexplained\.com)|pbb-themes\.com|yscology\.net)|cbp\.net|9\.org)|o(n(line(((f(o(ster|rce)|irstborn|raternal|ulltime)|b(r(idegroom|owse)|oxoffice)|e((valuat|xpress)e|fficient)|-(collegecourse|radiostation)|d(escendant|aughter|iscusse)|v(illage|acant)|re(sidence|al))s|c((r(iti(c(ize|al)|	2	0	0	1
+1711	1711	ue)|ew)|o(nsider|usin)|a(pture|meo)|elluloid)s|ha(racters|teau))|a(((vailabl|doptiv|llianc|pprais)e|ss(esse|ay)|unt)s|n((cestor|alyze)s|imated)|way)|per(sonal-trainer|manents))\.com|mediaconverter\.net)|e-lyrics\.com|amia\.biz)|(ver(seasexplained|drawnreal)|(wnership|ffline)explained|cean(ic-cable|you)|rphanagesinfo|klahomafuse)\.com|a(klandour\.com|pg\.org))|r(e((s(idenc(e(attorney|dating|cook|food)|yexplained)|erves(development|core))|(c(o(ver(ing|ed)|up)|laim)guid|laxationhyp|bateventur)e|g(i(on(private|mentor)|stercommunity)|ainguide)|t(r(ainingexplained|ieveguide)|ailexplained)|motecontrol-helicopter|viewwinters|payment24)\.com|alestate-perth\.net)|(a(cetracksinfo|veexplained|iserepair|tetask)|ising-antivirus|bnnetwork)\.com|o((o(m(sfootball|mateco)|fcute)|admodern)\.com|yallondonhospital\.net))|s((o((lventsourc|ftenguid)e|urceexplained|cietiesinfo|ng-india)|a(n(antoniosource|diegodiscover)|l(aryexplaine|euploa)d)|ta(nford(explained|info)|(bilis|v)eguide|r-treck)|p(ecialtyexplained|iralwatch|orts-tab)|	2	0	0	1
+1712	1712	h(oolexplained|eduleedu)|ites?explained)\.com|e((minar(y(explained|info)|explained)|c((urities|tor)explained|what)|aworld-coupons)\.com|rvertransfer\.net)|m(ier\.org|oz\.us)|hellgascard\.net|gba\.biz)|m(o((t(oristsinfo|iveshare)|ntre-breitling|dernexplained|squesinfo)\.com|hamed\.me)|(y(borrowings|-husband)|ultimediaexplained|inistriesinfo)\.com|mcd\.us)|n((a(ming(mac|our)|uticalfit|vigateadd)|e(tworkexplained|w-college))\.com|8\.biz))(\x3a\d{1,5})?$	2	0	0	1
+1713	1713	^[^\r\n]+?\.(t(e((l(e(phoneexplained|comsguide)|learth)|n(ured(explained|info)|nis-ranking))\.com|mp(l(ates-gratis\.com|ecollege\.net)|converter\.net)|a(ching(-certificate\.net|explained\.com)|m\.pro))|r(a(((nsferbyt|de-)e|in(eesinf|ge)o|mray)\.com|vel(insurance-comparison\.net|agentnerd\.com))|e(k-bicycles|nd-online)\.net|uckstool\.com|onco\.es)|(o(wn(housepic|study|euro|meta)|(tal-tool|memap)s|pgamebook|olboxsol)|u(mors?explained|lsatrain|rn-ons)|attoo-websites|ype-racer|wainfo)\.com|h((anksgivinggaming|riftexplained)\.com|e(sis-examples\.com|atreparis\.net))|i(mezonevendor\.com|dl\.net)|cmn\.biz)|w(e(b((b(estseller|ailout)|administer)\.com|site(downloader\.net|explained\.com)|developertoolbar\.net)|(l(lesley|fare)explained|akenguide)\.com)|or(th(voice|war)\.com|ld-records\.net)|ater(front-property\.net|-plants\.com)|(riterpics|hoiscan)\.com|pbh\.org|sse\.us)|s((t(ud(ent(financecontact|s?explained)|yexplained)|r(eetmaphub|ongat)|patricksweightloss|onewhat)|wissairinfo)\.com|u((mmertimelyrics|nset-wallpape	2	0	0	1
+1714	1714	|per-committee|itegraphic)\.com|b\.(name|cat|es)))|v((i(llage((in|na)no|crystal)|deo(-mediaset|explained)|ta(minssms|lwow)|rtualexplained)|o(lumesynergy|ucheragent|ters24)|a(rsityexplained|lentinesproxy)|entureexplained)\.com|qtel\.net|f1\.us)|u(n(i(versityexplained\.com|nstalltool\.net|\.me)|((secured|am)explained|ravelguide)\.com|limited-web-hosting\.net)|(cla(explained|info)|s-inflation|alinfo|zdom)\.com|[04]\.org)|y((o(u(ngstersinfo|rbroking)|mkippursocial)|(eshiva|ale)explained|vxs)\.com|nna\.biz)|zwr\.org)(\x3a\d{1,5})?$	2	0	0	1
+1715	1715	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+1716	1716	[a-z]{8}.(:?tif|gif)	2	0	0	1
+1717	1717	^.{2}[a-zA-Z0-9]+\x2e[01]	2	0	0	1
+1718	1718	(\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(	2	0	0	1
+1719	1719	^\w+?\[[^\]]+?\]\.src[\r\n\s]*=	2	0	0	1
+1720	1720	(\/(php)?|\.php)\?[\s\+]*\-[A-Za-z]	2	0	0	1
+1721	1721	^[A-Z]=[A-Za-z/+0-9=]{200,400}$	2	0	0	1
+1722	1722	^\{?[a-fA-F0-9]{4}\}?(\x5cu\{?[a-fA-F0-9]{4}\}?){20}	2	0	0	1
+1723	1723	^\{?[a-fA-F0-9]{4}\}?(\x25u\{?[a-fA-F0-9]{4}\}?){20}	2	0	0	1
+1724	1724	[^a-zA-Z0-9_\-\.][a-zA-Z]{7}\.class	2	0	0	1
+1725	1725	^[\r\n\s]*?\\?\(.+?\\?\)\.keep\.previous[\r\n\s]*[\r\n\s]*?[\x22\x27]contentArea	2	0	0	1
+1726	1726	\/vw\.php\?i=[a-fA-F0-9]+?\-[a-fA-F0-9]+?$	2	0	0	1
+1727	1727	^[\x11\x21-\x26\x41\x45\x70-\x79]	2	0	0	1
+1728	1728	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1729	1729	^.{0,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.jsp\x22	2	0	0	1
+1730	1730	^..[\x81\x82\x83\x84\x85\x86\x87]\x81	2	0	0	1
+1731	1731	^..[\x81\x82\x83\x84\x85\x86\x87]\x83	2	0	0	1
+1732	1732	^..[\x81\x82\x83\x84\x85\x86\x87]\x84	2	0	0	1
+1733	1733	^..[\x81\x82\x83\x84\x85\x86\x87]\x85	2	0	0	1
+1734	1734	REGISTER.{400}	2	0	0	1
+1735	1735	SELECT.+geometrycollectionfromwkb	2	0	0	1
+1736	1736	SELECT.+WHERE.+SELECT.+\x60	2	0	0	1
+1737	1737	ALTER.+DATABASE.+\x22\x2E(\x22|\x2E\x22|\x2E\x2E\x2F\x22).+UPGRADE.+DATA	2	0	0	1
+1738	1738	^Authorization\x3A Basic.{120}/Hmi	2	0	0	1
+1739	1739	^Host\x3a[^\x3a\r\n]+?\x3a[^\r\n]{6}/Hmi	2	0	0	1
+1740	1740	^[^\x00]+?\x00	2	0	0	1
+1741	1741	^[^\x00]+?\x00	2	0	0	1
+1742	1742	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*22C83263-E4B8-4233-82CD-FB047C6BF13E	2	0	0	1
+1743	1743	^Cache-Control\x3a\x20(max-age=0|no-cache)\r?$	2	0	0	1
+1744	1744	^\/\?id=[0-9]{13}&msg=	2	0	0	1
+1745	1745	^13\d{11}	2	0	0	1
+1746	1746	^Callback\x3a\x20<http[^>]+><http	2	0	0	1
+1747	1747	^[^\r\n]*uuid\x3a[^\r\n\x3a]{181}	2	0	0	1
+1748	1748	^[^\r\n]+#[^\x22\r\n]{2049}	2	0	0	1
+1749	1749	^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1750	1750	^[^\r\n]*urn\x3aservice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1751	1751	^[^\r\n]*urn\x3adevice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1752	1752	^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{1,180}\x3a[^\r\n\x3a]{181}	2	0	0	1
+1753	1753	M-SEARCH\s+[^\n]{500}	2	0	0	1
+1754	1754	(\/\.){70,}	2	0	0	1
+1755	1755	[\w]{70,}	2	0	0	1
+1756	1756	\xB6\x29\x8C\x23\xFF\xFF\xFF[\xF8-\xFF]	2	0	0	1
+1757	1757	^.{27}	2	0	0	1
+1758	1758	[0-9a-zA-Z]{200,}	2	0	0	1
+1759	1759	(GET).\/%.{1586,}	2	0	0	1
+1760	1760	ctxsys\x2Edrvxtabc\x2Ecreate\x5Ftables.+(SELECT|DELETE|CREATE|INSERT|UPDATE|OUTFILE)	2	0	0	1
+1761	1761	[^a-zA-Z0-9]+\.message	2	0	0	1
+1762	1762	\x3d[^\x26]{720}	2	0	0	1
+1763	1763	ENTER\x20LANGUAGE\x20\x3D.{55}	2	0	0	1
+1764	1764	[a-zA-Z0-9]{1000,}	2	0	0	1
+1765	1765	\xbc[\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4]	2	0	0	1
+1766	1766	\xae[\xef\xcf][\xf0\xd0][\xe5\xc5][\xee\xce]\xa0\xa2[\xe7\xc7][\xe5\xc5][\xf4\xd4]\xa2	2	0	0	1
+1767	1767	[\xf3\xd3][\xe8\xc8][\xe5\xc5][\xec\xcc][\xec\xcc][\xe5\xc5][\xf8\xd8][\xe5\xc5][\xe3\xc3][\xf5\xd5][\xf4\xd4][\xe5\xc5]	2	0	0	1
+1768	1768	[\xf6\xd6][\xe2\xc2][\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4]	2	0	0	1
+1769	1769	Cookie\:\ +REMOTE_ADDR=	2	0	0	1
+1770	1770	Authorization\x3a\s*Basic\s*[a-zA-Z0-9]{255,}==	2	0	0	1
+1771	1771	\x2findex\x2etmpl(\x3a\x3a\x24DATA|\x2f|\x2e)\x0d\x0a	2	0	0	1
+1772	1772	\/[a-z0-9]{30,}\.php\?height=\d+&sid=\d+&width=[a-z0-9]+&	2	0	0	1
+1773	1773	\.php\?sex=\d+&children=\d+&userid=	2	0	0	1
+1774	1774	^SSH-\s[^\n]{200}	2	0	0	1
+1775	1775	value\x22[^\x22]*\x2Eswf\x3finfo\x3D	2	0	0	1
+1776	1776	^(CLIENT|MACHINE)_INFO	2	0	0	1
+1777	1777	Host\x3a \d{8,10}(\x0d\x0a|\x3a\d{1,5}\x0d\x0a)/H	2	0	0	1
+1778	1778	\/tmp\/[^\/]+\.pdf$	2	0	0	1
+1779	1779	\/tmp\/[^\/]+\.jar$	2	0	0	1
+1780	1780	^Directory	2	0	0	1
+1781	1781	^HEAD[^s]{432}	2	0	0	1
+1782	1782	^PUT[^s]{432}	2	0	0	1
+1783	1783	^POST[^s]{432}	2	0	0	1
+1784	1784	^TRACE[^s]{432}	2	0	0	1
+1785	1785	^DELETE[^s]{432}	2	0	0	1
+1786	1786	^LOCK[^s]{432}	2	0	0	1
+1787	1787	^MKCOL[^s]{432}	2	0	0	1
+1788	1788	^COPY[^s]{432}	2	0	0	1
+1789	1789	^MOVE[^s]{432}	2	0	0	1
+1790	1790	\x2Frequests\x2Fstatus\x2Exml\x3F[^\x0A\x0D]*input\x3D[^\x0A\x0D\x26\x3B]{1000}	2	0	0	1
+1791	1791	^\/[0-9]{5}\.jar$	2	0	0	1
+1792	1792	Host\x3a \d{4,}[^A-Za-z\.]	2	0	0	1
+1793	1793	^\/[0-9]$	2	0	0	1
+1794	1794	^\/[a-z]{13,14}\.jar$	2	0	0	1
+1795	1795	^\s*?STOR\s+[^\r\n]*?nsswitch\.conf\r$	2	0	0	1
+1796	1796	^\s*?STOR\s+[^\r\n]*?\x2f(tgt|trace|rbp(c|p))\.conf\r$	2	0	0	1
+1797	1797	T.*?T.*?Y.*.*?R.*?O.*?M.*.*?T	2	0	0	1
+1798	1798	[0-9a-zA-Z]{10}	2	0	0	1
+1799	1799	[0-9a-zA-Z]{10}	2	0	0	1
+1800	1800	Host\x3a \d{4,}[^A-Za-z\.]	2	0	0	1
+1801	1801	^\/m[a-zA-Z0-9-_]{3,14}\/[a-zA-Z0-9-_]{3,17}$	2	0	0	1
+1802	1802	SELECT data FROM [^\x20]+?\x20INTO DUMPFILE [\x27\x22]c\x3a\/windows\/system32\/[a-z0-9_-]+?\.exe[\x27\x22]	2	0	0	1
+1803	1803	[a-zA-Z0-9]{5}	2	0	0	1
+1804	1804	[0-9a-zA-Z]{50}	2	0	0	1
+1805	1805	\x90{200}	2	0	0	1
+1806	1806	^\s+A{500}	2	0	0	1
+1807	1807	^[\r\n\s]*?\x28[^\x29]*?shellcode	2	0	0	1
+1808	1808	^[\r\n\s]*?\x28[^\x29]*?shellcode	2	0	0	1
+1809	1809	\.(php|asp|py|exe|htm|html)\/[joewxy](U[0-9a-f]{8})?H[0-9a-f]{8}V[0-9a-f]{8}\d{3}R[0-9a-f]{8}\d{3}T[0-9a-f]{8,}	2	0	0	1
+1810	1810	[\r\n\s]+(<var1>([a-z]([a-z0-9_])*|_+([a-z0-9])([a-z0-9_])*))[\r\n\s]*\x3d[\r\n\s]*CreateObject\(\s*[\x22\x27]Wscript\.Shell[\x27\x22]\s*\).+?(=var1)\.run	2	0	0	1
+1811	1811	^((>>).)+?#([46][1-9a-fA-F]|[57][\daA])	2	0	0	1
+1812	1812	^\s*?fun\s*?\(	2	0	0	1
+1813	1813	[\?&]mail=[^&]+?[\x3b\x2c\x7c\x27]	2	0	0	1
+1814	1814	WSH\.run\x28\x5c+?[\x22\x27][a-z0-9_-]+?\.exe	2	0	0	1
+1815	1815	^(90|0x5a|0+?132)\s*?,\s*?(71|0x47|0+?107)\s*?,\s*?(70|0x46|0+?106)\s*?,\s*?(48|0x30|0+?60)\s*?,\s*?(89|0x59|0+?131)\s*?,\s*?(84|0x54|0+?124)\s*?,\s*?(112|0x70|0+?160)	2	0	0	1
+1816	1816	\/\??[a-f0-9]{60,}(\x3b\d+){1,4}$	2	0	0	1
+1817	1817	\/\??[a-f0-9]{60,}\x3b4[0-1]\d{5}$	2	0	0	1
+1818	1818	^\/([a-z0-9]{3,7}\/)?[a-z]{3,7}\.swf$	2	0	0	1
+1819	1819	^(25)?282176\x25(25)?29\x25(25)?26chrw\x25(25)?2801	2	0	0	1
+1820	1820	^Referer\x3a[^\r\n]+\/gate.php\r$/Hm	2	0	0	1
+1821	1821	Host\x3a\x20(\.*[a-f0-9]\.*){32}\./Hm	2	0	0	1
+1822	1822	^( Systems|\.com\/techsupport)	2	0	0	1
+1823	1823	^\s*?(<v1>[^\x29\s]+)\s*?\x29\s*?To Ubound\x28(=v1)\s*?\x29\s*?(dim\s*?)?(<v2>[^\s\x3d]+)\s*?\x3d\s*?(=v2)\+Cstr\x28\s*?Chr\x28(=v1)\x28i\x29[\+\-]\d+\x29\x29.+?Execute\s*?(=v2)	2	0	0	1
+1824	1824	^[0-9][^=]	2	0	0	1
+1825	1825	^\s*?\d[\d\x2e]{255}	2	0	0	1
+1826	1826	^\s*?\d[\d\x2e]{255}	2	0	0	1
+1827	1827	\s+?trigger\s+?[^\x20]+?\s+?after\s+?insert\s+?on\s+?	2	0	0	1
+1828	1828	^..[^\x00]+\x00	2	0	0	1
+1829	1829	^..[^\x00]+\x00	2	0	0	1
+1830	1830	^..[^\x00]+\x00	2	0	0	1
+1831	1831	^..[^\x00]+\x00	2	0	0	1
+1832	1832	^([^>]*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]*?\.swf[\x22\x27])([^>]*?\swidth\s*\s*?[\x22\x27]0[\x22\x27])[^>]*?\sheight\s*\s*?[\x22\x27]0[\x22\x27]	2	0	0	1
+1833	1833	^(<addr1>.{4})(<addr2>.{4})(=addr2)(=addr1)	2	0	0	1
+1834	1834	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1835	1835	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1836	1836	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1837	1837	Type\x2FAction.+Launch.+\x28\x2F[a-z]\x2F[a-z].+NewWindow\x20true	2	0	0	1
+1838	1838	^=\s*\x22\s*[^\s\x22\x28]{1000}	2	0	0	1
+1839	1839	^(USE|PASS|SELECT|UPDATE|INSERT|ASCII|SHOW|CREATE|DESCRIBE|DROP|ALTER)\s+?(.{1}){300}	2	0	0	1
+1840	1840	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d+?&){3,}[a-z\_\-]{4,10}=-?[a-z0-9]+$	2	0	0	1
+1841	1841	^\s*\[\s*[\x22\x27]\\u[a-f0-9]{4}\\u[a-f0-9]{4}	2	0	0	1
+1842	1842	^[^\x00]+\x00\x00\x01	2	0	0	1
+1843	1843	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1844	1844	^.{6}[^\x00]+	2	0	0	1
+1845	1845	^.{6}[^\x00]+	2	0	0	1
+1846	1846	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1847	1847	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1848	1848	^\x20+\x3a\x20([0-9A-F]{2}\x3a){5}[0-9A-F]{2}\x0d\x00\x0a	2	0	0	1
+1849	1849	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1850	1850	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1851	1851	^(\x01((\x01((\x04((\x03(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x04(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?|\x02(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?))?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|\x02([\x01\x02\x03\x04])?|\x03([\x01\x02])?))?|\x03((\x03(\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e])?)?)?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13])?|\x02([\x01\x02])?))?|\x05((\x02(\x01([\x01\x02\x03\x04\x05\x06\x07])?)?|\x01([\x01\x02\x03])?))?|\x02(([\x01\x02]|\x03(\x01([\x01\x02\x03])?)?))?|\x06(\x01([\x01\x02\x03\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x07([\x01\x02])?|\x04))?|\x02((\x02([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|(\x01)?\x01))?)	2	0	0	1
+1852	1852	^(\x41\xd8\x41\xd8\x41\xdc){2,}\x41\x00	2	0	0	1
+1853	1853	^\s*\x28\s*retPtrAddr\.add\s*\x28\s*i\s*\*\s*8\s*\x29\s*,\s*rop\s*\x5b	2	0	0	1
+1854	1854	^\S+?drivestoredirect	2	0	0	1
+1855	1855	^\s*(f0VMR|9FTE|\/RUxG)	2	0	0	1
+1856	1856	^\s*=\s*[\x27\x22]\s*POST	2	0	0	1
+1857	1857	^.*?[\x24\x60]	2	0	0	1
+1858	1858	^\s*=\s*[^>]*file\x3a[^>]*\/\x24MFT\/	2	0	0	1
+1859	1859	^\s*(\x28|\%28)s	2	0	0	1
+1860	1860	^\s*\d*[^\x20-\x7e\r\n\t]	2	0	0	1
+1861	1861	^[\x30-\x3f\x7D]	2	0	0	1
+1862	1862	^[\x30-\x3f\x7D]	2	0	0	1
+1863	1863	AUTH\s+\S+\s+([a-zA-Z0-9\+\/=]{4})*[a-zA-Z0-9\+\/=]{3}\s	2	0	0	1
+1864	1864	^\s*((>).)+?\s*src\s*=\s*[\x22\x27]\s*[^\x27\x28]+?[\x22\x27]\s*onError\s*=\s*prompt\s*\x28\s*[^)]*?(document|s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+1865	1865	legal[^x7B]*\x7B[^\x7D]*restore	2	0	0	1
+1866	1866	legal[^x7B]*\x7B[^\x7D]*restore	2	0	0	1
+1867	1867	errordict\s+\x2Finvalidfileaccess	2	0	0	1
+1868	1868	errordict\s+\x2Finvalidfileaccess	2	0	0	1
+1869	1869	\x2Ebindnow[^\x7D]*\x7D\s*stopped	2	0	0	1
+1870	1870	\x2Ebindnow[^\x7D]+\x7D\s*stopped	2	0	0	1
+1871	1871	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1872	1872	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1873	1873	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1874	1874	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1875	1875	^\s*	2	0	0	1
+1876	1876	^\s*	2	0	0	1
+1877	1877	^\s*	2	0	0	1
+1878	1878	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){5}	2	0	0	1
+1879	1879	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7}	2	0	0	1
+1880	1880	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7}	2	0	0	1
+1881	1881	Template=.*\.\.	2	0	0	1
+1882	1882	act\x3D[^\x26\s\r\n]{257}	2	0	0	1
+1883	1883	app\x3D[^\x26\s\r\n]{257}	2	0	0	1
+1884	1884	[\x20-\x7e]{5,}\x5c\x00[\x20-\x7e]{5,}	2	0	0	1
+1885	1885	^[\x50-\x59]	2	0	0	1
+1886	1886	^[^\r\n]*?\x60[^\x60]*?\$\{IFS\}	2	0	0	1
+1887	1887	\bsolusvmc-node\b	2	0	0	1
+1888	1888	^\s*?\(\s*?[^,\s]*?\s*?,\s*?[\x22\x27][a-f0-9]{100}	2	0	0	1
+1889	1889	^mail\s*?from\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b	2	0	0	1
+1890	1890	^(\x25(25)*?20|\s)*?runmumaa\W	2	0	0	1
+1891	1891	^\s*?(<var>[^=\s\x3b]+)\s*\s*?getBits\(\s*?\)\x3b.+?flashvars\s*\s*?\x5c\x22(=var)\s*\s*?\x22\s*?\+\s*?(=var)\s*?\+\s*?\x22\x5c\x22	2	0	0	1
+1892	1892	^[a-z-]+\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b.*\x3b.*\x7d\s*\x3b(=[\r\n])	2	0	0	1
+1893	1893	^\s*\x28\s*[\x22\x27]\s*message	2	0	0	1
+1894	1894	^(\.|\[\s*?[\x22\x27])defineProperties\s*?\x28	2	0	0	1
+1895	1895	^[^\r\n]+\.hta\r?\n	2	0	0	1
+1896	1896	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1897	1897	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1898	1898	^(<num_value>\d+)\x7d,\x22id\x22\x3a(=num_value)	2	0	0	1
+1899	1899	^[(\x60|%60)(\x27|%27)]	2	0	0	1
+1900	1900	^\/(home\/a3user|root)\/agile3\/patches\/	2	0	0	1
+1901	1901	^.*?\x26	2	0	0	1
+1902	1902	(\x0a|\\n)\/s1Caa6	2	0	0	1
+1903	1903	^(\\r\\n|\x0d\x0a)C	2	0	0	1
+1904	1904	^\d{3}	2	0	0	1
+1905	1905	^(https\/\/|(\d{1,3}\.){3}\d{1,3}|([a-z0-9-]+\.)+[a-z]{1,8})	2	0	0	1
+1906	1906	^(==[A-Z0-9+/]{2}|=[A-Z0-9+/]{3}|[A-Z0-9+/]{4})([A-Z0-9+/]{4})*$	2	0	0	1
+1907	1907	^[A-Za-z0-9+/]{2}([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1908	1908	[\?\&]cmd_param=[^\&\r\n]{500}	2	0	0	1
+1909	1909	(%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))	2	0	0	1
+1910	1910	^.{11}([\xC0-\xC1]|[\xF5-\xFF]|\xE0[\x80-\x9F]|\xF0[\x80-\x8F]|[\xC2-\xDF]([\x80-\xBF])|[\xE0-\xEF]([\x80-\xBF]{2})|[\xF0-\xF4]([\x80-\xBF]{3})|([\x00-\x7F\xF5-\xFF])[\x80-\xBF]|([\xC2-\xDF]|[\xE0-\xEF]|[\xE0-\xEF][\x80-\xBF]|[\xF0-\xF4]|[\xF0-\xF4][\x80-\xBF]|[\xF0-\xF4][\x80-\xBF]{2})[\x80-\xBF]|([\xE0-\xEF])[\x80-\xBF]([\x80-\xBF])|([\xF0-\xF4])[\x80-\xBF]([\x80-\xBF]{2})|([\xF0-\xF4][\x80-\xBF])[\x80-\xBF]([\x80-\xBF]))	2	0	0	1
+1911	1911	^[^\x22]*[\x24\x60]+	2	0	0	1
+1912	1912	^[^\x22]*[\x24\x60]+	2	0	0	1
+1913	1913	^[a-z0-9\-_\.\/]+\x00	2	0	0	1
+1914	1914	^SOAPAction\x3a\s+?[^\r\n]*?http\x3a\/\/purenetworks\.com\/HNAP1\/([^\x2f]+?[\x2f])?[^\x2f]	2	0	0	1
+1915	1915	\/dev-report-overview\.html[^\"]*?\x3b	2	0	0	1
+1916	1916	^\s*\x22{2}	2	0	0	1
+1917	1917	^[\x22\x27]t(eamviewer(\d+|api)|v(c(hat|ontrol)|filetransfer|joinv|present|s(endfile|q(customer|support))|v(ideocall|pn))\d)	2	0	0	1
+1918	1918	^Host\x3a[^\n]{0,50}?\x3b	2	0	0	1
+1919	1919	^[\s>]	2	0	0	1
+1920	1920	^[\s>]	2	0	0	1
+1921	1921	^((\x0d\x0a).)+\x22(https?|file):\x2f\x2f	2	0	0	1
+1922	1922	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1923	1923	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1924	1924	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1925	1925	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1926	1926	^\s*?\x29	2	0	0	1
+1927	1927	^\s*?\(x\s*,\s*1,\s*24000\s*\x29	2	0	0	1
+1928	1928	^\s*[\x22\x27][^\x22\x27]{0,128}\x2e\x2e	2	0	0	1
+1929	1929	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1930	1930	=\s*\x25\s*\{\s*.+?\bProcessBuilder\b	2	0	0	1
+1931	1931	^[ a-zA-Z0-9+_]*[\x27\x3b]	2	0	0	1
+1932	1932	destination=[^&]*\x24\x28	2	0	0	1
+1933	1933	name=[^&]*\x24\x28	2	0	0	1
+1934	1934	^[^&]+\x2527(UNION|SELECT)	2	0	0	1
+1935	1935	[^&]*(\x60|\x24)	2	0	0	1
+1936	1936	(\x60|\x24)	2	0	0	1
+1937	1937	(\/GponForm\/diag_FORM\?images\/|\.html\?images\/)	2	0	0	1
+1938	1938	^((\S\:\\){2,}|\S\:\\\S\:\S\:|S\:\\\\\\([0-9]{1,3}\.){3}[0-9]{1,3}|\S\:\\\\\\([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+1939	1939	^(www\.)?(cisco|linksys)\.com\/jnap\/	2	0	0	1
+1940	1940	^.{1,10}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)	2	0	0	1
+1941	1941	(\%3C){1000}	2	0	0	1
+1942	1942	A{1000}	2	0	0	1
+1943	1943	id\=[^\r\n]*?(select|delete|union|update|insert)	2	0	0	1
+1944	1944	^\d{2,5}(\&|\d)	2	0	0	1
+1945	1945	^(8=|9BQQ==)\r?\n?	2	0	0	1
+1946	1946	=\s*\x25\s*\{\s*(.+?\bgetRunTime\b).+?\bexec\b	2	0	0	1
+1947	1947	^[0-9]+	2	0	0	1
+1948	1948	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\[[^\x5d]*?\W	2	0	0	1
+1949	1949	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\%5b[^\x5d]*?\W	2	0	0	1
+1950	1950	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\[[^\x5d]*?\W	2	0	0	1
+1951	1951	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\%5b[^\x5d]*?\W	2	0	0	1
+1952	1952	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\[[^\x5d]*?\W	2	0	0	1
+1953	1953	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1954	1954	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1955	1955	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1956	1956	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\[[^\x5d]*?\W	2	0	0	1
+1957	1957	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\%5b[^\x5d]*?\W	2	0	0	1
+1958	1958	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\[[^\x5d]*?\W	2	0	0	1
+1959	1959	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\%5b[^\x5d]*?\W	2	0	0	1
+1960	1960	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\[[^\x5d]*?\W	2	0	0	1
+1961	1961	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1962	1962	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1963	1963	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1964	1964	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\[[^\x5d]*?\W	2	0	0	1
+1965	1965	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\%5b[^\x5d]*?\W	2	0	0	1
+1966	1966	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\[[^\x5d]*?\W	2	0	0	1
+1967	1967	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\%5b[^\x5d]*?\W	2	0	0	1
+1968	1968	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\[[^\x5d]*?\W	2	0	0	1
+1969	1969	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1970	1970	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1971	1971	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1972	1972	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\[[^\x5d]*?\W	2	0	0	1
+1973	1973	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\%5b[^\x5d]*?\W	2	0	0	1
+1974	1974	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\[[^\x5d]*?\W	2	0	0	1
+1975	1975	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\%5b[^\x5d]*?\W	2	0	0	1
+1976	1976	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\[[^\x5d]*?\W	2	0	0	1
+1977	1977	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1978	1978	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1979	1979	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1980	1980	ping_addr=[\d.]*[^\d.]	2	0	0	1
+1981	1981	\?write_(m(ac|sn)|hdv|pid|tan)&[^&]*\x3b	2	0	0	1
+1982	1982	^User-Agent\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}	2	0	0	1
+1983	1983	^X-Forwarded-For\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}	2	0	0	1
+1984	1984	pjl\x5Fready\x5Fmessage\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+1985	1985	^[^=]{1,}$	2	0	0	1
+1986	1986	^\x22[^\x22]*\x3b[^\x22]*\x22/P	2	0	0	1
+1987	1987	^\s*[\x22\x27]	2	0	0	1
+1988	1988	\.hta([?&]|$)	2	0	0	1
+1989	1989	^[A-Za-z0-9+/]{0,4}?[^\x20-\x7e]	2	0	0	1
+1990	1990	\%(25)?temp\%	2	0	0	1
+1991	1991	^[a-zA-Z0-9]+$	2	0	0	1
+1992	1992	[^&]*(\x60|\x24)	2	0	0	1
+1993	1993	^User-Agent\x3a[^\r\n]*JDatabaseDriverMysqli/Hmi	2	0	0	1
+1994	1994	(localhost|127\.0\.0\.1)/W	2	0	0	1
+1995	1995	^[^\r\n]{128,}\r\n	2	0	0	1
+1996	1996	^[^\+]+\+0A	2	0	0	1
+1997	1997	^[^\+]+(\+[A-F0-9]{2}){4,}	2	0	0	1
+1998	1998	^.{0,100}\+0A.{0,100}\x40	2	0	0	1
+1999	1999	^[^\r\n]{50,}	2	0	0	1
+2000	2000	^\S{0,7}\/(meeting|fb\/smb|namedusers|metric)	2	0	0	1
+2001	2001	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+2002	2002	^(((:?0x[a-f0-9]{2}|0+?\d{1,3})\s*?,\s*?)*?\d{1,3})(((:?0x[a-f0-9]{2}|\d{1,3})\s*?,\s*?)*?0+?\d{1,3})(((:?0+?\d{1,3}|\d{1,3})\s*?,\s*?)*?0x[a-f0-9]{2})((:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?,\s*?)+(:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?\)	2	0	0	1
+2003	2003	^form(Ping|Tracert)$	2	0	0	1
+2004	2004	^form(Ping|Tracert)$	2	0	0	1
+2005	2005	^.{1,50}\/uapi-cgi\/	2	0	0	1
+2006	2006	^.{1,50}\/uapi-cgi\/	2	0	0	1
+2007	2007	^[^&]{150,}	2	0	0	1
+2008	2008	^[^&]{150,}	2	0	0	1
+2009	2009	\bexec\b	2	0	0	1
+2010	2010	parent=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2011	2011	oId=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2012	2012	[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2013	2013	^\s+?[^\s\>]+?\s+?SYSTEM\s	2	0	0	1
+2014	2014	^[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2015	2015	^[A-Z]{8}\x3a	2	0	0	1
+2016	2016	^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5bnull\x5d	2	0	0	1
+2017	2017	^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5b\x5d	2	0	0	1
+2018	2018	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2019	2019	^.{0,5}(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2020	2020	^\s*(<worker>[A-Za-z0-9_-]{1,20})\s*=\s*null\x3b.{1,300}(=worker)\s*=\s*document\.getElementById\([\x22\x27](=worker)[\x22\x27]\)\x3b.{1,300}\.addEventListener\([\x22\x27]DOMNodeInserted[\x22\x27]\s*,\s*(<callback0>[A-Za-z0-9_-]{1,20}).{0,300}(=worker)(<worker_ext>(\.\w{1,20})+)\s*=\s*\d+\x3b.{1,300}function\s*(=callback0)\([^\)]+\)\s*\{\s*.{1,300}\.requestAnimationFrame\((<callback>[A-Za-z0-9_-]{1,20})\)\x3b.{1,300}function\s*(<garbagecollector>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*.{0,100}for\s*\(let\s*(<gc_counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=gc_counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=gc_counter)(\+{2}|-{2})\s*\)\s*.{1,300}function\s*(=callback)\([^\)]+\)\s*\{\s*.{1,300}(=garbagecollector)\(\)\s*\x3b\s*.{1,300}\((=worker)(=worker_ext)\)	2	0	0	1
+2021	2021	^\s*(<opt>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*let\s*(<o_var>[A-Za-z0-9_-]{1,20})\s*=\s*\{\}\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=o_var)\.(<x_prop>[A-Za-z0-9_-]{1,20}).{1,300}for\s*\(\s*let\s*(<counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)(\+{2}|-{2})\).{1,100}(=opt)\(\).{1,300}let\s*(<leaked_stack_obj>[A-Za-z0-9_-]{1,20})\s*=\s*null.{1,100}let\s*(<obj_proto>[A-Za-z0-9_-]{1,20})\s*=\s*\(\{\}\)\.__proto__\x3b.{1,300}(=obj_proto)\.__defineGetter__\([\x22\x27](=x_prop)[\x22\x27],\s*Error\.prototype\.toString\)\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=obj_proto)\.__defineGetter__\([\x22\x27](<message_proto>[A-Za-z0-9_-]{1,20})[\x22\x27].{1,300}delete\s*(=obj_proto)\.(=message_proto)\x3b.{1,300}(=obj_proto)\.\w+\s*=\s*Array\.prototype.{1,300}(=opt)	2	0	0	1
+2022	2022	^\s*(<func_opt>[\w-]{1,20})\((<var_a>[\w-]{1,20})\s*,\s*(<var_b>[\w-]{1,20}).{1,300}((=var_a)\.(=var_b)|(=var_b)\.(=var_a))\s*=\s*\d+\x3b\s*((=var_a)|(=var_b))\.push\(\d+\)\x3b\s*((=var_a)\.(=var_a)|(=var_b)\.(=var_b))\s*=\s*0x.{1,300}Object\.prototype\.push\s*=\s*Array\.prototype\.push\x3b\s*for\s*\(\s*let\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\).{1,300}let\s*((=var_a)|(=var_b))\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}\x3b.{1,300}(=func_opt)\(((=var_a)|(=var_b)),\s*\{\}.{1,300}let\s*(<var_o>[\w-]{1,20})\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}.{1,300}(=func_opt)\((=var_o)	2	0	0	1
+2023	2023	^\s*(<func_a>[\w-]{1,20})\((<obj1>[\w-]{1,20})\s*,\s*(<tmp_obj>[\w-]{1,20})\s*,\s*(<value>[\w-]{1,20})\).{1,300}(=obj1)\.\w+\s*=\s*\d+\.\d+\x3b\s*var\s*\w+\s*=\s*\{__proto__:\s*(=tmp_obj)\}\x3b\s*(=obj1)\.\w+\s*=\s*(=value)\x3b.{1,300}var\s*(=obj1)\s*=\s*\{\w+:\s*\d+\.\d+\s*,\s*\w+:\s*\d+\.\d+\}\x3b\s*for\s*\(\s*var\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\)\s*\{\s*(=func_a)\((=obj1)\s*,\s*(\x22{2}|\x27{2})\s*,\s*(\x22{2}|\x27{2})\)\x3b.{1,300}(=func_a)\((=obj1)\s*,\s*(=obj1)\s*,\s*\d+\.\d{8,}.{1,300}eval\((=obj1)\.	2	0	0	1
+2024	2024	^form(RebootCheck|Wsc)$	2	0	0	1
+2025	2025	^[^&]{42,}	2	0	0	1
+2026	2026	^[^&]{512,}	2	0	0	1
+2027	2027	^Callback\x3a\x20\x3chttp[^\x3a]+\x3a\d{1,5}[^\/]/Hmi	2	0	0	1
+2028	2028	^[^&]{90,}	2	0	0	1
+2029	2029	^\d[012345]	2	0	0	1
+2030	2030	^\d[012345]	2	0	0	1
+2031	2031	^\d[012345]	2	0	0	1
+2032	2032	^\d[012345]	2	0	0	1
+2033	2033	^\d[012345]	2	0	0	1
+2034	2034	^\d[012345]	2	0	0	1
+2035	2035	^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e)	2	0	0	1
+2036	2036	^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e)	2	0	0	1
+2037	2037	^[^&\x0d\r]+[\n\x0a]	2	0	0	1
+2038	2038	^\s*(<func_a>[\w\-]{1,20})\((<obj_1>[\w\-]{1,20})\s*,\s*(<obj_2>[\w\-]{1,20}).{1,300}(=obj_1)\.(<prop_2>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,300}?(=obj_2)\.pop\(\).{1,300}?(=obj_1)\.(<prop_1>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,500}Object\.prototype\.p(op|ush)\s*=\s*Array\.prototype\.p(op|ush)\x3b.{1,500}var\s*(<obj_3>[\w\-]{1,20})\s*=\s*\{\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)?\s*,\s*((=prop_2)\s*\x3a\s*\d+(\.\d+)?|(=prop_2)\s*\x3a\s*\d+(\.\d+)?\s*,\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)).{1,500}(=func_a)\(\s*((=obj_3)\s*,\s*new\s*Object\(\)|\s*new\s*Object\(\)\s*,\s*(=obj_3)\s*).{1,500}?(=func_a)\((=obj_3)	2	0	0	1
+2039	2039	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2040	2040	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2041	2041	^[^&\r\n]+(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2042	2042	^(%[a-f0-9]{2}){5,}	2	0	0	1
+2043	2043	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2044	2044	^%(3b|0a|26|60|7C|24)	2	0	0	1
+2045	2045	^\/(icons|cgi-bin)	2	0	0	1
+2046	2046	^\/(icons|cgi-bin)	2	0	0	1
+2047	2047	^\/(icons|cgi-bin)	2	0	0	1
+2048	2048	[^\r\n]*true	2	0	0	1
+2049	2049	\x2f(FURUKAWA|APROS)\x2f	2	0	0	1
+2050	2050	[^\r\n]*(\x60|\x24|\x7c|\bsh\b)	2	0	0	1
+2051	2051	^[^\r\n=]*(union|select)	2	0	0	1
+2052	2052	^[^&=]*(union|select)	2	0	0	1
+2053	2053	^(<class>[A-Z0-9_-]{1,20})\s*.*?(<var>[A-Z0-9_-]{1,15})\s*=\s*(&amp\x3b|0x|\\x|&?h)*\d{8}\s*.*?(ReDim|Dim)\s*(=var)\(\d{4,20}\).*?set\s*(=var)\(\d+\)\s*=\s*new\s*(=class).*?Erase\s*(=var).*?Erase\s*(=var)	2	0	0	1
+2054	2054	^[^\x22]+\.jsp\x22	2	0	0	1
+2055	2055	([\x60\x3b\x7c]|%60|%3b|%7c|%26|(\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2056	2056	^[\s\x22\x27]*check_ping\b	2	0	0	1
+2057	2057	^\s*(<obj>[\w\-]{1,20})\s*=\s*document\.getElementById\(.{1,500}Class\s*(<class>[\w\-]{1,20}).{1,500}End\s*Class.{1,500}set\s*(=obj)\.scroll((Left|Top)(Max)?|Height|Width)\s*=\s*New\s*(=class)	2	0	0	1
+2058	2058	[^\r\n]*\x5c(n|c)[^\r\n]{0,100}[\x60\x24]	2	0	0	1
+2059	2059	([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2060	2060	^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2061	2061	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2062	2062	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2063	2063	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2064	2064	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2065	2065	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2066	2066	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2067	2067	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2068	2068	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2069	2069	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2070	2070	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2071	2071	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2072	2072	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2073	2073	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2074	2074	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2075	2075	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2076	2076	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2077	2077	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2078	2078	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2079	2079	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2080	2080	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2081	2081	\.((php\d{0,}|phps|pht|phtm|phtml|shtml|htaccess|phar|inc))	2	0	0	1
+2082	2082	^[^&]{100,}	2	0	0	1
+2083	2083	^[a-zA-Z0-9]+\.(zip|7z|gz)	2	0	0	1
+2084	2084	^(\x28|\x29|\x3c|\x3e|\x26|\x2a|\xe2|\x80|\x98|\x7c|\x3f|\x3b|\x5b|\x5d|\x5e|\x7e|\x21|\x2e|\xe2|\x80|\x9d|\x25|\x40|\x2f|\x5c|\x3a|\x2b|\x2c|\x60)	2	0	0	1
+2085	2085	^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr)	2	0	0	1
+2086	2086	^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr)	2	0	0	1
+2087	2087	^[0-9]{1,10}\x3b	2	0	0	1
+2088	2088	^(%2e|\.)exec	2	0	0	1
+2089	2089	^[a-zA-Z0-9]{5,40}	2	0	0	1
+2090	2090	^[a-zA-Z0-9]{7,200}	2	0	0	1
+2091	2091	^\d+..([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))-XX:OnOutOfMemoryError=	2	0	0	1
+2092	2092	^[^&=]*(union|select|update|insert|delete)	2	0	0	1
+2093	2093	^[^&=]*(union|select|update|insert|delete)	2	0	0	1
+2094	2094	((%2F|\/)(\.|%2E){2}(%2F|\/))	2	0	0	1
+2095	2095	((%2F|\/)(\.|%2E){2}(%2F|\/))	2	0	0	1
+2096	2096	^(%2E%2E%2F|\.\.\/)	2	0	0	1
+2097	2097	^[a-zA-Z0-9]{5,45}	2	0	0	1
+2098	2098	^([A-Z]\x00){20}\x00\x00	2	0	0	1
+2099	2099	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+2100	2100	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+2101	2101	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+2102	2102	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2103	2103	^SOAPAction\x3a\x20\x22?urn\x3aNETGEAR-ROUTER\x3aservice\x3a.{128,}(:\d#)/Hm	2	0	0	1
+2104	2104	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2105	2105	^[a-zA-Z0-9+/]{1000,}	2	0	0	1
+2106	2106	\We[\s\x22\x27,+]*?v[\s\x22\x27,+]*?a[\s\x22\x27,+]*?l\W	2	0	0	1
+2107	2107	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2108	2108	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2109	2109	^[^<]{30,}<\/NewMACAddress>	2	0	0	1
+2110	2110	^0+(&|$)	2	0	0	1
+2111	2111	^0+(&|$)	2	0	0	1
+2112	2112	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2113	2113	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2114	2114	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2115	2115	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2116	2116	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2117	2117	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2118	2118	^\/(icons|cgi-bin)	2	0	0	1
+2119	2119	^\/(icons|cgi-bin)	2	0	0	1
+2120	2120	^\/(icons|cgi-bin)	2	0	0	1
+2121	2121	^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2122	2122	(yJ0eXAiOiJKV1Qi|InR5cCI6IkpXVCJ)/H	2	0	0	1
+2123	2123	^(CREATE|SELECT|INSERT|UPDATE|EXEC)	2	0	0	1
+2124	2124	^["']\s*:\s*["']\s*[^0-9]+	2	0	0	1
+2125	2125	^\s?([\x3b\x0a\x26\x60\x7c\x24]|%(3b|0a|26|60|7c|24))	2	0	0	1
+2126	2126	^\s*=\s*[\x22\x27]\s*ms-msdt\x3a	2	0	0	1
+2127	2127	(\x2e|%2e)(\x2e|%2e)(\x2f|%2f)	2	0	0	1
+2128	2128	myname=[^&]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2129	2129	^\x2fdefault\x2fen_US\x2fframe(\x2eA100)?\x2ehtml\?(content|sidebar)=.*\x2e\x2e\x2f	2	0	0	1
+2130	2130	^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2131	2131	^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2132	2132	[^a-zA-Z0-9_\-\.][a-zA-Z]{8}\.jar	2	0	0	1
+2133	2133	^\s?(file|https?)\x3a	2	0	0	1
+2134	2134	^(\/?\.\.?\/){2}	2	0	0	1
+2135	2135	\b(<xps>[a-zA-Z]{7})\.classPK.+?\b(=xps)\[a-zA-Z]{12}\.classPK.+?\b(=xps)\$[a-zA-Z]{12}\.classPK	2	0	0	1
+2136	2136	^[\r\n\s\+]*.+?\}[\r\n\s]*?catch	2	0	0	1
+2137	2137	^(application\/(x-)?|text\/)xml	2	0	0	1
+2138	2138	^(application\/(x-)?|text\/)xml	2	0	0	1
+2139	2139	\/((index|toc)\.html?)?\?\/\/	2	0	0	1
+2140	2140	^.{0,10}[\x3b\x0a\x26\x60\x7c\x24]	2	0	0	1
+2141	2141	[?&]ap=	2	0	0	1
+2142	2142	^\d+\s*[^\r\n]{50,}	2	0	0	1
+2143	2143	(web|decorators|seraph-config)\x2exml$	2	0	0	1
+2144	2144	com.atlassian.jira\x2f(jira\x2dwebapp\x2ddist|atlassian\x2djira\x2dwebapp)\x2fpom\x2e(properties|xml)$	2	0	0	1
+2145	2145	^[^\x3c]{,100}\x27	2	0	0	1
+2146	2146	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+2147	2147	^(Begin|End)\=/P	2	0	0	1
+2148	2148	\/\?[a-f0-9]{64}\;\d\;\d	2	0	0	1
+2149	2149	\x7b?(visibility\x3ahidden|display\x3anone)\x3b?\x7d?\x22><div>\d{16}	2	0	0	1
+2150	2150	\/[a-z]\/[0-9a-f]{32}$	2	0	0	1
+2151	2151	\/dl\/\w{1,4}\.php\?[0-9]$	2	0	0	1
+2152	2152	\/[a-f0-9]{60,}_js\?	2	0	0	1
+2153	2153	\/[a-f0-9]{60,}_jar$	2	0	0	1
+2154	2154	\/[a-f0-9]{60,}_exe$	2	0	0	1
+2155	2155	,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,	2	0	0	1
+2156	2156	^\/showthread\.php\?t=\d+$	2	0	0	1
+2157	2157	function\x20booom[1-3]{1}\x28\x29	2	0	0	1
+2158	2158	var\x20Cute(Money|Power|Shine)	2	0	0	1
+2159	2159	iframe[^\r\n]*\x2FCUTE-IE\x2Ehtml	2	0	0	1
+2160	2160	^\/[a-z][0-9a-z_+=-]{10,30}\?\w=[0-9.]+\&\w=1.6.0_\d\d$	2	0	0	1
+2161	2161	\.php\?(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+$	2	0	0	1
+2162	2162	\/[a-z0-9]+\.[a-z0-9]{2,4}\/eH[a-z0-9]{60,}$	2	0	0	1
+2163	2163	\/[a-z0-9]+\.[a-z0-9]{2,4}\/oH[a-z0-9]{60,}$	2	0	0	1
+2164	2164	\/indigo\?\d+	2	0	0	1
+2165	2165	^\/\?[a-f0-9]{32}$	2	0	0	1
+2166	2166	=[.\"]\w{8}\.jar/Hi	2	0	0	1
+2167	2167	\.php\?showtopic=[0-9]{6}$	2	0	0	1
+2168	2168	\/[0-9]\.html$	2	0	0	1
+2169	2169	^\?[a-f0-9]{32}\" 	2	0	0	1
+2170	2170	^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$	2	0	0	1
+2171	2171	^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$	2	0	0	1
+2172	2172	^\/t\/[a-f0-9]{32}	2	0	0	1
+2173	2173	\/[A-Z]{20,}\?[A-Z]=\d$	2	0	0	1
+2174	2174	^\/q[a-zA-Z0-9+-]{3,14}\/[a-zA-Z0-9+-]{3,16}\?[a-z]{1,6}=[a-zA-Z0-9+-\._]{7,18}$	2	0	0	1
+2175	2175	^\/Applet\.jar$	2	0	0	1
+2176	2176	\/beacon\/[a-f0-9]{8}\.htm$	2	0	0	1
+2177	2177	\/t\/[a-f0-9]{32}$	2	0	0	1
+2178	2178	^\/[0-9]{3}\.jar$	2	0	0	1
+2179	2179	^[\r\n\s]*[\d\x5b]	2	0	0	1
+2180	2180	^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.jar$	2	0	0	1
+2181	2181	^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.pdf$	2	0	0	1
+2182	2182	\/[0-9]{3}\.pdf	2	0	0	1
+2183	2183	\(\x22[0-9\x3a\x3b\x3c\x3d\x3e\x3fa-k]{50,100}\x22\).{0,200}\)\x3b<\/script><\/body>	2	0	0	1
+2184	2184	^[a-f0-9]{32}	2	0	0	1
+2185	2185	^((<\/applet>).)+?\/.{1,12}\/.{1,12}\x3a.{1,12}p.{1,12}t.{1,12}t.{1,12}h	2	0	0	1
+2186	2186	^(\s*=\s*|[\x22\x27]\s*,\s*)[\x22\x27]	2	0	0	1
+2187	2187	^[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])(((=q)).)+?\.(gif|jpe?g|p(ng|sd))(=q)	2	0	0	1
+2188	2188	^((<\/applet>).)+[\r\n\s]value[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])[a-f0-9]{32}(=q1)	2	0	0	1
+2189	2189	^\/[a-z0-9A-Z]{25,35}\/(([tZFBeDauxR]+q){3}[tZFBeDauxR]+(_[tZFBeDauxR]+)?|O7dd)k(([tZFBeDauxR]+q){3}[tZFBeDauxR]+|O7dd)\/	2	0	0	1
+2190	2190	EGYPACK_CRYPT\d	2	0	0	1
+2191	2191	\/\?[0-9a-f]{60,66}\x3b(1(0[0-3]|1\d)|90)\d{1,3}\x3b\d{1,3}$	2	0	0	1
+2192	2192	^(ckwm)*?(Exp|cc)\.class	2	0	0	1
+2193	2193	^\/command\/[a-zA-Z]{6}$	2	0	0	1
+2194	2194	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+2195	2195	^(a(ttack|dEx[xp])|([a-z]))\.class	2	0	0	1
+2196	2196	^(a(ttack|dEx[xp])|([a-z]))\.class	2	0	0	1
+2197	2197	^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27]((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){10}|(=ascii){10})	2	0	0	1
+2198	2198	^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27][^\x22\x27]+?[\x22\x27][^>]*((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){9,20}|(=ascii){9,20})%3C	2	0	0	1
+2199	2199	^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$	2	0	0	1
+2200	2200	^\/[0-9]{1,2}\/red[0-9]{1,4}\.php[0-9]{0,1}$	2	0	0	1
+2201	2201	\.php\?(b=[a-fA-F0-9]{6}&)?v=1\.((4\.[0-2]\.[0-3]|5\.0\.[0-2]|6.0\.[0-4])\d?|[7-8]\.0\.\d{1,2})$	2	0	0	1
+2202	2202	&k=\d{16}(&|$)	2	0	0	1
+2203	2203	^(((?i:<\/applet>)).)+?[\r\n\s]value[\r\n\s]*[\r\n\s]*?[\x22\x27]?(\d{2,3})?(<sep>([^a-zA-Z0-9]{1,100}|[a-zA-Z0-9]{1,100}))\d{2,3}((=sep)\d{2,3}){20}	2	0	0	1
+2204	2204	^(((?i:<\/applet>)).)+?[\r\n\s]archive[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27]	2	0	0	1
+2205	2205	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+2206	2206	if.{1,10}[<>]=?\s*(<quot>[\x22\x27])1(<sep>[^0-9a-zA-Z])7((=sep)\d+)?(=quot).{1,10}[<>]=?\s*(=quot)1(=sep)7((=sep)\d+)?(=quot)	2	0	0	1
+2207	2207	^[\r\n\s]*[\r\n\s]*?[\x22\x27]http\x3a\/\/[^\/]+?\/\?[A-Za-z0-9]+=[A-Za-z0-9%]{60,}[\x22\x27]	2	0	0	1
+2208	2208	^[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\x22\x27]\.replace\([\r\n\s]*?(<q1>[\x22\x27]?)\/.+?\/g[\r\n\s]*?,[\r\n\s]*?(<q2>[\x22\x27]?)%(=q2)[\r\n\s]*?\)	2	0	0	1
+2209	2209	(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{12,16}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a)	2	0	0	1
+2210	2210	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27]	2	0	0	1
+2211	2211	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(<dot>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<p>((=dot))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<h>(((=p)|(=dot)))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=p).+?value[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(=dot)([^a-f0-9]{2}){1,20}(<e>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<x>((=e))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=e)(([^a-f0-9]{2}){1,20})?[\x22\x27]	2	0	0	1
+2212	2212	\/[a-f0-9]{32}\/[a-z]+?\-[a-z]+?\.php	2	0	0	1
+2213	2213	\.php\?e=\d+(&|$)	2	0	0	1
+2214	2214	^[\r\n\s]*?[\x22\x27][a-f0-9]{2}(<sep>[^a-f0-9]{1,10})(<a>[a-f0-9]{2})(=sep)(<p>[a-f0-9]{2})(=sep)(=p)(=sep)(<l>[a-f0-9]{2})(=sep)(<e>[a-f0-9]{2})[^\x22\x27]+?(=sep)(=p)(=sep)(=a)(=sep)[a-f0-9]{2}(=sep)(=a)(=sep)[^\x22\x27]+?(=sep)(=a)(=sep)(=l)(=sep)[a-f0-9]{2}(=sep)(=e)	2	0	0	1
+2215	2215	\/cod\/[^\x2f]+\.vbs$	2	0	0	1
+2216	2216	[a-f0-9]{32}\.jar	2	0	0	1
+2217	2217	^[^a-z0-9]	2	0	0	1
+2218	2218	\.php\?dwl=[a-z]+$	2	0	0	1
+2219	2219	^[\r\n\s]*[\r\n\s]*?[\x22\x27]h(<sep>\d{2})t(=sep)t(=sep)p(=sep)\x3a	2	0	0	1
+2220	2220	^[\r\n\s]*?[\x22\x27]<([\x27\x22]\s*?\+\s*?[\x22\x27])?a([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?l([\x27\x22]\s*?\+\s*?[\x22\x27])?e([\x27\x22]\s*?\+\s*?[\x27\x22])?t	2	0	0	1
+2221	2221	^\/ep\/cl\.php$	2	0	0	1
+2222	2222	^[\r\n\s]*?[\x22\x27]<applet	2	0	0	1
+2223	2223	=\d+&e=\d+$	2	0	0	1
+2224	2224	\/\d+\/\d\.zip$	2	0	0	1
+2225	2225	(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{10,20}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a)	2	0	0	1
+2226	2226	(<a>[0-9a-z]{2})(<s>((=a))[0-9a-z]{2})[0-9a-z]{2}(=s)[0-9a-z]{2}(<y>[0-9a-z]{2})[0-9a-z]{4}(<dot>[0-9a-z]{2})(=a)(<r>[0-9a-z]{2})(=r)(=a)(=y)(=dot)	2	0	0	1
+2227	2227	^[\r\n\s]*?\(	2	0	0	1
+2228	2228	\/[a-z0-9]{32}\.jar$	2	0	0	1
+2229	2229	^[^\s]*?\s*?\/[^\r\n\s]*?\?src=	2	0	0	1
+2230	2230	^\/([\/_]*?[a-f0-9][\/_]*?){32}\/\d+?$	2	0	0	1
+2231	2231	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?\/([\/_]*?[a-f0-9][\/_]*?){64}[\x22\x27]	2	0	0	1
+2232	2232	^\/([\/_]*?[a-f0-9][\/_]*?){32}$	2	0	0	1
+2233	2233	^\/[a-zA-Z0-9_\x2f-]{300,}\.jar$	2	0	0	1
+2234	2234	^\/[a-zA-Z0-9_\x2f-]{300,}\.eot$	2	0	0	1
+2235	2235	^((<\/applet>).)+?[\x22\x27]687474703a2f2f	2	0	0	1
+2236	2236	\.html\?sv=[1-5](\,\d+?){1,3}$	2	0	0	1
+2237	2237	\/(d|xie|fla)\.php\?[a-z]+687474703a2f2f	2	0	0	1
+2238	2238	\.html\?jar$	2	0	0	1
+2239	2239	^\/\d{4,5}\/\d{7}$	2	0	0	1
+2240	2240	\/\{0,2}[A-Za-z0-9\+\/]+?LvoDc0RHa8NnZ$	2	0	0	1
+2241	2241	^[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*?\.charCodeAt[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*[\r\n\s]*?\)[\r\n\s]*?\^[\r\n\s]*?[a-zA-Z_$][^\r\n\s]*\.charCodeAt[\r\n\s]*?\(	2	0	0	1
+2242	2242	^(<sep>[^\x22\x27]{1,10})100(=sep)97(=sep)115(=sep)104(=sep)115(=sep)116(=sep)121(=sep)108(=sep)101(=sep)46(=sep)97(=sep)114(=sep)114(=sep)97(=sep)121(=sep)	2	0	0	1
+2243	2243	^[a-z0-9]{1,500}?(<s>[a-z0-9]{2})(<t>((=s))[a-z0-9]{2})(<r>(((=s)|(=t)))[a-z0-9]{2})(=t)(<o>(((=s)|(=t)|(=r)))[a-z0-9]{2})(<b>(((=s)|(=t)|(=r)|(=o)))[a-z0-9]{2})(<y>(((=s)|(=t)|(=r)|(=o)|(=b)))[a-z0-9]{2})(=t)((((=s)|(=t)|(=r)))[a-z0-9]{4})(=s)(=t)(=r)	2	0	0	1
+2244	2244	^\/[a-z0-9]+?\?thread=\d+?&x?key=[A-F0-9]{32}$	2	0	0	1
+2245	2245	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+2246	2246	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+2247	2247	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+2248	2248	\/[A-Z]\.xml$	2	0	0	1
+2249	2249	^(<sep>((100).){1,20})100(=sep)101(=sep)102(=sep)97(=sep)117(=sep)108(=sep)116(=sep)35(=sep)86(=sep)77(=sep)76(=sep)	2	0	0	1
+2250	2250	\.php\?a=[^&]+&f=[a-f0-9]{32}&u=[^&]+$	2	0	0	1
+2251	2251	\.php\?a=(dw[a-z0-9]|[hr][2-7])$	2	0	0	1
+2252	2252	(PK\x01\x02.{24}\x0a\x00.{16}[a-z]{4}.class){4}	2	0	0	1
+2253	2253	^(((?i:<\/applet>)).)+?(?i:value)[\r\n\s]*=[\r\n\s]*\x5c?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]+(=slash)	2	0	0	1
+2254	2254	^\d+u\d+s\d+h\d	2	0	0	1
+2255	2255	^((<\/applet>).)+?&#(0*?(1([0-1]\d|2[0-2])|[78][0-9]|9[07-9]|4[8-9]|5[0-7]|6[5-9])|x0*?([46][1-9A-F]|[57][0-9A]|3[0-9]))(\x3b|&#)	2	0	0	1
+2256	2256	^\s*?\d	2	0	0	1
+2257	2257	^\s*\s*?[\x22\x27][^\x22\x27\x3d]{1,20}=[a-f0-9]{20}	2	0	0	1
+2258	2258	^[^\d]{1,20}100[^\d]{1,20}101[^\d]{1,20}102[^\d]{1,20}97[^\d]{1,20}117[^\d]{1,20}108[^\d]{1,20}116[^\d]{1,20}35[^\d]{1,20}86[^\d]{1,20}77[^\d]{1,20}76	2	0	0	1
+2259	2259	^\s*?<<\s*?\/[A-Z0-9a-z]+\([A-Z0-9a-z]+\)\s*?	2	0	0	1
+2260	2260	^\/[a-f0-9]{32}\.php\?q=[a-f0-9]{32}$	2	0	0	1
+2261	2261	\.php\?req=(swf(IE)?|x(ap|ml)|jar|mp3)&	2	0	0	1
+2262	2262	(\0[a-z]{3}\.classPK.{43}){4}	2	0	0	1
+2263	2263	^[\x22\x27]	2	0	0	1
+2264	2264	^\s*\s*?window\.document\.createElement	2	0	0	1
+2265	2265	^(<sep>[^\x22\x27]{0,10})6f(=sep)6c(=sep)6c(=sep)65(=sep)63(=sep)74(=sep)47(=sep)61(=sep)72(=sep)62(=sep)61(=sep)67(=sep)65(=sep)	2	0	0	1
+2266	2266	\/3\/[a-f0-9]{32}\/http\x3a\x2f	2	0	0	1
+2267	2267	\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+)?$	2	0	0	1
+2268	2268	^\x2Fload\x5Fmodule\x2Ephp\x3Fuser\x3D(n1|11?|2)$	2	0	0	1
+2269	2269	^\x2Fmodules\x2F(n[u3]|1|2)\x2Eswf$	2	0	0	1
+2270	2270	^\x2Fmodules\x2F(1|2)\x2Ejar$	2	0	0	1
+2271	2271	^\s*?\(\s*?[\x22\x27]Flash[\x22\x27]	2	0	0	1
+2272	2272	^\s*?[\x22\x27][A-Za-z0-9\s]{500}	2	0	0	1
+2273	2273	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}<script>var	2	0	0	1
+2274	2274	^[\r\n\s]*?<script>[\r\n\s]*?[A-Za-z]+[\r\n\s]*[\r\n\s]*?[\x22\x27][A-Za-z]{9}\x20[A-Za-z\x20]{300}	2	0	0	1
+2275	2275	^\/[a-z]\?[a-z]=[0-9]{5,}$	2	0	0	1
+2276	2276	[^0-9a-f]{1,3}68[^0-9a-f]{1,3}74[^0-9a-f]{1,3}74[^0-9a-f]{1,3}70[0-9a-f]{1,3}3a	2	0	0	1
+2277	2277	^[\x22\x27]	2	0	0	1
+2278	2278	^(e(vtmgr|ext)|actmon|nciesc|EBC32|comm|tdi)\.sys[\x22\x27]	2	0	0	1
+2279	2279	^([\x22\x27]\s*?\])?\(\s*?(\[[\x22\x27])?rc4([\x22\x27]\s*?\])?\(\s*?[\x22\x27][^\x22\x27]+?[\x22\x27]\s*?,\s*?(\[[\x22\x27])?hex2bin([\x22\x27]\s*?\])?\(	2	0	0	1
+2280	2280	^[\x22\x27]	2	0	0	1
+2281	2281	^[\x22\x27]	2	0	0	1
+2282	2282	^[\x22\x27]	2	0	0	1
+2283	2283	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\?\&]e=\d+[\x22\x27]	2	0	0	1
+2284	2284	^[\r\n\s]*?\,[\r\n\s]*?[\x22\x27][\%\\]u"	2	0	0	1
+2285	2285	^(((<\/object>).)+?codebase\s*\s*?[\x22\x27]spl[\x22\x27])(((<\/object>).)+?\/x-java-applet)	2	0	0	1
+2286	2286	^[\w.]*?\.class	2	0	0	1
+2287	2287	^\s*\s*?[\x22\x27]\-	2	0	0	1
+2288	2288	^\s*\s*?[\x22\x27]\-	2	0	0	1
+2289	2289	\/Fqxzdh\.jar$	2	0	0	1
+2290	2290	^\s*?\(\s*?[\x22\x27](AgControl\.AgControl)[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?\.[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?[\x22\x27]\s*?\.\s*?replace\s*?\(	2	0	0	1
+2291	2291	^id=[^&]+&dom=687474703a2f2f[a-f0-9]+2e706870\s*?$/Ps	2	0	0	1
+2292	2292	[^=]+(([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+?2e)+([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+\s*?/P	2	0	0	1
+2293	2293	\.php\?spl=[\w_]+$	2	0	0	1
+2294	2294	^Content-Disposition\x3a[^\r\n]+\.swf/Hm	2	0	0	1
+2295	2295	Referer\x3a[^\r\n]+\.php\/\[\[DYNAMIC\]\]\/\d/Hm	2	0	0	1
+2296	2296	^\s*?[\x3a\x3d]\s*?[\x22\x27]?\-	2	0	0	1
+2297	2297	^\/f(\/[^\x2f]+)?\/14\d{8}(\/\d{9,10})?(\/\d)+(\/x[a-f0-9]+(\x3b\d)+?)?$	2	0	0	1
+2298	2298	^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{14,}\.html(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+2299	2299	^(<sep>.{1,50})u(=sep)n(=sep)c(=sep)t(=sep)i(=sep)o(=sep)n(=sep)\s	2	0	0	1
+2300	2300	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}(\r\n)*?<script>[^\r\n]+?\We[\x22\x27\+]*?v[\x22\x27\+]*?a[\x22\x27\+]*?l\W	2	0	0	1
+2301	2301	^(<sep>.{1,20})\.___\+(=sep)\._\\\+(=sep)\._\\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+(=sep)\.\\\_\+(=sep)\.\\__\+(=sep)\.__\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.___\+(=sep)\.\\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\\_\+(=sep)\._\_\+(=sep)\.\_\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\__\+(=sep)\.\\\\+(=sep)\.\\\$_\+	2	0	0	1
+2302	2302	^\/(pruncd)?flashhigh\.swf$	2	0	0	1
+2303	2303	^\/(pruncd)?flashlow\.swf$	2	0	0	1
+2304	2304	^\/(pruncd)?silverapp1\.xap$	2	0	0	1
+2305	2305	\?action=lnd$	2	0	0	1
+2306	2306	\?action=(pld|exp)&exp=	2	0	0	1
+2307	2307	^Referer\x3a[^\r\n]+\x3a\d{1,5}\/[^\r\n]*?[a-z]+?\.php\?[a-z]+\d/Hm	2	0	0	1
+2308	2308	\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Z-a-z]{18}\.jnlp$	2	0	0	1
+2309	2309	\/k\?t[a-z]*=\d{5,}$	2	0	0	1
+2310	2310	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+2311	2311	^\/[^\x2f]*?flashhigh\.swf$	2	0	0	1
+2312	2312	^\/[^\x2f]*?flashlow\.swf$	2	0	0	1
+2313	2313	^\/[^\x2f]*?iebasic\.html$	2	0	0	1
+2314	2314	^\/[^\x2f]*?silverapp1\.xap$	2	0	0	1
+2315	2315	\/[a-z]{3,7}\.php$	2	0	0	1
+2316	2316	\/([a-z0-9]{1,7}\.php)?\?zho=	2	0	0	1
+2317	2317	^\/[a-f0-9]{32}\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Za-z]+\.(html|jar|swf)$	2	0	0	1
+2318	2318	^\/Drop2(-\d+)\.swf$	2	0	0	1
+2319	2319	^[^\r\n]*?(<name>\/[^\.\/]+\.html)\?[a-z]+?\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(\d{1,5})?\r\n	2	0	0	1
+2320	2320	^Content-Disposition\x3a[^\r\n]+\.swf/Hm	2	0	0	1
+2321	2321	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi	2	0	0	1
+2322	2322	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi	2	0	0	1
+2323	2323	^\s*?\x28\s*?[a-z0-9]{4,6}\s*?\x28\s*?[a-z0-9]{1,3}\s*?,\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x29\s*?\x3b\s*?(<var>[a-z0-9]{1,3})\s*?\x3d\s*?\x28\s*?(=var)\s*?\x2b\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x25\s*?[a-z0-9]{1,3}\.length\x3b	2	0	0	1
+2324	2324	^[A-Za-z0-9]+\x27\s*?src=\x27http\x3a[^\x27]+[\x27]\s*width=1\d\s+height=1\d\s+	2	0	0	1
+2325	2325	^Last-Modified\x3a\x20[^A-Za-z]{2}/Hm	2	0	0	1
+2326	2326	^\/ABs[A-Za-z0-9_]+(\/x?[a-f0-9]+(\x3b\d+)+)?$	2	0	0	1
+2327	2327	^\/AwoVG[A-Za-z0-9_]+$	2	0	0	1
+2328	2328	^[a-z0-9]+\x2A\x2F\x22\x6F\x66\x74\x2E	2	0	0	1
+2329	2329	^Referer\x3a[^\r\n]+?rowedmedia\.com\/search\.php\r?$/Hmi	2	0	0	1
+2330	2330	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r\n)/Hmi	2	0	0	1
+2331	2331	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+2332	2332	^[a-zA-Z0-9]{9}<\/[^>]+>\s+?<[^\s]+\sid=\x22[a-zA-Z]{3,5}\x22\sstyle=\x22display\x3anone\x22>[A-Za-z0-9]{500}	2	0	0	1
+2333	2333	^[a-z]{7}(\s*?[a-z]+\s*?)*?[a-z]{7,}\x2a\x2f	2	0	0	1
+2334	2334	nb[\d+]=Yes	2	0	0	1
+2335	2335	^(<vname>[A-Za-z0-9]+)\s*\s*?navigator.userAgent.toLowerCase\x28\x29\x3b.+?if\(document.cookie[^\r\n]+\([^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]b[\x22\x27+\s]*o[\x22\x27+\s]*t[\x22\x27+\s]*[\x22\x27][^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]s[\x22\x27+\s]*p[\x22\x27+\s]*i[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*r[\x22\x27+\s]*[\x22\x27]	2	0	0	1
+2336	2336	^Referer\x3a[^\r\n]+?\x3a\d+[^\r\n]*?\/[a-z0-9]+\.php\?[a-z0-9]+=\d+(\r\n|&)/Hm	2	0	0	1
+2337	2337	^GET \/(<name>a[a-z]{9,})\/.+?\r\nHost\x3a\x20(=name)\.	2	0	0	1
+2338	2338	^\s*?[\x22\x27][^\x22\x27]+\.php\?id=\d+[\x22\x27]	2	0	0	1
+2339	2339	^\W	2	0	0	1
+2340	2340	^[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(<arg>[a-z0-9]{3,})(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28[^\x29]+\x29\x3b\x2f\x2a[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(=arg)(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28	2	0	0	1
+2341	2341	^\s*?\d+,\s*?\d	2	0	0	1
+2342	2342	^\s*?\d+,\s*?\d	2	0	0	1
+2343	2343	\/14\d{8}(\.jar)?$	2	0	0	1
+2344	2344	^[a-z0-9]*\r\n/H	2	0	0	1
+2345	2345	^[a-z0-9]*\r\n/H	2	0	0	1
+2346	2346	filename=[a-z0-9]*\r\n/H	2	0	0	1
+2347	2347	\/\??4c2H($|[&?]utm_source=)	2	0	0	1
+2348	2348	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+2349	2349	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+2350	2350	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+2351	2351	\/([A-Za-z]{0,3}\d)(\d{0,3}[A-Za-z])[A-Za-z0-9]{4,5}\.swf$	2	0	0	1
+2352	2352	^\s*[^>]*?[a-zA-Z]+\s*\s*?[\x22\x27]([a-z]{0,20}[A-Z])([A-Z]{0,20}[a-z])[A-Za-z]{15,21}[\x22\x27][^>]*([A-Za-z_]{0,200}[0-9])([0-9a-z_]{0,200}[A-Z])([0-9A-Z_]{0,200}[a-z])[A-Za-z0-9_]{200}	2	0	0	1
+2353	2353	\/5\/[a-f0-9]{32}\/\x20*http\x3a\x2f	2	0	0	1
+2354	2354	^\x2f+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x2f\??[a-f0-9]+\x7chttp\x3a\x2f	2	0	0	1
+2355	2355	^Refresh\x3a\x20\d+\x3b\x20url[^\r\n]+\/999\/00000\/\r?$/Hm	2	0	0	1
+2356	2356	^\s*?[\x22\x27][^\x22\x27a-f0-9]68[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]70[^\x22\x27a-f0-9]3a[^\x22\x27a-f0-9]2f[^\x22\x27a-f0-9]2f[^\x22\x27]+?[^\x22\x27a-f0-9]00[\x22\x27]	2	0	0	1
+2357	2357	^\/[a-f0-9]{32}\/e\.html$	2	0	0	1
+2358	2358	Host\x3a\x20a[a-z]{10}\.[a-z]{5}\./H	2	0	0	1
+2359	2359	\.js\?ver=[0-9]\.[0-9]{2}\.[0-9]{4}$	2	0	0	1
+2360	2360	\/\d\/?[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.html&[a-z]+=[^&]+&[a-z]+=\d{3}\.\d{3}\.\d{3,}(\.\d{3,})?$	2	0	0	1
+2361	2361	\/\d\/?[A-Z]+\/[a-f0-9]{40}\/$	2	0	0	1
+2362	2362	\/([a-z0-9]{0,10}[A-Z])([A-Z0-9]{0,10}[a-z])[A-Z-a-z0-9]{5,20}\.jar$	2	0	0	1
+2363	2363	\?([a-z\d\x3d&\x2e]*?[A-Z])([A-Z\d=&\x2e]*?[a-z])([A-Za-z=&\x2e]*?\d)[A-Za-z\d=&\x2e]{50,}$	2	0	0	1
+2364	2364	^\/([a-z0-9]+\/)?[^\x2f]+\?[a-z]{1,40}_id=\d{2,5}?&[a-z]{1,40}_id=\d{2,5}&[^&\x3d]+(_id)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$	2	0	0	1
+2365	2365	&cat_no=\d{2,5}?&no=\d{2,5}&[^&\x3d]+(_no)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$	2	0	0	1
+2366	2366	\x3capplet[^\x3e]+visibility[^\x3e]+hidden[^\x3e]	2	0	0	1
+2367	2367	^\s*?[a-z]+\s*\s*?\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b]	2	0	0	1
+2368	2368	^\s*?	2	0	0	1
+2369	2369	^\/[0-9a-f]{32}\.html$	2	0	0	1
+2370	2370	^\/[a-z\_\-]{4,20}\.php\?([a-z\_\-]{4,20}=\d+?&){3,}[a-z\_\-]{4,20}=-?\d+$	2	0	0	1
+2371	2371	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{4,10}=\d{1,3}&){7,}[a-z\_\-]{4,10}=-?\d+$	2	0	0	1
+2372	2372	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d{1,3}&){3,}[a-z\_\-]{4,10}=-?\d+$	2	0	0	1
+2373	2373	\.jpg$	2	0	0	1
+2374	2374	^\s+\d+\x3b\s*\}	2	0	0	1
+2375	2375	^\/([a-z][a-z\x2f]*\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d)[a-z0-9\x2f]+\/$	2	0	0	1
+2376	2376	^\/([a-z][a-z\x2f]*-[a-z\x2f]+-)[a-z\x2f-]+\/$	2	0	0	1
+2377	2377	^http\x3a\/\/[^\x2f]+\/[A-Z]([a-z0-9]+[A-Z])([A-Z0-9]+[a-z])[A-Za-z0-9]{9,}\.html?\r?$/Hmi	2	0	0	1
+2378	2378	\.js\?chebstr=0\.\d+$	2	0	0	1
+2379	2379	\.js\?chbstr=0\.\d+$	2	0	0	1
+2380	2380	^[^\r\n\x22\?]+[&?][^=\r\n\x22]+=[a-f0-9]+[^\r\n\x22\?]*[&?][^=\r\n\x22]+=[a-f0-9]+\x22\s*\x3b\s*head\.appendChild\(\s*script\s*\)\x3b	2	0	0	1
+2381	2381	^\/([a-z\d]+[+-][a-z\d]+[+-][a-z\d]+[+-])[a-z\d+-]*\/$	2	0	0	1
+2382	2382	^\s*\(\s*[\x22\x27][\x00-\x09\x80-\xff][\x22\x27]\s*\)\s*\x3b\s*[A-Za-z0-9]+\s*=\s*[\x22\x27]	2	0	0	1
+2383	2383	^\s*\x27[^\x27]+\x27width=\x27250\x27\sheight=\x27250\x27>\s*<\/iframe>\s*<\/div>	2	0	0	1
+2384	2384	^[\x3b\x2c]postRequest\x28cfg\.urlSoftDetectorCallback	2	0	0	1
+2385	2385	^[\r\n\s]*?Base64\.decode[\r\n\s]*?\x28[\r\n\s]*?[\x22\x27]	2	0	0	1
+2386	2386	Referer\x3a\x20http\x3a\x2f\x2f[^\r\n\x2f]+\/index\.php\?[^\x3d&]+=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=)?\r\n/H	2	0	0	1
+2387	2387	^[^\n]*\x29\x3b$	2	0	0	1
+2388	2388	^\s*(<var>[^\r\n\s\x3d\x2c\x3b]+)\s*=[^\n]*<iframe([^\n>]*top\x3a-\d+px\x3b)[^\n>]+src\s*=\s*\x5c?[\x22\x27]http[^\n>]+>\s*<\/iframe>\x22\x3bdocument\.write\((=var)\)\x3b\s*$	2	0	0	1
+2389	2389	^[^\x2f\x22\x27]+\/\?[^=&\x22\x27]+=l3S	2	0	0	1
+2390	2390	^.{16}[a-z]{3}\.dll	2	0	0	1
+2391	2391	^.{16}[a-z]{4}\.dll	2	0	0	1
+2392	2392	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{7,8}\d{2,3}\.pdf\r\n/Hm	2	0	0	1
+2393	2393	\.php\?setup=d&s=\d+&r=\d+$	2	0	0	1
+2394	2394	\/\?[a-z0-9]{65,}\x3b \d\x3b \d	2	0	0	1
+2395	2395	^\/wordpress\/\?[A-Za-z0-9]{4}(&utm_source=le)?$	2	0	0	1
+2396	2396	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+2397	2397	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+2398	2398	\/\?nbVykj$	2	0	0	1
+2399	2399	^s?\x3a\x2f\x2f[^\x22\x27]+\/\?[A-Za-z0-9]{5,6}(=[^&\x22\x27]+)?[\x22\x27]\x29\x3bsetCookie\(\x22popundr\x22,1,864e5\)\}	2	0	0	1
+2400	2400	^(<var>[A-Z0-9a-z]{1,20})\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29	2	0	0	1
+2401	2401	^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.[a-z]+\?time=[^&]+&stamp=[a-z]*\d+(\.[a-z]*\d+)+$	2	0	0	1
+2402	2402	^[^\r\n]+\/%(3A|20)http%3A%2F%2F/Hmi	2	0	0	1
+2403	2403	^\/\?3b[A-Z0-9a-z]{2}(&subid=[^&]*)?$	2	0	0	1
+2404	2404	^\/[a-z]+\/$	2	0	0	1
+2405	2405	^\s*\([\x22\x27][A-F0-9a-f]{32}[\x22\x27]\s*\)\s*\x3b\s*}\s*catch\s*\(e\)\s*\{\s*\}\s*\}\s*<\/script>\s*<\/body>	2	0	0	1
+2406	2406	^([^>]*? name\s*=\s*[\x22\x27]flashvars)[^>]*? value\s*=\s*[\x22\x27]url=https?\x3a[^\x22\x27]*?\.wasm	2	0	0	1
+2407	2407	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22(\!(\x22\s*?\+\s*?\x22)?)?Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+2408	2408	^(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{2}(<J>[0-9a-z]{2})[0-9a-z]{4}(=v)[0-9a-z]{6}(=space)[0-9a-z]{2}(=space)[0-9a-z]{64}(=J)(=a)(=v)(=a)	2	0	0	1
+2409	2409	^\d{3}px\x3b\swidth\x3a3\d{2}px\x3b\sheight\x3a3\d{2}px\x3b\x22>[^<>]*?<iframe src=[\x22\x27][^\x22\x27]+[\x22\x27]\swidth=[\x22\x27]2\d{2}[\x22\x27]\sheight=[\x22\x27]2\d{2}[\x22\x27]><\/iframe>[^<>]*?\n[^<>]*?<\/span>	2	0	0	1
+2410	2410	\/[a-z]{4,20}-a\.[a-z]{4,20}\.jar$	2	0	0	1
+2411	2411	\/view.php\?i=\d&key=[0-9a-f]{32}$	2	0	0	1
+2412	2412	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.jar$	2	0	0	1
+2413	2413	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$	2	0	0	1
+2414	2414	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$	2	0	0	1
+2415	2415	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$	2	0	0	1
+2416	2416	^\/[a-z]\/f\.php\?k=\d(&e=\d&f=\d)?$	2	0	0	1
+2417	2417	^\/[a-z]+\/$	2	0	0	1
+2418	2418	\.php\?j=1&k=[0-9](i=[0-9])?$	2	0	0	1
+2419	2419	^\/[a-zA-Z]{7}\.jar$	2	0	0	1
+2420	2420	\/lpdf\.php\?i=[a-zA-Z0-9]+&?$	2	0	0	1
+2421	2421	[a-z0-9]{32}\.jar	2	0	0	1
+2422	2422	\/inf\.php\?id=[a-f0-9]{32}$	2	0	0	1
+2423	2423	^\s*=\s*[\x22\x27]	2	0	0	1
+2424	2424	\/vd\/\d+\x3b[a-f0-9]{32}	2	0	0	1
+2425	2425	\.php\?pprec$	2	0	0	1
+2426	2426	\.php\?c002$	2	0	0	1
+2427	2427	[a-f0-9]{32}\.jar	2	0	0	1
+2428	2428	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1)	2	0	0	1
+2429	2429	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1)	2	0	0	1
+2430	2430	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1)	2	0	0	1
+2431	2431	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1)	2	0	0	1
+2432	2432	[a-f0-9]{32,64}\/[a-f0-9]{32,64}/\w$	2	0	0	1
+2433	2433	\?(s|page|id)=\d+$	2	0	0	1
+2434	2434	^[\r\n\s\+]*[\r\n\s\+]*?(<func>[_a-zA-Z][a-zA-Z0-9_-]+)\([\r\n\s]*?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]*?[\x22\x27][\r\n\s]*?,[\r\n\s]*?[\x22\x27][^\x22\x27]+[\x22\x27][\r\n\s]*?\)\+(=func)	2	0	0	1
+2435	2435	\/FlashPlayer\.cpl$	2	0	0	1
+2436	2436	^((<\/applet>).)+?[\x22\x27]1337\.exe	2	0	0	1
+2437	2437	filename=[a-z]{4}\.txt\x0D\x0A/H	2	0	0	1
+2438	2438	&p=\d+\.\d+\.\d+\.\d+&j=\d+\.\d+\.\d+\.\d+&f=\d+\.\d+\.\d+\.\d+$	2	0	0	1
+2439	2439	^[\r\n\s]*[\r\n\s]*?(<q>[\x22\x27])[a-f0-9]{9,16}\.(jar|zip)(=q)	2	0	0	1
+2440	2440	^\x2Fclicker\x2Ephp$	2	0	0	1
+2441	2441	^(<var>.{1,10})\.\\_\\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\(\!\[\]\+\x22\x22\)\[(=var)\.\_\\_\]\+(=var)\.\\\$\_\+(=var)\.\_\_\+	2	0	0	1
+2442	2442	\?(s|page|id)=\d+&text=\d+$	2	0	0	1
+2443	2443	^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)j51[a-f0-9]{21}\.jar(=q)\r?$/Hm	2	0	0	1
+2444	2444	^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)e51[a-f0-9]{21}\.exe(=q)\r?$/Hm	2	0	0	1
+2445	2445	\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$	2	0	0	1
+2446	2446	\/\{0,2}[A-Za-z0-9\+\/]+?voDc0RHa8NnZ$	2	0	0	1
+2447	2447	^[^\x3b\r\n\x22\x27]+?[A-Za-z0-9\/\_\-]{60,}\.exe\?	2	0	0	1
+2448	2448	^[^\x3b\r\n\x22\x27]+?\.txt\?e=\d+(&[fh]=\d)?	2	0	0	1
+2449	2449	^[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)	2	0	0	1
+2450	2450	[a-z]	2	0	0	1
+2451	2451	\.exe\?(e=)?\d+$	2	0	0	1
+2452	2452	\/j\d{2}\.php\?i=	2	0	0	1
+2453	2453	\/\?whole=\d+$	2	0	0	1
+2454	2454	^\/search\/[0-9]{64}	2	0	0	1
+2455	2455	\/m1[1-6]\.jar$	2	0	0	1
+2456	2456	\/[0-9]{4}\.html$	2	0	0	1
+2457	2457	\/\d+\.pkg$	2	0	0	1
+2458	2458	\/j_[a-z0-9]+_(0422|1723|3544|5076)\.jar$	2	0	0	1
+2459	2459	\/[a-z0-9]{3}\.php\?[a-z]=[a-zA-Z0-9]{10}$	2	0	0	1
+2460	2460	amor\d{0,2}\.jar	2	0	0	1
+2461	2461	[a-f]	2	0	0	1
+2462	2462	=(3[0-9a]|2e)+3a313[3-9](3[0-9]){8}$	2	0	0	1
+2463	2463	(<m>[0-9a-f]{2})(<sep>[^0-9a-f])(<e>((=m))[0-9a-f]{2})(=sep)([0-9a-f]{2}(=sep)){7}(=e)(=sep)(=m)(=sep)[0-9a-f]{2}(=sep)(=e)(=sep)(<d>((=e))[0-9a-f]{2})(=sep)(=d)(=sep)(=e)(=sep)(=d)	2	0	0	1
+2464	2464	^[\r\n\s]*?\([\r\n\s]*?(<q>[\x22\x27])(<m>(((=q)).)+)(=q).+?<(=m)?a(=m)?p(=m)?p(=m)l(=m)?e(=m)?t	2	0	0	1
+2465	2465	\/[a-f0-9]{32}\/[a-f0-9]{32}\.jar$	2	0	0	1
+2466	2466	^\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$	2	0	0	1
+2467	2467	\.jar\?java=\d+$	2	0	0	1
+2468	2468	^((<\/applet>).)+?\.jar\?java=\d+	2	0	0	1
+2469	2469	^((<\/applet>).)+?[\x22\x27]aHR0cDov	2	0	0	1
+2470	2470	^[a-f0-9]{32}=\d{1,10}\r\n/H	2	0	0	1
+2471	2471	\/1[34]\d{8}\.tpl$	2	0	0	1
+2472	2472	^[\r\n\s]*?\([\r\n\s]*?[\x22\x27]f([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?m([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?C([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?h([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?a([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?c([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?d([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?e[\x22\x27]	2	0	0	1
+2473	2473	^\/\d{1,2}(<l>[A-Z])\d{1,2}(=l)\d{1,2}(=l)\d{1,2}\.pdf$	2	0	0	1
+2474	2474	\/java\.php\?eid=[a-f0-9]{32}&	2	0	0	1
+2475	2475	\/pdf\.php\?pdf=[a-f0-9]{32}&	2	0	0	1
+2476	2476	[&?]type=\d+($|&)	2	0	0	1
+2477	2477	^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{32,}\.html(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+2478	2478	^\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?m\d+([\x22\x27]\s*?,\s*[\x22\x27])?C\d+([\x22\x27]\s*?,\s*[\x22\x27])?h\d+([\x22\x27]\s*?,\s*[\x22\x27])?a\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?c\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?d\d+([\x22\x27]\s*?,\s*[\x22\x27])?e\d+[\x22\x27]	2	0	0	1
+2479	2479	\/13[89]\d{7}.swf$	2	0	0	1
+2480	2480	\/[a-z]+\.php\?[a-z]+\d{7}&[a-z]+\d{7,8}$	2	0	0	1
+2481	2481	^(<sep>[^\x22\x27]{0,10})75(=sep)6e(=sep)63(=sep)74(=sep)69(=sep)6f(=sep)6e(=sep)20	2	0	0	1
+2482	2482	^\d+?\*\/\s*?(<vname>[^\s\(\x3b]{1,20})\s*?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)\s*?(\/\*\d+?\*\/\s*?)?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)	2	0	0	1
+2483	2483	[&?]v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=	2	0	0	1
+2484	2484	\/1(3[89]\d{7}|4\d{8})\.xap$	2	0	0	1
+2485	2485	&dr=\d+$	2	0	0	1
+2486	2486	&nrk=\d+$	2	0	0	1
+2487	2487	^Content-Disposition\x3a[^\r\n]+(\W14\d{8})\.pdf\r?$/Hm	2	0	0	1
+2488	2488	^(((<\/iframe>).)+?src\s*\s*?\x22http\x3a[^\x22]+16\.html\x22)(((<\/iframe>).)+?left\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)(((<\/iframe>).)+?top\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)((<\/iframe>).)+?<\/iframe>\x27\x29	2	0	0	1
+2489	2489	^\s*?[A-Z0-9a-z\+]+?\s*?\x7d	2	0	0	1
+2490	2490	^((\/[a-z]+?)*?\/\d+\/)((\/\d+?)*?\/[a-z]+?\/)(\/([a-z]+|\d+)){4,}\/[a-z]+\.pack\.gz$	2	0	0	1
+2491	2491	^\s*?\x28\s*?(<q>[\x22\x27])(((=q)).)+?(=q)\s*?\,\s*?[\x22\x27]container[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27],\s*?[\x22\x27]9\.0\.0[\x22\x27]\s*?,\s*?false\s*?,\s*?flashvars,\s*?params\s*?,\s*?attributes\s*?\x29\s*?\x3b\s*?<\/script>\s*?<\/head>	2	0	0	1
+2492	2492	\/14\d{8}(\.swf)?$	2	0	0	1
+2493	2493	\/14\d{8}(\.pdf)?$	2	0	0	1
+2494	2494	^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.exe/Hm	2	0	0	1
+2495	2495	^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.dll/Hm	2	0	0	1
+2496	2496	\/14\d{8}(\/\d+)*?(\/x[a-f0-9]+[\x3b0-9]*)?$	2	0	0	1
+2497	2497	^\s[^\r\n]*?[\x28\x5b]\s*?[\x22\x27][^\x22\x27]?s[^\x22\x27]?u[^\x22\x27]?b[^\x22\x27]?s[^\x22\x27]?t[^\x22\x27]?r[^\x22\x27]?[\x22\x27]\s*?[\x29\x5d]\s*?(\x5d\s*?)?\x28	2	0	0	1
+2498	2498	\/video.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2499	2499	\/player.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2500	2500	\/search.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2501	2501	^\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28(=var1)\s*\!\s*=\s*[\x27\x22][\x22\x27]\s*?\x29\s*?\{\s*?(<var2>[^\s\x3d]+)\s*\s*?(=var1)\s*?\[	2	0	0	1
+2502	2502	\/1\.php\?r$	2	0	0	1
+2503	2503	^[^a-z]?\x65[^a-z]?\x6e[^a-z]?\x67[^a-z]?\x74[^a-z]?\x68	2	0	0	1
+2504	2504	^\s*?[\x22\x27](<char>[^\x22\x27]+)[\x22\x27]\.replace\x28\s*?[\x22\x27](=char)[\x22\x27]\s*?,	2	0	0	1
+2505	2505	\/banner.php\?sid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2506	2506	\/blog.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2507	2507	\/main\.html$	2	0	0	1
+2508	2508	\.php\?id=[0-9A-F]{44,54}&rnd=[0-9]{3,7}$	2	0	0	1
+2509	2509	^\/tdstest\/[a-f0-9]{32,}\/?$	2	0	0	1
+2510	2510	\/content\/dl\.php\?sl=vbs[a-z0-9]{32}$	2	0	0	1
+2511	2511	\/content\/getvbslink\.php\?d=[a-z0-9]{32}$	2	0	0	1
+2512	2512	Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H	2	0	0	1
+2513	2513	^[a-z0-9]*\r\n/H	2	0	0	1
+2514	2514	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+2515	2515	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+2516	2516	\/street[1-5]\.php$	2	0	0	1
+2517	2517	\/XV-\d+\.exe$	2	0	0	1
+2518	2518	\/bad\/[A-Z0-9]+\.swf$	2	0	0	1
+2519	2519	\/\d\/[A-Z]+\/[a-f0-9]{32}\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?$	2	0	0	1
+2520	2520	^\s*?[^\x28\s]*?\x28\s*?(<a1>[^\s,\x29]+)\s*?,\s*?(<a2>[^\s,\x29]+)\s*?\x29\{[^\r\n]*?[\+=]String.fromCharCode\((=a2)\)[^\r\n]*?\}	2	0	0	1
+2521	2521	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.jar\r\n/Hm	2	0	0	1
+2522	2522	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+2523	2523	\b[a-z]{2}\d+\s*\s*?Yes	2	0	0	1
+2524	2524	^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x20http\x3a\x2f	2	0	0	1
+2525	2525	^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?(\.[a-z]+)?$	2	0	0	1
+2526	2526	^[^\r\n]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?/H	2	0	0	1
+2527	2527	^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x3ahttp\x3a\x2f	2	0	0	1
+2528	2528	^Referer\x3a[^\r\n]+\/4\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?$/Hm	2	0	0	1
+2529	2529	^\s*\s*?[\x22\x27]8\.8\.8\.8[\x22\x27]	2	0	0	1
+2530	2530	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+2531	2531	Host\x3a\x20([\x2eg-z]*[a-f0-9][\x2eg-z]*){32}\./H	2	0	0	1
+2532	2532	\/e\.html$	2	0	0	1
+2533	2533	^(<var>[a-f0-9]{6})-->\s*?<script\s*?type=[\x22\x27]text\/javascript[\x22\x27]\s*?src=[\x22\x27]http\x3a\x2f[^\x22\x27]*?\/[a-z\d]{8}\.php\?id=\d+[\x22\x27]\s*<\/script><!--\/(=var)-->	2	0	0	1
+2534	2534	[&?]t=[a-f0-9]{32}(&|$)	2	0	0	1
+2535	2535	\/5\/[A-Z]{3,}\/[a-f0-9]{32}(\.[^\x2f]+|\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?|\/\d+\/?)?$	2	0	0	1
+2536	2536	^\s*?[_$]+\x28\x29	2	0	0	1
+2537	2537	^\s*?[_$]+\x28\x29	2	0	0	1
+2538	2538	Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)[^\r\n]*?\/search\?q=([A-Z&=\d]*?[a-z])([a-zA-Z\d&=]*?[A-Za-z=&]\d[A-Za-z])([a-zA-Z\d&=]*?[a-z\d][A-Z][A-Za-z\d])[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+[&=A-Za-z0-9]*?\r\n.*?Host\x3a\x20(=refhost)/Hsi	2	0	0	1
+2539	2539	^\s*?\w+\s*?\.\s*?charCodeAt	2	0	0	1
+2540	2540	^\/\?[a-f0-9]{32,64}$	2	0	0	1
+2541	2541	^[^>]*?id\s*[\x22\x27][a-z0-9]+[\x22\x27][^>]*\s*?[\x2a\d]{100}	2	0	0	1
+2542	2542	Referer\x3a\x20http\x3a\x2f+(<dl1>[^\x2e\r\n]+)\x2e[^\x2f\r\n]*?(<dl2>\x2e[^\x2e\r\n\x2f]+\x2e[^\x2e\x2f\r\n]+)\x2f(\??[a-f0-9]{32,64}\/?)?\r\n.*?Host\x3a\x20((=dl1))[^\r\n]*?(=dl2)\r\n/Hsm	2	0	0	1
+2543	2543	Referer\x3a\x20[^\r\n]*?\/[a-f0-9]{32,64}\.swf/H	2	0	0	1
+2544	2544	\.php\?id=[0-9A-F]{32,}&rnd=\d+$	2	0	0	1
+2545	2545	^((<\/div).)+?top\x3a\s*?\x2d[0-9]+px\x3b.+left\x3a\s*?\x2d[0-9]+px\x3b.+<iframe\x20.+?stack=\d+	2	0	0	1
+2546	2546	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)str2long(=sep)).+?(=sep)long2str(=sep)	2	0	0	1
+2547	2547	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)str2long(=sep)	2	0	0	1
+2548	2548	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)long2str(=sep)	2	0	0	1
+2549	2549	^([^>]*?\sname\s*?\x3d\s*?[\x22\x27]?movie[\x22\x27]?)[^>]*?\svalue\s*?\x3d\s*?[\x22\x27][^\x22\x27]+\/(\??[a-f0-9]+)?[\x22\x27]	2	0	0	1
+2550	2550	^Host\x3a[^\r\n]*?\.pw\r$/Hmi	2	0	0	1
+2551	2551	^Host\x3a\x20[a-z0-9]+\.(g[aq]|cf|ml|tk|xyz|info|space)(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+2552	2552	^\s*[a-z]+\s*\s*?(<q1>[\x22\x27])(((=q1)).)+?(=q1)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr\(\s*?\d+\s*?,\s*?\d+\s*?\)\s*?\x3b\s*?[a-z]+\s*\s*?(<q2>[\x22\x27])(((=q2)).)+?(=q2)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr	2	0	0	1
+2553	2553	^(<ccode>[a-f0-9]{6})-->.*?<script.+?<\/script>.*--/(=ccode)-->	2	0	0	1
+2554	2554	^\/[a-z]{2,20}\/[a-z]{2,20}\/(((featur|quot)e|ip)s|d(ropdown|etect)|co(mpiled|re)|header|jquery|lang|min|ga)\.js$	2	0	0	1
+2555	2555	^\s*?<script>\s*?([A-Za-z][A-Za-z\d+]+\s*?\+\s*([A-Za-z][A-Za-z\d]+|[\x22\x27]\\x[2-7][0-9a-fA-F](\\x[2-7][0-9a-fA-F]){0,4}[\x22\x27])\s*?\x3b){20}	2	0	0	1
+2556	2556	^\/js\/analytic\.php\?id=\d+&tz=\-?\d+&rs=\d+x\d+$	2	0	0	1
+2557	2557	^[\x22\x27](<script)[\x22\x27+\s]*<[\x22\x27+\s]*s[\x22\x27+\s]*c[\x22\x27+\s]*r[\x22\x27+\s]*i[\x22\x27+\s]*p[\x22\x27+\s]*t[^\r\n]+\.php\?id=\d+&tz=\x27\+tzSignature\x28\x29\+\x27&rs=	2	0	0	1
+2558	2558	^\/promo\d+(x\d+)?\/promo\.swf\?t=\d+$	2	0	0	1
+2559	2559	Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H	2	0	0	1
+2560	2560	^\s*\x28\s*[\x22\x27]<div\s*style\s*=\s*[\x22\x27]([^\x22\x27\r\n]*position\x3aabsolute\x3b)([^\x22\x27\r\n]*top\x3a\s\-\d+px\x3b)([^\x22\x27\r\n]*left\x3a\s0px\x3b)[^\r\n]*?<iframe[^\r\n>]*\s><\/i[\x22\x27]\+[\x22\x27]frame>[^\r\n]*<\/div>[\x22\x27]\s*\x29\x3b$	2	0	0	1
+2561	2561	^#?\d+	2	0	0	1
+2562	2562	^#?\d+	2	0	0	1
+2563	2563	^\s*var\s*(<var>[^\s=]+)\s*=\s*document.createElement\(\s*[\x22\x27]iframe[\x22\x27](.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b	2	0	0	1
+2564	2564	^\s*\([^\x29]*(\%2F|\/)(\%5B|\[)(\%5E|)([^\x29]*(%3C|\<))([^\x29]*(%3E|\>))([^\x29]*(\%5C|\\)(\%6E|n))	2	0	0	1
+2565	2565	^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27]	2	0	0	1
+2566	2566	^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Chrome_Font\.exe/Hmi	2	0	0	1
+2567	2567	^[^\x2f\x22\x27]+\/([^\x22\x27]*?[?&]oq=[A-Za-z0-9+\x2f_-]+([\x22\x27]|&))([^\x22\x27]*?[&?][a-z]+_[a-z]+=\d+)([^\x22\x27]*?[&?]q=)	2	0	0	1
+2568	2568	^\s*=\s*[\x27\x22](sh(ell(32)?)?|exec)=6wLrBej5\x2f\x2f	2	0	0	1
+2569	2569	(value=[\x22\x27](sh(ell(32)?)?|exec)=|unescape\(EscapeHexString\(.)EB02EB05E8F9FFFFFF	2	0	0	1
+2570	2570	^\s*=\s*[\x22\x27][Hh][Tt][Tt][Pp][Ss]?\x3a\x2f\x2f[^\x2f]+\x2f([^\x2f\x22\x27]+=[^\x2f\x22\x27&]{0,5}QMvXcJ)[^\x2f\x22\x27]{90}	2	0	0	1
+2571	2571	^(rocket|java)script\x22>\s*var\s*(<ifr>[^\s=]+)\s*=\s*[\x22\x27]iframe[\x22\x27].*?\s*var\s*(<var>[^\s=]+)\s*=\s*document\.createElement\(\s*(=ifr)(.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b	2	0	0	1
+2572	2572	^[a-z]\d{3}\(new Array\(	2	0	0	1
+2573	2573	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27]iddqd?\s*=	2	0	0	1
+2574	2574	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=]*\s*=EB02EB05E8F9FFFFFF	2	0	0	1
+2575	2575	^[a-zA-Z0-9]{4}NzgzNDI[a-zA-Z0-9]{8}=\x22	2	0	0	1
+2576	2576	^\d{1,2}\.php$	2	0	0	1
+2577	2577	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+2578	2578	^\/[a-z]+\/$	2	0	0	1
+2579	2579	^\/[a-z]+\/$	2	0	0	1
+2580	2580	^GET\s*?\/stat\/load((?-i)[a-z0-9]*?[A-Z])((?-i)[A-Z0-9]*?[a-z])(<hname>[a-z0-9]+)\.php\s.+?Host\x3a\x20(=hname)\.	2	0	0	1
+2581	2581	^[0-9a-fA-F]{25}$	2	0	0	1
+2582	2582	^[-_\w]+$	2	0	0	1
+2583	2583	\/[a-z]{2}[0-9]{3}[a-z]{2}\/LoginFacebook\.php$	2	0	0	1
+2584	2584	^\d+$	2	0	0	1
+2585	2585	\x2Fgetfile\x2Ephp\x3Fi\x3D[0-9]\x26key\x3D[a-f0-9]{32}$	2	0	0	1
+2586	2586	^\/[a-z]{15}[0-9]\.php$	2	0	0	1
+2587	2587	^\d$	2	0	0	1
+2588	2588	\/\?[a-f0-9]{32}=[^&]+&[a-f0-9]{32}=[^&]+$	2	0	0	1
+2589	2589	^\/\d{5}$	2	0	0	1
+2590	2590	\/[0-9]{2}\.html$	2	0	0	1
+2591	2591	\.php\?[a-z]=.{2}KAhFXlx9.{2}Oj[^&]+$	2	0	0	1
+2592	2592	\x2F[0-9]{3}\.pdf$	2	0	0	1
+2593	2593	^\d{1,2}=[a-zA-Z0-9+=]{100}	2	0	0	1
+2594	2594	^\/[a-z]\.jar$	2	0	0	1
+2595	2595	\/[a-f0-9]+\.zip$	2	0	0	1
+2596	2596	^\/\d{2,}\.[a-z0-9]+$	2	0	0	1
+2597	2597	^\/\?[a-f0-9]{32}$	2	0	0	1
+2598	2598	\/(java(db|im|rh)|silver|flash|msie)\.php\?id=	2	0	0	1
+2599	2599	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}\r\n<script>(var [a-zA-Z0-9]{1,20}\x3b){1,20}[a-zA-Z0-9]{1,20}\s*	2	0	0	1
+2600	2600	^Host\x3a\x20[^\.\r\n]+?\.[a-z]{2,4}\r\n	2	0	0	1
+2601	2601	\/\??[a-f0-9]{60,}\x3b1\d{5}\x3b\d{1,3}$	2	0	0	1
+2602	2602	\/\??[a-f0-9]{60,}\x3b5[0-1]\d{5}$	2	0	0	1
+2603	2603	^\/[^\x2f]+?\/\??[a-f0-9]{60,66}(\x3b\d+){1,4}$	2	0	0	1
+2604	2604	(\/[A-Z][a-z][A-Z][a-z][A-Z][a-z]|(b(m(nw|wn)|n(mw|wm)|w(mn|nm))|m(b(nw|wn)|n(bw|wb)|w(bn|nb))|n(b(mw|wm)|m(bw|wb)|w(bm|mb))|w(b(mn|nm)|m(bn|nb)|n(bm|mb))))\.jar$	2	0	0	1
+2605	2605	^\/index\.php\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+2606	2606	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.swf\r\n	2	0	0	1
+2607	2607	^\/\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+2608	2608	\x20filename=\r\n(\r\n)?$	2	0	0	1
+2609	2609	PK\x01\x02.{42}(<dir>[a-z]{7,}\/)([a-z]+\.class)?(\xfe\xca\x00\x00)?(PK\x01\x02.{42}(=dir)[a-z]+\.class){6,}(PK\x01\x02.{42}[0-9a-z]{5,}(\.[a-z]{3})?)K\x05\x06.{18}$	2	0	0	1
+2610	2610	^\/index\.php\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+2611	2611	\w_\.jar\?[a-f0-9]{8}$	2	0	0	1
+2612	2612	^\d+[\r\n\x2f]	2	0	0	1
+2613	2613	^\d+[\r\n\x2f]	2	0	0	1
+2614	2614	^\d+[\r\n\x2f]	2	0	0	1
+2615	2615	^\d+[\r\n\x2f]	2	0	0	1
+2616	2616	^\d+[\r\n\x2f]	2	0	0	1
+2617	2617	^\d+[\r\n\x2f]	2	0	0	1
+2618	2618	^\d+[\r\n\x2f]	2	0	0	1
+2619	2619	^\d+[\r\n\x2f]	2	0	0	1
+2620	2620	^\d+[\r\n\x2f]	2	0	0	1
+2621	2621	^\d+[\r\n\x2f]	2	0	0	1
+2622	2622	Content-Disposition\x3a[^\r\n]+\.exe-rc4\.exe\r\n	2	0	0	1
+2623	2623	^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/[a-zA-Z0-9]{12}\.php(\?[^&=]+=([a-zA-Z0-9]{8}|0(189|037)|flash|2(551|419)|6332))?$	2	0	0	1
+2624	2624	^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/test\.mp3$	2	0	0	1
+2625	2625	^\/\d{9,10}\/\d{4,5}$	2	0	0	1
+2626	2626	\/index\.html\?p=\d+$	2	0	0	1
+2627	2627	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?[a-f0-9]	2	0	0	1
+2628	2628	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a/Hmi	2	0	0	1
+2629	2629	^(<split>.{1,10})2f(=split)64(=split)69(=split)76(=split)3e(=split)?[^\x22\x27]*[\x22\x27]\.replace\s*\(\s*[\x22\x27]?\/(=split)\/g[\x22\x27]?\s*,\s*[\x22\x27]\x25[\x22\x27]\s*\x29\s*\x3b	2	0	0	1
+2630	2630	^\s*=\s*[\x22\x27]?(10|127|172\.(1[6-9]|2[0-9]|3[01])|192\.168)\.	2	0	0	1
+2631	2631	\.php\?hash=I3QxW[A-Za-z0-9\+\/]+={0,2}$	2	0	0	1
+2632	2632	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\/[a-zA-Z0-9\/\-\_]{60,}\/[a-zA-Z0-9]+\.exe\?[a-zA-Z0-9]+=[a-zA-Z0-9]+(&h=\d+)?[\x22\x27]	2	0	0	1
+2633	2633	^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27]	2	0	0	1
+2634	2634	^\s*type\s*=\s*[\x22\x27]\s*text\/javascript\s*[\x22\x27]\s*>\s+var\s*(<timestamp>[A-Za-z0-9]{1,25})\s*=\s*\(new\sDate\(\)\)\.getTime\(\)\;\s+(<url>[A-Za-z0-9]{1,25})\s*=\s*[\x22\x27]\s*[^\r\n]+\.php\?JBOSSESSION=\s*[\x22\x27]\s+(<urlvar2>[A-Za-z0-9]{1,25})\s*=\s*(=url)\s*\+\s*(=timestamp)\s+window\.location\.href\s*=\s*(=urlvar2)\s+	2	0	0	1
+2635	2635	^\s*[\x22\x27][^\r\n]+\/[a-z0-9]{20,40}\.js[\x22\x27]\s*>\s*<\/script>\s*<\/body>	2	0	0	1
+2636	2636	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+2637	2637	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+2638	2638	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+2639	2639	^http\:\/\/[^\r\n\x2f]+\/\?s=[a-f0-9]{32}[a-z]{2}$	2	0	0	1
+2640	2640	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+2641	2641	^(<vars>[a-z0-9]{1,20})\s*=\s*new\s*Array\x3b\r\n((=vars)\[\d{1,3}\]\s*=\s*\d{4,12}\x3b\r\n){5,40}	2	0	0	1
+2642	2642	^\/([\/_]*?[a-f0-9][\/_]*?){64}$	2	0	0	1
+2643	2643	src\s*=\s*https?\x3A\x2f+[^\x2f]*?((((static)?flick|blogge)r|p(hotobucket|icasa)|wordpress|tinypic)\.com|im(g(\.youtube|ur)\.com|ageshack\.us)|upload\.wikimedia\.org)[^\x2f]	2	0	0	1
+2644	2644	^[a-f0-9]{32}$	2	0	0	1
+2645	2645	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/	2	0	0	1
+2646	2646	[=\"]\w{8}\.jar	2	0	0	1
+2647	2647	^[a-z]{2}\.	2	0	0	1
+2648	2648	\/jdb\/[^\/]+\.class$	2	0	0	1
+2649	2649	\/lib\/adobe\.php\?id=[a-f0-9]{32}$	2	0	0	1
+2650	2650	\/i.php?token=[a-z0-9]+$	2	0	0	1
+2651	2651	\x2Fjerk\x2Ecgi\x3F[0-9]$	2	0	0	1
+2652	2652	^(\?[^=]{1,10}=[^&\r\n]{100,})?$	2	0	0	1
+2653	2653	\.php\?e=[^&]+?$	2	0	0	1
+2654	2654	\.txt\?e=\d+(&[fh]=\d+)?$	2	0	0	1
+2655	2655	^\x2F\x3Fwps\x3D[0-9]$	2	0	0	1
+2656	2656	^[^\r\n]+\/[A-Fa-f0-9]+\.js\?cp=	2	0	0	1
+2657	2657	^\/[a-z0-9]{1,4}\.jnlp$	2	0	0	1
+2658	2658	\.php\?id=[a-f0-9]{32}$	2	0	0	1
+2659	2659	^\/[a-f0-9]{32}\/[a-f0-9]{32}\.swf$	2	0	0	1
+2660	2660	\.php\?[^=]+=([^&]?[a-z0-9]{2}){5}&[^=]+=([^&]?[a-z0-9]{2}){10}&	2	0	0	1
+2661	2661	\/[A-F0-9]{8}\.js\?cp=	2	0	0	1
+2662	2662	^\/[a-z0-9]+[0-9][a-z0-9]+\/\?\d$	2	0	0	1
+2663	2663	\.exe(\?[a-zA-Z0-9]+=[a-zA-Z0-9]+)?&h=\d+$	2	0	0	1
+2664	2664	^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$	2	0	0	1
+2665	2665	^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$	2	0	0	1
+2666	2666	\/\d{6}\.mp3$	2	0	0	1
+2667	2667	\/14\d{8}(\.xap)?$	2	0	0	1
+2668	2668	\.swf\?myid=[a-zA-Z0-9]+$	2	0	0	1
+2669	2669	\.php\?rnd=[0-9]{3,7}&id=[0-9A-F]{44,54}$	2	0	0	1
+2670	2670	\/(Flash[23]?|Ink|New|One|HQ).exe$	2	0	0	1
+2671	2671	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.xap\r\n	2	0	0	1
+2672	2672	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?[^\r\n]*?\/(index.html)?\r\n.*?\r\nHost\x3a\x20(=refhost)[\x3a\r]	2	0	0	1
+2673	2673	\/\d{2,}\.xap$	2	0	0	1
+2674	2674	\.php\?rnd=\d+&id=[0-9A-F]{32,}$	2	0	0	1
+2675	2675	\/\?keyword=(([a-f]{0,31}[0-9])([0-9]{0,31}[a-f])[a-f0-9]{32}|\d{5})$	2	0	0	1
+2676	2676	^\/(.*?[&?][a-z]{2}_[a-z]{2}=\d+(&))(.*?[&?]q=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&))(.*?[&?]oq=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&)).*?[&?][a-z]{3}=[A-Za-z_]{3,20}([a-z\d]*\x2e)([a-z\x2e]*\d)[a-z\d\x2e]+(&|$)	2	0	0	1
+2677	2677	^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Font_Update\.exe	2	0	0	1
+2678	2678	^\s*[\x22\x27]\s*http[^\x22\x27]+\.php\s*[\x22\x27]\s*\x2c\s*[\x22\x27]\s*uylzJB3mWrFjellI9iDFGQjO	2	0	0	1
+2679	2679	=[a-f0-9]{32,}(&|$)	2	0	0	1
+2680	2680	\&e=(cve|flash)	2	0	0	1
+2681	2681	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.htm$	2	0	0	1
+2682	2682	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.swf$	2	0	0	1
+2683	2683	^(0x[a-f0-9]{1,2}, ){500}	2	0	0	1
+2684	2684	^[0-9_,{AbZwP&-]{2000}	2	0	0	1
+2685	2685	^[A-F0-9]+	2	0	0	1
+2686	2686	^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_	2	0	0	1
+2687	2687	^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_	2	0	0	1
+2688	2688	^[a-z0-9]{13}\.[a-z]{3}$	2	0	0	1
+2689	2689	^\d+$	2	0	0	1
+2690	2690	Host\x3a\x20(<refhost>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f(=refhost)(\x3a\d{1,5})?\/?	2	0	0	1
+2691	2691	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\r$|\x3a)	2	0	0	1
+2692	2692	^\/[a-z]{3,20}\.php\?sid=[A-F0-9]{40,200}$	2	0	0	1
+2693	2693	^\/[a-z]{3,20}\.php\?id=4[A-F0-9]{39,200}$	2	0	0	1
+2694	2694	^\/\?o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+$	2	0	0	1
+2695	2695	(.*?[?&]oq=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&)).*?[?&]q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$)	2	0	0	1
+2696	2696	(.*[^&]{3,4}QMvXcJ).*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&.*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$)	2	0	0	1
+2697	2697	^[HX3][^&]Q[cdM][^&]{3}[ab]R	2	0	0	1
+2698	2698	^\/\?[a-f0-9]{114}$	2	0	0	1
+2699	2699	Date\x3a\x20(<dstring>[^\r\n]+)\r\n.*?Last-Modified\x3a\x20(=dstring)\r\n	2	0	0	1
+2700	2700	^\/[a-f0-9]{16}$	2	0	0	1
+2701	2701	^GET (<uri>(\/[A-Za-z0-9]+)?\/\d+\/\d+)\sHTTP\/1\.1\r\nUser-Agent\x3a\x20http\x3a\/\/(<host>[^\r\n]+)(=uri)\r\nHost\x3a\x20(=host)\r\n(\r\n)?$	2	0	0	1
+2702	2702	^Referer\x3a[^\r\n]+?\/[a-z0-9A-Z\_\-]{26,}\.html(\x3a\d{1,5})?\r$	2	0	0	1
+2703	2703	\/3\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+|\/\d+\.\d+\.\d+\.\d+\/?)?$	2	0	0	1
+2704	2704	^\/([A-Za-z_-]*?\d)([a-z0-9_-]*?[A-Z])([A-Za-z0-9_-]{4}){15,}([[A-Za-z0-9_-]{2}\x2e?\x2e|[A-Za-z0-9_-]{3}\x2e)$	2	0	0	1
+2705	2705	^\d$	2	0	0	1
+2706	2706	^[A-F0-9]{16}\x22>	2	0	0	1
+2707	2707	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-zA-Z0-9]{16}\/[a-f0-9]{40}\/[a-zA-Z0-9]+\.jpg$	2	0	0	1
+2708	2708	^[A-F0-9]{16}(&|&amp\x3b)id=\d+(&|&amp\x3b)gid=[A-F0-9\-]+\x22>	2	0	0	1
+2709	2709	^[^>]*?\>	2	0	0	1
+2710	2710	^-?\d+=([a-zA-Z0-9]|%[A-F0-9]{2}){2}(<var1>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){6}(<var2>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){2}(=var2)([a-zA-Z0-9]|%[A-F0-9]{2}){4}(=var1)/P	2	0	0	1
+2711	2711	^\s*?[\x22\x27]([A-Z]{0,19}[a-z]{1,19}[A-Z])[a-zA-Z]{14,20}[\x22\x27][^<>]*([A-Za-z]{0,99}\d)[A-Za-z0-9\x20]{100}	2	0	0	1
+2712	2712	^\s*?(<var1>[^\x29]+)\x29[^\n]*\s*?(=var1)\s*?\x7c{2}\s*?\d+?\s*?\x2c	2	0	0	1
+2713	2713	^\s+\d{1,2}\x3b\s+else\s+(<var>[a-z]+)\s+\-=\s+\d{1,2}\x3b\s+return\s+[a-z]+\.charAt\x28(=var)\/\d{1,2}\x29\x7d	2	0	0	1
+2714	2714	^[a-z0-9_-]+\.([0-9_-]*[A-Z])[A-Z0-9_-]+\.[^\x22]+\x22\s	2	0	0	1
+2715	2715	^[a-z]{10}\.[a-z]{3}\r?$/Hm	2	0	0	1
+2716	2716	Last-Modified\x3a Mon, ((0[29]|16|23|30))\d{2} Jul 2001/H	2	0	0	1
+2717	2717	^\d+\x3b	2	0	0	1
+2718	2718	^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500}	2	0	0	1
+2719	2719	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+2720	2720	^[^\x27]+[\x27]\s*	2	0	0	1
+2721	2721	^\d+\x3b	2	0	0	1
+2722	2722	^([A-Z0-9]*?[a-z])([a-z0-9]*?[A-Z])[A-Za-z0-9]+\x2a\x2f[^\n]*?Function\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28\s*?(=var1)\s*[=!]{2}\s*?[\x27\x22][\x22\x27]\s*?\x29\s*?\{	2	0	0	1
+2723	2723	^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500}	2	0	0	1
+2724	2724	^\s*\x27[^\x27\x3b\r\n]+\x27width=\x27250\x27\sheight=\x27250\x27\>	2	0	0	1
+2725	2725	^[^A-Za-z0-9]	2	0	0	1
+2726	2726	^http\x3a\x2f[^\x27]+[\x27](\swidth=\d{1,2}\sheight=\d{1,2}\s|\sheight=\d{1,2}\swidth=\d{1,2}\s)	2	0	0	1
+2727	2727	^\s*\(\s*[\x22\x27]id[\x22\x27]\s*,\s*?(<var>[^,\x29\s\x3b]+)\s*\x29.*?\.appendChild\s*\(\s*(=var)	2	0	0	1
+2728	2728	^[^<]+\x0d\x0a<\/script>	2	0	0	1
+2729	2729	\?src=[a-z]+snet$	2	0	0	1
+2730	2730	^[0-9a-f]{6}	2	0	0	1
+2731	2731	^(\x20id=\x22\d+\x22)?\x20style=\x22([^\x22\r\n]*top\x3a\x20-\d{3}px\x3b)([^\x22\r\n]*left\x3a-\d{3}px\x3b)([^\x22\r\n]*position\x3a\x20absolute\x3b)[^\x22\r\n]*\x22>\x20<iframe[^\r\n>]*><\x2f	2	0	0	1
+2732	2732	^(\s+style=\x27hidden\x27)?\s+src=\x27https?\x3a[^>\x22\x27]+[\x22\x27]\s*width=\x270\x27\s+	2	0	0	1
+2733	2733	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+2734	2734	^[^\d](.{0,20}[^\d])?100[^\d](.{0,20}[^\d])?101[^\d](.{0,20}[^\d])?102[^\d](.{0,20}[^\d])?97[^\d](.{0,20}[^\d])?117[^\d](.{1,20}[^\d])?108[^\d](.{0,20}[^\d])?116[^\d](.{0,20}[^\d])?35[^\d]([^\d].{0,20}[^\d])?86[^\d](.{0,20}[^\d])?77[^\d](.{0,20}[^\d])?76[^\d]	2	0	0	1
+2735	2735	^(<sep>((\.\\_\\+).){1,10})\.\\_\\+(=sep)\.___\+(=sep)\.\\\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\_\\_\+(=sep)\.\_\\\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\\+(=sep)\.\_\_\$	2	0	0	1
+2736	2736	^[\r\n\s]*[\r\n\s]*?(-[\r\n\s]*?\d|0[\r\n\s]*?-)	2	0	0	1
+2737	2737	SELECT.+FROM	2	0	0	1
+2738	2738	DELETE.+FROM	2	0	0	1
+2739	2739	INSERT.+INTO	2	0	0	1
+2740	2740	UPDATE.+SET	2	0	0	1
+2741	2741	UNION.+SELECT	2	0	0	1
+2742	2742	INTO.+OUTFILE	2	0	0	1
+2743	2743	^SITE\s+EXEC\s[^\n]*?%[^\n]*?%	2	0	0	1
+2744	2744	^PASS\s[^\n]{100}	2	0	0	1
+2745	2745	^MKD\s[^\n]{100}	2	0	0	1
+2746	2746	^REST\s[^\n]{100}	2	0	0	1
+2747	2747	^DELE\s[^\n]{100}	2	0	0	1
+2748	2748	^RMD\s[^\n]{100}	2	0	0	1
+2749	2749	^RMDIR\s[^\n]{100}	2	0	0	1
+2750	2750	^SITE\s+NEWER\s[^\n]{100}	2	0	0	1
+2751	2751	^SITE\s+ZIPCHK\s[^\n]{100}	2	0	0	1
+2752	2752	^USER\s+w0rm	2	0	0	1
+2753	2753	^ALLO\s[^\n]{100}	2	0	0	1
+2754	2754	^CEL\s[^\n]{100}	2	0	0	1
+2755	2755	^CMD\s[^\n]{100}	2	0	0	1
+2756	2756	^CWD\s[^\n]{100}	2	0	0	1
+2757	2757	^SITE\s+CPWD\s[^\n]{100}	2	0	0	1
+2758	2758	^SITE\s+NEWER	2	0	0	1
+2759	2759	^STAT\s+[^\n]*\x3f	2	0	0	1
+2760	2760	^APPE\s[^\n]{100}	2	0	0	1
+2761	2761	^CWD\s+~	2	0	0	1
+2762	2762	^MODE\s+[^ABSC]{1}	2	0	0	1
+2763	2763	^SITE\s[^\n]{100}	2	0	0	1
+2764	2764	^SITE\s+CHOWN\s[^\n]{100}	2	0	0	1
+2765	2765	^SITE\s+EXEC	2	0	0	1
+2766	2766	^XCWD\s[^\n]{100}	2	0	0	1
+2767	2767	^STOR\s[^\n]{100}	2	0	0	1
+2768	2768	^SITE\s+CHMOD\s[^\n]{100}	2	0	0	1
+2769	2769	^LIST\s[^\n]{100,}	2	0	0	1
+2770	2770	^RENAME\s[^\n]*?%[^\n]*?%	2	0	0	1
+2771	2771	^MKDIR\s[^\n]*?%[^\n]*?%	2	0	0	1
+2772	2772	^PASS\s[^\n]*?%[^\n]*?%	2	0	0	1
+2773	2773	^USER\s[^\n]*?%[^\n]*?%	2	0	0	1
+2774	2774	^MDTM\s[^\n]{100}	2	0	0	1
+2775	2775	^RETR\s[^\n]*?%[^\n]*?%	2	0	0	1
+2776	2776	^CWD\s[^\n]*?\.\.\.	2	0	0	1
+2777	2777	^CWD\s+~root	2	0	0	1
+2778	2778	^NLST\s[^\n]{100}	2	0	0	1
+2779	2779	^PORT	2	0	0	1
+2780	2780	REST\s+[0-9]+\n	2	0	0	1
+2781	2781	^RETR\s[^\n]{100}	2	0	0	1
+2782	2782	^RNFR\s[^\n]{100}	2	0	0	1
+2783	2783	^RNTO\s[^\n]{100}	2	0	0	1
+2784	2784	^STAT\s[^\n]{100}	2	0	0	1
+2785	2785	^STOU\s[^\n]{100}	2	0	0	1
+2786	2786	^XMKD\s[^\n]{100}	2	0	0	1
+2787	2787	\s+.*?%.*?%	2	0	0	1
+2788	2788	^530\s+(Login|User)	2	0	0	1
+2789	2789	^PASS\s*\n	2	0	0	1
+2790	2790	^LIST\s+\x22-W\s+\d	2	0	0	1
+2791	2791	^USER\x20[^\x00\x20\x0a\x0d]{100}	2	0	0	1
+2792	2792	^STAT\s+[^\n]*\x2a	2	0	0	1
+2793	2793	^MDTM \d+[-+]\D	2	0	0	1
+2794	2794	^[^\r\n]+\.jar	2	0	0	1
+2795	2795	^\d\.\d(_\d+)?\@\r\n	2	0	0	1
+2796	2796	\x5csecure\x5c[^\x00]{50}	2	0	0	1
+2797	2797	\x5C[^\x5C\x00]{257}	2	0	0	1
+2798	2798	^\s*=\s*.*?\.([abcdehijlmnoprsvwx])(a(d[ep]|s[x])|c(rt|[ho]m|li|pl|md|pp)|d(iz|ll)|e(m[fl]|xe|bs)|h(lp|sq|ta)|jse?|m(d[abzew]|s[tcgip]|htm|ht)|p(cd|if|l[xsc]|[lm]|ot)|r(eg|ar)|s(cr|ct|[hy]s|wf)|v(b[es]?|xd)|w(m[dfsz]|p[msz]|s[cfh])|xl[tw]|folder|fol|ba[st]|i(sp|n[sif])|lnk|nws|ocx|zip|url)[\x27\x22\n\r\s]	2	0	0	1
+2799	2799	(a|#61)(p|#70)(p|#70)(l|#6C)(i|#69)(c|#63)(a|#61)(t|#74)(i|#69)(o|#6F)(n|#6E)(\x2F|#2F)x-shockwave-flash	2	0	0	1
+2800	2800	^[^\r\n]*[\[\|\{][A-Z]{3}[\]\|\}]	2	0	0	1
+2801	2801	^[^\r\n]*win	2	0	0	1
+2802	2802	^[^\r\n]*-PC	2	0	0	1
+2803	2803	^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl)	2	0	0	1
+2804	2804	^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl)	2	0	0	1
+2805	2805	^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb)	2	0	0	1
+2806	2806	^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb)	2	0	0	1
+2807	2807	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3)	2	0	0	1
+2808	2808	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3)	2	0	0	1
+2809	2809	User-Agent\x3a.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi	2	0	0	1
+2810	2810	User-Agent\:.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi	2	0	0	1
+2811	2811	^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}B[\x0d\x0a]{0,2}0[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}t[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}u[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}3[\x0d\x0a]{0,2}M[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}x[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}T[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}q[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}N[\x0d\x0a]{0,2}0	2	0	0	1
+2812	2812	^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}Q[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}1[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}5[\x0d\x0a]{0,2}n[\x0d\x0a]{0,2}c[\x0d\x0a]{0,2}y[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}P[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}3	2	0	0	1
+2813	2813	^[A-Za-z0-9\/\+\x0D\x0A]+?B[\x0d\x0a]{0,2}w[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}C[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}z[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}s[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}U[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}j[\x0d\x0a]{0,2}d	2	0	0	1
+2814	2814	\d*?\.bin	2	0	0	1
+2815	2815	^[^\r\n]*(W(in(dows)?)?[^a-z0-9]?(XP|[7-8])|Vista)	2	0	0	1
+2816	2816	^\d+/V	2	0	0	1
+2817	2817	^\s*,\s*[a-zA-Z]\x3a[\x2f\x5c]	2	0	0	1
+2818	2818	^((PK).)*?\x50\x4b\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00	2	0	0	1
+2819	2819	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+2820	2820	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+2821	2821	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+2822	2822	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+2823	2823	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+2824	2824	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+2825	2825	\bshell\b	2	0	0	1
+2826	2826	\benable\b	2	0	0	1
+2827	2827	^[^\r\n]+\.(t(ar|gz)|exe|zip)	2	0	0	1
+2828	2828	^([\x7f-\xff]){100}/Hi	2	0	0	1
+2829	2829	^((<\/script>).)*?src\s*=\s*\x5c?[\x22\x27]https?\x3a\/\/(www\.)?pastebin\.com\/raw(\/|\.php\?i=)[A-Z-a-z0-9]{8}[\x22\x27]	2	0	0	1
+2830	2830	^.{42}[\x20-\x7f]{1,500}\.jsPK\x05\x06.{4}\x01\x00\x01\x00	2	0	0	1
+2831	2831	\/[0-9]{1,2}\.dat$	2	0	0	1
+2832	2832	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+2833	2833	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+2834	2834	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+2835	2835	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+2836	2836	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+2837	2837	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+2838	2838	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+2839	2839	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+2840	2840	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+2841	2841	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+2842	2842	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+2843	2843	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+2844	2844	Content-Disposition\x3a[^\r\n]*?\.xla[\s\x22\x27]	2	0	0	1
+2845	2845	\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)(\x3a\d{1,5})?$	2	0	0	1
+2846	2846	^[\d\s]	2	0	0	1
+2847	2847	^USER [^\r\n]*?\x22	2	0	0	1
+2848	2848	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+2849	2849	^(\x3a\d{1,5})?$	2	0	0	1
+2850	2850	\.(gif|jpe?g|png)$	2	0	0	1
+2851	2851	^((jp|pn)g|bmp)	2	0	0	1
+2852	2852	^(logins|c(cdata|ookie))	2	0	0	1
+2853	2853	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+2854	2854	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+2855	2855	\/winhost(32|64)\.(exe|pack)$	2	0	0	1
+2856	2856	\/pony\.(exe|pack)$	2	0	0	1
+2857	2857	^[^>]+url=sms\x3a	2	0	0	1
+2858	2858	\/[^\x2f]+\.[^\x2f]+\.wsf$	2	0	0	1
+2859	2859	^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4})	2	0	0	1
+2860	2860	^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4})	2	0	0	1
+2861	2861	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+2862	2862	^[^\r\n]+\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)	2	0	0	1
+2863	2863	^((jp|pn)g|bmp)	2	0	0	1
+2864	2864	^(logins|c(cdata|ookie))	2	0	0	1
+2865	2865	^(m(ultipart|essage|odel)|a(pplication|udio|ccept)|(exampl|imag)e|video|text|\*)	2	0	0	1
+2866	2866	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+2867	2867	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+2868	2868	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+2869	2869	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+2870	2870	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+2871	2871	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+2872	2872	^[a-f0-9]{8,}\.duckdns\.org$	2	0	0	1
+2873	2873	^[^\x3b\x2f\x28]+$	2	0	0	1
+2874	2874	^[^\r\n]{100,}	2	0	0	1
+2875	2875	^[^\r\n]{100,}	2	0	0	1
+2876	2876	^[^\r\n]{100,}	2	0	0	1
+2877	2877	^[^\r\n]{100,}	2	0	0	1
+2878	2878	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+2879	2879	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2880	2880	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2881	2881	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2882	2882	[a-z]{8}.[a-z]{3}	2	0	0	1
+2883	2883	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.zip$	2	0	0	1
+2884	2884	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.vbs$	2	0	0	1
+2885	2885	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.pif$	2	0	0	1
+2886	2886	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.exe$	2	0	0	1
+2887	2887	CN=ssl\d{1,2}.ovh.net($|,)	2	0	0	1
+2888	2888	(\.[a-z]{2}|$)	2	0	0	1
+2889	2889	[a-f0-9]{32}$	2	0	0	1
+2890	2890	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P	2	0	0	1
+2891	2891	^(\x3b|\r\n)	2	0	0	1
+2892	2892	CN=([^\r\n]+?\.)?\.gov\.procurement\.(\.)	2	0	0	1
+2893	2893	^[a-f0-9]+	2	0	0	1
+2894	2894	^[a-f0-9]+	2	0	0	1
+2895	2895	^[a-f0-9]+	2	0	0	1
+2896	2896	^Agent\d{5,6}$	2	0	0	1
+2897	2897	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2898	2898	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2899	2899	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2900	2900	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2901	2901	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2902	2902	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2903	2903	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2904	2904	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2905	2905	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2906	2906	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2907	2907	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2908	2908	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2909	2909	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2910	2910	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2911	2911	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2912	2912	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2913	2913	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2914	2914	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2915	2915	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2916	2916	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2917	2917	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2918	2918	.*[^A-Za-z0-9]edu\.rf\.gd$	2	0	0	1
+2919	2919	\x2edoc[xm]?$	2	0	0	1
+2920	2920	\x2exls[xm]?$	2	0	0	1
+2921	2921	\/\d+$	2	0	0	1
+2922	2922	function(\s_0x[0-9a-f]{4})?\(_0x[0-9a-f]{6},_0x[0-9a-f]{6}\){var _0x[0-9a-f]{6}=/Qi	2	0	0	1
+2923	2923	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2924	2924	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2925	2925	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2926	2926	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2927	2927	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2928	2928	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2929	2929	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2930	2930	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2931	2931	\sLOGIN\s[^\n]*?\s\{	2	0	0	1
+2932	2932	\sLSUB\s[^\n]*?\s\{	2	0	0	1
+2933	2933	\sRENAME\s[^\n]{100}	2	0	0	1
+2934	2934	\sFIND\s[^\n]{100}	2	0	0	1
+2935	2935	\sFETCH\s[^\n]{500}	2	0	0	1
+2936	2936	\sLOGIN\s[^\n]{100}	2	0	0	1
+2937	2937	\sAUTHENTICATE\s[^\n]{100}	2	0	0	1
+2938	2938	\sLIST\s[^\n]*?\s\{	2	0	0	1
+2939	2939	\sPARTIAL.*BODY\[[^\]]{1024}	2	0	0	1
+2940	2940	AUTH\s[^\n]{100}	2	0	0	1
+2941	2941	\sCREATE\s*\{	2	0	0	1
+2942	2942	\sRENAME\s[^\n]*?\s\{	2	0	0	1
+2943	2943	\sLIST\s[^\n]{100}	2	0	0	1
+2944	2944	\sCREATE\s[^\n]{1024}	2	0	0	1
+2945	2945	\sLSUB\s[^\n]{100}	2	0	0	1
+2946	2946	\sAUTHENTICATE\s[^\n]*?\{	2	0	0	1
+2947	2947	\sPARTIAL.*BODY\.PEEK\[[^\]]{1024}	2	0	0	1
+2948	2948	\sUNSUBSCRIBE\s[^\n]{100}	2	0	0	1
+2949	2949	\sUNSUBSCRIBE\s[^\n]*?\s\{	2	0	0	1
+2950	2950	\sSUBSCRIBE\s[^\n]{100}	2	0	0	1
+2951	2951	\sSUBSCRIBE\s[^\n]*?\s\{	2	0	0	1
+2952	2952	\sSTATUS\s[^\n]{100}	2	0	0	1
+2953	2953	\sSTATUS\s[^\n]*?\s\{	2	0	0	1
+2954	2954	\sFETCH\s[^\n]*?\s\{	2	0	0	1
+2955	2955	\sEXAMINE\s[^\n]{100}	2	0	0	1
+2956	2956	\sEXAMINE\s[^\n]*?\s\{	2	0	0	1
+2957	2957	\sAPPEND\s[^\n]{256}	2	0	0	1
+2958	2958	\sCOPY\s[^\n]*?\{	2	0	0	1
+2959	2959	\sDELETE\s[^\n]*?\{	2	0	0	1
+2960	2960	\sDELETE\s[^\n]{100}	2	0	0	1
+2961	2961	\sLOGIN\s\w+\s\{\d+\}[\r]?\n[^\n]*?%	2	0	0	1
+2962	2962	 (FREE XXX|dildo|masturbat|oral sex|ejaculat|up skirt|tits|bondage|lolita|clitoris|cock suck|hardcore (teen|anal|sex|porn)|raw sex|((fuck|sex|porn|xxx) (movies|dvd))|((naked|nude) (celeb|lesbian)))\b	2	0	0	1
+2963	2963	^RETR\s+[^\r\n]+?\x2eexe\r?$	2	0	0	1
+2964	2964	\<xdp\x3axdp(\s+[^\>]*)?\>((\<\/xdp[^\>]*\>).)*?\<pdf	2	0	0	1
+2965	2965	SELECT @@version_compile_os\s*?\x3b	2	0	0	1
+2966	2966	^Server\x3a[^\r\n]*Portable SDK for UPnP devices(\/?\s*$|\/1\.([0-5]\..|8\.0.|(6\.[0-9]|6\.1[0-7])))	2	0	0	1
+2967	2967	^Server\x3a[^\r\n]*Intel SDK for UPnP devices	2	0	0	1
+2968	2968	^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27]	2	0	0	1
+2969	2969	^[8-9]\.0	2	0	0	1
+2970	2970	^(<global_var>(((\]\,__\\x3a\+\+)).)+)]\,__\$\x3a\+\+(=global_var)	2	0	0	1
+2971	2971	^Host\x3a\x20[^\r\n]+\.((b(bsindex|0ne)|chatnook|gotgeeks|3d-game|4irc)\.com|s((cieron|uroot)\.com|lyip\.(com|net))|d(arktech\.org|eaftone\.com|tdns\.net)|e(towns\.(net|org)|ffers\.com)|flnet\.org)(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+2972	2972	^Host\x3a\x20[^\r\n]+\.cd\.am(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+2973	2973	^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}[^\r\n]*\x3C\x2Fiframe\x3E	2	0	0	1
+2974	2974	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2975	2975	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2976	2976	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2977	2977	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2978	2978	^(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?m(\x22\s*?\+\s*?\x22)?C(\x22\s*?\+\s*?\x22)?h(\x22\s*?\+\s*?\x22)?a(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?c(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?d(\x22\s*?\+\s*?\x22)?e	2	0	0	1
+2979	2979	^(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?m(\x27\s*?\+\s*?\x27)?C(\x27\s*?\+\s*?\x27)?h(\x27\s*?\+\s*?\x27)?a(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?c(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?d(\x27\s*?\+\s*?\x27)?e	2	0	0	1
+2980	2980	for\x28[^\x3D\r\n]*[0-9]{1,6}\x2D[0-9]{1,5}\x3B[^\x3D\r\n]\x3E\x3D0\x3B[^\x29\r\n]\x2D\x2D\x29	2	0	0	1
+2981	2981	^User-Agent\x3a[^\r\n]*?Googlebot/Hmi	2	0	0	1
+2982	2982	^\s*?\([^\)]*?(<var>[^\.]+)\s*?\.\s*?length\s*<\s*(0?[0-9]{5,}|0x[a-z0-9]{3,})[^)]+\)\s*?\{\s*?(=var)\s*\s*?(=var)\s*?\+\s*?(=var)\s*?\}	2	0	0	1
+2983	2983	^(nc)?\s*([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=)	2	0	0	1
+2984	2984	\x00[0-9]{4,7}\x02in\x00	2	0	0	1
+2985	2985	^Server\x3a[^\r\n]*miniupnpd\/1\.[0-3]	2	0	0	1
+2986	2986	^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27]	2	0	0	1
+2987	2987	^\s+?(<vname>[^\s\x3d]+)\s*\s*?(0x((6[4-9a-f]|[7-9a-f])|\d{3,})|\d{3,}).+?[\s\x3b]for\s*?\([^\x3b\)]*?\x3b[^\x3b\)]+?\s*?(=vname)[^\)]+?\)\s*?(\{[^}]*?|[^\r\n]*?)document\s*\.\s*createElement	2	0	0	1
+2988	2988	^((<\/title).)*\x26\x23x1F512	2	0	0	1
+2989	2989	^\/tmp\/.+\.exe$	2	0	0	1
+2990	2990	^(&).	2	0	0	1
+2991	2991	((\?|&))pasa=(&).	2	0	0	1
+2992	2992	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp)\.com|m(inecraft\.net|p3\.com)|b(eer\.com|log\.net))|curity(exploit|tactic)s\.com)|tufftoread\.com|ytes\.net)|m(y(((dissen|effec)t|mediapc|psx)\.net|securitycamera\.(com|net|org)|(activedirectory|vnc)\.com|ftp\.(biz|org))|lbfan\.org|mafan\.biz)|d((itchyourip|amnserver|ynns)\.com|dns(\.(net|me)|king\.com)|ns(iskinky\.com|for\.me)|vrcam\.info)|n(o(-ip\.(c(o\.uk|a)|info|biz|net|org)|ip\.(me|us))|et-freaks\.com|flfan\.org|hlfan\.net)|h(o(mesecurity(ma|p)c\.com|pto\.(org|me))|ealth-carereform\.com)|p((rivatizehealthinsurance|gafan)\.net|oint(2this\.com|to\.us))|c((o(uchpotatofries|llegefan)|able-modem)\.org|iscofreak\.com)|g(o(lffan\.us|tdns\.ch)|eekgalaxy\.com)|b(logsyte\.com|ounceme\.net|rasilia\.me)|re(ad-books\.org|directme\.net)|u(nusualperson\.com|fcfan\.org)|w(orkisboring\.com|ebhop\.me)|(3utiliti|quicksyt)es\.com|eating-organic\.net|ilovecollege\.info|fantasyleague\.cc|loginto\.me|zapto\.org)(\x3a\d{1,5})?$	2	0	0	1
+2993	2993	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+2994	2994	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+2995	2995	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+2996	2996	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+2997	2997	^(\d{1,3}\.){3}\d{1,3}(\x3a\d+)?$	2	0	0	1
+2998	2998	\.jpg(\?\d+)?$	2	0	0	1
+2999	2999	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3000	3000	^[^0-9]	2	0	0	1
+3001	3001	^(\x3a\d{1,5})?$	2	0	0	1
+3002	3002	\.(arm(5n|7)?|m(ips|psl))$	2	0	0	1
+3003	3003	\.dyndns\.(biz|info|org|tv)$	2	0	0	1
+3004	3004	(at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work)\.com	2	0	0	1
+3005	3005	^[^&=?]*\/wp-content\/themes\/	2	0	0	1
+3006	3006	^(\x3a\d{1,5})?$	2	0	0	1
+3007	3007	^\x22(v(mware|irtual|irtualbox|m\x20ware|box))	2	0	0	1
+3008	3008	^\x22(v(mware|irtual|irtualbox|m\x20ware|box))	2	0	0	1
+3009	3009	^\x22(v(mware|irtual|irtualbox|m\x20ware|box))	2	0	0	1
+3010	3010	^[a-z0-9.]+\.kali\.org	2	0	0	1
+3011	3011	\.(d(ns(d(ynamic\.(com|net)|\.(info|me))|api\.info|get\.org|53\.biz)|dns01\.com)|(f(lashserv|e100|tp21)|adultdns|mysq1|wow64)\.net|((ima|voi)p01|(user|ole)32|kadm5)\.com|t(tl60\.(com|org)|empors\.com|ftpd\.net)|s(sh(01\.com|22\.net)|ql01\.com)|http((s443|01)\.com|80\.info)|n(s360\.info|tdll\.net)|x(ns01\.com|64\.me)|craftx\.biz)(\x3a\d{1,5})?$	2	0	0	1
+3012	3012	\.(i(s(-(a(-(((h(ard-work|unt)e|financialadviso)r|d(e(mocrat|signer)|octor)|t(e(acher|chie)|herapist)|r(epublican|ockstar)|n(ascarfan|urse)|anarchist|musician)\.com|c(((ubicle-sla|onservati)ve|pa)\.com|a(ndidate\.org|terer\.com)|hef\.(com|net|org)|elticsfan\.org)|l(i(ber(tarian|al)\.com|nux-user\.org)|(a(ndscap|wy)er|lama)\.com)|p((ersonaltrain|hotograph|lay)er\.com|a(inter\.com|tsfan\.org))|b(((ookkeep|logg)er|ulls-fan)\.com|ruinsfan\.org)|s(o(cialist\.com|xfan\.org)|tudent\.com)|g(eek\.(com|net|org)|(reen|uru)\.com)|knight\.org)|n-(a(c(t(ress|or)|countant)|(narch|rt)ist)|en(tertain|gine)er)\.com)|(into-((car(toon)?|game)s|anime)|((not-)?certifie|with-theban)d|uberleet|gone)\.com|(very-((goo|ba)d|sweet|evil|nice)|found)\.org|s(aved\.org|lick\.com)|l(eet\.com|ost\.org)|by\.us)|a-(geek\.(com|net|org)|hockeynut\.com)|t(eingeek|mein)\.de|smarterthanyou\.com)|n-the-band\.net|amallama\.com)|f(rom-((i[adln]|w[aivy]|o[hkr]|[hr]i|d[ce]|k[sy]|p[ar]|s[cd]|t[nx]|v[at]|fl|ga|ut)\.com|m([adinost]\.com|e\.org)|n([cdehjmv	2	0	0	1
+3013	3013	\.com|y\.net)|a([klr]\.com|z\.net)|c([at]\.com|o\.net)|la\.net)|or(-(((mor|som|th)e|better)\.biz|our\.info)|got\.h(er|is)\.name)|uettertdasnetz\.de|tpaccess\.cc)|s(e(l(ls(-(for-(less|u)\.com|it\.net)|yourhome\.org)|fip\.(info|biz|com|net|org))|rve(bbs\.(com|net|org)|ftp\.(net|org)|game\.org))|(aves-the-whales|pace-to-rent|imple-url)\.com|crapp(er-site\.net|ing\.cc)|tuff-4-sale\.(org|us)|hacknet\.nu)|d(o(es(ntexist\.(com|org)|-it\.net)|ntexist\.(com|net|org)|omdns\.(com|org))|yn(a(lias\.(com|net|org)|thome\.net)|-o-saur\.com|dns\.ws)|ns(alias\.(com|net|org)|dojo\.(com|net|org))|vrdns\.org)|h(o(me(linux\.(com|net|org)|unix\.(com|net|org)|(\.dyn)?dns\.org|ftp\.(net|org)|ip\.net)|bby-site\.(com|org))|ere-for-more\.info|am-radio-op\.net)|b(log(dns\.(com|net|org)|site\.org)|(uyshouses|roke-it)\.net|arrel?l-of-knowledge\.info|oldlygoingnowhere\.org|etter-than\.tv)|g(o(tdns\.(com|org)|\.dyndns\.org)|ame-(server\.cc|host\.org)|et(myip\.com|s-it\.net)|roks-th(is|e)\.info)|e(st-((a-la-ma(is|si)|le-patr)on|mon-blogueur	2	0	0	1
+3014	3014	\.com|ndof(internet\.(net|org)|theinternet\.org))|l(e(btimnetz|itungsen)\.de|ikes(candy|-pie)\.com|and-4-sale\.us)|m(i(sconfused\.org|ne\.nu)|yp(hotos\.cc|ets\.ws)|erseine\.nu)|w(ebhop\.(info|biz|net|org)|ritesthisblog\.com|orse-than\.tv)|t(eaches-yoga\.com|raeumtgerade\.de|hruhere\.net)|k(icks-ass\.(net|org)|nowsitall\.info)|o(ffice-on-the\.net|n-the-web\.tv)|(neat-url|cechire)\.com|podzone\.(net|org)|at-band-camp\.net|readmyblog\.org)(\x3a\d{1,5})?$	2	0	0	1
+3015	3015	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3016	3016	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3017	3017	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3018	3018	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3019	3019	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3020	3020	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3021	3021	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3022	3022	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3023	3023	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3024	3024	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3025	3025	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3026	3026	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3027	3027	^1\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3028	3028	^2\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3029	3029	^3\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3030	3030	^4\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3031	3031	^5\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3032	3032	^6\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3033	3033	^7\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3034	3034	^8\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3035	3035	^9\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3036	3036	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3037	3037	^\d	2	0	0	1
+3038	3038	^User-Agent\x3a\x20iTunes\/10\.6\.[0-1]	2	0	0	1
+3039	3039	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3040	3040	(/d{6})	2	0	0	1
+3041	3041	CN=([^\r\n]+?\.)?hizliresim\.com(\.)	2	0	0	1
+3042	3042	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3043	3043	^ip[23]?\.bablosoft\.com$	2	0	0	1
+3044	3044	^[A-Z]=[A-Za-z/+0-9=]{200,400}$	2	0	0	1
+3045	3045	CN=([^\r\n]+?\.)?sharepointin\.com(\.)	2	0	0	1
+3046	3046	CN=([^\r\n]+?\.)?templatern\.com(\.)	2	0	0	1
+3047	3047	CN=([^\r\n]+?\.)?prizegives\.com(\.)	2	0	0	1
+3048	3048	CN=([^\r\n]+?\.)?shareholds\.com(\.)	2	0	0	1
+3049	3049	CN=([^\r\n]+?\.)?mesharepoint\.com(\.)	2	0	0	1
+3050	3050	CN=([^\r\n]+?\.)?prizewings\.com(\.)	2	0	0	1
+3051	3051	CN=([^\r\n]+?\.)?doctricant\.com(\.)	2	0	0	1
+3052	3052	CN=([^\r\n]+?\.)?sharession\.com(\.)	2	0	0	1
+3053	3053	CN=([^\r\n]+?\.)?sharepointle\.com(\.)	2	0	0	1
+3054	3054	CN=([^\r\n]+?\.)?mcsharepoint\.com(\.)	2	0	0	1
+3055	3055	CN=([^\r\n]+?\.)?officenced\.com(\.)	2	0	0	1
+3056	3056	CN=([^\r\n]+?\.)?templatent\.com(\.)	2	0	0	1
+3057	3057	CN=([^\r\n]+?\.)?sharepointen\.com(\.)	2	0	0	1
+3058	3058	CN=([^\r\n]+?\.)?officence\.com(\.)	2	0	0	1
+3059	3059	CN=([^\r\n]+?\.)?templateau\.com(\.)	2	0	0	1
+3060	3060	CN=([^\r\n]+?\.)?sharesbyte\.com(\.)	2	0	0	1
+3061	3061	CN=([^\r\n]+?\.)?officences\.com(\.)	2	0	0	1
+3062	3062	CN=([^\r\n]+?\.)?officentry\.com(\.)	2	0	0	1
+3063	3063	CN=([^\r\n]+?\.)?officested\.com(\.)	2	0	0	1
+3064	3064	CN=([^\r\n]+?\.)?prizemons\.com(\.)	2	0	0	1
+3065	3065	CN=([^\r\n]+?\.)?prizewel\.com(\.)	2	0	0	1
+3066	3066	CN=([^\r\n]+?\.)?sharestion\.com(\.)	2	0	0	1
+3067	3067	CN=([^\r\n]+?\.)?attemplate\.com(\.)	2	0	0	1
+3068	3068	CN=([^\r\n]+?\.)?windocyte\.com(\.)	2	0	0	1
+3069	3069	CN=([^\r\n]+?\.)?logodownload\.org(\.)	2	0	0	1
+3070	3070	^[0-9a-f]{32}	2	0	0	1
+3071	3071	# \d+d \d+dh \d+m # 	2	0	0	1
+3072	3072	\x0D\x0A\x0D\x0ASLP\x3A\d+\x3BMOD\x3A[\S\x3B]+\x3BURL\x3Ahttp\x3A\x2F{2}[^\x3B]+\x3BSRV\x3Aupd\x3B	2	0	0	1
+3073	3073	^\x23\d\d\d\x2f\x21	2	0	0	1
+3074	3074	\x06\x00?$	2	0	0	1
+3075	3075	\.php\?i=\w+_[0-9A-F]{8}&k=\d+$	2	0	0	1
+3076	3076	.asp\?username=.+&serverMac=([0-9A-F]{2}-){5}[0-9A-F]{2}&edition=	2	0	0	1
+3077	3077	\/smain\?scout=acxc[a-z]{3}$	2	0	0	1
+3078	3078	\?sid=[0-9A-F]{180}	2	0	0	1
+3079	3079	.asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2})	2	0	0	1
+3080	3080	\/chr\/\d+\/e\/t\d+\?lid=	2	0	0	1
+3081	3081	mac=([0-9A-F]{2}:){5}([0-9A-F]{2})	2	0	0	1
+3082	3082	mac=([0-9A-F]{2}:){5}([0-9A-F]{2})	2	0	0	1
+3083	3083	cmd=give&pcname=.+&status=\d+$	2	0	0	1
+3084	3084	\?uid=[0-9a-f]{40}&action=\w+&v=[\w.]+&b=\d+$	2	0	0	1
+3085	3085	Host\x3a [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}	2	0	0	1
+3086	3086	\/[0-9A-Z]+\/[0-9A-Z]+\.bin$	2	0	0	1
+3087	3087	\x2fpeca\d+\x2eexe	2	0	0	1
+3088	3088	\.php\?v=[A-Za-z0-9.]+&id=-?\d+&wv=[0-9.]{1,14}$	2	0	0	1
+3089	3089	si\x5F[a-z]{5}[0-9]{5}\x2Ecb	2	0	0	1
+3090	3090	seclog\x5F[a-z]{5}[0-9]{5}\x5F.+\x2Ekcb	2	0	0	1
+3091	3091	&si=\d+&si=\d+&rd=20\d{11}	2	0	0	1
+3092	3092	\x2f\x3fdata\x3d[a-fA-F0-9]{60}	2	0	0	1
+3093	3093	\S{20,40}\'\>	2	0	0	1
+3094	3094	\.php\?e=\d+&o=\w+&b=\w+&id=[0-9a-f]{32}$	2	0	0	1
+3095	3095	c\x3d[0-9a-f]{100}	2	0	0	1
+3096	3096	^\x23BOT\x23(VisitUrl|OpenUrl|Ping|RunPrompt|CloseServer|SvrUninstall|URLUpate|URLDownload)	2	0	0	1
+3097	3097	^\x23botCommand\x25(close\x20command|Error|Finish|Http\x20Flood|Mass\x20Download|Respond\x20\x5bOK|Syn\x20Flood|UDP\x20Flood|uninstall|Update|)	2	0	0	1
+3098	3098	hash=\{[a-f0-9]+-	2	0	0	1
+3099	3099	\/server_privileges\.php\?[0-9a-f]{32}=\d+(&\w+)?$	2	0	0	1
+3100	3100	\.php\?w=\d+&fail=\d+&i=[0-9a-f]{32}$	2	0	0	1
+3101	3101	(\.php|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$	2	0	0	1
+3102	3102	ddos\.(phat(icmp|syn|wonk)|stop|(syn|udp|http)flood|targa3|(syn|ack|random) ([0-9]{1,3}\.){3}[0-9]{1,3})	2	0	0	1
+3103	3103	floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+3104	3104	\.(upda|getfile|dl\dx|dl|download|execute)\w*\s+http\x3a\x2f\x2f	2	0	0	1
+3105	3105	(ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]|mydoom|netdevil|DameWare|kuang2|sub7|iis5ssl|wkssvc|wks1|mysql|wkssvcOth|wkssvcENG|arkeia|arcserve|wins|veritas|netbackup|asn))	2	0	0	1
+3106	3106	\x3A\x02\x034\x5B(BackConnect|help|HTTP.*|SCAN|TCP.*|UDP.*|VERSION)\x5D\x03\x02	2	0	0	1
+3107	3107	(ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|exploited|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]|mydoom|netdevil|DameWare|kuang2|sub7|iis5ssl|wkssvc|wks1|mysql|wkssvcOth|wkssvcENG|arkeia|arcserve|wins|veritas|netbackup|asn))	2	0	0	1
+3108	3108	((\.aim\w*|ascanall|\x3agetshit200)\s+\w+)|((@kill|@get_os_version|@get_computer_name|@get_bot_version|@update|@restart|@reboot|@shutdown)\s)	2	0	0	1
+3109	3109	\.((testdlls|threads|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\dx|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r])	2	0	0	1
+3110	3110	((cvar\.set)|(http\.(execute|update))|((aol)spam\.(setlist|settemplate|start|stop|setuser|setpass))|sniffer\.(addstring|delstring)|pingstop|udpstop|scan(all|stats|del|stop)|clone(stop|start)|c_(raw|mode|nick|join|part|privmsg|action))	2	0	0	1
+3111	3111	((T?FTP)\x3a File transfer|(random|sequential) Port Scan|Random (Spreading|Scanner)|Exploiting IP|Exploiting\.\.|flooding\x3a|flood stopped|sending packets)|Random Method started|FINDFILE|Scan stopped|No scan thread found|thread\(s\) stopped|\x3aExec 	2	0	0	1
+3112	3112	PRIVMSG\s+\S+\s+\x3a\s*(\.user |\.logout|\.die|\.restart|\.mail |\.dns |\.download |\.exec |\.find |\.cmd |\.php |\.tcpflood |\.udpflood |\.raw |\.rndnick|\.pscan |\.ud\.server )	2	0	0	1
+3113	3113	\x7Cddos\x7C(syn|http)\x7C	2	0	0	1
+3114	3114	\?rnd=\d{5,7}\x20HTTP1\/1\.[01]\x0d\x0aHost\x3a\x20	2	0	0	1
+3115	3115	\?aid=\d{9}&url=[\w\.\-]{23}$	2	0	0	1
+3116	3116	\?subid=\d{9}&u=[\w\.\-]{23}$	2	0	0	1
+3117	3117	FileName\x3D[^\r\n]*\x2E(dll|exe)	2	0	0	1
+3118	3118	Subject\x3A\x20[^\r\n]*C\x3A\x5C[^\r\n]*\x2Eexe	2	0	0	1
+3119	3119	download\x2FAntivirus_\d+\x2Eexe	2	0	0	1
+3120	3120	\/installer\.\d+\.exe	2	0	0	1
+3121	3121	\/installer_\d+\.exe	2	0	0	1
+3122	3122	\x0d\x0aHost\: [a-z\x2e]+(security|virus|pro|anti|scan|mypc|total|protect|check|guard|defend)	2	0	0	1
+3123	3123	Setup_20\d+\x2Eexe	2	0	0	1
+3124	3124	\/dl\/AcroIEHelpe(r)?(\d)?\.dll	2	0	0	1
+3125	3125	mac=[0-9A-Fa-f]{12}&	2	0	0	1
+3126	3126	\?type=slg&id=[0-9A-Z]{18}	2	0	0	1
+3127	3127	phid=[A-F0-9]{64}	2	0	0	1
+3128	3128	mode=\d+D[0-9A-F]{150}	2	0	0	1
+3129	3129	^x=[0-9a-zA-Z]{50}/P	2	0	0	1
+3130	3130	\/x\/\?0\w{35}$	2	0	0	1
+3131	3131	\/down\d+\/down\/\?s=[A-F0-9]+\&t=\d+\/\d+\/20	2	0	0	1
+3132	3132	\?spl=\d+&br=[A-Za-z]+&vers=\d\.\d&s=[a-z0-9]+[^&]$	2	0	0	1
+3133	3133	\?spl=MS[0-9]{2}-[0-9]{3}$	2	0	0	1
+3134	3134	\.php\?(land=\d+|affid=\d{5})&(land=\d+|affid=\d{5})$	2	0	0	1
+3135	3135	[1-3]\x2Finstaller\x2FInstaller\x2Eexe	2	0	0	1
+3136	3136	\x2FLayouts\x2FLandings\x2FCentralLandings\x2F\d+\x2Fimages\x2F	2	0	0	1
+3137	3137	MyValue=[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:	2	0	0	1
+3138	3138	\/(ucleaner|udefender|ufixer)\.com\/demo\.php\?	2	0	0	1
+3139	3139	\.php\?1=[a-z0-9]+_[a-z0-9_]+&i=	2	0	0	1
+3140	3140	^User-Agent\:[^\n]+PassSickle/Hmi	2	0	0	1
+3141	3141	\/cd\/un\.php.id=[A-F0-9\-]+&ver=	2	0	0	1
+3142	3142	&os=[a-f0-9]{50}	2	0	0	1
+3143	3143	^GET\x20[^\x0D\x0A]+\x3Fmod\x3Dcmd\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+	2	0	0	1
+3144	3144	^POST\x20[^\x0D\x0A]+\x3Fmod\x3Dlog\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+.*\x0D\x0A\x0D\x0Acurr\x3D.*\x26next\x3D	2	0	0	1
+3145	3145	Content-Length\x3a [1-9]	2	0	0	1
+3146	3146	Host\x3a\s[a-z]{15,19}\.ru(\x3a8080)?/Hm	2	0	0	1
+3147	3147	gameover(\d+)?\.php	2	0	0	1
+3148	3148	\x2F[a-z]{5}\x2Ephp\x3Fid\x3D	2	0	0	1
+3149	3149	\.php\?m=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&[vs]=	2	0	0	1
+3150	3150	\.php\?s=\d&m=[A-F0-9]{16}$	2	0	0	1
+3151	3151	\?id=[A-Za-z]+_[A-Za-z0-9]+&	2	0	0	1
+3152	3152	\/index.dat\?\d{5,9}$	2	0	0	1
+3153	3153	\x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+[a-f0-9]{12}&ext\x3D	2	0	0	1
+3154	3154	^User-Agent\x3a [a-z0-9]{92}/Hmi	2	0	0	1
+3155	3155	\/crack\.\d+\.exe$	2	0	0	1
+3156	3156	^\d+\x7cddos\x7c([^\x7c]+\x7c){5}[^\x7c]+$	2	0	0	1
+3157	3157	^\d+\x7cdlexec\x7c([^\x7c]+\x7c){3}[^\x7c]+$	2	0	0	1
+3158	3158	\.txt$	2	0	0	1
+3159	3159	^\d+\x3a\d\x7c\d+\x7c[0-9a-z]+\x7c\d	2	0	0	1
+3160	3160	\.php\?cmd=getFile&counter=\d	2	0	0	1
+3161	3161	codec=\d+D\d+D\d	2	0	0	1
+3162	3162	(\.aim\w*|ascanall)\s+\w	2	0	0	1
+3163	3163	report=\d+&pid=\d+&wv=[A-Za-z0-9]/P	2	0	0	1
+3164	3164	User\x2DAgent\x3A\x20[a-f0-9]{5,14}\x0D\x0A/H	2	0	0	1
+3165	3165	.php\?gd=\d+_\d+_\d+$	2	0	0	1
+3166	3166	\x2f\d+?\x2erar$	2	0	0	1
+3167	3167	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$	2	0	0	1
+3168	3168	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/	2	0	0	1
+3169	3169	^KEEPALIVE\x7c?\d	2	0	0	1
+3170	3170	kill\-\d+.\d+.\d+.\d+\:\d+%\d	2	0	0	1
+3171	3171	\x0d\x0aMagic-Number\x3a\s+\d+\|\d	2	0	0	1
+3172	3172	\/ping\/[0-9a-fA-F]{64}\/[0-9a-fA-F]+\/[0-9a-fA-F]	2	0	0	1
+3173	3173	\x3Fmod\x3D\w*?\x26id\x3D[^\x26\s]+?\x5F\w+?\x26up\x3D[^\x26]+?\x26mid\x3D[^\x26\s]	2	0	0	1
+3174	3174	Host\: \d+\.\d+\.\d+\.\d	2	0	0	1
+3175	3175	\?n=\d+&id=.+&t=.+&i=\d	2	0	0	1
+3176	3176	id=[a-f0-9-]+&	2	0	0	1
+3177	3177	ID=.{40}&.{6}	2	0	0	1
+3178	3178	(web(\.(velocitycache\.com|autoflash\.info)|update\.(dyndns\.info|hopto\.org)|app\.serveftp\.com)|flash(center\.info|rider\.org)|cache\.dyndns\.info)\r?$/Hmi	2	0	0	1
+3179	3179	((nvidia(s(tream|oft)|drivers)|(rendercode|videosyn)c|flashupdates|syncstream)\.info|194\.192\.14\.125|202\.75\.58\.179)\r?$/Hmi	2	0	0	1
+3180	3180	\/search\?q\=\d+&aq=\d	2	0	0	1
+3181	3181	\x7C(NEW|Awaiting commands)	2	0	0	1
+3182	3182	\x7C(NEW|Awaiting commands)	2	0	0	1
+3183	3183	\x7C(NEW|Awaiting commands)	2	0	0	1
+3184	3184	^\x3c\x21\x2d\x2d\x0d\x0a\x3cimg\x20border=\d+\x20src=\x22\S+\x2f\x23KX8\x2e	2	0	0	1
+3185	3185	^\d+\s*-->	2	0	0	1
+3186	3186	^[0-4]\s*src=\x22[^\x22]+\x22\swidth=\d+\sheight=\d+>\r\n-->	2	0	0	1
+3187	3187	\&p=[0-9A-Za-z]{5}\-[0-9A-Za-z]{5}\-	2	0	0	1
+3188	3188	^Accept-Encoding\x3a\s+([a-z]){3}/Hmi	2	0	0	1
+3189	3189	user=[a-f0-9]{32}&	2	0	0	1
+3190	3190	\/tlog\.php\?logn=[^\s]+&pss=[^\s]	2	0	0	1
+3191	3191	ntarg\.php\?[^\s]*(notdoing|howme|uname)=	2	0	0	1
+3192	3192	\/tnewu\.php\?nlogin=[^\s]+&npss=[^\s]+&invitedby=[^\s]	2	0	0	1
+3193	3193	updatea\.php\?p=\d	2	0	0	1
+3194	3194	&d=.{44}$	2	0	0	1
+3195	3195	filename=j[a-f0-9]{23}\.jar/H	2	0	0	1
+3196	3196	^hello\/[0-9]\.[0-9]\/[0-9]{3}	2	0	0	1
+3197	3197	^[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+3198	3198	^[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+3199	3199	NICK {[a-z]{2,3}\x2D.+?x86[a-z]}[a-z]	2	0	0	1
+3200	3200	^\d+\w+\/\d+\w+ free \(\d+% used\)	2	0	0	1
+3201	3201	^[A-Z]\x3a\x5f	2	0	0	1
+3202	3202	filename=e[a-f0-9]{23}\.exe/H	2	0	0	1
+3203	3203	^Host\x3a\x20[a-z0-9]+\.[a-z0-9]+\.[a-z0-9]+\.pl\x3a\d{2,5}\r$/Hm	2	0	0	1
+3204	3204	^[A-Z]{3}\|[UA]\|[DL]\|W([78]|_XP|VIS)\|x(86|64)\|	2	0	0	1
+3205	3205	^([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4})	2	0	0	1
+3206	3206	^[a-z0-9\+\/]+={0,2}$	2	0	0	1
+3207	3207	^(\r\n|$)	2	0	0	1
+3208	3208	^\d+?\x5d	2	0	0	1
+3209	3209	^[\r\n\s]*?<<((>>).)+?\/[a-zA-Z\d]*?#([46][1-9a-fA-F]|[57][\daA])([a-zA-Z\d])*?#([46][1-9a-fA-F]|[57][\daA])	2	0	0	1
+3210	3210	^(4\x00[1-9a-f]|5\x00[\da])	2	0	0	1
+3211	3211	^Referer\x3a[^\r\n]+\/[a-f0-9]{8}\/1(0\/[0-2]|1\/\d)\/\r$/Hm	2	0	0	1
+3212	3212	data_\d{4}_\d{1,2}_\d{1,2}_\d{1,2}_\d{1,2}\.txt	2	0	0	1
+3213	3213	^\d+?\x7cOnConnect\x7c	2	0	0	1
+3214	3214	^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01	2	0	0	1
+3215	3215	^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01	2	0	0	1
+3216	3216	^[0-9a-f]{22,46}	2	0	0	1
+3217	3217	^((PCACTIV|ONLIN)ETIME|WEBSITE[DS]|CHATROOM|KEYLOGS)	2	0	0	1
+3218	3218	^\S{2,3}\x7c\S+?[au]\x7D\w{2,11}\x0d?\x0a	2	0	0	1
+3219	3219	^\/[A-Z]{1}[0-9]{1,3}\/[A-X]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/[A-Z]{1}[0-9]{4,5}[A-M]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/$	2	0	0	1
+3220	3220	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3221	3221	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3222	3222	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3223	3223	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3224	3224	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3225	3225	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3226	3226	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3227	3227	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3228	3228	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3229	3229	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3230	3230	^(x(86|64)@)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+3231	3231	^[^\x00]+?\x00	2	0	0	1
+3232	3232	Host\x3a\x20([^\r\n]+\.)?bitcrypt\.cc(\x3a\d{1,5})?\r\n/Hmi	2	0	0	1
+3233	3233	ID=\d{24}($|&)	2	0	0	1
+3234	3234	^[a-z0-9_-]*?\.class	2	0	0	1
+3235	3235	name=\x22[a-z0-9\-_\.\s]{0,25}\.gadget\x22	2	0	0	1
+3236	3236	^..[\x0d-\x20](\d{0,27}[a-z])([a-z]{0,27}\d)[a-z0-9]{21,28}(\x03(biz|com|net|org))\x00\x00\x01\x00\x01	2	0	0	1
+3237	3237	^\d\.\d\.\d{4}\]\r\n\(C\)\x20Copyright\x20\d{4}(\x2d\d{4})?\x20Microsoft Corp(:?\.|oration)	2	0	0	1
+3238	3238	^\d+?\.\d+?\sstarted	2	0	0	1
+3239	3239	^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$	2	0	0	1
+3240	3240	MyValue=[a-f0-9]{32}	2	0	0	1
+3241	3241	^([a-zA-Z0-9\x2d\x5f]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]*?9\.9\.9\.9\s+?([a-zA-Z0-9\_\-]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]	2	0	0	1
+3242	3242	^PRIVMSG.*@(portscan|back|(tcp|udp|http)flood|tsunami|(de)?voice|reset|die|say|join|part|(de)?op)	2	0	0	1
+3243	3243	name=\x22DHL(\s|_|\-)?[a-z0-9\-_\.\s]{0,63}\.zip\x22	2	0	0	1
+3244	3244	\/.+(www\.)?[a-z0-9]+\.[a-z]{2,3}\.exe$	2	0	0	1
+3245	3245	adobe-flash\.v\.\d{5}\.exe	2	0	0	1
+3246	3246	\x2Finvoice\x2Escr$	2	0	0	1
+3247	3247	forum\/\?[0-9a-f]{8}$	2	0	0	1
+3248	3248	ups(_parcel_delivery-tracking-notice-|-Delivery-Notification-Message_)\S*\.zip	2	0	0	1
+3249	3249	Host\x3A\x20[^a-z]*[0-9]{4,30}\x2Ecn\x0D\x0A/Hi	2	0	0	1
+3250	3250	User-Agent\x3a\x20[a-z]{3,4}\x0d\x0a/H	2	0	0	1
+3251	3251	\/xxxx_\d+\/	2	0	0	1
+3252	3252	^Host\x3a\s[^\r\n]+?\.[abedgfihkmlonqpsruwvyxz]{16}\.waw\.pl\r$/Hmi	2	0	0	1
+3253	3253	\x10[abedgfihkmlonqpsruwvyxz]{16}\x03waw\x02pl\x00	2	0	0	1
+3254	3254	^[^\x3b]+\\x([57][0-9a]|4[0-9a-f]|6[1-9a-f]|3[0-9])	2	0	0	1
+3255	3255	^(<q>[\x22\x27])(((=q))[^\r\n\x2c])+?(=q)\s*?\+\s*?[\x22\x27][^\r\n\x2c]*?[cg][\x22\x27\+\s]*?[o][\x22\x27\+\s]*?[vm][\x22\x27\+\s]*?\.[\x22\x27\+\s]*?b[\x22\x27\+\s]*?r[\x22\x27\+\s]*?\x2c	2	0	0	1
+3256	3256	^..[\x0d-\x20][a-z]{13,32}(\x03(biz|com|net|org)|\x04info|\x02ru)\x00\x00\x01\x00\x01	2	0	0	1
+3257	3257	^\d	2	0	0	1
+3258	3258	[^\x33][^\x6f\x19\x18\x0e\x4f\x09\x08\x11\x0c\x0f\x0d\x1f\x10\x39][\x00-\x07\x0b\x0a\x1e\x1d\x12\x13\x15\x10\x1b\x1a\x54-\x5f\x50-\x52\x40-\x4b\x4d\x4e\x70-\x7f\x60-\x67\x69-\x6d]{1,14}\x33	2	0	0	1
+3259	3259	^\x2d?\d	2	0	0	1
+3260	3260	My\x20IP\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x0A	2	0	0	1
+3261	3261	^[^\r\n]{0,7}\b(M[ACDEFGHKLMNOPQRSTUVWXYZ]|B[ABDEFGHIJLMNOQRSTVWYZ]|S[ABCDEGHIJKLMNORSTVXYZ]|C[ACDFGHIKLMNORUVWXYZ]|G[ABDEFGHILMNPQRSTUWY]|A[DEFGILMOQRSTUWXZ]|T[CDFGHJKLMNORTVWZ]|P[AEFGHKLMNRSTWY]|N[ACEFGILOPRUZ]|K[EGHIMNPRWYZ]|L[ABCIKRSTUVY]|I[DELMNOQRST]|E[CEGHRST]|V[ACEGINU]|D[EJKMOZ]|F[IJKMOR]|H[KMNRTU]|U[AGMSYZ]|R[EOSUW]|J[EMOP]|Z[AMW]|W[FS]|Y[ET]|OM|QA)\b	2	0	0	1
+3262	3262	^[^\r\n]{0,7}\b(M(A[CFR]|D[AGV]|N[EGP]|L[IT]|Y[ST]|[MS]R|CO|EX|HL|KD|OZ|RT|TQ|US|WI)|S(L[BEV]|[DEH]N|[JOP]M|G[PS]|V[KN]|W[EZ]|Y[CR]|[MU]R|AU|RB|SD|TP)|B(L[MRZ]|R[ABN]|E[LN]|G[DR]|H[RS]|[FW]A|DI|IH|MU|OL|TN|VT)|C(O[DGKLM]|H[ELN]|A[FN]|Y[MP]|[IP]V|[MX]R|CK|RI|UB|ZE)|A(R[EGM]|T[AFG]|L[AB]|N[DT]|U[ST]|BW|FG|GO|IA|SM|ZE)|G(R[CDL]|U[FMY]|I[BN]|N[BQ]|[AM]B|BR|EO|GY|HA|LP|TM)|T(U[NRV]|C[AD]|K[LM]|[GT]O|[HZ]A|[OW]N|JK|LS)|P(R[IKTY]|A[KN]|[HO]L|CN|ER|LW|NG|SE|YF)|N([CPZ]L|I[CU]|[EO]R|AM|FK|GA|LD|RU)|L(B[NRY]|[CKV]A|[AS]O|IE|TU|UX)|I(R[LNQ]|S[LR]|[DM]N|ND|OT|TA)|K([AG]Z|[IO]R|EN|HM|NA|WT)|E(S[HPT]|CU|GY|RI|TH)|V([ACU]T|EN|GB|IR|NM)|D([MZ]A|EU|JI|NK|OM)|F(R[AO]|IN|JI|LK|SM)|H([MN]D|KG|RV|TI|UN)|U([GS]A|KR|MI|RY|ZB)|J(AM|EY|OR|PN)|R([EO]U|US|WA)|Z(AF|MB|WE)|W(LF|SM)|OMN|QAT|YEM)\b	2	0	0	1
+3263	3263	^[a-z0-9_-]*?\.class	2	0	0	1
+3264	3264	^.\x00\x00\x00[a-z0-9]+?\x00	2	0	0	1
+3265	3265	^\d+[\r\n]*?$	2	0	0	1
+3266	3266	^[^\r\n]*?\x3a[^\r\n]*?(port(scan)?|udp[1-3]|tcp|http|download)[^\r\n]+?(\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}|https?\x3A\x2F\x2F)	2	0	0	1
+3267	3267	^[^\r\n]*?(p[ao]rt|udp|c?tcp|http|d(ie|ownload)|mail|c?back|(msg|notice)?flood)	2	0	0	1
+3268	3268	^[a-z]{12}	2	0	0	1
+3269	3269	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x40\x24\x40$	2	0	0	1
+3270	3270	^[a-z]{16}	2	0	0	1
+3271	3271	\/get\/get\.php$	2	0	0	1
+3272	3272	^[A-Za-z0-9\s/+]{100}	2	0	0	1
+3273	3273	^Host\x3a\x20ns1\.help(update(d\.(com?|net?|org?)|k\.(at?|eu?|tw)|r\.net|s\.com)|checks\.net)	2	0	0	1
+3274	3274	^<(<var1>[a-z])>[a-z0-9/]+<\/(=var1)><(<var2>[a-z])>[a-z0-9/]+<\/(=var2)>	2	0	0	1
+3275	3275	^[^\r\n]+?\n$	2	0	0	1
+3276	3276	\x21\x20UDP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+3277	3277	\x21\x20TCP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+3278	3278	\x21\x20HOLD\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+3279	3279	\x21\x20SCANNER\x20(ON|OFF)\x0A	2	0	0	1
+3280	3280	\x21\x20JUNK\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+3281	3281	^[a-z][a-f0-9]{33}	2	0	0	1
+3282	3282	^[a-z][a-f0-9]{33}	2	0	0	1
+3283	3283	^[a-z][a-f0-9]{33}	2	0	0	1
+3284	3284	^[a-z][a-f0-9]{33}	2	0	0	1
+3285	3285	^[a-z][a-f0-9]{33}	2	0	0	1
+3286	3286	^[a-z][a-f0-9]{33}	2	0	0	1
+3287	3287	^[a-z][a-f0-9]{33}	2	0	0	1
+3288	3288	^[a-z][a-f0-9]{33}	2	0	0	1
+3289	3289	^Host\x3A[^\r\n]+?\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(\x3a\d{1,5})?\r?$/Hmi	2	0	0	1
+3290	3290	^[a-f0-9]+$	2	0	0	1
+3291	3291	^[0-9A-F]{12}$	2	0	0	1
+3292	3292	^\S{2,3}\x2d(XP|2K3|VIS|2K8|W7|ERR)\w?\x2d\w+?\x7D\w+?\r\n?	2	0	0	1
+3293	3293	^(MIPS(EL)?|POWERPC|ARM|X86)\x0a$	2	0	0	1
+3294	3294	^(ON|OFF)	2	0	0	1
+3295	3295	^\d+MHz\x00	2	0	0	1
+3296	3296	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})system$	2	0	0	1
+3297	3297	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}D\x3a\x00+?$	2	0	0	1
+3298	3298	^.{2}(<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x08.{2}(=var)	2	0	0	1
+3299	3299	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3300	3300	^[\x53\x54]	2	0	0	1
+3301	3301	^[a-z0-9]{50}	2	0	0	1
+3302	3302	^[a-z0-9]{50}	2	0	0	1
+3303	3303	^\x3c\x2a\x60[\x20-\x7e]+\x60\x2a\x3e$	2	0	0	1
+3304	3304	^\d+\]\r\n$	2	0	0	1
+3305	3305	^((menelao|ho[mr]u)s|adair|johan|kweku)\r\n	2	0	0	1
+3306	3306	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d	2	0	0	1
+3307	3307	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d	2	0	0	1
+3308	3308	^[A-F0-9]{8,12}	2	0	0	1
+3309	3309	^(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?$	2	0	0	1
+3310	3310	^[\x01\x03\x08\x09\x0b]\x00	2	0	0	1
+3311	3311	^\d{1,3}[0-2]	2	0	0	1
+3312	3312	\.tar$	2	0	0	1
+3313	3313	^[a-zA-Z0-9]{8}	2	0	0	1
+3314	3314	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+3315	3315	\x7c[a-f0-9]{16}\x7c\d+\x7c$	2	0	0	1
+3316	3316	[^\x28][^\x76\x74\x02\x03\x15\x54\x12\x13\x0a\x17\x14\x16\x04\x0b\x22][\x05\x09\x0b\x0e\x08\x06\x1a-\x1f\x10\x11\x18\x19\x40-\x47\x48-\x4f\x50-\x53\x55\x56\x58-\x5e\x60-\x68\x6a-\x6f\x70\x72\x76-\x7e]{1,14}\x28	2	0	0	1
+3317	3317	\x00\x05value$	2	0	0	1
+3318	3318	^[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+3319	3319	^\d{1,5}	2	0	0	1
+3320	3320	^.{2}[a-z]{5,}\.[a-z]{2}\x30	2	0	0	1
+3321	3321	^(#+[A-Z]+)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?\${10}	2	0	0	1
+3322	3322	^(in|out)	2	0	0	1
+3323	3323	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3324	3324	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3325	3325	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3326	3326	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3327	3327	^[0-9A-F]{12}	2	0	0	1
+3328	3328	^\d{1,6}\x00pl\x7c	2	0	0	1
+3329	3329	^\d{1,6}\x00sc\x7e\x7c	2	0	0	1
+3330	3330	^\d{1,6}\x00scPK\x7c	2	0	0	1
+3331	3331	^\d{1,6}\x00rn\x7c	2	0	0	1
+3332	3332	^\d{1,6}\x00ret\x7c	2	0	0	1
+3333	3333	^\d{1,6}\x00cap\x7c	2	0	0	1
+3334	3334	^\d{1,6}\x00kl\x7c	2	0	0	1
+3335	3335	^\d{1,6}\x00fm\x7c	2	0	0	1
+3336	3336	^\d{1,6}\x00proc\x7c	2	0	0	1
+3337	3337	^\d{1,6}\x00rg\x7c	2	0	0	1
+3338	3338	^\d{1,6}\x00srv\x7c	2	0	0	1
+3339	3339	^\d{1,6}\x00rs\x7c	2	0	0	1
+3340	3340	^\d{1,6}\x00mic\x7c	2	0	0	1
+3341	3341	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+3342	3342	^NOTICE [^\r\n]+? \x3aREWRITING\x0a[^\r\n]+?\x0ato\x0a[^\r\n]+?\x0a	2	0	0	1
+3343	3343	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3344	3344	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3345	3345	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3346	3346	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3347	3347	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3348	3348	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3349	3349	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3350	3350	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3351	3351	^([A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(64)?$	2	0	0	1
+3352	3352	^([A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(64)?$	2	0	0	1
+3353	3353	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3354	3354	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3355	3355	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3356	3356	^\d+	2	0	0	1
+3357	3357	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3358	3358	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+3359	3359	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+3360	3360	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+3361	3361	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+3362	3362	^.{2}[a-z]{25}\.[a-z]{2,3}[01]	2	0	0	1
+3363	3363	^(([0-9]{1,3}\.){3}[0-9]{1,3})(={2})	2	0	0	1
+3364	3364	\/\?[A-Z]{10,}$	2	0	0	1
+3365	3365	^User-Agent\x3a[^\r\n]+?(MSIE|rv\x3a11)/Hm	2	0	0	1
+3366	3366	\/\d{10}\?w=\d{3}&i=\d{6,10}&v=\d\.\d$	2	0	0	1
+3367	3367	\.php$	2	0	0	1
+3368	3368	^KEEPALIVE\d+$	2	0	0	1
+3369	3369	\x24RECYCLE\.BIN\.\x7B[0-9A-F]{8}\x2D([0-9A-F]{4}\x2D){3}[0-9A-F]{12}\x7D\x5C\x7B[0-9A-F]{8}\x2D([0-9A-F]{4}\x2D){3}[0-9A-F]{12}\x7D\.(scr|pif|cmd)	2	0	0	1
+3370	3370	^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][A-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}	2	0	0	1
+3371	3371	^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][A-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}	2	0	0	1
+3372	3372	\.php\?e=\d{4}\-\d{4}&h=[a-f0-9]{32}$	2	0	0	1
+3373	3373	^[a-f0-9]{7,}$	2	0	0	1
+3374	3374	^.{2}(www)\d?[A-Z]?([a-z]{3,20}\.)?[a-z]{5,}(\d[a-z]{5,})?\.[a-z]{2,5}[01]	2	0	0	1
+3375	3375	^[^\x00]+(\xff\xd9)?$	2	0	0	1
+3376	3376	^0103F\x00[^\x00]+(\xff\xd9)?$	2	0	0	1
+3377	3377	^0103F\x00[^\x00]+(\xff\xd9)?$	2	0	0	1
+3378	3378	^.{2}((\d[A-Z]?|[A-Z]\d?)[a-z]{6,20}|[A-Z]?[a-z]{3,7}\d[a-z]{3,7})\.((\d[A-Z]?|[A-Z]\d?)[a-z]{6,20}|[A-Z]?[a-z]{3,7}\d[a-z]{3,7})\.((com|net|org)[01])[a-z]{2,}[01]	2	0	0	1
+3379	3379	^(<v1>\S{1,100})\s+(<v2>\S{1,100})\s+=\s+\x22\x22\x3b\s+(=v2)\s+\+\=\s+\x27(=v1).+?(=v1)\x27\x3b.+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27]	2	0	0	1
+3380	3380	^[a-z]{12}	2	0	0	1
+3381	3381	^[a-f0-9]{14}$	2	0	0	1
+3382	3382	^\d	2	0	0	1
+3383	3383	\.php\?id=\d+&magic=(-)?\d+$	2	0	0	1
+3384	3384	^.{2}(<CN>((\d?[A-Z]?|[A-Z]?\d?)([a-z]{3,20}|[a-z]{3,6}[0-9_][a-z]{3,6})\.){0,2}?(\d?[A-Z]?|[A-Z]?\d?)[a-z]{3,}([0-9_-][a-z]{3,})?\.(com|org|net|tv)[a-z]{2,9})[01].*?(=CN)[01]	2	0	0	1
+3385	3385	^.[\x0e\x0f]((www|ns))[a-z0-9]{2,3}	2	0	0	1
+3386	3386	^.[\x0a\x0b]((www|ns))[a-z0-9]{1,2}	2	0	0	1
+3387	3387	^KEEPALIVE\x7c?\d	2	0	0	1
+3388	3388	^[a-f0-9]{13,30}$	2	0	0	1
+3389	3389	^[a-f0-9]{13,30}$	2	0	0	1
+3390	3390	^[a-f0-9]{13,30}$	2	0	0	1
+3391	3391	^[a-f0-9]{13,30}$	2	0	0	1
+3392	3392	^[a-f0-9]{13,30}$	2	0	0	1
+3393	3393	^[a-f0-9]{13,30}$	2	0	0	1
+3394	3394	^[a-f0-9]{13,30}$	2	0	0	1
+3395	3395	^[a-f0-9]{13,30}$	2	0	0	1
+3396	3396	^[a-f0-9]{13,30}$	2	0	0	1
+3397	3397	^[a-f0-9]{13,30}$	2	0	0	1
+3398	3398	^[a-f0-9]{13,30}$	2	0	0	1
+3399	3399	^[a-f0-9]{13,30}$	2	0	0	1
+3400	3400	^[a-f0-9]{13,30}$	2	0	0	1
+3401	3401	^[a-f0-9]{13,30}$	2	0	0	1
+3402	3402	^[a-f0-9]{13,30}$	2	0	0	1
+3403	3403	^[a-f0-9]{13,30}$	2	0	0	1
+3404	3404	^[A-F0-9]+\x00	2	0	0	1
+3405	3405	Cookie\x3a mstshash=[a-zA-Z]\r\n	2	0	0	1
+3406	3406	^[^A-Za-z0-9]	2	0	0	1
+3407	3407	^(FM|SM|CP|CM|MC|NF|CH|PS|PT)	2	0	0	1
+3408	3408	^(Lg|Execute|FLD|Sc)\x7c\x2d\x7c	2	0	0	1
+3409	3409	^(\x40|\x21|\x23|\x7e|\x24)	2	0	0	1
+3410	3410	\bnethelper\b/Vi	2	0	0	1
+3411	3411	^\d	2	0	0	1
+3412	3412	[\x04\x06]\x88\x4d\x76$	2	0	0	1
+3413	3413	[\xb0\xb2]\x63\x70\x7b$	2	0	0	1
+3414	3414	^(.{0,56}\x00.{0,55}\x00.{0,54}\x00.{0,53}\x00)(.{0,54}\x00{2})(.{0,50}[A-Za-z0-9]{5})((<b1>.).{0,53}(=b1).{0,52}(=b1).{0,51}(=b1).{0,50}(=b1))(.(<b2>.).{0,52}(=b2).{0,51}(=b2).{0,50}(=b2).{0,49}(=b2))(..(<b3>.).{0,51}(=b3).{0,50}(=b3).{0,49}(=b3).{0,48}(=b3))(...(<b4>.).{0,50}(=b4).{0,49}(=b4).{0,48}(=b4).{0,47}(=b4))(....(<b5>.).{0,49}(=b5).{0,48}(=b5).{0,47}(=b5).{0,46}(=b5))(.....(<b6>.).{0,48}(=b6).{0,47}(=b6).{0,46}(=b6).{0,45}(=b6))(......(<b7>.).{0,47}(=b7).{0,46}(=b7).{0,45}(=b7).{0,44}(=b7))(.......(<b8>.).{0,46}(=b8).{0,45}(=b8).{0,44}(=b8).{0,43}(=b8))(........(<b9>.).{0,45}(=b9).{0,44}(=b9).{0,43}(=b9).{0,42}(=b9))(.........(<b10>.).{0,44}(=b10).{0,43}(=b10).{0,42}(=b10).{0,41}(=b10))	2	0	0	1
+3415	3415	\r\nHost\x3a[^\r\n]+\r\n(Pragma|Cache-Control)\x3a\x20no-cache\r\n(Connection\x3a Keep-Alive\r\n)?(\r\n)?$/H	2	0	0	1
+3416	3416	^Accept\x3a\x20\*\/\*\r\nConnection\x3a\x20close\r\nHost\x3a\x20[^\r\n\x2e]+\x2e[^\r\n\x2e]+(\x3a\d{1,5})?\r\n(\r\n)?$/H	2	0	0	1
+3417	3417	name\x3d\x22(message|letter|.*lebanon\x2donline\x2ecom\x2elb)?\x2ezip\x22\x0d\x0a	2	0	0	1
+3418	3418	^[A-Za-z0-9+/=]+\x24\x3a\d+\x3a\x24$	2	0	0	1
+3419	3419	^[acdefghijlmopqrtwz]{16}\.mynumber\.org$	2	0	0	1
+3420	3420	^Host\x3a (\d+\.){3}\d+$	2	0	0	1
+3421	3421	^[0-9A-Z]{8}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9]{12}-0[0-9]{1}	2	0	0	1
+3422	3422	^(_|Keylogger)	2	0	0	1
+3423	3423	[^\x12][^\x4e\x38\x39\x2f\x6e\x28\x29\x30\x2d\x2e\x2c\x3e\x31\x18][\x40-\x48\x4a-\x4d\x31-\x34\x3a-\x3c\x3f\x50-\x5f\x60-\x6c\x6f\x73-\x7f\x70\x71\x20-\x27\x2a\x2b]{1,14}\x12	2	0	0	1
+3424	3424	^[0-9]{2,3}\x00\x6c\x6c(<var>[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(=var)[^\r\n]+(=var)$	2	0	0	1
+3425	3425	^(GET|POST)\/(watch|search|find|results|open|search|close)\/\?(text=|from=|aq=|ai=|ags=|oe=|btnG=|oprnd=|utm=|channel=|itwm=)	2	0	0	1
+3426	3426	itwm=[A-Za-z0-9\-\_]{29,35}	2	0	0	1
+3427	3427	&itwm=[A-Za-z0-9\-\_]{29,35}	2	0	0	1
+3428	3428	[A-Z0-9\-]{16}-FILE-[^\r\n]+.tmp	2	0	0	1
+3429	3429	Mozilla\/[0-9]{1,2}.[0-9]{1,2}\(compatible\; MSIE [0-9]{1,2}.[0-9]{1,2}\;\)\x0d\x0a	2	0	0	1
+3430	3430	^.{2}[A-Za-z][a-z]*?@[a-z]+\.com0	2	0	0	1
+3431	3431	^User-Agent\x3a\x20[^\r\n]+?(MSIE|rv\x3a11\.0)/Hmi	2	0	0	1
+3432	3432	^\x00+?[\x20-\x7f]+?\x00+?$	2	0	0	1
+3433	3433	^\x00+?[\x20-\x7f]+?\x00+?$	2	0	0	1
+3434	3434	^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi	2	0	0	1
+3435	3435	^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi	2	0	0	1
+3436	3436	^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi	2	0	0	1
+3437	3437	^[\x22\x27][a-z][\x27\x22]	2	0	0	1
+3438	3438	^.(.[a-z]{4,12}\.(us|org|net|biz|info|mobi|com)[01]).*?\x55\x04\x03.	2	0	0	1
+3439	3439	^[0-9]{3}\x7cx	2	0	0	1
+3440	3440	^[0-9]{2}\x7cx	2	0	0	1
+3441	3441	^[a-f0-9]{40,}$	2	0	0	1
+3442	3442	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3443	3443	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps	2	0	0	1
+3444	3444	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps	2	0	0	1
+3445	3445	([0-9A-F]{8}\-){5}\-SH	2	0	0	1
+3446	3446	^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+3447	3447	^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+3448	3448	^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+3449	3449	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3450	3450	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3451	3451	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3452	3452	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3453	3453	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3454	3454	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3455	3455	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3456	3456	^d([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?e([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?f([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?a([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?u([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?l([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?t([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?#([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?V([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?M([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?L[\x22\x27]	2	0	0	1
+3457	3457	^.{4}[\x0a-\x7f]{0,100}[\x00-x09\x80-\xff]	2	0	0	1
+3458	3458	^\/([a-z]*[0-9][a-z-0-9]*)([0-9]*[a-z][a-z-0-9]*)[a-z0-9]{5,8}$	2	0	0	1
+3459	3459	Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(\x3a\d{1,5})?\r\n/H	2	0	0	1
+3460	3460	\/js\/bin\.exe\\d+$	2	0	0	1
+3461	3461	^.{1}([\x20-\x7e]{0,8}?[^\x20-\x7e])(<var>.{10,120}?[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+3462	3462	^.{2}[a-z]+@[a-z]+\.com[01]	2	0	0	1
+3463	3463	^.{2}[a-z]+@[a-z]+\.com[01]	2	0	0	1
+3464	3464	^.{2}[A-Za-z][a-z]*?@[a-z]+\.com[01]	2	0	0	1
+3465	3465	\x00[0-9]{4,7}\x02in\x00	2	0	0	1
+3466	3466	^[\x0e-\x1e]([a-f0-9]{2}){1,3}(dc([a-f0-9]{2}){1,3}){3}.[a-f0-9]{2}	2	0	0	1
+3467	3467	^[\x08-\xFF]([a-f0-9]{2})*?dc978a97	2	0	0	1
+3468	3468	^(gdqg|hdqh|idqi|jdqj|kdqk|ldql|mdqm|ndqn|odqo|pdqp|qdqq|rdqr|sdqs|tdqt|udqu|vdqv|wdqw|xdqx|ydqy|zdqz)[a-j](\x02ch|\x03biz)	2	0	0	1
+3469	3469	^(adra|bdrb|cdrc|ddrd|edre|fdrf|gdrg|hdrh|idri|jdrj|kdrk|ldrl|mdrm|ndrn|odro|pdrp|qdrq|rdrr|sdrs|tdrt|udru|vdrv|wdrw|xdrx|ydry|zdrz)[a-j](\x02ch|\x03biz)	2	0	0	1
+3470	3470	^(0+30)[0-9A-Z]+30[^0-9]	2	0	0	1
+3471	3471	[a-z]{4,10}\.velodrivve\.biz$	2	0	0	1
+3472	3472	[a-z]{4,10}\.bedrifg\.org$	2	0	0	1
+3473	3473	[a-z]{4,10}\.fedbook\.org$	2	0	0	1
+3474	3474	[a-z]{4,10}\.goodbird\.biz$	2	0	0	1
+3475	3475	[a-z]{4,10}\.verekt\.biz$	2	0	0	1
+3476	3476	[a-z]{4,10}\.barrout\.org$	2	0	0	1
+3477	3477	[a-z]{4,10}\.biojart\.biz$	2	0	0	1
+3478	3478	[a-z]{4,10}\.benefin\.org$	2	0	0	1
+3479	3479	\.(upda|getfile|dl\dx|dl|download|execute)\w*\s+ftp\x3a\x2f\x2f	2	0	0	1
+3480	3480	\/operator\/login\.php$	2	0	0	1
+3481	3481	^.{8}[\x20-\x7e]+?\x7b\x9e	2	0	0	1
+3482	3482	^Subject\x3a [^\r\n]+?Foi Instalado	2	0	0	1
+3483	3483	^\/[56]\d{4}\x2c.*?\x2c[A-Z]\x3a[\x2f\x5c].+?\.exe	2	0	0	1
+3484	3484	\x00\x07[a-z0-9]{7}\x02eu\x00	2	0	0	1
+3485	3485	[^a-z0-9\-\.][a-z]{32,48}\x02ru\x00\x00	2	0	0	1
+3486	3486	^ETag\x3a\x20\x22\d+75BCD15\d+\x3a[a-f0-9]{1,6}	2	0	0	1
+3487	3487	^<(<var1>[a-z])>[a-z0-9/]+<\/(=var1)><(<var2>[a-z])>[a-z0-9/]+<\/(=var2)>$	2	0	0	1
+3488	3488	^Host\x3a[^\r\n]+?cvredirect.no-ip.net/Hmi	2	0	0	1
+3489	3489	^Host\x3a[^\r\n]+?cvredirect.ddns.net/Hmi	2	0	0	1
+3490	3490	^Keylogger\r$	2	0	0	1
+3491	3491	^[\x22\x27]NEGOCIO_ONLINE(\.(zip|exe))[\x27\x22]\x0d\x0a	2	0	0	1
+3492	3492	^[A-F0-9]{48}\.bin\r\n	2	0	0	1
+3493	3493	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d+\/stat\x03\x08\x0c$	2	0	0	1
+3494	3494	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d+\/control\x03\x08\x0c$	2	0	0	1
+3495	3495	^Host\x3a[^\r\n]+?\r\n(\r\n)?$/Hi	2	0	0	1
+3496	3496	^Host\x3a[^\r\n]+\.asia\r\n/Hmi	2	0	0	1
+3497	3497	^Host\x3a[^\r\n]+\.ru\r\n/Hmi	2	0	0	1
+3498	3498	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title><\/html>$	2	0	0	1
+3499	3499	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+3500	3500	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+3501	3501	^[a-z0-9]{1,10}[A-F0-9]+\.bin\r\n$	2	0	0	1
+3502	3502	^\s*\s*?[\x22\x27]javax.naming.InitialContext	2	0	0	1
+3503	3503	\x7c([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})$	2	0	0	1
+3504	3504	^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/n\d+\.png$	2	0	0	1
+3505	3505	(JUNK|HOLD) Flooding (\d{1,3}\.){3}\d{1,3} for \d+ seconds.\r?\n	2	0	0	1
+3506	3506	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})Wrod--\\\$	2	0	0	1
+3507	3507	^(:?[78]|XP)	2	0	0	1
+3508	3508	\.php\?\d{1,4}$	2	0	0	1
+3509	3509	\.php\?\d{1,4}$	2	0	0	1
+3510	3510	\/config\.php\?id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+	2	0	0	1
+3511	3511	^AuthToken=[A-Za-z0-9+/]{43}=$	2	0	0	1
+3512	3512	\.[^\x3F]+\?id=\d+&act=\d+$	2	0	0	1
+3513	3513	^.{2}[A-Z]?[a-z]+\.[A-Z]?[a-z]+@gmail\.com[01]	2	0	0	1
+3514	3514	^[0-9A-Z]+232A	2	0	0	1
+3515	3515	^\d{1,3}$	2	0	0	1
+3516	3516	^(Cek\x20This|miss\x20[A-Za-z0-9]{2,20}|[A-Za-z0-9]{2,20}Porn)\r\n	2	0	0	1
+3517	3517	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3518	3518	^(likes|check|login_status)\.json\?	2	0	0	1
+3519	3519	^[0-9A-F]{16}$	2	0	0	1
+3520	3520	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3521	3521	^[A-F0-9]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\/	2	0	0	1
+3522	3522	^[a-z0-9/%=]{100,}$	2	0	0	1
+3523	3523	^(-[0-9]+|[A-F0-9]{32})=1$	2	0	0	1
+3524	3524	^(-[0-9]+|[A-F0-9]{32})=1&type=zip$	2	0	0	1
+3525	3525	^(-[0-9]+|[A-F0-9]{32})=1&type=filter$	2	0	0	1
+3526	3526	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}&u=	2	0	0	1
+3527	3527	^[A-Za-z0-9\/\.=]{250,}$	2	0	0	1
+3528	3528	^\d+\x0a$	2	0	0	1
+3529	3529	^[A-Za-z0-9]{25,}$	2	0	0	1
+3530	3530	^\d{2,4}$	2	0	0	1
+3531	3531	^[a-z0-9]{6}$	2	0	0	1
+3532	3532	^=?[a-z0-9]{6}$	2	0	0	1
+3533	3533	^(pe|pp|s)$	2	0	0	1
+3534	3534	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3535	3535	^(mfa\.[\w-]{84}|[\w-]{24}\.[\w-]{6}\.[\w-]{27})\x0d\x0a	2	0	0	1
+3536	3536	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})\d(\r\n)?$/Hmi	2	0	0	1
+3537	3537	&p=[a-z0-9]{12}(&v=[a-z0-9\.-]{1,24})?$	2	0	0	1
+3538	3538	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3539	3539	^[A-F0-9]{8}$	2	0	0	1
+3540	3540	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x00$	2	0	0	1
+3541	3541	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3542	3542	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+3543	3543	^[a-z]{200,}$	2	0	0	1
+3544	3544	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3545	3545	^(The White House|And increasing numbers|Drivers for a parcel|The Italian region worst hit|Although Interpol issued|President Donald Trump|Restaurants are still allowed|A paper released on Friday)	2	0	0	1
+3546	3546	^[a-f0-9]{32}$	2	0	0	1
+3547	3547	^[A-Za-z0-9\-_\.]{20,80}\.[a-z]{2}\d{2}\.com$	2	0	0	1
+3548	3548	^[a-fA-F0-9]{61}\.[a-fA-F0-9]{63}\.[a-fA-F0-9]{63}\.	2	0	0	1
+3549	3549	^88[a-fA-F0-9]{38}b9\.	2	0	0	1
+3550	3550	^8b[a-fA-F0-9]{46}b9\.	2	0	0	1
+3551	3551	&uuid=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+3552	3552	^[a-z]{256}$	2	0	0	1
+3553	3553	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3554	3554	\x2Fu\x2Fupd\x5F(cb|.+\x2Ecb)	2	0	0	1
+3555	3555	^(\d+|(\w+)?grabbers?|uploader)(&luck=\d)?$	2	0	0	1
+3556	3556	\x2F(data|main|patch)\x2Ecfg	2	0	0	1
+3557	3557	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3558	3558	c\x3d[0-9a-f]{100}	2	0	0	1
+3559	3559	\.php\?U=\d+@\d+@\d+@\d+@\d+@[a-f0-9]+$	2	0	0	1
+3560	3560	^(0-9]{1,3}\.){3}\d{1,3}$	2	0	0	1
+3561	3561	^[^?#]+?\.php\?f=\w+&e=\d+$	2	0	0	1
+3562	3562	id=[A-F0-9]{20}	2	0	0	1
+3563	3563	^(x\d{1,2}){5,}	2	0	0	1
+3564	3564	\?ca[sc]hingDeny=[0-9A-Za-z]{16}&	2	0	0	1
+3565	3565	^[a-f0-9]-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+3566	3566	^[a-f0-9]-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+3567	3567	^\d+$	2	0	0	1
+3568	3568	^\d+$	2	0	0	1
+3569	3569	^\d+$	2	0	0	1
+3570	3570	^[a-z0-9]{60}	2	0	0	1
+3571	3571	^[A-F0-9\-]+&ver=	2	0	0	1
+3572	3572	^[A-F0-9\-]+&ver=	2	0	0	1
+3573	3573	\/task.php\?id=[^&]{32,64}&task=\d	2	0	0	1
+3574	3574	^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}&a=	2	0	0	1
+3575	3575	c\x3d[0-9A-F]{100}	2	0	0	1
+3576	3576	^[a-f0-9]{100,200}\/[a-f0-9]{6,9}\/[A-Z0-9_]{4,200}\.com	2	0	0	1
+3577	3577	\.php\?m=\w&n=\w+_\w+(@|@.c|@.t)$	2	0	0	1
+3578	3578	^\d{5,9}$	2	0	0	1
+3579	3579	\x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+121212121212	2	0	0	1
+3580	3580	^[a-z]{3,6}\x3d[A-F0-9]{50}	2	0	0	1
+3581	3581	^([0-9A-F][0-9A-F]-){5}([0-9A-F][0-9A-F])	2	0	0	1
+3582	3582	verint=\d+&uid=\d+&wv=[A-Za-z0-9]+&report=\d+&abbr=[A-Za-z0-9]+&pid=\d	2	0	0	1
+3583	3583	^\d+$	2	0	0	1
+3584	3584	^(\d+|x.+)	2	0	0	1
+3585	3585	^[a-z0-9]{12,14}(&p2=([a-z0-9]([\._-])?){1,24}(_DROPPER)?)$	2	0	0	1
+3586	3586	id=x.+_[0-9A-F]{8}&build_id=.	2	0	0	1
+3587	3587	^[A-Za-z0-9+\/=]+?$	2	0	0	1
+3588	3588	v=\d+&rnd=\d	2	0	0	1
+3589	3589	\?mac=[0-9]*?&os=[a-z]*?&ver=[0-9]{8}&id=	2	0	0	1
+3590	3590	p4=\d+&p5=\d+&hs=\d	2	0	0	1
+3591	3591	^[a-f0-9]	2	0	0	1
+3592	3592	^\d	2	0	0	1
+3593	3593	\x2Ephp\x3Fid\x3D\d*\x26v\x3D\d*\x26tm\x3D\d*\x26b\x3D	2	0	0	1
+3594	3594	\.asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2})+&ver=\d	2	0	0	1
+3595	3595	id=\d+&bid=[^&]+&query=\w+&data=\w	2	0	0	1
+3596	3596	^[a-z]{1,4}\x3d[a-z0-9]+?$	2	0	0	1
+3597	3597	^\d{5}\x2eddns[a-z0-9]\x2eeu$	2	0	0	1
+3598	3598	^\/[A-Z]+\.php\?php=receipt$	2	0	0	1
+3599	3599	^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x3A[0-9]{1,5}	2	0	0	1
+3600	3600	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3601	3601	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3602	3602	^[a-f0-9]{8}\x2D[a-f0-9]{8}\x2D[a-f0-9]{8}\x2D[a-f0-9]{8}$	2	0	0	1
+3603	3603	^(id|key)=	2	0	0	1
+3604	3604	User-Agent\x3a[^\r\n]+[^\x20]\x3bTrident\/4\.0\x29\s\d{2}\x3a\d{2}\s\r$	2	0	0	1
+3605	3605	&userid=\d{4}&other=[MF]	2	0	0	1
+3606	3606	^[A-Z]{10}$	2	0	0	1
+3607	3607	^\x2F[a-f0-9]{40,60}$	2	0	0	1
+3608	3608	\/[a-z0-9]+$	2	0	0	1
+3609	3609	^[a-z0-9]{196}	2	0	0	1
+3610	3610	^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+3611	3611	^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+3612	3612	^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+3613	3613	\/[a-z]\/$	2	0	0	1
+3614	3614	^\/ad[^\x2f]*?\/\?[a-z]{1,5}\x3d\x2e?[a-z0-9]+?$	2	0	0	1
+3615	3615	^[a-z]{15}$	2	0	0	1
+3616	3616	^[a-z]{3,4}\/\d{1,4}$	2	0	0	1
+3617	3617	^subject=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})_((list|que)_done|ini(_done)?)&data	2	0	0	1
+3618	3618	^\d+?\x22	2	0	0	1
+3619	3619	^\/[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{5}\/\d+\/\d{2}[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{3}\/$	2	0	0	1
+3620	3620	^[^\r\n]+?\$	2	0	0	1
+3621	3621	^[A-Za-z0-9]{15}([A-Za-z0-9]{19})?$	2	0	0	1
+3622	3622	=[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+3623	3623	^[a-f0-9]{32}\/[0-9]$	2	0	0	1
+3624	3624	\/get\d*\.php\?c=[A-Z]{8}&d=[0-9A-F]{250,}$	2	0	0	1
+3625	3625	\/crypt_[^\/]*?sell[^\/]*?\d\.exe$	2	0	0	1
+3626	3626	\/[A-F0-9]+$	2	0	0	1
+3627	3627	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+3628	3628	^[^\x22\x2f\r\n]+?\x22\r\n	2	0	0	1
+3629	3629	^[^&]+?&\d+$	2	0	0	1
+3630	3630	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3631	3631	^id=[A-Z0-9]+?&info=[A-Z0-9]+?$	2	0	0	1
+3632	3632	^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}	2	0	0	1
+3633	3633	^\x2F(policy|cache)$	2	0	0	1
+3634	3634	^(ode)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&h(wid)	2	0	0	1
+3635	3635	(\?|&)guid=[^!&]+?\!	2	0	0	1
+3636	3636	^\d+\d+?(&ver=\d+?)?&req=\d+?(&r=)?$	2	0	0	1
+3637	3637	^mac=([A-F0-9]{2}-){5}[A-F0-9]{2}&t1=	2	0	0	1
+3638	3638	\.((jp|pn)g|cgi|gif)\?tq=	2	0	0	1
+3639	3639	^\/[b-u][A-Za-z0-9]{6,25}\.php$	2	0	0	1
+3640	3640	^Last-Modified\x3a(\s[^\r\n]{2}|[^\r\n\s]{3}),	2	0	0	1
+3641	3641	^\d{5,}$	2	0	0	1
+3642	3642	\?[0-9a-f]{6}$	2	0	0	1
+3643	3643	\?ID=[A-Z]{10}$	2	0	0	1
+3644	3644	^[0-9A-F]{12,24}	2	0	0	1
+3645	3645	^\x2F[a-f0-9]{40,60}$	2	0	0	1
+3646	3646	\.cgi\?s(id)\d{1,12}&r=	2	0	0	1
+3647	3647	\/([^\x2f]+?\/)?[a-z-_]+?\.(php|html)$	2	0	0	1
+3648	3648	^\x2fimage\x2f[A-Za-z0-9\+_-]+\.jpg$	2	0	0	1
+3649	3649	\/\/?$	2	0	0	1
+3650	3650	^(\x3a\d{1,5})?$	2	0	0	1
+3651	3651	^(\x3a\d{1,5})?$	2	0	0	1
+3652	3652	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})$	2	0	0	1
+3653	3653	^[A-Za-z0-9]{48}\x3a([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})$	2	0	0	1
+3654	3654	\/0\/$	2	0	0	1
+3655	3655	^[^\x2f]+\/[a-z0-9]+$	2	0	0	1
+3656	3656	\/([a-z]{4,9}\/[a-z]{3,10}\?[a-z_]{2,9}=[0-9]{2,8}|[a-z]{10})&[a-z]{5,9}=[a-zA-Z0-9_*]{30,}$	2	0	0	1
+3657	3657	^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}_	2	0	0	1
+3658	3658	^\/lolo\/[0-9]+\/[0-9]+\/[0-9]+\/[0-9]+\.html$	2	0	0	1
+3659	3659	^\/log\/[0-9]+\/[0-9]+\/\?id=[0-9]+$	2	0	0	1
+3660	3660	^\/[\/a-z0-9]+$	2	0	0	1
+3661	3661	^\/\?\d([A-Za-z0-9~_]{4})*([A-Za-z0-9~_]{2}--|[A-Za-z0-9~_]{3}-|[A-Za-z0-9~_]{4})$	2	0	0	1
+3662	3662	^\/UID\d+\.jsp\?	2	0	0	1
+3663	3663	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+3664	3664	\.php\?id=[a-zA-Z]{15,}&?x=\d+&?os=[0-9.]+&?n=\d	2	0	0	1
+3665	3665	^[0-9A-F]{550,}\.html	2	0	0	1
+3666	3666	\/Setup_\d+\.exe$	2	0	0	1
+3667	3667	\?0=.*\&1=.*\&2=.*\&3=.*\&4=.*\&5=.*\&6=.*\&7=.*\&8=	2	0	0	1
+3668	3668	&ver=\d\.\d$	2	0	0	1
+3669	3669	^\/([A-Fa-f0-9]+|index\.php)$	2	0	0	1
+3670	3670	^(c(omment|_id)|m(jdu)?)=	2	0	0	1
+3671	3671	^\/1+$	2	0	0	1
+3672	3672	(MSIE|rv\x3a11)	2	0	0	1
+3673	3673	\/\d+\.png\?uid=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+3674	3674	&data=([a-z]\d){7,}$	2	0	0	1
+3675	3675	^([a-z]\d){7,}\.zip\x22	2	0	0	1
+3676	3676	(MSIE|rv\x3a11\.0)	2	0	0	1
+3677	3677	^\x2f[a-zA-Z]{4,}\x2ephp\x3f[a-zA-Z]{2,10}\x3d([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+	2	0	0	1
+3678	3678	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+3679	3679	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})$	2	0	0	1
+3680	3680	=0[0-2](&\w+=[a-fA-F0-9]{8}){2}&\w+=[a-fA-F0-9]+$	2	0	0	1
+3681	3681	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3682	3682	0[0-2]0000[a-fA-F0-9]{16,}$	2	0	0	1
+3683	3683	^\d+$	2	0	0	1
+3684	3684	^([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})+	2	0	0	1
+3685	3685	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+?$	2	0	0	1
+3686	3686	^\x5b[^\r\n]+\(64\s=\s\d\)\sEXE\s=	2	0	0	1
+3687	3687	^[a-zA-Z0-9+/]{43}	2	0	0	1
+3688	3688	^winver=\d+&ver=\d+$	2	0	0	1
+3689	3689	^\/\?0=([^&]+?&\d+)+?[^=&]+?$	2	0	0	1
+3690	3690	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+3691	3691	^[a-z]{2,}=(%[A-F0-9]{2})+&	2	0	0	1
+3692	3692	^[a-z]{2,}=(%[A-F0-9]{2})+&	2	0	0	1
+3693	3693	^\/[^\x2f]+\/0000[A-F0-9]{4}\/0[0-2]\/[A-F0-9]{8}$	2	0	0	1
+3694	3694	^\/0[0-2]\/[^\x2f]+\/0000[A-F0-9]{4}\/[^\x2f]+\/[A-F0-9]{8}$	2	0	0	1
+3695	3695	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]svchost\.exe[\x22\x27]\r\n	2	0	0	1
+3696	3696	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]explorer\.exe[\x22\x27]\r\n	2	0	0	1
+3697	3697	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]hkcmd\.exe[\x22\x27]\r\n	2	0	0	1
+3698	3698	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]server\.exe[\x22\x27]\r\n	2	0	0	1
+3699	3699	^\d+?\/(\d+?\/-?\d+?\.(php|jsp))?$	2	0	0	1
+3700	3700	\?uid=\d+&context=\w+&mode=text&data=\w+$	2	0	0	1
+3701	3701	^\/\d+$	2	0	0	1
+3702	3702	^\/sys\/(who|genid|data|upload|update)	2	0	0	1
+3703	3703	^a=(%[0-9A-Fa-f]{2})+\x26b=[0-9A-Za-z]+(%3[dD]){0,2}\x26c=(%[0-9A-Fa-f]{2})+$	2	0	0	1
+3704	3704	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3705	3705	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3706	3706	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3707	3707	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3708	3708	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+3709	3709	^\/[a-z]+\/[a-z]+\.exe$	2	0	0	1
+3710	3710	\.php\?uid=\d{5,6}&ver=[^&]+(&traff=\d+)?$	2	0	0	1
+3711	3711	^Host\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+3712	3712	^[a-z]{4,12}=([A-Za-z0-9+/]{4})*[A-Za-z0-9+/]{3}=&[a-z]{4,12}=[A-Za-z0-9+/]{4}	2	0	0	1
+3713	3713	\/0[0-2](\/[^\/]*?)?\/0000[a-fA-F0-9]{4}(\/[^\/]*?)?\/[a-fA-F0-9]{8}(\?\w+=[a-fA-F0-9]+)?$	2	0	0	1
+3714	3714	^http\x3a\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/[a-z_-]+\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r?$	2	0	0	1
+3715	3715	^[C-J]\r\n	2	0	0	1
+3716	3716	^[A-Z]+$	2	0	0	1
+3717	3717	^(32|64)$	2	0	0	1
+3718	3718	\/$	2	0	0	1
+3719	3719	^[a-f0-9]+(\x20[a-f0-9]+)+$	2	0	0	1
+3720	3720	^\/-?[a-f0-9]{8,9}\/-?\d+(\.php|\/)$	2	0	0	1
+3721	3721	&_=\d+$	2	0	0	1
+3722	3722	&_=\d+$	2	0	0	1
+3723	3723	&_=\d+$	2	0	0	1
+3724	3724	^User-Agent\x3a[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x30442e9d036a40c8cbd41f8f4c9afab1ba\x20no-cache\r\n(\r\n)?$	2	0	0	1
+3725	3725	^\d+$	2	0	0	1
+3726	3726	^[a-z]=[a-f0-9]{80,}$	2	0	0	1
+3727	3727	\/[a-f0-9]{32}\.png$	2	0	0	1
+3728	3728	&(un)?key=[A-Z]+$	2	0	0	1
+3729	3729	\.php\?pn=[^&]+&s=[0-9]+&x=0\.[0-9]{7}$	2	0	0	1
+3730	3730	^\/([a-z]{4,9}\/[a-z]{4,12}\?[a-z]{4,7}\=[0-9]{5,7})$	2	0	0	1
+3731	3731	^\/p\?\d+(\x3b\d+){4}$	2	0	0	1
+3732	3732	^\/s\?\d+\x3b\d+\x3b\d{1,2}\.\d_(32|64)_\d+(\x3b\d+){4}$	2	0	0	1
+3733	3733	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3734	3734	\/[a-f0-9]{8}\/archive\/\d{8,10}\.html$	2	0	0	1
+3735	3735	\?[0-9a-f]{5,}=\d+&id=\d+&v=\d+$	2	0	0	1
+3736	3736	iid=[a-fA-F0-9]{32}&kernel=	2	0	0	1
+3737	3737	iid=[a-fA-F0-9]{32}&username=	2	0	0	1
+3738	3738	^[a-z]{2}\x3d[a-z0-9]+?[A-F0-9]+?$	2	0	0	1
+3739	3739	^\x2F[a-z]\x2Ephp\x3Fp\x3D[a-z0-9]{30,}$	2	0	0	1
+3740	3740	^\x2Ftrack\x2F\x3Fip\x3D\d&data\x3D	2	0	0	1
+3741	3741	\/\d{5}\/(<s1>[a-z]{3})[a-z]\.php\?(=s1)_id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3742	3742	^filename=[a-z]+?\.[a-z]+?&data=	2	0	0	1
+3743	3743	^Host\x3a[^\r\n]+\r\n(Connection\x3a\x20Keep-Alive\r\n)?(\r\n)?	2	0	0	1
+3744	3744	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+3745	3745	^\x0a([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})\x0a	2	0	0	1
+3746	3746	_W\d+\.[A-F0-9]+\/\d+\/[^\x2f]+\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/$	2	0	0	1
+3747	3747	x20InfoPath\x2e\d[^\x29]+$	2	0	0	1
+3748	3748	\/\d{4,}\.txt$	2	0	0	1
+3749	3749	\/([a-z]+|\d+)\.jpg	2	0	0	1
+3750	3750	\?[a-z0-9]{32}$	2	0	0	1
+3751	3751	[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+3752	3752	\.[a-z]{3,4}$	2	0	0	1
+3753	3753	\/[A-Za-z]{4,9}\.dot$	2	0	0	1
+3754	3754	\/get(_new)?\.php\?[a-zA-Z]{4,}=0\.[0-9]{10,}&key=[a-zA-Z0-9]{4,}$	2	0	0	1
+3755	3755	\/get(_new)?\.php\?[a-zA-Z]{4,}=0\.[0-9]{10,}&key=[a-zA-Z0-9]{4,}&pdf=[a-zA-Z]{4,}$	2	0	0	1
+3756	3756	^\/document\.php\?rnd=[0-9]{4}&id=[A-F0-9]{100,}$	2	0	0	1
+3757	3757	\/0[0-2](\/[^\/]*?)?\/0000[a-fA-F0-9]{4}(\/[^\/]*?)?\/[a-fA-F0-9]{8}(\?\w+=[a-fA-F0-9]+)?$	2	0	0	1
+3758	3758	^[a-zA-Z]{4,}=0\.[0-9]{10,}&jndj=[a-zA-Z0-9]{4,}$	2	0	0	1
+3759	3759	^[a-zA-Z]{4,}=0\.[0-9]{10,}&jndj=[a-zA-Z0-9]{4,}&ncm=[a-zA-Z]{4,}$	2	0	0	1
+3760	3760	^\/[a-f0-9]+000[a-f0-9]{37}$	2	0	0	1
+3761	3761	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3762	3762	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P	2	0	0	1
+3763	3763	\.php\?check=\d$	2	0	0	1
+3764	3764	^tekst=\w+$	2	0	0	1
+3765	3765	^User-Agent\x3a MSIE \d+\.\d+\r\n	2	0	0	1
+3766	3766	\/libso\d{1,4}\.php\?id=[a-zA-Z0-9]+$	2	0	0	1
+3767	3767	\/[0-9]{2}\.exe\?[0-9]$	2	0	0	1
+3768	3768	^\/0[a-f0-9]{48}$	2	0	0	1
+3769	3769	path=[A-Z]\x3a\x5c[A-F0-9]+\r\nlog=	2	0	0	1
+3770	3770	^(Connection\x0d\x0a)?\x0d\x0a$	2	0	0	1
+3771	3771	^[a-z0-9]{10,}$	2	0	0	1
+3772	3772	\?sid=[a-f0-9]{40}&cid=[0-9]$	2	0	0	1
+3773	3773	[A-F0-9]{8}(-[A-F0-9]{4}){2}-[A-F0-9]{8}	2	0	0	1
+3774	3774	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3775	3775	\/[A-Za-z]+\.php\?((id|token1|token2|C)=[A-Za-z0-9\/=+%]*={0,2}&?){4}$	2	0	0	1
+3776	3776	^([a-zA-Z]*?\d)([a-z0-9]*?[A-Z])[a-zA-Z0-9+/]{30}	2	0	0	1
+3777	3777	^[a-z]{256}$	2	0	0	1
+3778	3778	^[abcdefghiklmnopqrstvxyz123456789]{62}\.aaaaaaaaaaaa	2	0	0	1
+3779	3779	^(Connection\x3a[^\r\n]+\r\n)?Accept\x3a[^\r\n]+\r\n(Accept-Encoding\x3a[^\r\n]+\r\n)?Accept-Language\x3a[^\r\n]+\r\n(Referer\x3a[^\r\n]+[^\r\n]*?\r\n)?User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)	2	0	0	1
+3780	3780	\.php\?lid=[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$	2	0	0	1
+3781	3781	^[A-F0-9]{2}F4[A-F0-9]{2}0(1|2|3)[A-F0-9]{8}	2	0	0	1
+3782	3782	&m=\d$	2	0	0	1
+3783	3783	^[a-f0-9]{31}\x3B([a-zA-Z0-9+/=]+)?\r?$	2	0	0	1
+3784	3784	\?q=[a-f0-9]{32}$	2	0	0	1
+3785	3785	^(<id>[a-z])\x22\sname=\x22(=id)\x22>TVqQAA	2	0	0	1
+3786	3786	^version=\d{4}-\d{1,2}-\d{1,2}$	2	0	0	1
+3787	3787	[\x80-\xff]	2	0	0	1
+3788	3788	(xyz|pw)$	2	0	0	1
+3789	3789	^[A-Z0-9_-]+\.analytics-akadns\.com$	2	0	0	1
+3790	3790	^[A-Z0-9_-]+\.akamai-analytics\.com$	2	0	0	1
+3791	3791	^[A-Z0-9_-]+\.akamai-information\.com$	2	0	0	1
+3792	3792	^[A-Z0-9_-]+\.akamai-technologies\.com$	2	0	0	1
+3793	3793	^[A-Z0-9_-]+\.sync-akamai\.com$	2	0	0	1
+3794	3794	^\/[^\r\n]+\.php\?[a-f0-9]{32}(=(%3D|\x3d)*[A-Za-z0-9%\/]+&[a-f0-9]{32}){4,}=(%3D|\x3d)*[A-Za-z0-9%\/]+$	2	0	0	1
+3795	3795	^.{0,15}[^\x20-\x7e\r\n]	2	0	0	1
+3796	3796	\?---[A-Z]$	2	0	0	1
+3797	3797	^\/help(me)?\.bmp$	2	0	0	1
+3798	3798	\/[a-z0-9]{16}\.php\?ufw=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3799	3799	(BrowsingHistoryView|WebBrowserPassView)\.exe$	2	0	0	1
+3800	3800	[\x80-\xff]	2	0	0	1
+3801	3801	\.php\?a=\d{5,10}.+\x3a\d\x3a\d\x3a\d\.\d\x3a\d$	2	0	0	1
+3802	3802	=8ACEFC[0-9A-F]{150,}$	2	0	0	1
+3803	3803	\?[a-f0-9]{32}$	2	0	0	1
+3804	3804	^ps0=[A-F0-9]+\&ps1=[A-F0-9]+($|\&[a-z]s\d=)	2	0	0	1
+3805	3805	\.php\?computerid=[a-fA-F0-9]{32}&(public|private)=\d$	2	0	0	1
+3806	3806	^[^_]+_[^\_]+_[A-F0-9]{10}_[0-9]{2}-[0-9]{2}-20[0-9]{2}\s[0-9]{1,2}\.[0-9]{1,2}\.[0-9]{1,2}\.	2	0	0	1
+3807	3807	\/(tr(_w)?|ft)\.so$	2	0	0	1
+3808	3808	^([a-zA-Z0-9+/\x20]{4})*([a-zA-Z0-9+/\x20]{2}==|[a-zA-Z0-9+/\x20]{3}=|[a-zA-Z0-9+/\x20]{4})$	2	0	0	1
+3809	3809	^\/v\d+\/lady_[ix]	2	0	0	1
+3810	3810	\/(IUpdate|fbclient|IETask|Mixeds|Ubuntu10)\.dll$	2	0	0	1
+3811	3811	\?action=\d(&botId=[A-F0-9]{32})?$	2	0	0	1
+3812	3812	^[^&]+?\.html\?s=[^&]+?&d=$	2	0	0	1
+3813	3813	\/victim\.php\?info=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&ip=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3814	3814	\/savekey\.php\?file=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3815	3815	\/images\/.*_2[FB].*\.(avi|gif|bmp|jpeg|png)$	2	0	0	1
+3816	3816	^[A-F0-9]{8}$	2	0	0	1
+3817	3817	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a)?	2	0	0	1
+3818	3818	^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$	2	0	0	1
+3819	3819	^\/kb\/\d{4,8}$	2	0	0	1
+3820	3820	\.[a-z]{3}\?[a-z]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3821	3821	^[a-zA-Z]{7}=([A-Za-z0-9+/]|%2[FB]){2}AAAA[a-z]A[^\s=]+=?$	2	0	0	1
+3822	3822	END\x20CERTIFICATE-----$	2	0	0	1
+3823	3823	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+3824	3824	^get=\d+($|&)	2	0	0	1
+3825	3825	^(Mozilla\/|Shockwave)	2	0	0	1
+3826	3826	=11&[^&]{1,7}2[^&]{6,12}&[^&]{1,7}410&[^&]{1,7}650&[^&]{1,7}51$	2	0	0	1
+3827	3827	(\x20MSIE\x20|rv\x3a11)	2	0	0	1
+3828	3828	^id=[0-9A-Z]+&count=	2	0	0	1
+3829	3829	^guid=[^&]+?&ver=[^&]+?(&fc=[^\r\n]+)?$	2	0	0	1
+3830	3830	\.php\?rid=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3831	3831	^machine=[^&]+$/Pi	2	0	0	1
+3832	3832	\.(arm(5n|7)?|m(ips|psl))$	2	0	0	1
+3833	3833	[a-z]+\.php\?aid=\d+&sid=[a-z0-9]+$	2	0	0	1
+3834	3834	^\/oscp\/[a-z]+$	2	0	0	1
+3835	3835	\/(countdown|check)\/[a-f0-9]{30,45}\/([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})?$	2	0	0	1
+3836	3836	\.php\?key=[^\r\n]+&string=[^\r\n]+?(\x3a\x3a[^\x3a]+?){5,}$	2	0	0	1
+3837	3837	\.php\?key=[^\r\n]+&string=[^\r\n]+?((\x3a\x3a|3A3A)[^\x3a]+?){5,}$	2	0	0	1
+3838	3838	^((Passwords|PCinformation)\.txt|(Data|GrabbedTxtFiles)\.zip)\x22\r\n	2	0	0	1
+3839	3839	\/[a-z]+2\.php\?jpg=[^&]+$	2	0	0	1
+3840	3840	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$	2	0	0	1
+3841	3841	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$	2	0	0	1
+3842	3842	\.php\?Hwid=[^&]+[0-9](&(Pc|Etat)=[^&]+)?(&user=[^&]+&Ip=[^&]+&Ping=[^&]+&v=[^&]+&Ville=[^&]+&Pays=[^&]+&Region=[^&]+)?$	2	0	0	1
+3843	3843	\.php\?[a-z]{3,8}=[a-f0-9]{16}[01][a-z]+$	2	0	0	1
+3844	3844	^((a((lbu|d)m|ccount|uthor)|c(ont(ac|en)|lien)t|p(artners|hoto)|(memb|us)er|session|video|hash|key|id)=[a-z0-9]{6,12}&){4}	2	0	0	1
+3845	3845	\.(aspx|txt)\?[a-z0-9]{3}=[a-f0-9]{32}&[a-z0-9]{3}=[^&]+&[a-z0-9]{3}=[a-f0-9]{32}$	2	0	0	1
+3846	3846	\.php\?string=[a-zA-Z0-9+=]+$	2	0	0	1
+3847	3847	^([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})$	2	0	0	1
+3848	3848	^c=[A-F0-9]{10,}&v=[^&]+&h=[^&]+&t=[0-9]$	2	0	0	1
+3849	3849	^([a-f0-9]{30,60})$	2	0	0	1
+3850	3850	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3851	3851	\x26affid\x3D[0-9]{4,7}$	2	0	0	1
+3852	3852	[\x80-\xff]{16}	2	0	0	1
+3853	3853	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+3854	3854	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}	2	0	0	1
+3855	3855	^[0-9a-f]{4,8}\x3d\x2d?\d+(&id\x3d\d+)?$	2	0	0	1
+3856	3856	^[A-Z0-9]{18}$	2	0	0	1
+3857	3857	^[a-z]{3,4}\x2F[a-f0-9]{24}$	2	0	0	1
+3858	3858	^\/[a-z0-9]{1,10}\/?\?.+?$	2	0	0	1
+3859	3859	\/[a-z0-9A-Z]\.exe$	2	0	0	1
+3860	3860	^\d+$	2	0	0	1
+3861	3861	^\d+$	2	0	0	1
+3862	3862	^\/[a-z0-9+\/=]{16,400}$	2	0	0	1
+3863	3863	&s=\{?[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}\}?(&|$)	2	0	0	1
+3864	3864	^(cache|logs)\/[^\x2f]+\.(exe|dll|doc|bin)$	2	0	0	1
+3865	3865	^\/[a-z0-9.&-]+([a-z0-9]{4}-){3}[a-z0-9.&+-]+$	2	0	0	1
+3866	3866	=\d+$	2	0	0	1
+3867	3867	\/[A-Z0-9]+\.[aj]sp\?[a-zA-Z0-9+/\x20=]+$	2	0	0	1
+3868	3868	\.php\?w=\d+&i=[0-9a-f]{32}&a=\d+$	2	0	0	1
+3869	3869	\?action=\w+gen&v=\d	2	0	0	1
+3870	3870	\/counter(\?[a-z]?\d{1,2}|[^\x2f]*\d\.exe|.*?[]([A-Za-z_-]{0,200}[0-9][A-Za-z_-]{0,200}[0-9])([A-Z0-9_-]{0,200}[a-z][A-Z0-9_-]{0,200}[a-z])([a-z0-9_-]{0,200}[A-Z][a-z0-9_-]{0,200}[A-Z])[A-Za-z0-9_-]{50,}(&|$)	2	0	0	1
+3871	3871	^[^\r\n]+\.(jpe?g|gif|png)\r\n	2	0	0	1
+3872	3872	^\/report[0-9]?_(v[0-9])?[A-Z]?[A-F0-9_-]+_[0-9]{1,3}_(st(arted|ep)|already|mark|p(rocess|a(ge|yload))|watch2|http|image|gdiplus|crc|DIRRR|finished|(ex(cept|ecuted)))	2	0	0	1
+3873	3873	\/[a-z]+\.php\?[A-F0-9]{250,}$	2	0	0	1
+3874	3874	^Accept\x3a\x20text\/\*,\x20application\/\*\r\nUser-Agent\x3a\x20[^\r\n]+\r\n(Pragma|Cache-Control)\x3a\x20no-cache\r\nConnection\x3a Keep-Alive\r\nHost\x3a[^\r\n]+?\r\n(\r\n)?$	2	0	0	1
+3875	3875	^[A-F0-9]{250,}$	2	0	0	1
+3876	3876	^\d+?$	2	0	0	1
+3877	3877	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3878	3878	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}	2	0	0	1
+3879	3879	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3880	3880	^\/debug\/trace\/(Fw(Downloaded|Check)|N(oFw|sis))$	2	0	0	1
+3881	3881	^\/[a-z]+\.php\?num=\d+&rev=	2	0	0	1
+3882	3882	^[A-Za-z0-9]{14,15}$	2	0	0	1
+3883	3883	^\d{2}$	2	0	0	1
+3884	3884	\.php\?v\x3d\d+?\x26rs\x3d((\d+?\x2d){3})?\d+?\x26n\x3d\d	2	0	0	1
+3885	3885	^(<vname>[^\r\n\x3a]+)(<n1>[0-4])\x3a\x20\d+\r\n(=vname)(<n2>(((=n1))[0-4]))\x3a\x20\d+\r\n(=vname)(<n3>((((=n1)|(=n2)))[0-4]))\x3a\x20\d+\r\n(=vname)((((=n1)|(=n2)))[0-4])\x3a\x20\d+\r\n	2	0	0	1
+3886	3886	\/counter\/\?id=[A-Z0-9_-]{60,}&rnd=\d{1,}$	2	0	0	1
+3887	3887	^[0-9a-f]{32}\.php	2	0	0	1
+3888	3888	^[A-F0-9]{30}	2	0	0	1
+3889	3889	^[a-f0-9]{24}$	2	0	0	1
+3890	3890	^\x00\x00\x00[\x72-\x74]	2	0	0	1
+3891	3891	(\d{1,3}\.){3}\d{1,3} (\d{1,3}\.){3}\d{1,3} \x3a(Linux|FreeBSD|SunOS)	2	0	0	1
+3892	3892	^\d+[\x22\x27]	2	0	0	1
+3893	3893	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3894	3894	^[0-9]{2,3}\x00\x6c\x6c(<var>[\x20-\x2f\x30-\x39\x3a-\x40\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x5b-\x60\x7b-\x7e])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(=var)[^\r\n]+(=var)$	2	0	0	1
+3895	3895	^(-[0-9]+|[A-F0-9]{32})=1&type=txt$	2	0	0	1
+3896	3896	^([a-f0-9]{2}-){5}[a-f0-9]{2}	2	0	0	1
+3897	3897	^[a-f0-9]{18}\x22	2	0	0	1
+3898	3898	^(<id>[a-z])\x22\sname=\x22(=id)\x22>[a-zA-Z0-9+/=]{28}	2	0	0	1
+3899	3899	^[A-Za-z0-9]{10,}[\-\)\(]{1,2}	2	0	0	1
+3900	3900	data=[a-zA-Z0-9\+\/]{64}/P	2	0	0	1
+3901	3901	<root><clnt>\d{8}-\d{4}-\d{4}-\d{4}-[0-9A-F]{12}</clnt><code>CheckUpdate</code>/P	2	0	0	1
+3902	3902	\d{2}\x7C\d{1,3}\x7C\d{1,3}http\x3A\x2F\x2F	2	0	0	1
+3903	3903	^X-ID\x3a\x20\d+\r?$/Hm	2	0	0	1
+3904	3904	\/ff\.ie\?rnd=\x2d?\d	2	0	0	1
+3905	3905	c=[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}	2	0	0	1
+3906	3906	^.{2}(<fake_org>([asdfgh]+|[qwerty]+|[zxcvbn]+|[23werf]+)[01]).+?\x06\x03\x55\x04\x0a.{2}(=fake_org)	2	0	0	1
+3907	3907	^\d{1,6}\x00msg\x7c	2	0	0	1
+3908	3908	^\/counter\/\?([a-z]=(0\.\d{8}|1[A-Z0-9a-z]+))+&r=\d+$	2	0	0	1
+3909	3909	[^A-Za-z0-9+/]TVqQA	2	0	0	1
+3910	3910	\/im(age|g)\.php\?id=\d+$	2	0	0	1
+3911	3911	^.{1,1000}p([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?o([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?w([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?r([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?s([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?h([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l	2	0	0	1
+3912	3912	^(-[0-9]+|[A-F0-9]{32})=1$	2	0	0	1
+3913	3913	^([a-z0-9]{0,19}[A-Z])(([A-Z0-9]{0,19}[a-z])|([A-Za-z]{0,19}\d)|([A-Z]+\.))[a-zA-Z0-9]{3,20}[\x2e\x20][a-z]{2,3}$	2	0	0	1
+3914	3914	^.{0,15}[^\x20-\x7e\r\n]	2	0	0	1
+3915	3915	^\d{30}\w{6}-\d{2}-\d{3}-\d{9}$	2	0	0	1
+3916	3916	(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3917	3917	^[a-zA-Z0-9/+]{171}=	2	0	0	1
+3918	3918	ms-?office	2	0	0	1
+3919	3919	^(Connection\r\n)?\r\n$	2	0	0	1
+3920	3920	^(Connection\r\n)?\r\n$	2	0	0	1
+3921	3921	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3922	3922	^[0-9]+lu[0-9]+d[0-9]+$	2	0	0	1
+3923	3923	^[a-f0-9]{16}$	2	0	0	1
+3924	3924	^[a-z0-9_\/+-]{1000}	2	0	0	1
+3925	3925	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3926	3926	^\d{4,8}$	2	0	0	1
+3927	3927	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3928	3928	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3929	3929	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3930	3930	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3931	3931	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3932	3932	^[\x00-\x01]\x00.\x00[\x00-\x01]\x00.\x00.{4}\x01\x00.\x00{3}.{48}\x05\x00{3}	2	0	0	1
+3933	3933	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3934	3934	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3935	3935	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3936	3936	^[\x00-\x01]\x00.\x00[\x00-\x01]\x00.\x00.{4}\x01\x00.\x00{3}.{48}\x05\x00{3}	2	0	0	1
+3937	3937	^Host\x3a\x20[^\r\n]+\r\n(Connection\x3a\x20Keep-Alive\r\n)?(\r\n)?$	2	0	0	1
+3938	3938	^(WOW64\x3b\s)?Trident\/[457]\.0\x3b\s*SLCC2\x3b\s\.NET\sCLR\s2\.0\.50727\x3b\s\.NET\sCLR\s3\.5\.30729\x3b\s(\x20\.NET\x20CLR\x203\.5\.30729\x3b\s)?\.NET\sCLR\s3\.0\.30729\x3b\sMedia\sCenter\sPC\s6\.0\x3b\s\.NET4\.0C\x3b\s\.NET4\.0E(\.NET4\.0E(\x3b\s)?)?(\x3b\sInfoPath\.3)?\)$	2	0	0	1
+3939	3939	^[a-z0-9]+\.(biz|com|net|org)	2	0	0	1
+3940	3940	\/wp-(content|admin|includes)\/	2	0	0	1
+3941	3941	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3942	3942	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3943	3943	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3944	3944	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3945	3945	^[A-Za-z0-9\/\-\+]{40,}\.=auth\.	2	0	0	1
+3946	3946	^[A-Za-z0-9\/\-\+]{10,}\.=connect\.	2	0	0	1
+3947	3947	^[A-Za-z0-9\/\-\+]{10,}AAAA--\.	2	0	0	1
+3948	3948	^[A-Z]{2}-[0-9]{1,5}\x3aEnd(\x3a[0-9]{1,5})?$	2	0	0	1
+3949	3949	^[a-z0-9]{8}	2	0	0	1
+3950	3950	^(\d{1,3}\.)\d{1,3}$	2	0	0	1
+3951	3951	^\/[a-z]\.php\?query=[a-f0-9]{32}$	2	0	0	1
+3952	3952	^[A-F0-9]{50,}$	2	0	0	1
+3953	3953	^([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=|[A-Z0-9+\/]{4})$	2	0	0	1
+3954	3954	^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$	2	0	0	1
+3955	3955	^data=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3956	3956	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+3957	3957	^(<js>\$[a-z0-9]{1,15})\s*=\s*\[System\.Text\.Encoding\]::ASCII\.GetString\(\[System\.Convert\]::FromBase64String\((=js)\)\)\s*Set-Content\s*(-Path\s*C:\\Windows\\Temp\\[a-z0-9]{1,15}\.[a-z0-9]{2,4}\s*|-Value\s*(=js)\s*|-Encoding\s*ASCII){3}	2	0	0	1
+3958	3958	^(<content>\[a-z0-9]{1,15})\s*=\s*\[System\.Convert\]::FromBase64String\(\$[a-z0-9]{1,15}\)\s*Set-Content\s*(-Path\s*C:\\Windows\\Temp\\[a-z0-9]{1,15}\.vbe\s*|-Value\s*(=content)\s*|-Encoding\s*Byte){3}	2	0	0	1
+3959	3959	^[a-zA-Z0-9\x21\x2a\x2f\x2e\x3b\x3a\x5b\x5d\x7b\x7d]+$	2	0	0	1
+3960	3960	^[0-9]{3,5}\s*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+3961	3961	^[a-z0-9]{3,10}$	2	0	0	1
+3962	3962	^[a-z0-9]{5,30}$	2	0	0	1
+3963	3963	^\d{3,15}$	2	0	0	1
+3964	3964	^\/([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3965	3965	^[a-z]{3,10}=[a-z0-9]+$	2	0	0	1
+3966	3966	^[a-z]{3,10}=[a-z0-9]+$	2	0	0	1
+3967	3967	^[a-z]{3,10}=[a-z0-9]+$	2	0	0	1
+3968	3968	^\.(space|press|website)$	2	0	0	1
+3969	3969	^\/hyllkjit\/[a-f0-9]{8}\/\?n=\d{4,10}$	2	0	0	1
+3970	3970	^9([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3971	3971	^(\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?<pushvar>\.push\x28\x22)(\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)([\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)([\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)	2	0	0	1
+3972	3972	^lessie(\/[0-9]\.0)?$	2	0	0	1
+3973	3973	^Cakle(\/[0-9]\.0)?$	2	0	0	1
+3974	3974	^Damien(\/[0-9]\.0)?$	2	0	0	1
+3975	3975	^Solar(\/[0-9]\.0)?$	2	0	0	1
+3976	3976	^muhstik(-scan)?(\/[0-9]\.0)?$	2	0	0	1
+3977	3977	^Shaolin(\/[0-9]\.0)?$	2	0	0	1
+3978	3978	^Rift(\/[0-9]\.0)?$	2	0	0	1
+3979	3979	^Tsunami(\/[0-9]\.0)?$	2	0	0	1
+3980	3980	^Yowai(\/[0-9]\.0)?$	2	0	0	1
+3981	3981	^Yakuza(\/[0-9]\.0)?$	2	0	0	1
+3982	3982	^Hentai(\/[0-9]\.0)?$	2	0	0	1
+3983	3983	\/[A-Za-z0-9]{2,8}[-_][a-zA-Z0-9-_]+\/\?InvoiceType=Regular&date=[0-9-_]+$	2	0	0	1
+3984	3984	^[A-F0-9]+\x2d\x2d\x3e(\r\n)?$	2	0	0	1
+3985	3985	^CN=(help|g(ui(de|ld)|round))\.domainoutlet\.site$	2	0	0	1
+3986	3986	^CN=((jasper|qwe|alter|car|param|bike|genwar)\.)?drivethrough\.top$	2	0	0	1
+3987	3987	^CN=((justin|digest)\.)?drinkeatgood\.space$	2	0	0	1
+3988	3988	^\d	2	0	0	1
+3989	3989	^\/[a-zA-Z0-9]{1,19}\/?\?[abdefijhgv\x22](\x7C\x2d?\d+?[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\%^&\(\)\x20_{}\.~]{1,14})?$	2	0	0	1
+3990	3990	^\/(<n>\d)(=n){1,2}$	2	0	0	1
+3991	3991	\/\d+$	2	0	0	1
+3992	3992	^\/[a-f0-9]{7,8}\/[a-f0-9]{7,8}\/$	2	0	0	1
+3993	3993	^GET\x20\/[A-F0-9]{32}\x20HTTP\/1\.1\r\nHost\x3a\x20[^\r\n]+\r\n\r\n$	2	0	0	1
+3994	3994	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3995	3995	_[A-F0-9]{12}\.jpg$	2	0	0	1
+3996	3996	_[A-F0-9]{12}&filename=\w{1,20}\.jpg$	2	0	0	1
+3997	3997	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+3998	3998	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+3999	3999	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+4000	4000	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4001	4001	^[0-9]{3}$	2	0	0	1
+4002	4002	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4003	4003	^.+(IlR5cGUiO|JUeXBlIj|iVHlwZSI6)	2	0	0	1
+4004	4004	\.jpg\?v=\d+&d=(\d{8}T\d{6}Z)([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+4005	4005	^\/[^\x2f]+\/pops[a-z]?\.php$	2	0	0	1
+4006	4006	\.php\?s=\d+&cn=	2	0	0	1
+4007	4007	^[a-z]{4,10}\.freemooon\.org$	2	0	0	1
+4008	4008	[a-z]{4,10}\.olimpian\.org$	2	0	0	1
+4009	4009	[a-z]{4,10}\.sunsay\.biz$	2	0	0	1
+4010	4010	[a-z]{4,11}\.feellgood\.org$	2	0	0	1
+4011	4011	[a-z]{4,11}\.kinomix\.org$	2	0	0	1
+4012	4012	[a-z]{4,10}\.beneton\.biz$	2	0	0	1
+4013	4013	[a-z]{4,10}\.bigdoggi\.biz$	2	0	0	1
+4014	4014	[a-z]{4,10}\.bjksfohseaguu\.org$	2	0	0	1
+4015	4015	[a-z]{4,10}\.closedoors\.net$	2	0	0	1
+4016	4016	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4017	4017	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4018	4018	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4019	4019	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4020	4020	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$	2	0	0	1
+4021	4021	^(www|bbs|cms|down|up|file|ftp)	2	0	0	1
+4022	4022	\/log\/proc\.php.key=[a-z0-9]{11}	2	0	0	1
+4023	4023	code=[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}	2	0	0	1
+4024	4024	x=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+4025	4025	mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+4026	4026	^RAV\d\.\d\d	2	0	0	1
+4027	4027	^([a-z0-9:.,]{3,10}\s){50,}[a-z0-9:.,]{3,10}\s*$	2	0	0	1
+4028	4028	^[a-zA-Z0-9]{20}	2	0	0	1
+4029	4029	\x2E(p(hp|ng)|jpe?g|cgi|gif)\x3F(v\d{1,2}|pr)\x3D	2	0	0	1
+4030	4030	\/\?rnd=\d+&id=\d+$	2	0	0	1
+4031	4031	port=[1-9]{1,5}	2	0	0	1
+4032	4032	\/getfile\.php\?r=-?\d+&p=	2	0	0	1
+4033	4033	\/manda\.php\?id=(-)?\d{8,10}&v=\w	2	0	0	1
+4034	4034	\/\?id(\d+)?&rnd=\d+$	2	0	0	1
+4035	4035	\.php\?hdr_ctx=[0-9]{1,5}_[0-9]{1,5}$	2	0	0	1
+4036	4036	^\/\d+\.functions$	2	0	0	1
+4037	4037	\/\d{10}$	2	0	0	1
+4038	4038	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4039	4039	^[A-F0-9]{100,}$	2	0	0	1
+4040	4040	^\d	2	0	0	1
+4041	4041	^\/[a-z-_]+?\.(php|html)$	2	0	0	1
+4042	4042	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4043	4043	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+4044	4044	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4045	4045	^data=[a-zA-Z0-9+\/]{64}	2	0	0	1
+4046	4046	^\d{4}$	2	0	0	1
+4047	4047	\.(jpg|png|gif)\?v[0-9]{1,2}=[0-9]+&tq=	2	0	0	1
+4048	4048	^\/[mp]od[12]\/[^\/]+?\.exe$	2	0	0	1
+4049	4049	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4050	4050	\/[0-9]{2}\.exe$	2	0	0	1
+4051	4051	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+4052	4052	[\x80-\xff]	2	0	0	1
+4053	4053	\.(me|net)$/W	2	0	0	1
+4054	4054	\/[A-Z]?[a-z]{1,3}[0-9]?\.exe$	2	0	0	1
+4055	4055	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4056	4056	^[a-z]\.	2	0	0	1
+4057	4057	^((malwarehuntertea|nomoreranso)m|politiaromana|ransomware|carder)\.(bit|coin)$	2	0	0	1
+4058	4058	^((malwarehuntertea|nomoreranso)m|politiaromana|ransomware|carder)\.(bit|coin)$	2	0	0	1
+4059	4059	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4060	4060	^m=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+4061	4061	^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$	2	0	0	1
+4062	4062	\/[0-9]{10}.php1$	2	0	0	1
+4063	4063	^[A-F0-9]{10,}(BBZ|BBY)[A-F0-9]{,1000}$	2	0	0	1
+4064	4064	^[A-F0-9]{10,}$	2	0	0	1
+4065	4065	^[A-F0-9]{10,}$	2	0	0	1
+4066	4066	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+4067	4067	^\/d[0-9]?\.php\?check$	2	0	0	1
+4068	4068	^\/d[0-9]?\.php\?servers$	2	0	0	1
+4069	4069	^\/[a-z]\.php\?check=[a-f0-9]{32}$	2	0	0	1
+4070	4070	^[a-f0-9]{8}$	2	0	0	1
+4071	4071	\.aspx\?m=[A-F0-9]{3,40}&i=[A-F0-9]{3,40}&p=[A-F0-9]{3,40}$	2	0	0	1
+4072	4072	^([\x3a\x2c\x2e]?[A-Za-z0-9]{1,8}[\x3a\x2c\x2e]?[\x3a\x2c\x2e]?\s*){50,}$	2	0	0	1
+4073	4073	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4074	4074	^[a-z]{1,10}=[A-Z]+(&[a-z]{1,10}=[A-Z]+){2,}$	2	0	0	1
+4075	4075	^[A-F0-9]{16}$	2	0	0	1
+4076	4076	\/rpt\d	2	0	0	1
+4077	4077	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4078	4078	^\/fbot\.arm\d{1}\.u$	2	0	0	1
+4079	4079	^\/[A-F0-9]{30,60}\/1\/0\/0$	2	0	0	1
+4080	4080	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4081	4081	^[A-F0-9]+$	2	0	0	1
+4082	4082	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+4083	4083	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+4084	4084	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+4085	4085	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+4086	4086	^[a-z0-9\-\.]{1,60}\.ssmailer\.com$	2	0	0	1
+4087	4087	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4088	4088	^[a-z]=[a-f0-9]{80,}$	2	0	0	1
+4089	4089	^Mozilla\/\d+\.\d+\x20\x28compatible\x3b\x20MSIE\x20\d+\.\d+\x3b\x20Windows\x20NT\x20\d+\.\d+\x3b\x20SV1\x29$	2	0	0	1
+4090	4090	^php.{0,500}[\x80-\xff]	2	0	0	1
+4091	4091	^[a-zA-Z0-9_-]{2,6}=[a-zA-Z0-9_-]+(\x3b\x20[a-zA-Z0-9_-]{2,6}=[a-zA-Z0-9_-]+){1,6}={0,2}?$	2	0	0	1
+4092	4092	^[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(&[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$	2	0	0	1
+4093	4093	^[A-F0-9]{8}_[A-F0-9]{8}\.sql	2	0	0	1
+4094	4094	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+4095	4095	\/[a-z-_]{75,}\.php$	2	0	0	1
+4096	4096	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4097	4097	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4098	4098	^[^\x20-\x7e\r\n]{2}$	2	0	0	1
+4099	4099	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+4100	4100	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4101	4101	^\/\?([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4102	4102	^[a-zA-Z0-9=/&?\x2e-]+$	2	0	0	1
+4103	4103	^\d{5,10}$	2	0	0	1
+4104	4104	^[a-z0-9/%=]{100,}$	2	0	0	1
+4105	4105	\/[a-z0-9]+\/[a-z0-9]+\.exe$	2	0	0	1
+4106	4106	^[a-zA-Z0-9]+$	2	0	0	1
+4107	4107	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[A-Za-z]+?	2	0	0	1
+4108	4108	^.([a-z0-9+/]*?[A-Z])([A-Z0-9+/]*?[a-z])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\.29a\.de$	2	0	0	1
+4109	4109	(^|\.)en-content\.com$	2	0	0	1
+4110	4110	ch=1$	2	0	0	1
+4111	4111	^\/\?ptrxcz_[a-z0-9A-Z]{30}$	2	0	0	1
+4112	4112	[a-z]{2}\.CAB.bin	2	0	0	1
+4113	4113	\.php\?(print_)?receipt=(s00|\d{3})_\d+$	2	0	0	1
+4114	4114	^sleep \d+[\r\x2c]	2	0	0	1
+4115	4115	\.php\?id=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}&os=\d\.\d[^&]*&bot_id=	2	0	0	1
+4116	4116	\.php\?id=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}-(\d{1,3}\.){3}\d{1,3}&gr	2	0	0	1
+4117	4117	\(b\x3a\d+?\x3bc\x3aAMD-	2	0	0	1
+4118	4118	\(b\x3a\d+?\x3bc\x3aINT-	2	0	0	1
+4119	4119	^\/uploading\/id=\d{2,20}&u=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4120	4120	user=[a-f0-9]{31,32}&	2	0	0	1
+4121	4121	^$	2	0	0	1
+4122	4122	\/gate\.php\?reg=([a-z]{10}|[A-Za-z]{15})$	2	0	0	1
+4123	4123	\(b\x3a\d+?\x3bc\x3a[^\x3b]+AuthenticAMD\x3b	2	0	0	1
+4124	4124	\(b\x3a\d+?\x3bc\x3a[^\x3b]+GenuineIntel\x3b	2	0	0	1
+4125	4125	\?hostid=[0-9A-F]+?&	2	0	0	1
+4126	4126	^\/[a-z0-9]{3,}\/upload\/img\.jpg$	2	0	0	1
+4127	4127	\.php\?[a-zA-Z0-9]+[a-zA-Z0-9]+?&[a-zA-Z0-9]+([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4})(&[a-zA-Z0-9]+[a-f0-9]{32}){2}$	2	0	0	1
+4128	4128	\.php\?ver=\d\&cver=\d\&id=\d{5}$	2	0	0	1
+4129	4129	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4130	4130	^\x2Flts\x2Etxt$	2	0	0	1
+4131	4131	\/\d\d[A-F0-9]{4}0000\/log$	2	0	0	1
+4132	4132	\/[a-z]{2,3}\/(\d{3,4}x\d{3,4}|default)\.bmp\.gz$	2	0	0	1
+4133	4133	\/cp\/\?(logo\.jpg|adm)	2	0	0	1
+4134	4134	\x2Fping\x2Ehtml\x3Fr\x3D[0-9]{5,14}$	2	0	0	1
+4135	4135	^g=[A-Z0-9]+&cmd=	2	0	0	1
+4136	4136	&arg2=(([a-f0-9]{32})|([A-Za-z0-9\x2b\x2f]{4})*([A-Za-z0-9\x2b\x2f]{2}==|[A-Za-z0-9\x2b\x2f]{3}=|[A-Za-z0-9\x2b\x2f]{4}))(&|$)	2	0	0	1
+4137	4137	filename=[a-f0-9]{13}\.file\r\n	2	0	0	1
+4138	4138	\/monitor\.php\?resp=ID\x3a[A-Za-z]{15}	2	0	0	1
+4139	4139	\/gate\.php\?cmd=(get(installconfig|exe)|urls)$	2	0	0	1
+4140	4140	\.php\?(q|name)=	2	0	0	1
+4141	4141	^\x2F(acheb|bajree|cyacrin|dauber|eaves)\x2Easpx\x3FRandom\x3D[a-z]{16}$	2	0	0	1
+4142	4142	^\/201\d{5,8}\/\d{6,11}\/\d{5,10}\.jsp$	2	0	0	1
+4143	4143	\.php\?a1=\d+&a2=([0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}|([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4}))(&a\d+=[^&]+)+$	2	0	0	1
+4144	4144	&HD=[A-F0-9]{32}&	2	0	0	1
+4145	4145	&id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&os=	2	0	0	1
+4146	4146	\.asp\?MAC=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&VER=[^&]+$	2	0	0	1
+4147	4147	\/log\?(start|install)\x7caid=	2	0	0	1
+4148	4148	\.php\?user=[a-f0-9]{32}&id=\d+&type=\d+($|&)	2	0	0	1
+4149	4149	^\/post\.aspx\?[^&]+=[0-9]{9,10}$	2	0	0	1
+4150	4150	^\/j\/[a-f0-9]{8}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{12}\/0001\/?$	2	0	0	1
+4151	4151	^\x2Fel\x2Fsregister\x2Ephp\x3Fname\x3D[a-f0-9]{32}$	2	0	0	1
+4152	4152	^\x2Fel\x2Fslogin\x2Ephp\x3Fuid\x3D[a-f0-9]{32}$	2	0	0	1
+4153	4153	\.php\?m=[A-F0-9]{12}	2	0	0	1
+4154	4154	&rvz1=\d+&rvz2=\d+?$	2	0	0	1
+4155	4155	^\/getc(loud|onf)\/\?c=	2	0	0	1
+4156	4156	^\/home\/index\.asp\?typeid=(1[13]?|[3579])$	2	0	0	1
+4157	4157	\/tasksz\.php\?(dc|load)	2	0	0	1
+4158	4158	^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3Ffile(index\x3D[A-Z]|n\x3Dnoexist|wh\x3Dfalse)	2	0	0	1
+4159	4159	^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3FRe\x3D	2	0	0	1
+4160	4160	^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3Fverify\x3D	2	0	0	1
+4161	4161	\.asp\?IDPC=[^\x26]*?\x26(Status=|Msg=)[^\x26]*?$	2	0	0	1
+4162	4162	^OPC=\d	2	0	0	1
+4163	4163	^\/[^\x2f]+?\.hlp$	2	0	0	1
+4164	4164	^\/(components|wp-content|tmp)/api/[a-zA-Z0-9\/\x20]{43}=\/(toll|inv|notice|get_label)$	2	0	0	1
+4165	4165	&build_id=[A-F0-9]+$	2	0	0	1
+4166	4166	^&op=\d{1,2}&id=\w+?&ui=.+?&bv=\d{1,2}\.\d{1,2}($|&)	2	0	0	1
+4167	4167	\/vtris\d?\.php\?srs=\d{1,10}$	2	0	0	1
+4168	4168	\/soft(32|64)\.dll$	2	0	0	1
+4169	4169	\/ord\/[^\x2f]+?\.exe$	2	0	0	1
+4170	4170	\/zConfig\/\d+$	2	0	0	1
+4171	4171	\/zImprimer\/\d+-	2	0	0	1
+4172	4172	\/enc\/1$	2	0	0	1
+4173	4173	^\/p\/(p(hphphphphphphp|thon)|(dropytho|admmmom)n|u(pdata-server|dom)|eyewheye|joompler|rubbay|tempzz)	2	0	0	1
+4174	4174	[a-z]\d{2}$	2	0	0	1
+4175	4175	\/images2\/[0-9a-fA-F]{500}	2	0	0	1
+4176	4176	^(u(wf(ekfyj|ubpeb)|d(xowub|zycaf)|h(duxic|zubvo)|x(fokur|osgik)|celgos|ggifym|mpefan|qlahaf)|s(u(t(fasof|imjy)|kbewli)|i(ttanyg|webheb|hemuj)|e(suhror|xjereh)|o(haxim|qvaqo)|axyjuw)|r(i(zsebym|firac|sytfa|trios)|e(bfelqi|kvyfo)|u(xymqic|jfeag)|y(buhoq|kafeh)|acadpuh)|j(y(meegom|vvozoz|kyvca|torqu)|a(mwazer|ibzup)|e(btelyx|dytlu)|o(dkymy|kenqi))|o(t(geguuz|xolpow|pipug)|q(lapjim|jogxi)|cgaextu|gdowkys|jpaxlam|vquqaip|smuryf)|i(r(ojvuqu|hegre)|v(kikcop|nuvuk)|hmytog|kevzaq|mgohut|pdehas|wvahin|zxirfy)|b(y((cmolh|vbym)y|gotbys|jlegta)|i(pulte|wuvba)|o(pwyeb|wbaiv))|p(e(dugtap|gyrgun|vhyvys)|y(nxomoj|ykxug)|a(gube|waha)v|ogwytfy)|d(e(afesqy|hjujuq)|o(hwapih|xilik)|a(lwoza|rabub)|inymak)|t(a(hfifak|ixcih)|i(wciwu|koqo)x|ecviqir|ozfyma|uriwil)|g(i(jevsog|nnyjyb)|olhysux|ywilhof|azuzoz|edopan|ubahvi)|y((n(japru|kicy)|kocna)r|bsahov|dabxag|xyqwiz|zsabuq)|h(a(hsekju|poneg)|e(ztymut|dybih)|uquqxov|itakat)|w(a(pifnu|rkafo)c|e(tifjam|fecfo)|ibveces|yjenqo)|a(d(nedat|tesok)|qzepylu|baxhad|smukuf|wewsip)|l(u((fseki|pylz	2	0	0	1
+4177	4177	)m|ditla)|eqgugom|opoqyv)|z(u(pivzed|qijcel)|aefofin|idamuk|ylhomu)|v(u(njuet|ohsub)|ijsixem|otqygiq|euwhyz)|m(u(zupdyg|hipew|wosiv)|osjinme|abuhos)|x(o(fsimi|gitaj|moqol)|ikmonej|enacoz)|f(e(vnotow|tucxo)|i(dedhah|xavpu))|k(u(btyhuz|irfufo)|ejejib|ycufvy)|n((iliqri|obzeky)x|eluzjiv)|c(ylqiduh|aqxaro|itsibe)|q(aijroke|iquzcy|uohdit)|e(gnisje|stesgo|vdyvaz))\.ru$	2	0	0	1
+4178	4178	\/[a-z]\.htm\?[A-Za-z0-9]+$	2	0	0	1
+4179	4179	Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+4180	4180	Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+4181	4181	\/p?2p\/[a-z]{3}$	2	0	0	1
+4182	4182	\/\d\.php\?sid=[0-9A-F]{32}$	2	0	0	1
+4183	4183	^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?\r?$	2	0	0	1
+4184	4184	^\/mod_jshoppi(-|ng|\/)	2	0	0	1
+4185	4185	( MSIE |rv\x3a11)	2	0	0	1
+4186	4186	( MSIE |rv\x3a11)	2	0	0	1
+4187	4187	( MSIE |rv\x3a11)	2	0	0	1
+4188	4188	( MSIE |rv\x3a11)	2	0	0	1
+4189	4189	\/[a-z]+\.k(ey)?btc$	2	0	0	1
+4190	4190	&id=[A-F0-9]+$	2	0	0	1
+4191	4191	\/images\/view\.php$	2	0	0	1
+4192	4192	\/txt\/read\.php$	2	0	0	1
+4193	4193	^hwid=[A-F0-9]{4}(-[A-F0-9]{4}){7}&func=	2	0	0	1
+4194	4194	\/[A-Za-z0-9-_]{75,}\.html$	2	0	0	1
+4195	4195	filename=\x22[A-Z]\x3a\\.+?\\[a-f0-9]{32}\.zip\x22\r\n	2	0	0	1
+4196	4196	^\/me\/(get(ref|ua)\.php|videos\.txt)$	2	0	0	1
+4197	4197	\/infect(-\d)?\.php$	2	0	0	1
+4198	4198	&hash=[^&]+$	2	0	0	1
+4199	4199	^Host\x3a[^\r\n]+?webdav\.cloudme\.com[^\r\n]*?\r?$	2	0	0	1
+4200	4200	\.exe\?dummy=\d+$	2	0	0	1
+4201	4201	^(<v1>.).{33}(=v1).{9}(<v2>.)(.{4}(=v2)){3}	2	0	0	1
+4202	4202	\.png$	2	0	0	1
+4203	4203	\x26enckey\x3D[A-F0-9]+$	2	0	0	1
+4204	4204	^\/action\.php\?action=get_(mails|red)$	2	0	0	1
+4205	4205	^Host\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4206	4206	\/data\.cfg$	2	0	0	1
+4207	4207	\/bn_versions\/\d+?\.exe$	2	0	0	1
+4208	4208	^(Accept\x3a\x20text\/\*, application\/\*\r\n)?User-Agent\x3a[^\r\n\x3b\x28\x29]+\r\nHost\x3a[^\r\n]+checkip\.dyndns\.org\r\nCache-Control\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4209	4209	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4210	4210	&user=\d+$	2	0	0	1
+4211	4211	^Host\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4212	4212	\/web_[0-9A-F]{12}\.jpg$	2	0	0	1
+4213	4213	^Mozilla(\/4\.0)?$	2	0	0	1
+4214	4214	Host\x3a\x20[a-z0-9]{16}\.[^\r\n]*?(tor|onion)	2	0	0	1
+4215	4215	^\/([^\x2f]+\/)?rp\?[a-z]=	2	0	0	1
+4216	4216	^User-Agent\x3a\x20(\d*[a-z])[a-z0-9]+\r\nHost\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4217	4217	^Host\x3a[^\r\n]+bagacaoutra\.ru\r\n	2	0	0	1
+4218	4218	^Host\x3a[^\r\n]+bagacavoltou\.ru	2	0	0	1
+4219	4219	^Host\x3a[^\r\n]+bagacaveia\.ru	2	0	0	1
+4220	4220	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4221	4221	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4222	4222	\/state[^\x2f]*\.php\?[A-Za-z0-9+/]*={0,2}$	2	0	0	1
+4223	4223	^Accept\x3a\x20\*\/\*,[^\r\n]+, MZ	2	0	0	1
+4224	4224	^\/[^\x2f]+?\.exe$	2	0	0	1
+4225	4225	^[A-F0-9]+$	2	0	0	1
+4226	4226	\/redirect\.php\?loc=mail$	2	0	0	1
+4227	4227	&(uid|name|file)=[a-f0-9]+$	2	0	0	1
+4228	4228	\?HostID=([A-F0-9]{2}(-|<>)){5}[A-F0-9]{2}$	2	0	0	1
+4229	4229	\/\?bit=(32|64)&version=\d{4}-\d{1,2}-\d{1,2}$	2	0	0	1
+4230	4230	\/\?check$	2	0	0	1
+4231	4231	^Host\x3a[^\r\n]+\r\nAccept-Language\x3a[^\r\n]+\r\nAccept\x3a[^\r\n]+\r\nAccept-Encoding\x3a[^\r\n]+\r\nConnection\x3a\x20close\r\nUser-Agent\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4232	4232	[A-Z]{100}(&\w+=[a-zA-Z0-9/+=]+){0,2}$	2	0	0	1
+4233	4233	^\w+=([a-zA-Z0-9/+=]{1,30}&\w+=)?[a-zA-Z0-9+/]{0,13}[A-Z]{200}	2	0	0	1
+4234	4234	(&(boardid|bbsNo|strBoardID|userid|bbs|filename|code|pid|seqNo|ReportID|v|PageNumber|num|view|read|action|page|mode|idx|cateId|bbsId|pType|pcode|index|tbl|idx_num|act|bbs_id|bbs_form|bid|bbscate|menu|tcode|b_code|bname|tb|borad01|borad02|borad03|mid|newsid|table|Board_seq|bc_idx|seq|ArticleID|B_Notice|nowPage|webid|boardDiv|sub_idxa)=[^&]+){3}$	2	0	0	1
+4235	4235	\/setup\/[a-zA-Z0-9!-]{100,}$	2	0	0	1
+4236	4236	\/app\.exe$	2	0	0	1
+4237	4237	^Host\x3a[^\r\n]+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4238	4238	=c3NoOi8v[A-Za-z0-9+/]+={0,2}$	2	0	0	1
+4239	4239	\.asp\?([A-Za-z0-9+*]{4})*([A-Za-z0-9+*]{2}==|[A-Za-z0-9+*]{3}=|[A-Za-z0-9+*]{4})$	2	0	0	1
+4240	4240	\?wd=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})$	2	0	0	1
+4241	4241	&version=\d+$	2	0	0	1
+4242	4242	^[A-Za-z0-9/_]+={0,2}$	2	0	0	1
+4243	4243	\/[a-z]\/infects\/[a-z]\?[a-z]=[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}	2	0	0	1
+4244	4244	^\d{4}	2	0	0	1
+4245	4245	^\d{4}	2	0	0	1
+4246	4246	^Host\x3a\x20(\d{1,3}\.){3}\d{1,3}\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4247	4247	\/lns.txt$	2	0	0	1
+4248	4248	^\/[a-z]+?\.*?ini\?\d+$	2	0	0	1
+4249	4249	\/[a-f0-9]{8}\/page_\d{8,10}\.html$	2	0	0	1
+4250	4250	^[a-z]{1,7}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4251	4251	SSID=[0-9]{5}[0-8][01][a-f0-9]{36}	2	0	0	1
+4252	4252	SSID=[0-9]{5}[0-8][01][a-f0-9]{36}	2	0	0	1
+4253	4253	^[\x20-\x7e\s]{0,20}[^\x20-\x7e\s]	2	0	0	1
+4254	4254	^s?\x3a\x2f+[^\r\n\s]+\.exe	2	0	0	1
+4255	4255	\.jpg\?vid=\d+$	2	0	0	1
+4256	4256	^[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\nUser-Agent\x3a	2	0	0	1
+4257	4257	\.php\?[a-z]+=0000[a-fA-F0-9]{4}&[a-z]+=\?[A-F0-9]+&[a-z]=\d{4}&[a-z]=\d{4}$	2	0	0	1
+4258	4258	^[0-9a-f]+$	2	0	0	1
+4259	4259	\/r\.php\?[A-F0-9]+=?$	2	0	0	1
+4260	4260	^m=([A-Za-z0-9+/]{4}){11}(([A-Za-z0-9+/]{4}){6})?AA==	2	0	0	1
+4261	4261	\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/\x20]{2}==|[A-Za-z0-9+/\x20]{3}=|[A-Za-z0-9+/\x20]{4})$	2	0	0	1
+4262	4262	^\d+\x20	2	0	0	1
+4263	4263	^\d+\x20	2	0	0	1
+4264	4264	^\d+\x20	2	0	0	1
+4265	4265	^\d+\x20	2	0	0	1
+4266	4266	^\d+\x20	2	0	0	1
+4267	4267	^\d+\x20	2	0	0	1
+4268	4268	^\d+\x20	2	0	0	1
+4269	4269	^\d+\x20	2	0	0	1
+4270	4270	\.php\?a1=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&a2=[a-f0-9]{32}&a3=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4271	4271	\/(im(age|g)|pict)\.(jpg|php)\?id=\d+&act=[12]$	2	0	0	1
+4272	4272	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4273	4273	\.php\?hwid=[A-F0-9]{16}$	2	0	0	1
+4274	4274	^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/general\.png$	2	0	0	1
+4275	4275	^\/\d+$	2	0	0	1
+4276	4276	^[\x2fa-z\d]+\.exe$	2	0	0	1
+4277	4277	\.php\?command=(g(hl|et(ip|id|backconnect))|update2?|dl|log)($|&)	2	0	0	1
+4278	4278	\.(gif|jpe?g)\.zip$	2	0	0	1
+4279	4279	^(zh-CN|en-US)\x3b rv\x3a1\.7\.6\)\r\n	2	0	0	1
+4280	4280	(,0x[0-9a-f]{2}){10}$	2	0	0	1
+4281	4281	\/default\.aspx?\?tmp=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4282	4282	^[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(&[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$	2	0	0	1
+4283	4283	\/\d{8,10}\.html$	2	0	0	1
+4284	4284	^\x40\x24[^\x20-\x7e\r\n]+$	2	0	0	1
+4285	4285	^\/[A-F0-9]+$	2	0	0	1
+4286	4286	^\/[a-z0-9]+\.jpg\?([a-z0-9]*[A-Z]+[a-z0-9])[A-Za-z0-9]+=\d{1,4}$	2	0	0	1
+4287	4287	\.png\x3f[0-9a-f]{4,8}\x3d\d+?$	2	0	0	1
+4288	4288	^Host\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4289	4289	(\/((p(lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|osts?\/[a-z0-9]+|rogcicicic)|s(ystem\/(logs|engine)\/[^\x2f]+?|e(rv(au|er)|ct)|gau\/.*?|alam|ucks|can|ke)|([a-z]*[0-9])([0-9]*[a-z])(setup\d+\.exe)[a-z0-9]{5,10}|a(d(min\/images\/\w+|obe)|salam|live|us)|m(edia\/files\/\w+|a(cros?|rch)|soffice)|d(o(c(\/[a-z0-9]+)?|ne)|bust)|(~.+?\/\.[^\x2f]+|\.css)\/.+?|in(voice\/[^\x2f]+|fos?)|c(onfig|hris|alc)|u(swinz\w+|pdate)|xml\/load\/[^\x2f]+|([Dd]ocumen|ve)t|Ozonecrytedserver|w(or[dk]|insys)|t(mp\/.+?|est)|fa(cture|soo)|n(otepad|ach)|k(be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe|(([a-z0-9]*?[3456789][a-z0-9]*?[3456789])([a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(^\/(image\/.+?\/[^\x2f]+|x\/setup)|keem)\.exe)	2	0	0	1
+4290	4290	\.pdf\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4291	4291	\.zip\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4292	4292	\.htm\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4293	4293	\.xml\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4294	4294	^\/[a-z0-9_-]+\.jpg\?[A-Za-z0-9]{2,10}=\d{1,4}$	2	0	0	1
+4295	4295	^(www\.)?google(\.[a-z]{2,3})+$	2	0	0	1
+4296	4296	\.log$	2	0	0	1
+4297	4297	\/([a-z0-9]+_){4,}[a-z0-9]+(\/[a-f0-9]+)*?\/[a-f0-9]+\.([Ee][Xx][Ee])[a-z0-9]+$	2	0	0	1
+4298	4298	^\/pm\.sh\?\d+$	2	0	0	1
+4299	4299	\.asp\?m=(INS|UAC)(&p=&a=)?&i=201\d{11}&	2	0	0	1
+4300	4300	\?ver=\d+$	2	0	0	1
+4301	4301	^\/(i686|arm|mips(el)?)\?ver=\d+$	2	0	0	1
+4302	4302	&u=[a-f0-9]{16}&p=	2	0	0	1
+4303	4303	\/[a-f0-9]{16}\.down$	2	0	0	1
+4304	4304	\.php\/data$	2	0	0	1
+4305	4305	\/catalog\/\d{3,}$	2	0	0	1
+4306	4306	\.php\?cookie=1$	2	0	0	1
+4307	4307	^\/[A-Za-z0-9]+?\/file\.php$	2	0	0	1
+4308	4308	\/tor\/[^\x2f\x2e]+(32|64)\.dll$	2	0	0	1
+4309	4309	\.php\?shinu=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4310	4310	^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$	2	0	0	1
+4311	4311	^\/link\.txt\?[0-9]{1,2}\x3a[0-9]{1,2}\x3a[0-9]{1,2}	2	0	0	1
+4312	4312	\.php\?uuid=[a-z0-9]{32}$	2	0	0	1
+4313	4313	^(Referer\x3a[^\r\n]+\r\n)?Host\x3a[^\r\n]+[\r\n]+$	2	0	0	1
+4314	4314	\.exe\?$	2	0	0	1
+4315	4315	^\/\w+\.php\?f=[a-z]?\d{1,3}(\.(dat|gif))?$	2	0	0	1
+4316	4316	\/\?[a-zA-Z0-9]{1,3}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4317	4317	\.php\?cn(ame)	2	0	0	1
+4318	4318	^(Host\x3a [^\r\n]+?\r\nConnection\x3a Keep-Alive|Connection\x3a Keep-Alive\r\nHost\x3a [^\r\n]+?)\r\n(\r\n)?$	2	0	0	1
+4319	4319	\.php\?file=(64|86)$	2	0	0	1
+4320	4320	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4321	4321	meta=(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?(&?id=[a-z]+)?$	2	0	0	1
+4322	4322	^\/[a-z]+?\/\?([a-z]+[A-Za-z0-9\x5f\x2d]+&){1,}ai=[^&]{5}([A-Za-z0-9\x5f\x2d]{4})*([A-Za-z0-9\x5f\x2d]{2}==|[A-Za-z0-9\x5f\x2d]{3}=|[A-Za-z0-9\x5f\x2d]{4})(&|$)	2	0	0	1
+4323	4323	(^|=)[A-F0-9]{70,}($|&)	2	0	0	1
+4324	4324	^[A-Za-z0-9+/]{64}\x0a	2	0	0	1
+4325	4325	\/viewforum\.php\?f=\d+&sid=[A-F0-9]{32}$	2	0	0	1
+4326	4326	\?uid=\d{8}&ver=\d\.\d{2}&mk=[0-9a-zA-Z]{6}&os=[A-Za-z0-9]+&rs=[a-z]+&c=\d+&rq=\d	2	0	0	1
+4327	4327	^Content-Disposition\x3a[^\r\n]*\.sct[\x22\x27\s\r\n]	2	0	0	1
+4328	4328	\.php\?cmd=p&id=\w+.*?&rnd=[\x2e\d]+$	2	0	0	1
+4329	4329	myguy\.(xls(\.hta)?|exe)$	2	0	0	1
+4330	4330	\/invoice[^a-z\/]*?\.(exe|zip|7z|rar|com|vbs|ps1)$	2	0	0	1
+4331	4331	\/[\x2f\x2bA-Za-z0-9]{59}AAA==$	2	0	0	1
+4332	4332	^\/[^\x2f]+?\/create\.php\?[a-z0-9]+\x3d[a-z0-9\x5f\x2d]+?$	2	0	0	1
+4333	4333	\.php\?id=\d+&stat=[a-z0-9]{32}(&cidl=\d+|&sidl=[\d%:\x20-]+)?$	2	0	0	1
+4334	4334	\/[A-Z0-9]{4,8}\/[A-Z0-9]{8}\.DAT$	2	0	0	1
+4335	4335	\.exe\?\.\d+$	2	0	0	1
+4336	4336	^Host\x3a[^\r\n]+\r\n((Cache-Control|Pragma)\x3a[^\r\n]+\r\n)?(\r\n)?$	2	0	0	1
+4337	4337	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4338	4338	^\/Search\/en-US\?query=[a-z]{200,400}&pgArea=header$	2	0	0	1
+4339	4339	\/stat\d+\.php	2	0	0	1
+4340	4340	\?url=[0-9]&affid=[0-9]{5}	2	0	0	1
+4341	4341	\.php\?id=[0-9a-f]{8}$	2	0	0	1
+4342	4342	^6\.[0-2]\x20\d\d\x3a\d\d\x20	2	0	0	1
+4343	4343	^IPHONE\d+\x2e\d+\x28(host\x3a|[^\r\n\x2c]+\x2c(\d{1,3}\.){3}\d{1,3})	2	0	0	1
+4344	4344	(1|2)\.(p(hp|ng)|jpe?g|cgi|gif)\?sv=\d{2,3}&tq=	2	0	0	1
+4345	4345	[\?&]p=\d&t=\d(&|$)	2	0	0	1
+4346	4346	^\x2fhistory\x2f[A-Za-z0-9+_-]+\x2easp$	2	0	0	1
+4347	4347	^\x2fdocs\x2fname\x3d\x2f[A-Za-z0-9+_-]+$	2	0	0	1
+4348	4348	^\x2ftech\x2fs\x2easp\x3fm\x3d[A-Za-z0-9+_-]+$	2	0	0	1
+4349	4349	^\x2fmanage\x2fasp\x2fitem\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26mux\x3d[A-Za-z0-9+_-]+$	2	0	0	1
+4350	4350	^\x2farticle\x2f30441\x2fReview\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26data\x3d[A-Za-z0-9+_-]+$	2	0	0	1
+4351	4351	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4352	4352	^\/[A-Za-z0-9-_]{30,}\/$	2	0	0	1
+4353	4353	^build\d	2	0	0	1
+4354	4354	^[a-zA-Z0-9]{5}6164(3[0-9]){4}31303[0-9]([a-f0-9][a-f0-9]){5,}\.	2	0	0	1
+4355	4355	^[a-zA-Z0-9]{5}6364(3[0-9]){4}\d{1,3}\.	2	0	0	1
+4356	4356	^[a-zA-Z0-9]{5}6464(3[0-9]){4}\.	2	0	0	1
+4357	4357	^[a-zA-Z0-9]{5}6664(3[0-9]){4}\.	2	0	0	1
+4358	4358	^[a-zA-Z0-9]{5}6864(3[0-9]){4}31303[0-9]\.	2	0	0	1
+4359	4359	^[a-zA-Z0-9]{5}7264(3[0-9]){4}31303[0-9]([a-f0-9][a-f0-9]){10,}\.	2	0	0	1
+4360	4360	^[a-zA-Z0-9]{5}7164(3[0-9]){4}\.	2	0	0	1
+4361	4361	^[a-f0-9]{8}$	2	0	0	1
+4362	4362	^\d{1,3}$	2	0	0	1
+4363	4363	^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+4364	4364	^[A-Za-z0-9\/\+\=]{100,}$	2	0	0	1
+4365	4365	\.(txt|gif|exe|bmp)$	2	0	0	1
+4366	4366	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4367	4367	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4368	4368	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4369	4369	^[A-F0-9]{128}$	2	0	0	1
+4370	4370	^DEMONS((\/|\s)[0-9]\.0)?$	2	0	0	1
+4371	4371	^Hakai((\/|\s)[0-9]\.0)?$	2	0	0	1
+4372	4372	^Messiah((\/|\s)[0-9]\.0)?$	2	0	0	1
+4373	4373	^Liquor((\/|\s)[0-9]\.0)?$	2	0	0	1
+4374	4374	^Nija((\/|\s)[0-9]\.0)?$	2	0	0	1
+4375	4375	^Gemini((\/|\s)[0-9]\.0)?$	2	0	0	1
+4376	4376	^Kayla((\/|\s)[0-9]\.0)?$	2	0	0	1
+4377	4377	^Sector((\/|\s)[0-9]\.0)?$	2	0	0	1
+4378	4378	^OSIRIS((\/|\s)[0-9]\.0)?$	2	0	0	1
+4379	4379	^lessie(\/[0-9]\.0)?$	2	0	0	1
+4380	4380	^Cakle(\/[0-9]\.0)?$	2	0	0	1
+4381	4381	^Damien(\/[0-9]\.0)?$	2	0	0	1
+4382	4382	^Solar(\/[0-9]\.0)?$	2	0	0	1
+4383	4383	^muhstik(-scan)?(\/[0-9]\.0)?$	2	0	0	1
+4384	4384	^Shaolin(\/[0-9]\.0)?$	2	0	0	1
+4385	4385	^Rift(\/[0-9]\.0)?$	2	0	0	1
+4386	4386	^Tsunami(\/[0-9]\.0)?$	2	0	0	1
+4387	4387	^Yowai(\/[0-9]\.0)?$	2	0	0	1
+4388	4388	^Yakuza(\/[0-9]\.0)?$	2	0	0	1
+4389	4389	^Hentai(\/[0-9]\.0)?$	2	0	0	1
+4390	4390	^[a-zA-Z/+=]$	2	0	0	1
+4391	4391	\?uid=[A-F0-9]{15,}&pid=\d+$	2	0	0	1
+4392	4392	\.php\?[A-F0-9]{15,25}$	2	0	0	1
+4393	4393	^(Sucessful|Failed|Missing\x20CBA8|Missing\x20LANDesk\x20Agent)$	2	0	0	1
+4394	4394	^POST\shttp\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.0\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+4395	4395	^name=v[0-9]{1,2}_kt[0-9]{1,2}p[0-9]{1}_[0-9]{8,10}$	2	0	0	1
+4396	4396	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4397	4397	^\/[a-z]\.php	2	0	0	1
+4398	4398	^\d{1,6}$	2	0	0	1
+4399	4399	^[A-Z0-9]{8}	2	0	0	1
+4400	4400	^\d{15}	2	0	0	1
+4401	4401	^(winload(32)?|cmms)\x0d\x0a	2	0	0	1
+4402	4402	^\d$	2	0	0	1
+4403	4403	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4404	4404	^\/[a-z]+\/\?ip=	2	0	0	1
+4405	4405	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+4406	4406	^\d{1,5}\.[2-5]0[0-5]\.\d+? Firefox\/7\.0\.1	2	0	0	1
+4407	4407	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4408	4408	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4409	4409	^(update_hash|js|key|arsiv_(hash|link))$	2	0	0	1
+4410	4410	\/([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})\.jpg$	2	0	0	1
+4411	4411	^[a-z0-9]{11}=\d{16}$	2	0	0	1
+4412	4412	^[A-Za-z0-9]{3,25}=[a-f0-9]{28,}$	2	0	0	1
+4413	4413	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4414	4414	^Hello, World((\/|\s)[0-9]\.0)?$	2	0	0	1
+4415	4415	\/cgi\/[a-z0-9]{1,31}\.bin$	2	0	0	1
+4416	4416	^[0-9a-zA-Z=%-]{0,48}(%[A-F0-9]{2}){4}	2	0	0	1
+4417	4417	\?id=\d+&act=[12]$	2	0	0	1
+4418	4418	\?id=\d+&act=\d$	2	0	0	1
+4419	4419	^([A-F0-9]{2}%3A){5}[A-F0-9]{2}&	2	0	0	1
+4420	4420	\/([a-z]{0,7}[0-9])([0-9]{0,7}[a-z])[a-z0-9]{7,8}\/([a-z]{0,7}[0-9])([0-9]{0,7}[a-z])[a-z0-9]{7,8}$	2	0	0	1
+4421	4421	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&isAdvpp=(true|false)$	2	0	0	1
+4422	4422	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+4423	4423	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+4424	4424	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+4425	4425	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+4426	4426	^\d\.\d_(64|32)_\d\x3a	2	0	0	1
+4427	4427	(^|\.)15438\.xyz$	2	0	0	1
+4428	4428	(^|\.)12724\.xyz$	2	0	0	1
+4429	4429	(^|\.)21736\.xyz$	2	0	0	1
+4430	4430	^[a-f0-9]+\x08\x00$	2	0	0	1
+4431	4431	^([A-Za-z0-9%2b%2f]{4})*([A-Za-z0-9%2b%2f]{2}%3d%3d|[A-Za-z0-9%2b%2f]{3}%3d|[A-Za-z0-9%2b%2f]{4})$	2	0	0	1
+4432	4432	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4433	4433	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4434	4434	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4435	4435	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4436	4436	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4437	4437	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4438	4438	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4439	4439	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4440	4440	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4441	4441	^Host\x3a\x20(\d{1,3}\.){3}\d{1,3}\r\nConnection\x3a\x20close(\r\n)+$	2	0	0	1
+4442	4442	^[A-Z]+$	2	0	0	1
+4443	4443	^\d+$	2	0	0	1
+4444	4444	^(64|86)$	2	0	0	1
+4445	4445	\/counter\/(\?[a-z]?\d{1,2}|[^\x2f]*\d\.exe|.*?[]([A-Za-z_-]{0,200}[0-9][A-Za-z_-]{0,200}[0-9])([A-Z0-9_-]{0,200}[a-z][A-Z0-9_-]{0,200}[a-z])([a-z0-9_-]{0,200}[A-Z][a-z0-9_-]{0,200}[A-Z])[A-Za-z0-9_-]{50,}(&|$)	2	0	0	1
+4446	4446	^\/(\w+\/){1,5}\?[a-z]{1,6}=[a-z0-9]{2,40}(&[a-z]{1,6}=([a-z0-9]){1,40}(%3D){0,2}){1,4}$	2	0	0	1
+4447	4447	^\d{5,10}\x7d	2	0	0	1
+4448	4448	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+4449	4449	\/\d{8,10}\.html$	2	0	0	1
+4450	4450	^\d{1,3}=	2	0	0	1
+4451	4451	(Proxy-)?Connection\x3a[^\r\n]+?\r\n(Pragma|Cache-Control)\x3a[^\r\n]+?\r\n(\r\n)?$	2	0	0	1
+4452	4452	\/?[a-zA-Z0-9]{1,3}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4453	4453	^\d+$	2	0	0	1
+4454	4454	^\/\?m=[abcde]&p1=[a-f0-9]{8,12}(&p2=[^&]+)?(&p3=[^&]+)?$	2	0	0	1
+4455	4455	[&?]a=([a-zA-Z0-9_-]{25,}|(0\.)?\d+)(&|$)	2	0	0	1
+4456	4456	^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$	2	0	0	1
+4457	4457	\.(aspx?|php)\?q=(KT)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$	2	0	0	1
+4458	4458	^[A-Za-z]{1,10}=[^&]+(&[A-Za-z]{1,10}=[^&]+){10,}$	2	0	0	1
+4459	4459	^[a-f0-9]{32}\x3b$	2	0	0	1
+4460	4460	^\/(kas|ser|mac)[0-9]+\.png$	2	0	0	1
+4461	4461	^\/s\.php\?id=[a-z0-9]{2,6}$	2	0	0	1
+4462	4462	\.php\?d=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4463	4463	^[a-z0-9!\x22#%&'()*,.\/\x3a\x3b<=>?@\[\] ^_`{|}~\s-]+?downloading\.?\s*Please wait\x2e*<\/div\>\s*<iframe src\s*=\s*[\x22\x27]http\:\/\/[^\x22\x27]+\.php[\x22\x27]\s*style\s*=\s*[\x22\x27]display\x3a\s*none\x3b\s*[\x22\x27]>\s*<\/iframe\>\s*$	2	0	0	1
+4464	4464	^[a-f0-9]{16}$	2	0	0	1
+4465	4465	^[A-Za-z0-9]{3,4}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})	2	0	0	1
+4466	4466	^[A-Za-z0-9]{3,4}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+4467	4467	[a-z0-9]{3,4}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+4468	4468	^Mozilla\/4\.0\x20\(compatible\x3b\x20MSIE\x20\d{1,2}\.0\.\d+\.\d+\.0\x3b\x20Windows\x20NT\x20	2	0	0	1
+4469	4469	^[\x20-\x7e\r\n]{0,28}[^\x20-\x7e\r\n]	2	0	0	1
+4470	4470	^\/([a-z]{0,9}?\d)(\d{0,9}?[a-z])[a-z0-9]{4,10}$	2	0	0	1
+4471	4471	(^|&)id=\d+($|&)	2	0	0	1
+4472	4472	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+4473	4473	^\d?\.dll$	2	0	0	1
+4474	4474	^(32|64)$	2	0	0	1
+4475	4475	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)$	2	0	0	1
+4476	4476	\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d{1,5}$	2	0	0	1
+4477	4477	^env=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4478	4478	\/pict\.(jpg|php|xsp)\?id=\d+((&data=|&bid=)[^&]*?)?$	2	0	0	1
+4479	4479	^SESSIONID=[A-Z0-9]{16}	2	0	0	1
+4480	4480	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+4481	4481	^(\/\w{3,12}){2,4}\?[a-z]{3,12}=([A-Za-z0-9+/\x20]{4})*([A-Za-z0-9+/\x20]{2}==|[A-Za-z0-9+/\x20]{3}=|[A-Za-z0-9+/\x20]{4})$	2	0	0	1
+4482	4482	^\d+$	2	0	0	1
+4483	4483	^POST \/(<filep>[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(=filep)[a-z]+?\.net\r\n	2	0	0	1
+4484	4484	[=\"]\w{8}\.jar	2	0	0	1
+4485	4485	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4486	4486	filename\x3D\x22[^\r\n]*security[^\n]+\.exe	2	0	0	1
+4487	4487	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4488	4488	^[A-F0-9]{30}$	2	0	0	1
+4489	4489	\.php\?cx=[A-F0-9]+&b=[A-F0-9]+&gt=[A-F0-9]+&tx=[A-F0-9]+$	2	0	0	1
+4490	4490	^\/ucD[A-Za-z0-9_\/\-+]{171}$	2	0	0	1
+4491	4491	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+4492	4492	^<CHECK>([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/CHECK>$	2	0	0	1
+4493	4493	^[a-zA-Z0-9\/+_-]{171}$	2	0	0	1
+4494	4494	\/\d+\/\d+\.exe$	2	0	0	1
+4495	4495	^[A-Za-z0-9]{20,22}&usg=[A-Za-z0-9_]{34}&bvm=bv\.81[1-7]{6}\,d\.[A-Za-z0-9_]{3}\r\n	2	0	0	1
+4496	4496	^fn=[^&]*\.gif&code=\d+$	2	0	0	1
+4497	4497	^[A-F0-9]+$	2	0	0	1
+4498	4498	^log=save&session_id=[^&]+&value=[^&]+$	2	0	0	1
+4499	4499	%comSpec%\s\/c\s((\\x50)|(\\x70)|[Pp])\^?((\\x4f)|(\\x5f)|[Oo])\^?((\\x57)|(\\x77)|[Ww])\^?((\\x45)|(\\x65)|[Ee])\^?((\\x52)|(\\x72)|[Rr])\^?((\\x53)|(\\x73)|[Ss])\^?((\\x48)|(\\x68)|[Hh])\^?((\\x45)|(\\x65)|[Ee])\^?((\\x4c)|(\\x6c)|[Ll])\^?((\\x4c)|(\\x6c)|[Ll])\^?((\\x2e)|\.)\^?((\\x45)|(\\x65)|[Ee])\^?((\\x58)|(\\x78)|[Xx])\^?((\\x45)|(\\x65)|[Ee])\^?\s	2	0	0	1
+4500	4500	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4501	4501	^([a-f0-9]{2}){23,60}$	2	0	0	1
+4502	4502	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4503	4503	^[0-9]*?[a-z]/P	2	0	0	1
+4504	4504	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a8080$	2	0	0	1
+4505	4505	^\/[a-z]{4}(\d{1,3}\.){3}\d{1,3}[a-z]{6}\.txt	2	0	0	1
+4506	4506	^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+4507	4507	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+	2	0	0	1
+4508	4508	^[a-zA-Z0-9=/&?\x2e-]+$	2	0	0	1
+4509	4509	^[a-f0-9]{8}\.grp[0-9]*\.ping\.adm\.([a-f0-9]+\.){2,}	2	0	0	1
+4510	4510	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+4511	4511	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+4512	4512	^[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}$	2	0	0	1
+4513	4513	^[\x20-\x25\x27-\x3c\x3e-\x7e]{25,}$	2	0	0	1
+4514	4514	^(i686|x86_64|arm|mipsel)\-(static-linux|w64|iamsatan)\-(mingw32|uclibc(gnueabi)?)	2	0	0	1
+4515	4515	^[^\\\*\+\=\|\:\;\x22\?\>\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}[\d_]+\.(jpg|png)\x22\x0d\x0a	2	0	0	1
+4516	4516	^([A-Za-z0-9%2b%2f]{4})*([A-Za-z0-9%2b%2f]{2}%3d%3d|[A-Za-z0-9%2b%2f]{3}%3d|[A-Za-z0-9%2b%2f]{4})$	2	0	0	1
+4517	4517	^\/[^\x2f]+?\.htm$	2	0	0	1
+4518	4518	^\d{2,7}$	2	0	0	1
+4519	4519	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\.bin$	2	0	0	1
+4520	4520	^Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x3A\d{1,5}\r?$	2	0	0	1
+4521	4521	^Host\x3a[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(\r\n)?$	2	0	0	1
+4522	4522	(\/((p(lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|osts?\/[a-z0-9]+|rogcicicic)|s(ystem\/(logs|engine)\/[^\x2f]+?|e(rv(au|er)|ct)|gau\/.*?|alam|ucks|can|ke)|([a-z]*[0-9])([0-9]*[a-z])(setup\d+\.exe)[a-z0-9]{5,10}|a(d(min\/images\/\w+|obe)|salam|live|us)|m(edia\/files\/\w+|a(cros?|rch)|soffice)|d(o(c(\/[a-z0-9]+)?|ne)|bust)|(~.+?\/\.[^\x2f]+|\.css)\/.+?|in(voice\/[^\x2f]+|fos?)|c(onfig|hris|alc)|u(swinz\w+|pdate)|xml\/load\/[^\x2f]+|([Dd]ocumen|ve)t|Ozonecrytedserver|w(or[dk]|insys)|t(mp\/.+?|est)|fa(cture|soo)|n(otepad|ach)|k(be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe|(([a-z0-9]*?[3456789][a-z0-9]*?[3456789])([a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(^\/(image\/.+?\/[^\x2f]+|x\/setup)|keem)\.exe$)	2	0	0	1
+4523	4523	^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+4524	4524	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4525	4525	^[a-zA-Z0-9\/+_-]{171}$	2	0	0	1
+4526	4526	^cnc\.[a-fA-F0-9]{14}.xyz$	2	0	0	1
+4527	4527	^[^&]+&[a-z]=[^&]+&[a-z]=[A-F0-9]+$	2	0	0	1
+4528	4528	^[A-Za-z0-9]{3,20}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4529	4529	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4530	4530	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4531	4531	_aWQ9[a-zA-Z0-9\/]{43,46}(JmdpZD|Z2lkP|ZnaWQ9)	2	0	0	1
+4532	4532	^\/[a-f0-9]+$	2	0	0	1
+4533	4533	^[A-Z]{4}	2	0	0	1
+4534	4534	\.php\?host=[^&]+&password=[a-f0-9]{32}$	2	0	0	1
+4535	4535	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+4536	4536	^\x2F[a-f0-9]{40,60}$	2	0	0	1
+4537	4537	^[^\r\n]+\.exe(\x3b)?$	2	0	0	1
+4538	4538	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4539	4539	\r\nHost\x3a[^\r\n]+\r\n(Content-Length\x3a\x20\d+\r\n)?Connection\x3a\x20Keep-Alive\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4540	4540	Content-Disposition\x3a[^\r\n]+=[\x22\x27]?[a-z]?\d{1,3}(\.dat)?[\x22\x27]?\r\n	2	0	0	1
+4541	4541	Content-Disposition\x3a[^\r\n]+=[\x22\x27]?[a-z]?\d{1,3}(\.dat)?[\x22\x27]?\r\n	2	0	0	1
+4542	4542	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4543	4543	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4544	4544	^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$	2	0	0	1
+4545	4545	^Host\x3a\x20[^\r\n]+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4546	4546	^[a-z0-9]+\.appsync-api\.(eu|us)-(ea|we)st-[12]\.avsvmcloud\.com$	2	0	0	1
+4547	4547	^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$	2	0	0	1
+4548	4548	=[a-z0-9\(_~\-\.\x00]{300,}\x00$	2	0	0	1
+4549	4549	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$/Wm	2	0	0	1
+4550	4550	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$/Wm	2	0	0	1
+4551	4551	^[A-Z0-9\-]{30,42}$	2	0	0	1
+4552	4552	^\d+?\r\n	2	0	0	1
+4553	4553	^__io_r=[0-9]{10}_[01]_[0-9]{4,5}_[0-9]{7,8}_[0-9]{1,2}\x3b\x20__io_vl=[0-9]_[0-9]{6}_[0-9]{3}_[0-9]{2}\x3b\x20__io_bl=[0-9]{1,2}:[0-9]:[0-9]{4,5}:[0-9]{2}\x3b\x20Session_id=[0-9A-F]{12}\x3b\x20__io_uniq=[0-9A-F]{8,22}_[0-9A-F]{12,20}\x3b\x20__io_f=[0-9]{2}::[0-9]{10}::[0-9]{9,10}::[0-9]{9,10}$	2	0	0	1
+4554	4554	\.php\?c=[a-f0-9]{160}$	2	0	0	1
+4555	4555	Cache-Control\r\n(\r\n|Cookie\r\n\r\n)$	2	0	0	1
+4556	4556	^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$	2	0	0	1
+4557	4557	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4558	4558	^dkv=[a-f0-9]{32}\x3bYSC=\d+$	2	0	0	1
+4559	4559	^(resp|onl|pr)=	2	0	0	1
+4560	4560	^id=\d+&cred=[a-z]+\x7c	2	0	0	1
+4561	4561	[\x80-\xff]	2	0	0	1
+4562	4562	(retdl|fb|step) HTTP\/1\.1$	2	0	0	1
+4563	4563	^\/[0-9]{6,16}-(pro|xl2|us1)$	2	0	0	1
+4564	4564	^(81|freq|domains|over|rate|npcap\.exe)\/?\s*[^\/]*$	2	0	0	1
+4565	4565	^\/[0-9a-f]{16}$	2	0	0	1
+4566	4566	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4567	4567	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4568	4568	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4569	4569	^[A-F0-9]{24}	2	0	0	1
+4570	4570	^[a-z0-9]{32}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4571	4571	^\/[a-z0-9]{32}\/\d\/$	2	0	0	1
+4572	4572	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4573	4573	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4574	4574	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4575	4575	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/Psi	2	0	0	1
+4576	4576	^transfer=[A-Za-z0-9/+=]+$	2	0	0	1
+4577	4577	^__gads=\d{9,10}:[01]:\d+:\d+(:\d{2,4})?\x3b\s_gat=(10|6)\.[0-3]\.\d{4,6}\.(32|64)\x3b\s_ga=\d\.\d+\.\d+\.\d+\x3b\s_u=[0-9A-F]+:[0-9A-F]+\x3b\s__io=\d{2}_\d{9,10}_\d{9,10}_\d{9,10}\x3b\s_gid=[0-9A-F]{12}$	2	0	0	1
+4578	4578	^[A-Z]{256}$	2	0	0	1
+4579	4579	^[0-9]{90,180}\r\n	2	0	0	1
+4580	4580	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r\n	2	0	0	1
+4581	4581	^\/vpn-service\/[a-z]{15}\/crunchyroll-vpn$	2	0	0	1
+4582	4582	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4583	4583	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4584	4584	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4585	4585	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4586	4586	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4587	4587	^SSID=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4588	4588	^(id|tfzT)=	2	0	0	1
+4589	4589	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4590	4590	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+4591	4591	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+4592	4592	^[a-zA-Z0-9]{32}\.dot$	2	0	0	1
+4593	4593	^[0-9A-F]{21,22}\x20HTTP\/1\.1$	2	0	0	1
+4594	4594	^[0-9A-F]+$	2	0	0	1
+4595	4595	^C=(M[ACDEGHKLMNOPQRSTUVWXYZ]|G[ABDEFGHILMNPQRSTUWY]|B[ABDEFGHIJMNORSTVWZ]|A[DEFGILMNOQRSTUWXZ]|S[ABCEGHIJKLMNRTUVZ]|C[ACFHIKLMNORSVXYZ]|T[CDFGHJKMNOPRTVWZ]|P[AEFGHKLMNRSTWY]|N[ACEFGILOPRTUZ]|K[EGHIMNRWYZ]|L[ACIKSTUVY]|I[DELMNOST]|E[CEGHRST]|F[IJKMORX]|U[AGKMSYZ]|V[ACEGINU]|D[EJKMOZ]|H[KMNRTU]|R[EOSUW]|J[EMOP]|W[FS]|Y[ET]|Z[AM]|OM|QA),\sST=((M[ADEINOST]|N[CDEHJMVY]|A[KLRZ]|I[ADLN]|W[AIVY]|C[AOT]|O[HKR]|[GLP]A|K[SY]|S[CD]|T[NX]|V[AT]|[HR]I|DE|FL|UT))[A-Z]{2},\sL=[A-Z][a-z]{2,15}(\s[A-Z][a-z]{2,10})?,\sO=[A-Z][a-z]{2,25}\s[A-Z][a-z]{2,25}(\s[A-Z][a-z]{2,25})?(\s[A-Z][a-z]{2,25})?(\s(Inc|LLC)\.)?,\sCN=[a-z]{4,11}\.[a-z]{2,4}$	2	0	0	1
+4596	4596	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4597	4597	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4598	4598	\x1c([a-z0-9]{28})[^\r\n]+(\x03(net|com)|\x02in)	2	0	0	1
+4599	4599	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4600	4600	^[a-zA-Z0-9/+]{171}=$	2	0	0	1
+4601	4601	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4602	4602	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4603	4603	^OSID=[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+4604	4604	\=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4605	4605	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4606	4606	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4607	4607	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4608	4608	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4609	4609	^[a-z0-9_]{6}[^a-z0-9_]	2	0	0	1
+4610	4610	^[a-z0-9]{5}\.com$	2	0	0	1
+4611	4611	^[a-z]{3,15}\x3a\x20	2	0	0	1
+4612	4612	^[a-zA-z]{5,10}_[A-F0-9]{12}$	2	0	0	1
+4613	4613	^[a-zA-z]{5,10}_[A-F0-9]{12}$	2	0	0	1
+4614	4614	^[^\"]+\x7c\x22\x2c\x22	2	0	0	1
+4615	4615	^[a-z0-9]{32}	2	0	0	1
+4616	4616	^[a-z0-9]{32}	2	0	0	1
+4617	4617	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4618	4618	^(curl|wget)_?(c(ve_20(1((7_1161|8_760)0|9_10758)|20_16846)|url_xxljobUnauth)|tp5)$	2	0	0	1
+4619	4619	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4620	4620	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4621	4621	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4622	4622	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+4623	4623	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4624	4624	^_?([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4625	4625	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4626	4626	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4627	4627	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4628	4628	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4629	4629	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4630	4630	^[a-f0-9]{5,12}&a=	2	0	0	1
+4631	4631	CN=([^\r\n]+?\.)?hotjar\.info(\.)	2	0	0	1
+4632	4632	^\/\?d=[a-f0-9]{16}$	2	0	0	1
+4633	4633	^[a-z]{1}	2	0	0	1
+4634	4634	^Date\x3a\x20[^\r\n]+[0-9]{2}::[0-9]{2}\x20	2	0	0	1
+4635	4635	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+4636	4636	^[A-P]{256}$	2	0	0	1
+4637	4637	^[a-f0-9]{32}\r\n\r\nPK	2	0	0	1
+4638	4638	^pk=[A-Za-z0-9]{8,50}&value=[a-f0-9]{50,500}$	2	0	0	1
+4639	4639	^[A-Z]{2}-[A-Z0-9]{10,20}-[A-Z0-9]{6,10}-[A-Z0-9]{2,8}-[A-Z0-9]{2,8}-[0-9]{2,5}$	2	0	0	1
+4640	4640	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$	2	0	0	1
+4641	4641	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$	2	0	0	1
+4642	4642	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$	2	0	0	1
+4643	4643	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+4644	4644	^\.(93joshua|purrple|black)$	2	0	0	1
+4645	4645	Content-Disposition\x3a\x20form-data\x3b\s*name=\x22(source|formdata|billinfo|cardinfo)\x22	2	0	0	1
+4646	4646	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4647	4647	^[A-Za-z0-9_-]+$	2	0	0	1
+4648	4648	(\/((p(lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|o(sts?\/[a-z0-9]+|ny[a-z]*)|rogcicicic|m\d{1,2})|s(ystem\/(logs|engine)\/[^\x2f]+?|e(rv(au|er)|ct)|vchost[^\x2f]*|gau\/.*?|alam|ucks|can|ke)|([a-z]*[0-9])([0-9]*[a-z])(setup\d+\.exe)[a-z0-9]{5,10}|in(voice(\/[^\x2f]+|[^\x2f]*)|st\d+|fos?)|a(d(min\/images\/\w+|obe)|salam|live|us)|m(edia\/files\/\w+|a(cros?|rch)|soffice)|d(o(c(\/[a-z0-9]+)?|ne)|bust)|(~.+?\/\.[^\x2f]+|\.css)\/.+?|c(onfig|hris|alc)|u(swinz\w+|pdate)|xml\/load\/[^\x2f]+|([Dd]ocumen|ve)t|Ozonecrytedserver|w(or[dk]|insys)|t(mp\/.+?|est)|fa(cture|soo)|n(otepad|ach)|k(be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe|(([a-z0-9]*?[3456789][a-z0-9]*?[3456789])([a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(^\/(image\/.+?\/[^\x2f]+|x\/setup)|[\x2f\s]order|keem)\.exe$)	2	0	0	1
+4649	4649	^CN=www\.[0-9a-z]{8,20}\.net$	2	0	0	1
+4650	4650	^[A-F0-9]+$	2	0	0	1
+4651	4651	\.[dghbcijklmnfqrwxyz23stuopaev4569]{26}\.[a-z0-9_-]{1,50}\.[a-z]{2,8}$	2	0	0	1
+4652	4652	^[a-zA-z]{8}\.	2	0	0	1
+4653	4653	^[a-zA-z]{8}\.	2	0	0	1
+4654	4654	[^\x18][^\x44\x32\x33\x25\x64\x22\x23\x3a\x27\x24\x26\x34\x3b\x12][\x20\x21\x28-\x2f\x70-\x77\x79-\x7f\x60-\x63\x65\x66\x67-\x6f\x50-\x5f\x40-\x42\x46-\x4f\x30\x31\x35\x36\x38\x3e\x39\x3b]{1,14}\x18	2	0	0	1
+4655	4655	^[A-F0-9]{32}	2	0	0	1
+4656	4656	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4657	4657	^tt[cf]$	2	0	0	1
+4658	4658	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4659	4659	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4660	4660	^([1-3]?)\/download\.php\?filename=ccom	2	0	0	1
+4661	4661	^[a-z]$	2	0	0	1
+4662	4662	\/([0-9]*?[a-z]*?[a-z0-9)([a-z0-9]*[0-9][a-z]*[0-9][a-z0-9]*\.exe)(setup\d+\.exe)[a-z0-9]{5,15}\.exe	2	0	0	1
+4663	4663	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+4664	4664	^User-Agent\x3a\x20(Mozilla\/|Shockwave)	2	0	0	1
+4665	4665	id\x3d[a-z0-9]{8}\x2d[a-z0-9]{4}\x2d[a-z0-9]{4}\x2d[a-z0-9]{4}\x2d[a-z0-9]{12}\x26key\x3d[a-z0-9]{512}	2	0	0	1
+4666	4666	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+4667	4667	^([a-f0-9]{32})=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4668	4668	^[a-z0-9]{32}	2	0	0	1
+4669	4669	^[\x20-\x7e]+?.{8}\x7d\x9f	2	0	0	1
+4670	4670	^[\x20-\x7e]+?.{8}\x7a\x9f	2	0	0	1
+4671	4671	^[\x20-\x7e]+?.{8}\x78\x9a	2	0	0	1
+4672	4672	^[\x20-\x7e]+?.{8}\x7f\x9f	2	0	0	1
+4673	4673	^[\x20-\x7e]+?.{8}\xc3\x70	2	0	0	1
+4674	4674	^[\x20-\x7e]+?.{8}\x7c\x9e	2	0	0	1
+4675	4675	^.{4}[\x20-\x7e]+?.{4}\x78\x9c	2	0	0	1
+4676	4676	^[\x20-\x7e]+?.{8}\x7c\x99	2	0	0	1
+4677	4677	^[\x20-\x7e]+?.{8}\x7f\x9b	2	0	0	1
+4678	4678	^[\x20-\x7e]+?.{8}\x31\xd9	2	0	0	1
+4679	4679	^[\x20-\x7e]+?.{8}\x70\x9b	2	0	0	1
+4680	4680	^[\x20-\x7e]+?.{8}\xda\x41	2	0	0	1
+4681	4681	^[\x20-\x7e]+?.{8}\x7a\x9a	2	0	0	1
+4682	4682	^[\x20-\x7e]+?.{8}\x3f\xa6	2	0	0	1
+4683	4683	^[\x20-\x7e]+?.{8}\x70\x9b	2	0	0	1
+4684	4684	^[\x20-\x7e]+?.{8}\x39\xdd	2	0	0	1
+4685	4685	^.{4}[\x20-\x7e]+?.{4}\x78\x9c	2	0	0	1
+4686	4686	^[\x20-\x7e]+?.{8}\x3b\xd8	2	0	0	1
+4687	4687	^[\x20-\x7e]+?.{8}\x79\x9b	2	0	0	1
+4688	4688	^[\x20-\x7e]+?.{8}\x7c\x9c	2	0	0	1
+4689	4689	^[\x20-\x7e]+?.{8}\x79\x95	2	0	0	1
+4690	4690	^[\x20-\x7e]+?.{8}\x71\x95	2	0	0	1
+4691	4691	^[\x20-\x7e]{5,}.{8}\x78\x9c	2	0	0	1
+4692	4692	^[\x20-\x7e]+?.{8}\x7b\x95	2	0	0	1
+4693	4693	^[\x20-\x7e]+?.{8}\x79\x9f	2	0	0	1
+4694	4694	^[A-Z]{14}$	2	0	0	1
+4695	4695	^.{4}[\x20-\x7e]+?.{4}\x71\x94	2	0	0	1
+4696	4696	^[\x20-\x7e]*?.{8}\x79\x9e	2	0	0	1
+4697	4697	^.{4}[\x20-\x7e]+?.{4}\x7c\x9c	2	0	0	1
+4698	4698	^[\x20-\x7e]+?.{8}\x7f\x9d	2	0	0	1
+4699	4699	^[\x20-\x7e]+?.{8}\x49\xa5	2	0	0	1
+4700	4700	^[\x20-\x7e]+?.{8}\x79\x94	2	0	0	1
+4701	4701	^.{8}[\x20-\x7e]+?.{5}\x7b\x9e	2	0	0	1
+4702	4702	^.{4}[\x20-\x7e]+?.{4}\x7d\x94	2	0	0	1
+4703	4703	^[\x20-\x7e]+?.{8}\x7d\x94	2	0	0	1
+4704	4704	^multipart/form-data\x3b\x20boundary=[a-f0-9]{60}$	2	0	0	1
+4705	4705	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+4706	4706	^[\x20-\x7e]+?.{8}\x7b\x98	2	0	0	1
+4707	4707	^[\x20-\x7e]+?.{8}\x31\xad	2	0	0	1
+4708	4708	^[\x20-\x7e]+?.{8}\x40\xa3	2	0	0	1
+4709	4709	^[\x20-\x7e]+?.{8}\x7d\x98	2	0	0	1
+4710	4710	^.{4}[\x20-\x7e]{5}.{4}\x7a\x9a	2	0	0	1
+4711	4711	^[\x20-\x7e]+?.{8}\x71\x9d	2	0	0	1
+4712	4712	^[\x20-\x7e]+?.{8}\x7a\x9b	2	0	0	1
+4713	4713	^.{8}\x70\x94[\x20-\x7e]	2	0	0	1
+4714	4714	^[\x20-\x7e]+?.{8}\x79\xda	2	0	0	1
+4715	4715	^[\x20-\x7e]+?.{8}\x30\xa5	2	0	0	1
+4716	4716	^[\x20-\x7e]+?.{8}\x70\x9a	2	0	0	1
+4717	4717	^[\x20-\x7e]+?.{8}\x79\x9b	2	0	0	1
+4718	4718	^[\x20-\x7e]+?.{8}\x31\xd9	2	0	0	1
+4719	4719	^[\x20-\x7e]+?.{8}\x79\x9c	2	0	0	1
+4720	4720	^[\x20-\x7e]+?.{8}\x7d\x99	2	0	0	1
+4721	4721	^[\x20-\x7e]+?.{8}\x7b\x9d	2	0	0	1
+4722	4722	^[\x20-\x7e]+?.{8}\x2e\x96	2	0	0	1
+4723	4723	^[\x20-\x7e]+?.{8}\x78\x9c	2	0	0	1
+4724	4724	^[\x20-\x7e]+?.{8}\x70\x98	2	0	0	1
+4725	4725	^[\x20-\x7e]+?.{8}\x4a\xae	2	0	0	1
+4726	4726	^[\x20-\x7e]+?.{8}\x71\x9e	2	0	0	1
+4727	4727	^.{8}[\x20-\x7e]+?[\x00]*?\x78\x9c	2	0	0	1
+4728	4728	^.{8}[\x20-\x7e]+?[\x00]*?\x78\x9c	2	0	0	1
+4729	4729	^.{8}[\x20-\x7e]+?\x79\x94	2	0	0	1
+4730	4730	^[\x20-\x7e]+?.{8}\x84\x60	2	0	0	1
+4731	4731	^[\x20-\x7e]+?.{8}\x40\xd8	2	0	0	1
+4732	4732	^[\x20-\x7e]+?.{8}\x7f\x94	2	0	0	1
+4733	4733	^[\x20-\x7e]+?.{8}\x79\x9c	2	0	0	1
+4734	4734	^[\x20-\x7e]+?.{8}\x7a\x9c	2	0	0	1
+4735	4735	^[\x20-\x7e]+?.{8}\x7e\x9c	2	0	0	1
+4736	4736	^[\x20-\x7e]+?.{8}\x39\x99	2	0	0	1
+4737	4737	^[\x20-\x7e]+?.{8}\x49\xa2	2	0	0	1
+4738	4738	^[\x20-\x7e]+?.{8}\x79\x9d	2	0	0	1
+4739	4739	^[\x20-\x7e]+?.{8}\x7b\x9f	2	0	0	1
+4740	4740	^[\x20-\x7e]+?.{8}\x79\x9a	2	0	0	1
+4741	4741	^[\x20-\x7e]+?.{8}\x70\x94	2	0	0	1
+4742	4742	^[\x20-\x7e]+?.{8}\x44\xdf	2	0	0	1
+4743	4743	^.{4}[\x20-\x7e]+?.{4}\x7b\x9e	2	0	0	1
+4744	4744	^[\x20-\x7e]+?.{8}\x7b\x9e	2	0	0	1
+4745	4745	^[\x20-\x7e]+?.{8}\x83\x7f	2	0	0	1
+4746	4746	^.{8}[\x20-\x7e]+?\x7c\x9f	2	0	0	1
+4747	4747	^[\x20-\x7e]+?.{8}\x7d\x9a	2	0	0	1
+4748	4748	^.{9,28}\x78\x9c	2	0	0	1
+4749	4749	^.{8}[\x20-\x7e]{5}\x78\x9c	2	0	0	1
+4750	4750	^[\x20-\x7e]+?.{8}\x4a\xd5	2	0	0	1
+4751	4751	^[\x20-\x7e]+?.{8}\x79\xdd	2	0	0	1
+4752	4752	^[\x20-\x7e]+?.{8}\x70\x9e	2	0	0	1
+4753	4753	^[\x20-\x7e]+?.{10}\x7a\x5d	2	0	0	1
+4754	4754	^.{8}[\x20-\x7e]+?.{5}\x7c\x9e	2	0	0	1
+4755	4755	^[\x20-\x7e]+?.{8}\x7d\x9e	2	0	0	1
+4756	4756	^[\x20-\x7e]+?.{8}\x70\x9c	2	0	0	1
+4757	4757	^[\x20-\x7e]+?.{8}\x3b\xdf	2	0	0	1
+4758	4758	^[\x20-\x7e]+?.{8}\x47\xd9	2	0	0	1
+4759	4759	^[\x20-\x7e]+?.{8}\x79\x99	2	0	0	1
+4760	4760	^.{8}[\x20-\x7e]+?.{2}\x78\x9c	2	0	0	1
+4761	4761	^.{4}[\x20-\x7e]{5}.{4}\x96\x71	2	0	0	1
+4762	4762	^[\x20-\x7e]+?.{8}\x7b\x9b	2	0	0	1
+4763	4763	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4764	4764	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4765	4765	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4766	4766	([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4767	4767	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4768	4768	^[a-f0-9]{32}	2	0	0	1
+4769	4769	>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}>	2	0	0	1
+4770	4770	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4771	4771	^[A-Za-z0-9_]{20}\/[a-f0-9]{40}$	2	0	0	1
+4772	4772	\/[a-z0-9]{1,31}\.bin$	2	0	0	1
+4773	4773	^[A-Za-z0-9\-_~]{75,}$	2	0	0	1
+4774	4774	(JmJ1aWxkP|YnVpbGQ9|ZidWlsZD)	2	0	0	1
+4775	4775	^[\x80|\x40]\x00[\x80|\x40]\x00\x00\x00	2	0	0	1
+4776	4776	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4777	4777	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4778	4778	^[A-Za-z0-9]{16,32}$	2	0	0	1
+4779	4779	^[a-zA-Z0-9_-]{171}$	2	0	0	1
+4780	4780	(Q(k(MIdh|UMcR)|0IPdR)|(DQg91|FRghw)F|(NCD3U|VGCHA)X|C(Qwh2E|RQxxF)|J(DCHYT|FDHEW)|R(UYIcB|kIJcR)|GQglxE|ZCCXEQ)	2	0	0	1
+4781	4781	(fCxTeXN0ZW0gSWRsZS|wsU3lzdGVtIElkbGUg|8LFN5c3RlbSBJZGxlI)	2	0	0	1
+4782	4782	(I(iwidmFsdWUiO|sInZhbHVlIjo)i|iLCJ2YWx1ZSI6I)	2	0	0	1
+4783	4783	^[0-9a-f]{64}$	2	0	0	1
+4784	4784	^[0-9a-f]{64}$	2	0	0	1
+4785	4785	^[\x01-\x4c]$	2	0	0	1
+4786	4786	CN=([^\r\n]+?\.)?OU=Delegated\ Licensor,KYP\ SDT\ LTD(\.)	2	0	0	1
+4787	4787	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4788	4788	^key=\w+\&data=	2	0	0	1
+4789	4789	^\d+$	2	0	0	1
+4790	4790	\.php\?zs=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&t=[0-9]{1,2}$	2	0	0	1
+4791	4791	^[0-9D]+$	2	0	0	1
+4792	4792	\.(dll|exe|zip|json)$	2	0	0	1
+4793	4793	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4794	4794	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4795	4795	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4796	4796	^\/[a-zA-Z0-9]{9,12}\/t\.html$	2	0	0	1
+4797	4797	^\/[a-z]{3,10}\.php\?[a-z]{3,10}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4798	4798	^[a-z]{256}$	2	0	0	1
+4799	4799	^[0-9]&(index|pi|serv)=	2	0	0	1
+4800	4800	^[0-9]&(index|pi|serv)=	2	0	0	1
+4801	4801	^[0-9]&(index|pi|serv)=	2	0	0	1
+4802	4802	^\/[a-zA-Z0-9+=]{29,44}.{0,8}=$	2	0	0	1
+4803	4803	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4804	4804	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})([\r\n]([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?$	2	0	0	1
+4805	4805	^[A-Za-z0-9]{1,15}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+4806	4806	(IiwiM2ZlMTEiOi|IsIjNmZTExIjoi|iLCIzZmUxMSI6I)	2	0	0	1
+4807	4807	(IiwiYXU1byI6I|IsImF1NW8iOi|iLCJhdTVvIjoi)	2	0	0	1
+4808	4808	(ifQ==|In0=|J9)$	2	0	0	1
+4809	4809	^[a-z]{256}-\.jpg$	2	0	0	1
+4810	4810	^[IJKL].*(PT0iLC|09Iiwi|9PSIsI)[a-zA-Z0-9+\/]+(PT0iLC|09Iiwi|9PSIsI)	2	0	0	1
+4811	4811	^[a-f0-9]{5,12}&a=	2	0	0	1
+4812	4812	^[a-zA-Z0-9]{12}\.onion	2	0	0	1
+4813	4813	^\x7b(\x22[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.[a-z]{2,10}\x22,){4}\x22[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.[a-z]{2,10}\x22\x7d$	2	0	0	1
+4814	4814	^[a-z]{256}\.gif$	2	0	0	1
+4815	4815	(JTBEJTBBJTBEJTBBJTREJTY1JTZEJTZGJTcyJTc5JTNBJTIw|UwRCUwQSUwRCUwQSU0RCU2NSU2RCU2RiU3MiU3OSUzQSUyM|lMEQlMEElMEQlMEElNEQlNjUlNkQlNkYlNzIlNzklM0ElMj)	2	0	0	1
+4816	4816	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d+)?$	2	0	0	1
+4817	4817	^\/[a-zA-Z0-9]{9,12}\/x\.html$	2	0	0	1
+4818	4818	^[0-9]+$	2	0	0	1
+4819	4819	^([A-Za-z0-9%+\/]{4,6})*([A-Za-z0-9%+\/]{2}==|[A-Za-z0-9%+\/]{3}=|[A-Za-z0-9%+\/]{4})$	2	0	0	1
+4820	4820	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4821	4821	^[\x01-\x04]	2	0	0	1
+4822	4822	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4823	4823	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4824	4824	[a-z]{8}.(:?psd|dib)	2	0	0	1
+4825	4825	[a-z]{8}.(:?dib|psd)	2	0	0	1
+4826	4826	https:\/\/[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}.[a-z]{3,12}.com\/[a-z]{3,4}\/[a-z0-9]{6}_[a-z0-9]{32}	2	0	0	1
+4827	4827	^[a-z0-9]{6}_[a-z0-9]{32}	2	0	0	1
+4828	4828	\.php\?[a-z]{3}=(baby|child|adult)	2	0	0	1
+4829	4829	^[a-f0-9=]{5,12}&ap=	2	0	0	1
+4830	4830	^[0-9]{8}$	2	0	0	1
+4831	4831	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4832	4832	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4833	4833	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4834	4834	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4835	4835	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4836	4836	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4837	4837	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4838	4838	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4839	4839	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4840	4840	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4841	4841	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$	2	0	0	1
+4842	4842	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$	2	0	0	1
+4843	4843	^(update|designs)$	2	0	0	1
+4844	4844	^\d$	2	0	0	1
+4845	4845	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a80$	2	0	0	1
+4846	4846	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4847	4847	\*\*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\*\*	2	0	0	1
+4848	4848	^\/wp\x2dcontent\/[a-z]{3}\/[0-9]{16}\.exe$	2	0	0	1
+4849	4849	^[A-Za-z0-9-_]{176}$	2	0	0	1
+4850	4850	^\/\.x\/irq\d$	2	0	0	1
+4851	4851	^\/\.x\/\dsh$	2	0	0	1
+4852	4852	^(?<len>.{2})\xc0\xff(=len)\x00\x00.{2}\x00\x00\x01\x78\x9c	2	0	0	1
+4853	4853	\x24url[0-9]{1}\s=\s'(http|https):\/\/[^']*\x27\x3b	2	0	0	1
+4854	4854	^\/[A-Za-z0-9]{10,11}\/	2	0	0	1
+4855	4855	\.php\?serial=[a-z0-9]{16}	2	0	0	1
+4856	4856	^[0-3]{2}_[0-2]{2}\.php$	2	0	0	1
+4857	4857	^dBrowser\x20\d\x20CallGetResponse\x3a\d$	2	0	0	1
+4858	4858	^\/\w$	2	0	0	1
+4859	4859	^\/wrte\?maid=[A-Z0-9]{8}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{12}$	2	0	0	1
+4860	4860	^\/[a-z0-9]{1,3}\/service\?uuid=[A-Z0-9]{8}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{12}$	2	0	0	1
+4861	4861	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n][\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n][\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4862	4862	^\/wp-includes\/[A-Za-z0-9]{10}\/$	2	0	0	1
+4863	4863	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4864	4864	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4865	4865	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4866	4866	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4867	4867	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4868	4868	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4869	4869	^[A-Za-z0-9]{16,32}$	2	0	0	1
+4870	4870	^[A-Za-z0-9]{16,32}$	2	0	0	1
+4871	4871	^\d+$	2	0	0	1
+4872	4872	^\/[A-Za-z0-9]{30}\.php$	2	0	0	1
+4873	4873	^[a-f0-9]{5}([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})[a-f0-9]{2}-v[a-f0-9]{2}\x0a\x22\x3e\x0a\x3c	2	0	0	1
+4874	4874	^([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})$	2	0	0	1
+4875	4875	^[a-zA-Z0-9+\/]+([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})$	2	0	0	1
+4876	4876	^[a-zA-Z0-9+\/]+([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})$	2	0	0	1
+4877	4877	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4878	4878	^[a-z0-9]{8}\r\n	2	0	0	1
+4879	4879	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+4880	4880	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4881	4881	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4882	4882	^[0-9]{6,10}\.	2	0	0	1
+4883	4883	^\/[a-zA-z]{14}\/	2	0	0	1
+4884	4884	^\/[a-zA-z]{14}\/	2	0	0	1
+4885	4885	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4886	4886	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4887	4887	^[A-Z]{16}$	2	0	0	1
+4888	4888	^\/\x3fusername\x3d[a-z0-9]{2,3}_\d$	2	0	0	1
+4889	4889	^[A-Z]{16}$	2	0	0	1
+4890	4890	^[A-Z]{16}$	2	0	0	1
+4891	4891	^([A-F0-9]\x00){12}	2	0	0	1
+4892	4892	^([A-F0-9]\x00){12}	2	0	0	1
+4893	4893	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4894	4894	^[A-F0-9]{12}	2	0	0	1
+4895	4895	^([A-F0-9]\x00){12}	2	0	0	1
+4896	4896	^[A-F0-9]{12}	2	0	0	1
+4897	4897	^(<letter>[a-z])(=letter)\,	2	0	0	1
+4898	4898	O=(GoDaddy)[A-Z][a-z]+\s[A-Z][a-z]+\s(NL|Pty|Inc|Corp|Ltd)\.?,.+CN=[a-z]{5,}\.[a-z]{2,3}($|,)	2	0	0	1
+4899	4899	[eE]mail(Address)admin@	2	0	0	1
+4900	4900	^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email)	2	0	0	1
+4901	4901	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+4902	4902	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+4903	4903	^[A-F0-9]{12}	2	0	0	1
+4904	4904	^\d	2	0	0	1
+4905	4905	^\x2F[a-z]{1}\x2Ehtm$	2	0	0	1
+4906	4906	\/index.dat\?\d{5,9}$	2	0	0	1
+4907	4907	^\/[A-Za-z]{2,}\/\?[a-z]\sHTTP\/1\.[0-1]\r\nUser-Agent\x3a Mozilla\/4\.0 \x28compatible\x3b MSIE 7\.0\x3b Windows NT 5\.1\x3b SV1\x29\r\nHost\x3a\x20[^\r\n]+?(\x3a(443|8080|900[0-9]))?\r\n(Connection\x3a\x20Keep-Alive\r\n)?\r\n$	2	0	0	1
+4908	4908	^Host\x3a\x20([a-z0-9]{0,19}[A-Z])([A-Z0-9]{0,19}[a-z])[a-zA-Z0-9]{4,20}\.[a-z]{2,3}/H	2	0	0	1
+4909	4909	^[a-zA-Z0-9\+\/]+={0,2}$/P	2	0	0	1
+4910	4910	filename=[a-f0-9]{32}v\.(docm|zip)\x0d\x0a/Hmi	2	0	0	1
+4911	4911	^((\x00\x00\x00).)*?_\x00((\x00\x00).)*?_\x00((\x00\x00).)*?_\x00((\x00\x00).)*?\x2e\x00t\x00x\x00t	2	0	0	1
+4912	4912	^[a-z]\x29	2	0	0	1
+4913	4913	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title	2	0	0	1
+4914	4914	^.{2}([a-z]{0,15}\d)(<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x0a.{2}(=var)	2	0	0	1
+4915	4915	^\/[a-z]$	2	0	0	1
+4916	4916	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4917	4917	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4918	4918	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4919	4919	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4920	4920	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4921	4921	^.{2}(<fake_loc>([asdfgh]+|[qwerty]+|[zxcvbn]+|[23werf]+)[01]).+?\x06\x03\x55\x04\x07.{2}(=fake_loc)	2	0	0	1
+4922	4922	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4923	4923	^[a-z0-9/=\+]$	2	0	0	1
+4924	4924	^[a-z0-9/=\+]$	2	0	0	1
+4925	4925	^\/d\/[a-z]+\d+\.jpg$	2	0	0	1
+4926	4926	\/p?2p\/[0-9]{1,2}\.exe$	2	0	0	1
+4927	4927	^\/2p\/[a-z]{1,2}\.exe$	2	0	0	1
+4928	4928	\/[a-z0-9]{3,}\.gz$	2	0	0	1
+4929	4929	\/mss\d+\.exe$	2	0	0	1
+4930	4930	^\/download\/ftp\/(grabftp|grabftp64)\.bin$	2	0	0	1
+4931	4931	^\/image\/(data|flags)\/[^\x2f]+\.exe$	2	0	0	1
+4932	4932	(\x20MSIE\x20|rv\x3a11)	2	0	0	1
+4933	4933	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4934	4934	^\/[a-z]{3,6}\/[a-z]{3,6}\.[a-z]{3}$	2	0	0	1
+4935	4935	^[A-Z]{2}-[0-9]{1,5}\x3aBegin$	2	0	0	1
+4936	4936	^[A-Z]{2}-[0-9]{1,5}\x3aStartU$	2	0	0	1
+4937	4937	^\/command\/[A-Fa-f0-9]{8}\-([A-Fa-f0-9]{4}\-){3}[A-Fa-f0-9]{12}\.cmd$	2	0	0	1
+4938	4938	^<CHECK>([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/CHECK>	2	0	0	1
+4939	4939	^\{\x22uid\x22\x3a\x22[a-f0-9]+\x22\}$	2	0	0	1
+4940	4940	^[A-Za-z0-9_-]{171}$	2	0	0	1
+4941	4941	^\/[a-f0-9]{8}\/\D+\d{8,10}\.html$	2	0	0	1
+4942	4942	^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}\/){1,10})\sHTTP\/1\.1\r\nReferer\x3a\x20http:\/\/(\d{1,3}\.){3}\d{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+4943	4943	^\x2f\x00{3}[A-Z0-9]{6}_[a-f0-9]+\x00{16}$	2	0	0	1
+4944	4944	[A-Za-z0-9]{62}	2	0	0	1
+4945	4945	^(php)?Yuok\\\d\d	2	0	0	1
+4946	4946	Data\\\d\d	2	0	0	1
+4947	4947	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+4948	4948	^\/\?id\=[A-Z]{12,28}[0-9]$	2	0	0	1
+4949	4949	^\/\?id\=[A-Z]{12,28}[0-9]$	2	0	0	1
+4950	4950	\/\?p=p52dcW[A-Za-z]{4}	2	0	0	1
+4951	4951	^.{2}(<var>[a-zA-Z0-9]{24}[01]).+?\x06\x03\x55\x04\x07.{2}(=var)	2	0	0	1
+4952	4952	^(<var>[a-zA-Z0-9]{1,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+4953	4953	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+4954	4954	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+4955	4955	^.(<orgname>.[^01]+).*?\x55\x04\x0b.(=orgname)	2	0	0	1
+4956	4956	[^\x15][^\x49\x3f\x3e\x28\x69\x2f\x2e\x37\x2a\x29\x2b\x39\x36][\x20-\x27\x2c\x2d\x30\x31\x33-\x36\x38\x3b-\x3d\x40-\x47\x4a-\x4d\x4f\x50-\x5f\x60\x68\x6b-\x6f\x70-\x74\x76-\x7f]{1,14}\x15	2	0	0	1
+4957	4957	^[0-9]-[0-9]-[0-9]{5}-[0-9]\r\n	2	0	0	1
+4958	4958	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4959	4959	^[A-Za-z0-9\/_\-\+]{171}=$	2	0	0	1
+4960	4960	[a-zA-Z0-9]{8}\/	2	0	0	1
+4961	4961	^[a-z]\.(tech|online)$	2	0	0	1
+4962	4962	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+4963	4963	^[a-zA-Z0-9-_]{171}$	2	0	0	1
+4964	4964	[a-z0-9]{8}\/.*\?[a-z0-9]{3,10}=[a-z0-9]{8,11}$	2	0	0	1
+4965	4965	updateb\.php\?p=\d	2	0	0	1
+4966	4966	&os=[0-9a-z]{40}	2	0	0	1
+4967	4967	&(<vname>[a-z]+)1=[A-F0-9]+&(=vname)2=[A-F0-9]+&(=vname)3=[A-F0-9]+&(=vname)4=[A-F0-9]	2	0	0	1
+4968	4968	^[1-z]{13}=[0-9]{16}$	2	0	0	1
+4969	4969	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4970	4970	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4971	4971	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4972	4972	^\/[A-F0-9]{33}$	2	0	0	1
+4973	4973	^\d+?\x00	2	0	0	1
+4974	4974	%(USERPROFILE|APPDATA)%	2	0	0	1
+4975	4975	%(USERPROFILE|APPDATA)%	2	0	0	1
+4976	4976	%(USERPROFILE|APPDATA)%	2	0	0	1
+4977	4977	%(USERPROFILE|APPDATA)%	2	0	0	1
+4978	4978	^[0-9]{10}$	2	0	0	1
+4979	4979	^key=[A-F0-9]{32}$	2	0	0	1
+4980	4980	^[a-f0-9]{60}\x0d\x0a	2	0	0	1
+4981	4981	^(pro)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4982	4982	[0-9]{1,2}	2	0	0	1
+4983	4983	\d{1,2}	2	0	0	1
+4984	4984	[0-9]{1,2}	2	0	0	1
+4985	4985	[0-9]{1,2}	2	0	0	1
+4986	4986	[0-9]{1,2}	2	0	0	1
+4987	4987	[0-9]{1,2}	2	0	0	1
+4988	4988	CN=([^\r\n]+?\.)?supportmicrohere\.com(\.)	2	0	0	1
+4989	4989	CN=([^\r\n]+?\.)?jbdelmarket\.com(\.)	2	0	0	1
+4990	4990	[0-9]{1,3}	2	0	0	1
+4991	4991	[0-9]{1,3}	2	0	0	1
+4992	4992	^ETag\x3a\x20[0-9]{6}-[0-9]{3,5}-[0-9]{8}\r\n	2	0	0	1
+4993	4993	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+4994	4994	[a-f0-9]{60}$	2	0	0	1
+4995	4995	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+4996	4996	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+4997	4997	^[a-z0-9]{33}	2	0	0	1
+4998	4998	^[qbedm]{1}[a-zA-Z]{1,3}646[a-zA-Z0-9]{1,3}\.	2	0	0	1
+4999	4999	^[zjr9x]{1}[tmdhpz]{1}[0-9a-z]{1,6}266([a-zA-Z0-9]{1,6})?\.	2	0	0	1
+5000	5000	^5\.[0-2]\x20\d\d\x3a\d\d\x20	2	0	0	1
+5001	5001	^\d{1,5}\x00ll	2	0	0	1
+5002	5002	^LIST-[A-Za-z0-9]{16}\.	2	0	0	1
+5003	5003	^LS-[A-Za-z0-9]{16}\.	2	0	0	1
+5004	5004	^SIZE-[A-Za-z0-9]{16}\.	2	0	0	1
+5005	5005	^LD-[A-Za-z0-9]{16}\.	2	0	0	1
+5006	5006	^CB-[A-Za-z0-9]{16}\.	2	0	0	1
+5007	5007	^CD-[A-Za-z0-9]{16}\.	2	0	0	1
+5008	5008	^EX-[A-Za-z0-9]{16}\.	2	0	0	1
+5009	5009	^ALIVE-[A-Za-z0-9]{16}\.	2	0	0	1
+5010	5010	^EXIT-[A-Za-z0-9]{16}\.	2	0	0	1
+5011	5011	^finito-[A-Za-z0-9]{16}\.	2	0	0	1
+5012	5012	^.{4}(R(k(Z(GQkBG|CQEY)|BCRUVG)|0FFRkFH|UJDQUE)|Q(U(V(CQ0FB|GQUc)|NCRkI)|kFDQkZC|EJFRUY)|(Z(AQkVF|GRkJA)R|JBQ0JGQ)g|FFQkNBQQ|dBRUZBRw)	2	0	0	1
+5013	5013	\/([0-9]{2,8}\.)?[0-9]{4,16}\.dat$	2	0	0	1
+5014	5014	\/([0-9]{2,8}\.)?[0-9]{4,16}\.dat$	2	0	0	1
+5015	5015	^(send|receive)	2	0	0	1
+5016	5016	^(send|receive)	2	0	0	1
+5017	5017	^(send|receive)	2	0	0	1
+5018	5018	^(send|receive)	2	0	0	1
+5019	5019	^[0-9a-zA-Z]{32}	2	0	0	1
+5020	5020	^\/\.x\/var\/run\/tty\d$	2	0	0	1
+5021	5021	^\/var\/(run|tmp)\/pty$	2	0	0	1
+5022	5022	^\/[a-z0-9]{45,60}\/[a-z0-9]{35,65}\/[a-z0-9]{38,60}\.php\?data=active$	2	0	0	1
+5023	5023	^\/\?m=[abcde]&p1=[a-f0-9-]{8,40}(&p2=[^&]+)?(&p3=[^&]+)?$	2	0	0	1
+5024	5024	^sg\x3a\x20[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}[\r\n]+$	2	0	0	1
+5025	5025	\/\?m=[a-z]&p1=[a-z0-9]{8,12}(&p2=[^&]+)?(&p3=[^&]+)?$	2	0	0	1
+5026	5026	^[A-Za-z0-9+=/]{172}$	2	0	0	1
+5027	5027	^(FileManager|PortScan|ExecuteCommand|DatabaseManager)	2	0	0	1
+5028	5028	^[A-Za-z]{15,20}$	2	0	0	1
+5029	5029	^PHPSESSID=[a-z0-9]{26}$	2	0	0	1
+5030	5030	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5031	5031	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5032	5032	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5033	5033	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5034	5034	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5035	5035	^[\da-z]{11}	2	0	0	1
+5036	5036	^[A-Z]{2}	2	0	0	1
+5037	5037	^[A-Z]{2}	2	0	0	1
+5038	5038	^\/admin[0-9]?\/client\.php$	2	0	0	1
+5039	5039	^\/[a-z0-9]{16}\/	2	0	0	1
+5040	5040	^(\d{1,3}\.){3}\d{1,3}\|\|	2	0	0	1
+5041	5041	^\/[a-zA-Z0-9]{1,25}\-[a-f0-9]{8}$	2	0	0	1
+5042	5042	^[a-f0-9]{32}	2	0	0	1
+5043	5043	^[A-Z]{2}[A-F0-9]{16}	2	0	0	1
+5044	5044	^Referer\x3a\x20[a-zA-Z0-9_\-.]+\x28[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]\x29\w+\x0d\x0a	2	0	0	1
+5045	5045	^[A-Z0-9]{18}$	2	0	0	1
+5046	5046	^[A-Za-z0-9+/=]{730,}	2	0	0	1
+5047	5047	^[a-f0-9]{32}	2	0	0	1
+5048	5048	^[a-f0-9]{32}	2	0	0	1
+5049	5049	\/([a-zA-Z0-9+/\x20]{4})*([a-zA-Z0-9+/\x20]{2}==|[a-zA-Z0-9+/\x20]{5}=|[a-zA-Z0-9+/\x20]{4})([a-zA-Z=]{4}?)$	2	0	0	1
+5050	5050	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5051	5051	^\/([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})([a-zA-Z=]{4})?(\x20?)$	2	0	0	1
+5052	5052	^\/([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})([a-zA-Z=]{4})?(\x20?)$	2	0	0	1
+5053	5053	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+5054	5054	(([a-zA-Z0-9]\0){10,})	2	0	0	1
+5055	5055	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+5056	5056	^\/([a-zA-Z0-9]{280,408})$	2	0	0	1
+5057	5057	^\/([a-zA-Z0-9=]{60,408})$	2	0	0	1
+5058	5058	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+5059	5059	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+5060	5060	(TWljcm9zb2Z0IENvcnBvcmF0aW9uL|1pY3Jvc29mdCBDb3Jwb3JhdGlvbi|NaWNyb3NvZnQgQ29ycG9yYXRpb24u)[a-zA-Z0-9\x2f\x2b]{25,35}(Cg0KQzpc|oNCkM6XD|KDQpDOlw\x2b)	2	0	0	1
+5061	5061	^[0-9]{3}$	2	0	0	1
+5062	5062	(www\.((b(an(co(dobrasil|hsbc)|espa)|radesco(prime)?|b)|hsbc(pr(ivatebank|emier)|ba(merindus|nk))?|s(antander(banespa|net)?|erasa(experian)?)|uolhost)\.com\.br|c((aixa((economica(federal)?|qui)\.gov|\.(com|gov))|onsultasintegradas\.rs\.gov|ef\.(com|gov))\.br|redicard\.com(\.br)?)|itau(p(ersonnalite|rivatebank)|uniclass)?\.com\.br,|ame(ricanexpress\.com(\.br)?|x\.com\.br))|((b(an(co(dobrasil|hsbc)|risul)|radesco(prime)?|b)|hsbc(pr(ivatebank|emier)|ba(merindus|nk))?|s(erasa(experian)?|antander)|uolhost)\.com|c(aixa((economica(federal)?|qui)\.gov|\.(com|gov))|onsultasintegradas\.rs\.gov|ef\.(com|gov)|redicard\.com))\.br|itau((p(ersonnalite|rivatebank)|uniclass)\.com\.br|\.com\.br,)|ame(ricanexpress.com(\.br)?|x\.com\.br)|\*(linhadefensiva*|hsbc*))	2	0	0	1
+5063	5063	^\/(GetProDownConfig|downservers|ShopIp)\.aspx\?ShopId=[0-9]+$	2	0	0	1
+5064	5064	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+5065	5065	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+5066	5066	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+5067	5067	^\x5b[A-Z]{2}\x5d\x20[A-Z0-9]{32}\x20\x5b[0-9]{2}\x2d[0-9]{2}\x2d[0-9]{4}\x20[0-9]{2}\x2d[0-9]{2}\x2d[0-9]{2}\x5d\x5bsplit\x5d	2	0	0	1
+5068	5068	Subject\x3a[0-9]{1,2}\x2f[0-9]{1,2}\x2f[0-9]{4}\x20[0-9]{1,2}\x3a[0-9]{1,2}\x3a[0-9]{2}\x20[AP]	2	0	0	1
+5069	5069	^\d{3,6}$	2	0	0	1
+5070	5070	^.{2}([A-Z]{0,32}[^A-Z01])(<var>[^01]{4,33}[01]).+?\x06\x03\x55\x04\x08.{2}(=var)	2	0	0	1
+5071	5071	^\/[A-Za-z0-9]{16}\/[A-Za-z0-9]{16}\.php$	2	0	0	1
+5072	5072	^\/[A-Za-z0-9]{16}\/[A-Za-z0-9]{48}\.mp3$	2	0	0	1
+5073	5073	[A-Za-z0-9]{16}\x0d\x0a/Content|2d|Disposition|3a	2	0	0	1
+5074	5074	^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}	2	0	0	1
+5075	5075	^[A-Za-z0-9=/+]{100}	2	0	0	1
+5076	5076	^[A-Za-z0-9=/+]{100}	2	0	0	1
+5077	5077	CN=([^\r\n]+?\.)?edou\.me(\.)	2	0	0	1
+5078	5078	^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}\}	2	0	0	1
+5079	5079	^###\d+###[a-zA-Z0-9\-\.]{2,63}###\x00+$	2	0	0	1
+5080	5080	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+5081	5081	^([A-Za-z0-9]{4})*([A-Za-z0-9]{2}==|[A-Za-z0-9]{3}=|[A-Za-z0-9]{4})$	2	0	0	1
+5082	5082	^[A-Za-z0-9=+/\x22\x00]{100,1000}$	2	0	0	1
+5083	5083	^([A-F0-9]\x00){12}	2	0	0	1
+5084	5084	^[A-Za-z0-9]{262}$	2	0	0	1
+5085	5085	^[a-f0-9]{32}	2	0	0	1
+5086	5086	^(\x3a\d{1,5})?$	2	0	0	1
+5087	5087	^[A-Za-z0-9-_]{171}$	2	0	0	1
+5088	5088	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5089	5089	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5090	5090	\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|	2	0	0	1
+5091	5091	^(([a-z0-9])()){33,}\.ru$	2	0	0	1
+5092	5092	^\x12\x0b\x01\x00\x00\x01[\x00]{6}.[a-f0-9]{6,}(([\x01|\x02|\x03]\d{1,3}){4}|\x03::1)\x00\x00\x01	2	0	0	1
+5093	5093	^(0\x3d\w\x261\x3d\d{3}\x262\x3d\d{3})$	2	0	0	1
+5094	5094	^\d{6}	2	0	0	1
+5095	5095	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5096	5096	^.(<servercert>[\x00-\xff][\x20-\x7f]{1,50})\x30.+?\x55\x04\x03.(=servercert)\x30	2	0	0	1
+5097	5097	[a-f0-9]{24}\.[a-f0-9]{16}	2	0	0	1
+5098	5098	^[a-z]{4}\x3d	2	0	0	1
+5099	5099	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+5100	5100	^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}	2	0	0	1
+5101	5101	^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}	2	0	0	1
+5102	5102	^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}	2	0	0	1
+5103	5103	^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}	2	0	0	1
+5104	5104	^[a-f0-9]{32}\x7c\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x7c	2	0	0	1
+5105	5105	^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+5106	5106	^(ct_start|chr_start|moz_start|grb_start|upl_start)	2	0	0	1
+5107	5107	^(sqlite|mozglue|nss3|freebl3|softokn3)	2	0	0	1
+5108	5108	\{[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}\}	2	0	0	1
+5109	5109	\.jpg\?id=\d+$	2	0	0	1
+5110	5110	^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}	2	0	0	1
+5111	5111	^([A-Za-z0-9\x2b\x2f\x3d]){15,25}$	2	0	0	1
+5112	5112	^([A-Za-z0-9\x2b\x2f\x3d]){10,30}$	2	0	0	1
+5113	5113	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5114	5114	^\/[a-zA-Z0-9]{32}$	2	0	0	1
+5115	5115	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5116	5116	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+5117	5117	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+5118	5118	^[A-F0-9]{8}\-[A-F0-9]{4}\-[A-F0-9]{4}\-[A-F0-9]{4}\-[A-F0-9]{12}$	2	0	0	1
+5119	5119	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5120	5120	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5121	5121	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5122	5122	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5123	5123	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5124	5124	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5125	5125	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5126	5126	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5127	5127	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5128	5128	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5129	5129	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5130	5130	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5131	5131	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5132	5132	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5133	5133	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5134	5134	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5135	5135	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5136	5136	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)	2	0	0	1
+5137	5137	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5138	5138	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5139	5139	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5140	5140	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5141	5141	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5142	5142	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5143	5143	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5144	5144	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5145	5145	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5146	5146	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5147	5147	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)	2	0	0	1
+5148	5148	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5149	5149	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5150	5150	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5151	5151	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5152	5152	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5153	5153	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)	2	0	0	1
+5154	5154	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5155	5155	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5156	5156	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5157	5157	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5158	5158	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5159	5159	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5160	5160	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5161	5161	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5162	5162	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5163	5163	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5164	5164	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5165	5165	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+5166	5166	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+5167	5167	^\d{4}\/\w{2,8}_\w{8}\.bmp	2	0	0	1
+5168	5168	\.(bmp|png|jpe?g)$	2	0	0	1
+5169	5169	\.(bmp|png|jpe?g)$	2	0	0	1
+5170	5170	\.(bmp|png|jpe?g)$	2	0	0	1
+5171	5171	\.(bmp|png|jpe?g)$	2	0	0	1
+5172	5172	\.(bmp|png|jpe?g)$	2	0	0	1
+5173	5173	\/\d{6,8}\/\w{2,5}_\w{8}\.bmp$	2	0	0	1
+5174	5174	^[0-9]{15,16}\x7d$	2	0	0	1
+5175	5175	^[a-z0-9]{19}	2	0	0	1
+5176	5176	^[a-f0-9]{32}\.gif\"	2	0	0	1
+5177	5177	^[A-Za-z0-9]{3,20}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+5178	5178	^[a-f0-9]{32}	2	0	0	1
+5179	5179	^\d{14}\.jpg\x22/P	2	0	0	1
+5180	5180	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+5181	5181	^((([a-f0-9]){2}){16})	2	0	0	1
+5182	5182	^[A-Z0-9]{12}$	2	0	0	1
+5183	5183	^[A-Z0-9]{10}\x22	2	0	0	1
+5184	5184	^images[a-f0-9]{8}\.	2	0	0	1
+5185	5185	^[a-f0-9]{12}	2	0	0	1
+5186	5186	^[A-F0-9]{32}	2	0	0	1
+5187	5187	^([A-Za-z0-9~\+\/]{4})*([A-Za-z0-9~\+\/]{2}==|[A-Za-z0-9~\+\/]{3}=|[A-Za-z0-9~\+\/]{4})$	2	0	0	1
+5188	5188	^\d+\.\d+\.\d{3,5}	2	0	0	1
+5189	5189	^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\x7c	2	0	0	1
+5190	5190	^([0-9A-F]{2}(-)?){16}\x7c	2	0	0	1
+5191	5191	^http|3a 2f 2f|[a-z]{5,10}.(com|org|net)\/$	2	0	0	1
+5192	5192	^[a-f0-9]{8}\-[a-f0-9]{8}\x22\x0d\x0a	2	0	0	1
+5193	5193	^AUTHINFO\s+USER\s[^\n]{200}	2	0	0	1
+5194	5194	^SEARCH\s+[^\n]{1024}	2	0	0	1
+5195	5195	--backup-dir\s+\x2e\x2e\x2f	2	0	0	1
+5196	5196	^200\s[^\n]{64}	2	0	0	1
+5197	5197	^Location\x3a[^\n]{128}	2	0	0	1
+5198	5198	^newgroup\x3a[^\n]{21}	2	0	0	1
+5199	5199	^XAT\s+[^\n]{1024}	2	0	0	1
+5200	5200	^sendsys\x3a[^\n]{21}	2	0	0	1
+5201	5201	^checkgroups\x3a[^\n]{21}	2	0	0	1
+5202	5202	^ihave\x3a[^\n]{21}	2	0	0	1
+5203	5203	^rmgroup\x3a[^\n]{21}	2	0	0	1
+5204	5204	^sendme\x3a[^\n]{21}	2	0	0	1
+5205	5205	^senduuname\x3a[^\n]{21}	2	0	0	1
+5206	5206	^version\x3a[^\n]{21}	2	0	0	1
+5207	5207	Enter User Name\x3a(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*\s*(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*f(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*a(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*c(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*t(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*o(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*r(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*y(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*[\r\n]	2	0	0	1
+5208	5208	\x2FHiShowServlet\x2Fservlet.+(InstalNum|UserActivation)	2	0	0	1
+5209	5209	Host\x3A[^\n\r]*jiao.com/Hi	2	0	0	1
+5210	5210	imei=\d{2}-?\d{6}-?\d{6,}-?\d{1,}	2	0	0	1
+5211	5211	^\s*?\(\s*?(<var>[^\x3d\x3b\)\s]+)\s*\s*?0\s*?\x3b\s*?(=var)\s*?\<\s*?(0x)?\d{4,}\s*?\x3b\s*?(=var)\+\+\s*?\)\s*?\x7b\s*?(<var2>[^\x3d\x3b\)\s]+)\s*\s*?(=var2)\s*?\+\s*?[\x22\x27]\d+[\x22\x27]	2	0	0	1
+5212	5212	^\s*?\(\s*?(<var>[^\x3d\x3b\)\s]+)\s*\s*?0\s*?\x3b\s*?(=var)\s*?\<\s*?(0x)?\d{4,}\s*?\x3b\s*?(=var)\+\+\s*?\)\s*?\x7b\s*?(<var2>[^\x3d\x3b\)\s]+)\s*\s*?(=var2)\s*?\+\s*?[\x22\x27]\d+[\x22\x27]	2	0	0	1
+5213	5213	\/kt\/JpNx9n$	2	0	0	1
+5214	5214	^\d{15}\r\n$	2	0	0	1
+5215	5215	^[a-f0-9]	2	0	0	1
+5216	5216	^[a-f0-9]	2	0	0	1
+5217	5217	^(update|startcharge)	2	0	0	1
+5218	5218	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+5219	5219	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+5220	5220	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+5221	5221	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+5222	5222	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+5223	5223	^((sear|wat)ch|results|close|find|open)\/\?[a-zA-Z]{2,8}=	2	0	0	1
+5224	5224	^bot_id=[a-f0-9]{32}&	2	0	0	1
+5225	5225	\/RequestActionsToExecute$	2	0	0	1
+5226	5226	\/n\/\d{15}$	2	0	0	1
+5227	5227	\/ad-(strat|devi)\/$	2	0	0	1
+5228	5228	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+5229	5229	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+5230	5230	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+5231	5231	^[a-f0-9]{30,35}&app_package_name=	2	0	0	1
+5232	5232	^\/flash\/api\.php\?id=\d	2	0	0	1
+5233	5233	^Host\x3a[^\r\n]+?dmp\.[^\r\n]+?\r?$	2	0	0	1
+5234	5234	^\/gac\/[a-f0-9]{15}$	2	0	0	1
+5235	5235	&game=[a-f0-9]{40}$	2	0	0	1
+5236	5236	&id=\d{15}$	2	0	0	1
+5237	5237	^Host\x3a\x20[a-z0-9.]+\.bb800\.com	2	0	0	1
+5238	5238	^Host\x3a\x20[a-z0-9.]+\.bb800\.com	2	0	0	1
+5239	5239	\/NotifyLog$	2	0	0	1
+5240	5240	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+5241	5241	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+5242	5242	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+5243	5243	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+5244	5244	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+5245	5245	^d(id|ei)=[A-F0-9]{10,100}&method=IS[A-Z]{1,10}$	2	0	0	1
+5246	5246	&data=(([A-Za-z0-9]|%2[FB]){4})*(([A-Za-z0-9]|%2[FB]){2}==|([A-Za-z0-9]|%2[FB]){3}=|([A-Za-z0-9]|%2[FB]){4})$	2	0	0	1
+5247	5247	^Host\x3a[^\n\r]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[\r\n]+$	2	0	0	1
+5248	5248	\.php\?id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&type=	2	0	0	1
+5249	5249	\?id=([a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$	2	0	0	1
+5250	5250	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+5251	5251	Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r)	2	0	0	1
+5252	5252	(^|&|\x22|\{\x22)id(=|\x22\x3a\x22)([a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})(&|\x22|$)	2	0	0	1
+5253	5253	^\{\x22(os|type)\x22\x3a	2	0	0	1
+5254	5254	^[a-z]{15}\.(com|ru|cn|su)$/W	2	0	0	1
+5255	5255	^[a-z]{15}\.(com|ru|cn|su)$/W	2	0	0	1
+5256	5256	^[a-z]{15}\.(com|ru|cn|su)$/W	2	0	0	1
+5257	5257	\.php\?m=[abcdefgh]&p1=[a-f0-9]{16}&p2=[^\r\n]+$	2	0	0	1
+5258	5258	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5259	5259	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5260	5260	\.php\?m=[abcdefgh]&p1=[a-f0-9]{16}$	2	0	0	1
+5261	5261	^[a-z]{15}\.(ru|su|cn)$	2	0	0	1
+5262	5262	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+5263	5263	^([0-9]{15})$	2	0	0	1
+5264	5264	(\x00\\\x00.*?){2}\x00{2}\xFF{2}.{128,}[\x04-\xFF][\x00-\xFF]{3}\x00{4}$	2	0	0	1
+5265	5265	(\x00\\\x00.*?){2}\x00{2}\xFF{2}.{128,}[\x04-\xFF][\x00-\xFF]{3}\x00{4}$	2	0	0	1
+5266	5266	^.{4}	2	0	0	1
+5267	5267	^.{4}	2	0	0	1
+5268	5268	^.{4}	2	0	0	1
+5269	5269	^.{27}	2	0	0	1
+5270	5270	^.{27}	2	0	0	1
+5271	5271	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5272	5272	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5273	5273	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5274	5274	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5275	5275	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5276	5276	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5277	5277	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5278	5278	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5279	5279	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5280	5280	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5281	5281	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5282	5282	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5283	5283	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5284	5284	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5285	5285	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5286	5286	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5287	5287	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5288	5288	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5289	5289	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5290	5290	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5291	5291	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5292	5292	^.{27}	2	0	0	1
+5293	5293	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5294	5294	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5295	5295	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5296	5296	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5297	5297	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5298	5298	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5299	5299	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5300	5300	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5301	5301	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5302	5302	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5303	5303	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5304	5304	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5305	5305	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5306	5306	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5307	5307	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5308	5308	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5309	5309	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5310	5310	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5311	5311	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5312	5312	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5313	5313	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5314	5314	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5315	5315	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5316	5316	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5317	5317	^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5318	5318	^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5319	5319	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5320	5320	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5321	5321	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5322	5322	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5323	5323	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5324	5324	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5325	5325	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5326	5326	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5327	5327	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5328	5328	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5329	5329	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5330	5330	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5331	5331	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5332	5332	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5333	5333	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5334	5334	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5335	5335	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5336	5336	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5337	5337	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5338	5338	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5339	5339	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5340	5340	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5341	5341	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5342	5342	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5343	5343	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5344	5344	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5345	5345	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5346	5346	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5347	5347	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5348	5348	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5349	5349	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5350	5350	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5351	5351	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5352	5352	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5353	5353	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5354	5354	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5355	5355	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5356	5356	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5357	5357	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5358	5358	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5359	5359	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5360	5360	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5361	5361	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5362	5362	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5363	5363	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5364	5364	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5365	5365	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5366	5366	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5367	5367	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5368	5368	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5369	5369	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5370	5370	^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5371	5371	^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5372	5372	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5373	5373	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5374	5374	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5375	5375	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5376	5376	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5377	5377	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5378	5378	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5379	5379	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5380	5380	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5381	5381	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5382	5382	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5383	5383	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5384	5384	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5385	5385	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5386	5386	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5387	5387	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5388	5388	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5389	5389	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5390	5390	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5391	5391	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5392	5392	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5393	5393	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5394	5394	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5395	5395	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5396	5396	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5397	5397	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5398	5398	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5399	5399	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5400	5400	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5401	5401	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5402	5402	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5403	5403	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5404	5404	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5405	5405	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5406	5406	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5407	5407	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5408	5408	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5409	5409	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5410	5410	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5411	5411	^.{4}	2	0	0	1
+5412	5412	^.{4}	2	0	0	1
+5413	5413	^.{4}	2	0	0	1
+5414	5414	^.{4}	2	0	0	1
+5415	5415	^.{4}	2	0	0	1
+5416	5416	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5417	5417	^.{4}	2	0	0	1
+5418	5418	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5419	5419	^.{4}	2	0	0	1
+5420	5420	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5421	5421	^.{4}	2	0	0	1
+5422	5422	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5423	5423	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5424	5424	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5425	5425	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5426	5426	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5427	5427	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5428	5428	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5429	5429	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5430	5430	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5431	5431	^.{4}	2	0	0	1
+5432	5432	^.{4}	2	0	0	1
+5433	5433	^.{4}	2	0	0	1
+5434	5434	^.{4}	2	0	0	1
+5435	5435	^.{4}	2	0	0	1
+5436	5436	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5437	5437	^.{4}	2	0	0	1
+5438	5438	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5439	5439	^\x00.{3}\xFFSMB(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f).{28}(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f)	2	0	0	1
+5440	5440	^.{4}	2	0	0	1
+5441	5441	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5442	5442	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+5443	5443	^\x00.{3}\xFFSMB(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f).{28}(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f)	2	0	0	1
+5444	5444	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+5445	5445	^PRIVMSG\s+[^\s]+\s+\x3a\s*\x01SENDLINK\x7c[^\x7c]{69}	2	0	0	1
+5446	5446	^\s*?\d+?\s*?\)https\x3a\x2f	2	0	0	1
+5447	5447	\/tslyphper([A-Za-z0-9+/-_]{4})*([A-Za-z0-9+/-_]{2}==|[A-Za-z0-9+/-_]{3}=|[A-Za-z0-9+/-_]{4})\.html$	2	0	0	1
+5448	5448	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x22|\x27	2	0	0	1
+5449	5449	\.php$	2	0	0	1
+5450	5450	\.php$	2	0	0	1
+5451	5451	\.php$	2	0	0	1
+5452	5452	\.php\?usernms=[^@]+@[^\r\n]+$	2	0	0	1
+5453	5453	^\s*\.\s*location\s*\.\s*href\s*=\s*redirect_url	2	0	0	1
+5454	5454	^[a-z0-9_]{50,}	2	0	0	1
+5455	5455	^(www(1\.masterconsultas\.com\.ar|\.linkedin\.com)|(tools\.google|facebook)\.com|cfspart\.impots\.gouv\.fr)	2	0	0	1
+5456	5456	^\s*?\d+?\s*?\)https\/\/[^/]+\.edu\/	2	0	0	1
+5457	5457	^\s*?\d+?\s*?\)(https://(w(ww(\.((bankofamerica|paypal|ups|wellsfargo)\.com|a(dobecloud\.com|mazon\.co\.jp)|tax\.service\.gov\.uk|cibc\.mobi)|1\.royalbank\.com)|ebmail\.(i(llinois|ndstate)\.ed|optusnet\.com\.a)u)|(s(i(tekey\.bankofamerica|gnin\.ebay)|ecure(\.bankofamerica|05c\.chase))|login\.((microsoftonlin|liv)e|verizonwireless|alibaba)|my\.screenname\.aol)\.com|((ex(change\.(louisvill|purdu)|mail\.oregonstat)e|owa\.uaa\.alaska)\.ed|ib\.nab\.com\.a)u|voscomptesenligne\.labanquepostale\.fr|auth\.centurylink\.net)|/logon/logon/chaseOnline|#www\.kucoin\.com)	2	0	0	1
+5458	5458	^[^/]+(xfinity|comcast)\.(com|net)	2	0	0	1
+5459	5459	^\s*\.\s*style\s*\.\s*visibility\s*=\s*[\x22\x27]visible[\x22\x27]	2	0	0	1
+5460	5460	^["']?post	2	0	0	1
+5461	5461	^((\.php).+)\.php\x22	2	0	0	1
+5462	5462	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+5463	5463	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+5464	5464	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+5465	5465	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+5466	5466	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+5467	5467	^[^\x22]+<\s*?script\s*?.+data\x3atext/html\x3bbase64,	2	0	0	1
+5468	5468	=[A-Za-z0-9._+-]+%40[A-Za-z0-9.-]+\.[A-Za-z]{2,6}&data	2	0	0	1
+5469	5469	[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}$	2	0	0	1
+5470	5470	\/usaa\.com(\.|-)(sec(ure)?|inet|ent)(\.|-)	2	0	0	1
+5471	5471	^\s*?\d+?\s*?\)https?\x3a\x2f	2	0	0	1
+5472	5472	^(l(o(ading|gin)|imited)|(proccess|card)ing|b(illing|ank)|success)\.php	2	0	0	1
+5473	5473	\x3b[a-f0-9]{32}	2	0	0	1
+5474	5474	Content\-Length\x3a\x20\d{3}\x0d\x0a	2	0	0	1
+5475	5475	\.asp$	2	0	0	1
+5476	5476	\/[a-f0-9]{32}\/\?\d$	2	0	0	1
+5477	5477	\/[a-f0-9]{32}\/\?\d$	2	0	0	1
+5478	5478	\s*(<var>[^)]+)\s*\).+window\s*\.\s*location\s*=\s*\(\s*(=var)	2	0	0	1
+5479	5479	\/webapps\/[a-f0-9]{5}\/websrc	2	0	0	1
+5480	5480	\.asp$	2	0	0	1
+5481	5481	(\/mpp\/[0-9a-f]{32}\/|\/[0-9a-f]{32}\/mpp\/)	2	0	0	1
+5482	5482	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}$	2	0	0	1
+5483	5483	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}$	2	0	0	1
+5484	5484	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+5485	5485	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+5486	5486	^[a-f0-9]{32}\??\x0d\x0a	2	0	0	1
+5487	5487	^data=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+5488	5488	\/submit$	2	0	0	1
+5489	5489	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+5490	5490	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+5491	5491	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+5492	5492	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+5493	5493	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+5494	5494	(udo\.photo|ulcraft\.com|biennale\.info|topstyle\.me|urest\.org|ukit\.me)$	2	0	0	1
+5495	5495	(udo\.photo|ulcraft\.com|biennale\.info|topstyle\.me|urest\.org|ukit\.me)$	2	0	0	1
+5496	5496	^\s*?\(\s*[^,]+,\s*?[^,]+,\s*?(128|256|512)\s*?\)	2	0	0	1
+5497	5497	^\d{5,20}\x22/Q	2	0	0	1
+5498	5498	^[^\x22|\x27]+<\s*?script((<\s*?\/\s*?script).)+?data\x3atext\/html\x3b(charset=UTF-8\x3b)?base64\x2c	2	0	0	1
+5499	5499	^[a-z]+\-[a-z]+\-[a-z0-9]{8,11}\.glitch\.me$	2	0	0	1
+5500	5500	^[a-z]*?[0-9]{3,9}[a-z]*?\.[a-z]{2,4}	2	0	0	1
+5501	5501	^[a-z]*?[0-9]{3,9}[a-z]*?\.[a-z]{2,4}$	2	0	0	1
+5502	5502	^\s*?\(\s*?unescape\s*?\(	2	0	0	1
+5503	5503	^[a-z0-9]{15}\.	2	0	0	1
+5504	5504	^\s*?\(\s*[^,]+,\s*?[^,]+,\s*?(128|256|512)\s*?\)	2	0	0	1
+5505	5505	^ui=[^&]+&pw=	2	0	0	1
+5506	5506	^id=[^&%]+%40[^&]+&pass=	2	0	0	1
+5507	5507	^\s*(\./|\.\./)*(s(e(curity(-check|cvv)|rver|condpage)|uccess)|l(o(ad(ing|er)|g(off))|iamg)|d(e(livery|tails)|one|hl)|i(d(entity)?|ndex2|i)|p(ro(cess(ing)?|file)|hone|ass|in|ayment)|w(e(iter|bsc)|ait)|t(hanky[o0]u|racking)|v(alidate|erify?|bv)|L(oginVerification|L1|2|ogin2)|f(orward|irst|in(al|ish))|b(illing2?|ank)|e(rror|xcel|nd)|questions|1loader|account|recova|confirm|outlook|update(bill|card)?|good|SS|verification|qes|upgrade2?|activation|check(ing)?|ex|indexx|warning|re(name|try))\.	2	0	0	1
+5508	5508	^id=[^&]+&ps=	2	0	0	1
+5509	5509	\.(ga|gq|cf|ml|gdn|tk|icu)$	2	0	0	1
+5510	5510	^mail=[^\x25]+\x2540[^&]+&pass=[^&]+$	2	0	0	1
+5511	5511	^a=[^\x25]+\x2540[^&]+&b=[^&]+	2	0	0	1
+5512	5512	^email=[^\x25]+\x2540[^&]+&epass=[^&]+	2	0	0	1
+5513	5513	^(s)?\x3a\/\/[^\/]*((a(m(ericanexpress|azon)|(dob|ppl)e|libaba|ol)|r(e(gions|max)|bcroyalbank)|f(irst-online|acebook|edex)|m(icrosoft(online)?|atch)|u(s(bank|aa|ps)|ps)|(technologyordi|googl)e|na(twest|ver)|d(ropbox|hl)|yahoo(mail)?|1(26|63)|keybank|qq)\.com|i(n(t(ertekgroup\.org|uit\.com)|vestorjunkie\.com|g\.nl)|c(icibank\.com|scards\.nl)|mpots\.gouv\.fr|rs\.gov)|c((h(ristianmingl|as)e|apitalone(360)?|ibcfcib|panel)\.com|om(mbank\.com\.au|cast\.net)|redit-agricole\.fr)|b(a(nkofamerica\.com|rclays\.co\.uk)|(igpond|t)\.com|luewin\.ch)|o((utlook|ffice)\.com|range\.(co\.uk|fr)|nline\.hmrc\.gov\.uk)|s(((aatchiar|untrus)t|c)\.com|ecure\.lcl\.fr|parkasse\.de)|h(a(lifax(-online)?\.co\.uk|waiiantel\.net)|otmail\.com)|p((rimelocation|aypal)\.com|ostbank\.de)|l(i(nkedin|ve)\.com|abanquepostale\.fr)|we(llsfargo\.com|stpac\.co\.nz)|etisalat\.ae)\/?	2	0	0	1
+5514	5514	^ud=[^&]*&pd=[^&]*	2	0	0	1
+5515	5515	^uname=[^&]+&psw=	2	0	0	1
+5516	5516	=[a-f0-9]{32}&session=[a-f0-9]{40}$	2	0	0	1
+5517	5517	^password=[^&]*&submit=Next$	2	0	0	1
+5518	5518	\?rid=[a-f0-9]{64}$	2	0	0	1
+5519	5519	\?rid=[a-f0-9]{64}\x0d\x0a	2	0	0	1
+5520	5520	\x0d\x0aReferer\x3a\x20[^\r\n]+[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\r\n	2	0	0	1
+5521	5521	\/\?email=[a-zA-Z0-9+&*-]+(\.[a-zA-Z0-9_+&*-]+)*@([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}\x0d\x0a	2	0	0	1
+5522	5522	^Editbox1=[^%]+(@|%40)[^&]+&	2	0	0	1
+5523	5523	^EM=[^%]+(@|%40)[^&]+&	2	0	0	1
+5524	5524	^e=[^%]+(@|%40)[^&]+&	2	0	0	1
+5525	5525	\.(tk|gq|ga|xyz|ml|cf)$	2	0	0	1
+5526	5526	^userid=[^&]*&passid=[^&]*&Token=$	2	0	0	1
+5527	5527	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5528	5528	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5529	5529	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5530	5530	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5531	5531	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5532	5532	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5533	5533	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5534	5534	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5535	5535	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5536	5536	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5537	5537	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5538	5538	^[^\r\n]+(s(e(rvic|cur)e|c(otia|ure)|antander|ign\-?in|napchat)|c(h(eck(out)?|a(in|se))|ustomer|onfirm|loud)|p(ay(pa[il]|ment)|(hon|ost)e|rivacy)|i(n(terac|sta)|cloud|phone|tunes)|re(solution|covery|fund|port|dir)|a(pp(id|le)|ccount|mazon)|n(otification|etflix|terac)|l(o(cked|gin)|imited)|(etransf|twitt|ord)er|d(ocusign|ropbox)|f(acebook|orgot)|veri(tas|f)|upd(ate|t)|yahoo|bofa|hmrc)	2	0	0	1
+5539	5539	^(s)?\x3a\/\/[^\/]*(ebay\.co\.uk|singtel\.com|blockchain\.com)\/?	2	0	0	1
+5540	5540	^(s)?\x3a\/\/[^\/]*(s(ocietegenerale\.com|parkasse\.at|ina\.com\.cn|wisscom\.ch|ec\.gov)|b(bva(compass\.com|\.com\.co)|anque-accord\.fr|mo\.com)|g(o((ogle\.co|v)\.uk|daddy\.com)|mail\.com)|(z(illow|oosk)|images\.kw|office365)\.com|t(el(stra\.com\.au|ekom\.com)|-online\.de)|c(reditmutuel\.fr|panel\.net|iti\.com)|((realestate|nab)\.com\.a|unc\.ed)u|d(esjardins\.c(om|a)|iscover\.com)|e(arthlink\.net|ftel\.com\.au|bay\.de)|a(bl\.com\.pk|liyun\.com|nz\.co\.nz)|w(estpac\.com\.au|ikimedia\.org)|v(isaeurope\.ch|erizon\.net)|h(blibank\.com\.pk|sbc\.com)|paypal\.co\.uk)\/?	2	0	0	1
+5541	5541	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5542	5542	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5543	5543	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5544	5544	^POST\x20(?<var>[^\x20]+).+Referer\x3a\x20[^\r\n]+(=var)[\r\n]+	2	0	0	1
+5545	5545	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5546	5546	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5547	5547	^s?\x3a\/\/[^\/]*(goo(gle(\.(c(om\.[en]g|a)|r[ou])|apps\.com)|\.gl)|c(iovaccocapital\.com|entrin\.net\.id|artasi\.it)|s((antander\.com\.b|fr\.f)r|tandardbank\.co\.za)|(aliexpress|vanguard|tdbank|ibm)\.com|e(xperienceasb\.co\.nz|im\.ae)|n((avy)?fcu\.org|wolb\.com)|unicredit\.it|mbna\.co\.uk|oney\.fr|zkb\.ch)\/?	2	0	0	1
+5548	5548	^[a-z]{36,38}\-dot\-[a-z]+\-[a-z]+\-\d{6}\.[a-z]{2}\.[a-z]\.appspot\.com$	2	0	0	1
+5549	5549	^[a-f0-9]{32}(\/index\.php)?\x0d\x0a	2	0	0	1
+5550	5550	^[^\r\n]+\.edu	2	0	0	1
+5551	5551	^(s)?\x3a\/\/[^\/]*((t(dcanadatrust|escobank|radekey)|r(ealtyexecutive|bcd)s|x(finity|oom)|ourtime)\.com|a(s(perasoft\.com|b\.co\.nz)|(ccesbankplc|nz)\.com|mazon\.co\.uk|ruba\.it)|m((icrosoftstore|organstanley|sn)\.com|a(de-in-china\.com|il\.ru))|s((eniorpeoplemeet|cotiabank)\.com|antander\.co\.uk|uddenlink\.net)|c(o((ldwellbankerpreviews|x)\.com|mpresso\.co\.th)|fapubs\.org)|w(e(althmanagement\.com|bmail\.sfr\.fr)|ww-01\.ibm\.com)|l((endingtree|loydsbank)\.com|abanquepostale\.mobi)|v((aluewalk|ideotron)\.com|erifyemailaddress\.org)|n(a(tionwide\.co\.uk|vyfederal\.org)|etsuite\.com)|b(a(nquepopulaire\.fr|9hus\.in)|iztree\.com)|i(nternetbanking\.caixa\.gov\.br|cloud\.com)|d(iscoverbank\.com|hl\.co\.uk)|k(iwibank\.co\.nz|eybank\.com)|fidelitybank\.ng|paypal\.fr|ebay\.it)\/?	2	0	0	1
+5552	5552	^(d((ocu|uco)sign|ropbox)|o(ffice365|nedrive)|adobe|gdoc)	2	0	0	1
+5553	5553	^(d((ocu|uco)sign|ropbox)|o(ffice365|nedrive)|adobe|gdoc)	2	0	0	1
+5554	5554	<title>\s*(log\s*in|sign\s*in)	2	0	0	1
+5555	5555	<title>\s*(s(e(nd money, pay online or set up a merchant|cure) account|uspicious (transaction |activities))|con(firm card security information|to limitato)|(profile updat|mot de pass)e|login)\s*-\s*paypal\s*<\/title>	2	0	0	1
+5556	5556	^\/v0\/b\/(send|hit|few|lik|mtn|eli|rfda)\d.*\.appspot\.com\/	2	0	0	1
+5557	5557	^em=[^&]*&ps=[^&]*$	2	0	0	1
+5558	5558	https\/\/[^/]+\.edu	2	0	0	1
+5559	5559	^[a-z0-9]{24,28}\.php\?client_id=	2	0	0	1
+5560	5560	\.php\?template=[^\r\n]+&valid=[^\r\n]+&session=[a-f0-9]{32,}$	2	0	0	1
+5561	5561	^uname=[^&]*&pass	2	0	0	1
+5562	5562	^emid=[^&]*&epass	2	0	0	1
+5563	5563	(verify|support|account|copyright|help|verified|service|badge|verification|safety)?.{0,30}tiktok(verify|support|account|copyright|help|verified|service|badge|verification|safety)?.{0,30}(\.ml|\.ga|\.cf|\.gq|\.tk|\.xyz$)	2	0	0	1
+5564	5564	^[a-f0-9]{42}\.js\x27\x29\.then\x28(.{1,1000}themes\/js\/[a-f0-9]{42}\.js\x27\x29\.then\x28){5,}	2	0	0	1
+5565	5565	\w{1,255}\/\w{1,255}'\]\s*==\s*"\w{1,255}\"	2	0	0	1
+5566	5566	^[a-f0-9]{42}\.css\x27\x29\.then\x28(.{1,1000}themes\/css\/[a-f0-9]{42}\.css\x27\x29\.then\x28){5,}	2	0	0	1
+5567	5567	[\w\d]{8}\.	2	0	0	1
+5568	5568	[\w\d]{8}	2	0	0	1
+5569	5569	\.(jpe?g|png|svg)$	2	0	0	1
+5570	5570	\.(css|ttf|woff2?|js)$	2	0	0	1
+5571	5571	^[a-f0-9]{8}-([a-f0-9]{4}-){3}a-f0-9]{12}	2	0	0	1
+5572	5572	[a-z0-9]{32}	2	0	0	1
+5573	5573	^\s*?\.\s*?Ctr\s*?\.\s*?decrypt	2	0	0	1
+5574	5574	^\s*?\.\s*?Ctr\s*?\.\s*?decrypt	2	0	0	1
+5575	5575	\.php\?e=[a-zA-Z0-9+&*-]+(\.[a-zA-Z0-9_+&*-]+)*@([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$	2	0	0	1
+5576	5576	^1=[^%]+(@|%40)[^&]+&	2	0	0	1
+5577	5577	^username=[^%]+(@|%40)[^&]+&	2	0	0	1
+5578	5578	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+5579	5579	\.php	2	0	0	1
+5580	5580	^([^0-9][a-zA-Z0-9_]{1,254}),\s*([^0-9][a-zA-Z0-9_$]{1,254}),\s*256\)\x3b	2	0	0	1
+5581	5581	\/nrp=[a-f0-9]{32}$	2	0	0	1
+5582	5582	\/nrp=[a-f0-9]{32}$	2	0	0	1
+5583	5583	nrp=[a-f0-9]{32}	2	0	0	1
+5584	5584	(outlook|helpdesk|help desk)	2	0	0	1
+5585	5585	Set-Cookie\x3a\x20[a-z0-9]{4}=\x22\x22\x3b	2	0	0	1
+5586	5586	^/?username=[a-zA-Z0-9.-]+@[a-zA-Z0-9.]+.[a-zA-Z]{2,3}$	2	0	0	1
+5587	5587	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x22\x7d$	2	0	0	1
+5588	5588	[a-f0-9]{8}.	2	0	0	1
+5589	5589	[a-f0-9]{8}.	2	0	0	1
+5590	5590	[a-f0-9]{8}.	2	0	0	1
+5591	5591	[a-f0-9]{8}.	2	0	0	1
+5592	5592	[a-f0-9]{8}.	2	0	0	1
+5593	5593	[a-f0-9]{8}.	2	0	0	1
+5594	5594	[a-f0-9]{8}.	2	0	0	1
+5595	5595	[a-f0-9]{8}.	2	0	0	1
+5596	5596	[a-f0-9]{8}.	2	0	0	1
+5597	5597	[a-f0-9]{8}.	2	0	0	1
+5598	5598	[a-f0-9]{8}.	2	0	0	1
+5599	5599	&a_failed=[01]$	2	0	0	1
+5600	5600	&a_failed=[01]$	2	0	0	1
+5601	5601	^[0-9]{3,4}	2	0	0	1
+5602	5602	^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}-[a-f0-9]{8}\.	2	0	0	1
+5603	5603	^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}-[a-f0-9]{8}\.	2	0	0	1
+5604	5604	^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}-[a-f0-9]{8}\.	2	0	0	1
+5605	5605	^(php|html)$	2	0	0	1
+5606	5606	^(php|html)$	2	0	0	1
+5607	5607	 (6011|5[1-5]\d{2}|4\d{3}|3\d{3}) \d{4} \d{4} \d{4}	2	0	0	1
+5608	5608	 (6011|5[1-5]\d{2}|4\d{3}|3\d{3})-\d{4}-\d{4}-\d{4}	2	0	0	1
+5609	5609	 (6011|5[1-5]\d{2}|4\d{3}|3\d{3})\d{12} 	2	0	0	1
+5610	5610	 (3[4|7]\d{2}|2014|2149|2131|1800)\d{11} 	2	0	0	1
+5611	5611	 (3[4|7]\d{2}|2014|2149|2131|1800) \d{4} \d{4} \d{3} 	2	0	0	1
+5612	5612	 (3[4|7]\d{2}|2014|2149|2131|1800)-\d{4}-\d{4}-\d{3} 	2	0	0	1
+5613	5613	 (30[0-5]\d|36\d{2}|38\d{2})\d{10} 	2	0	0	1
+5614	5614	 (30[0-5]\d|36\d{2}|38\d{2}) \d{4} \d{4} \d{2} 	2	0	0	1
+5615	5615	 (30[0-5]\d|36\d{2}|38\d{2})-\d{4}-\d{4}-\d{2} 	2	0	0	1
+5616	5616	 (3[4|7]\d{2}|2014|2149|2131|1800) \d{6} \d{5} 	2	0	0	1
+5617	5617	 (3[4|7]\d{2}|2014|2149|2131|1800)-\d{6}-\d{5} 	2	0	0	1
+5618	5618	filename=\s*[^\n]+\.exe	2	0	0	1
+5619	5619	 \d\d-\d{7} 	2	0	0	1
+5620	5620	 ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])-\d{2}-\d{4} 	2	0	0	1
+5621	5621	 ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2]) \d{2} \d{4} 	2	0	0	1
+5622	5622	SSN ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])\d{6} 	2	0	0	1
+5623	5623	SSN# ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])\d{6} 	2	0	0	1
+5624	5624	User-Agent\x3a[^\n]+McAfee AutoUpdate	2	0	0	1
+5625	5625	User-Agent\x3a[^\n]+Winamp/Hi	2	0	0	1
+5626	5626	(gif|car(d|tao)|jpe?g)\.exe$	2	0	0	1
+5627	5627	\.exe$	2	0	0	1
+5628	5628	User-Agent\x3a[^\n]+Windows-Update-Agent	2	0	0	1
+5629	5629	((\?|&))password=(&)	2	0	0	1
+5630	5630	((\?|&))passwd=(&)	2	0	0	1
+5631	5631	((\?|&))pass=(&)	2	0	0	1
+5632	5632	((\?|&))pwd=(&)	2	0	0	1
+5633	5633	((\?|&))pw=(&)	2	0	0	1
+5634	5634	((\?|&))passphrase=(&)	2	0	0	1
+5635	5635	((\?|&))pword=(&)	2	0	0	1
+5636	5636	\x3C\x3C[^>]*\x2FJavaScript	2	0	0	1
+5637	5637	Location\: (http\:\/\/)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/	2	0	0	1
+5638	5638	\.png$	2	0	0	1
+5639	5639	\.jpeg$	2	0	0	1
+5640	5640	\.bmp$	2	0	0	1
+5641	5641	^User-Agent\:[^\n]+Java\/\d\.\d/Hmi	2	0	0	1
+5642	5642	^Content-Type\x3a\s*([av])(video\/x\-ms\-(w[vm]x|asf)|a(udio\/x\-ms\-w(m[av]|ax)|pplication\/x\-ms\-wm[zd]))/Hi	2	0	0	1
+5643	5643	\.exe\b	2	0	0	1
+5644	5644	^(ANONYMOUS|PASSDSS-3DES-1)\r\n	2	0	0	1
+5645	5645	((\x0d|\x05)Admin(istrator)?|\x04root|\x06USERID)	2	0	0	1
+5646	5646	^[^/s]*(eth_(g(et(B(lock(TransactionCountBy(Number|Hash)|By(Number|Hash))|alance)|Transaction(By(Block(Number|Hash)AndIndex|Hash)|(Receip|Coun)t)|Uncle(ByBlock(Number|Hash)AndIndex|CountByBlock(Number|Hash))|(Filter(Change|Log)|Log)s|Co(mpilers|de)|StorageAt|Work)|asPrice)|((new(PendingTransaction|Block)?|uninstall)Filt|blockNumb)er|s((end(Raw)?Transactio|ig)n|ubmit(Hashrate|Work)|yncing)|c(o(mpile(S(olidity|erpent)|LLL)|inbase)|all)|(estimateGa|account)s|protocolVersion|hashrate|mining)|shh_(new(Identity|Filter|Group)|get(FilterChan|Messa)ges|uninstallFilter|hasIdentity|addToGroup|version|post)|db_(get(String|Hex)|put(String|Hex))|net_(listening|peerCount|version)|web3_(clientVersion|sha3))	2	0	0	1
+5647	5647	\x3C\x3C[^>]*\x2FEmbeddedFile	2	0	0	1
+5648	5648	&|#|\+|!	2	0	0	1
+5649	5649	[0-9a-f]{40}[^0-9a-f]/P	2	0	0	1
+5650	5650	^.\x04[^\x08\x10\x14\x20\x30\x40]	2	0	0	1
+5651	5651	^[\x80-\xff]	2	0	0	1
+5652	5652	^[67]\.[01235]	2	0	0	1
+5653	5653	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+5654	5654	^\d\d?\.\d	2	0	0	1
+5655	5655	OS 4_2_[0-9] like	2	0	0	1
+5656	5656	\/\?v=\d	2	0	0	1
+5657	5657	^\d+\.\d	2	0	0	1
+5658	5658	((command(statu)?|bookmark|shortcut)s|h(omepage|istory)|eula(status)?|installation|activate|dumplog)	2	0	0	1
+5659	5659	^(\x3a\d{1,5})?$	2	0	0	1
+5660	5660	^(\x3a\d{1,5})?$	2	0	0	1
+5661	5661	filename\x3d[\x27\x22][a-z0-9]{1,3}\x2Eexe	2	0	0	1
+5662	5662	select[^\r\n]+from	2	0	0	1
+5663	5663	\x26Phone(Number\x3D|\x5FNumber\x3D|\x2DNumber\x3D)	2	0	0	1
+5664	5664	^(\x3a\d{1,5})?$	2	0	0	1
+5665	5665	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]\x7d	2	0	0	1
+5666	5666	User-Agent|3a|[^\n]+Windows-Update-Agent/Hsmi	2	0	0	1
+5667	5667	\x0d\x0aContent-Length\x3a \d{0,6}\x0d\x0a	2	0	0	1
+5668	5668	^(sh|lu|to)	2	0	0	1
+5669	5669	^(\x3a\d{1,5})?$	2	0	0	1
+5670	5670	[0-9a-f]{40}[^0-9a-f]	2	0	0	1
+5671	5671	^[^\r\n]+showip\.[a-z]+(\x3a\d{1,5})?$	2	0	0	1
+5672	5672	^(\x3a\d{1,5})?$	2	0	0	1
+5673	5673	^[a-z0-9\-\.]{1,60}\.dns-report\.com$	2	0	0	1
+5674	5674	^\/(text|json|xml)?$	2	0	0	1
+5675	5675	^\/changelog\/(appversion|changelog|help)$	2	0	0	1
+5676	5676	\d/\d+.jpg	2	0	0	1
+5677	5677	^(com|io|host)	2	0	0	1
+5678	5678	^[A-Z]=([A-Za-z0-9+/])+=?$	2	0	0	1
+5679	5679	^[0-9]{18}\/[0-9]{18}\/[a-zA-Z0-9]{5,7}$	2	0	0	1
+5680	5680	[A-F0-9]{96}$	2	0	0	1
+5681	5681	^CN=www\.[0-9a-z]{8,20}\.net$	2	0	0	1
+5682	5682	^(\x01|\x02)(\x4b|\x4c|\x4d)	2	0	0	1
+5683	5683	^[A-Za-z0-9+\/]{50,}={0,2} HTTP\/	2	0	0	1
+5684	5684	CN=([^\r\n\,]+?[\.-])?app\d	2	0	0	1
+5685	5685	^[a-z0-9]{40,}	2	0	0	1
+5686	5686	OS 4_2_[0-9] like	2	0	0	1
+5687	5687	^AUTH\s[^\n]{50}	2	0	0	1
+5688	5688	^LIST\s[^\n]{10}	2	0	0	1
+5689	5689	^XTND\s[^\n]{50}	2	0	0	1
+5690	5690	^APOP\s[^\n]{256}	2	0	0	1
+5691	5691	^PASS\s[^\n]{50}	2	0	0	1
+5692	5692	^USER\s+[^\n]*?%	2	0	0	1
+5693	5693	^UIDL\s+-\d	2	0	0	1
+5694	5694	^DELE\s+-\d	2	0	0	1
+5695	5695	^RSET\s[^\n]{10}	2	0	0	1
+5696	5696	^DELE\s[^\n]{10}	2	0	0	1
+5697	5697	^STAT\s[^\n]{10}	2	0	0	1
+5698	5698	^TOP\s[^\n]{10}	2	0	0	1
+5699	5699	^CAPA\s[^\n]{10}	2	0	0	1
+5700	5700	^APOP\s+USER\s[^\n]{256}	2	0	0	1
+5701	5701	^PASS\s+[^\n]*?%	2	0	0	1
+5702	5702	^USER\s[^\n]{50}	2	0	0	1
+5703	5703	\x64\x12\x54\x6a[\x20\x10\x02]\x00\x00\x00\xf4\x1f\x00\x00	2	0	0	1
+5704	5704	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D25FCAFC-F795-4609-89BB-5F78B4ACAF2C	2	0	0	1
+5705	5705	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BD9E5104-2F20-4A9F-AB14-82D558FF374E	2	0	0	1
+5706	5706	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2BBD45A5-28AE-11D1-ACAC-0800170967D9	2	0	0	1
+5707	5707	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2BBD45A5-28AE-11D1-ACAC-0800170967D9	2	0	0	1
+5708	5708	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2BBD45A5-28AE-11D1-ACAC-0800170967D9	2	0	0	1
+5709	5709	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02000002-9DFA-4B37-ABE9-1929F4BCDEA2	2	0	0	1
+5710	5710	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02000002-9DFA-4B37-ABE9-1929F4BCDEA2	2	0	0	1
+5711	5711	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3310FA24-A027-47B3-8C49-1091077317E9	2	0	0	1
+5712	5712	^[^>]*?classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*?083B40D3-CCBA-11D2-AFE0-00C04F7993D6	2	0	0	1
+5713	5713	^[^>]*?classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*083B40D3-CCBA-11D2-AFE0-00C04F7993D6	2	0	0	1
+5714	5714	^PASS\s+PRO(-|\s)*search\s+Crawler	2	0	0	1
+5715	5715	^\x2f	2	0	0	1
+5716	5716	^Authorization\x3a\s*Basic\s+YWRtaW46cGFzc3dvcmQ/Hi	2	0	0	1
+5717	5717	\x20AND\x20[0-9]{6}\x3D[0-9]{4}	2	0	0	1
+5718	5718	Range\x3a\s?bytes=[-0-9,\x20]{100}/iH	2	0	0	1
+5719	5719	530\s+(Login|User|Failed|Not)	2	0	0	1
+5720	5720	^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{16}\/	2	0	0	1
+5721	5721	^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{16}\/	2	0	0	1
+5722	5722	Arachni\/v?\d\.\d\.\d$	2	0	0	1
+5723	5723	User-Agent\:[^\n]+WHCC	2	0	0	1
+5724	5724	^.+\x3a\s(test.)?C\:\/WINDOWS\/system32\/calc\.exe(.test)?\r$	2	0	0	1
+5725	5725	\x2Frandom\w+?\x2E(c(f[cm]|gi)|ht(ml?|r)|(ws|x)dl|a(sp|xd)|p(hp3|l)|bat|swf|vbs|do)	2	0	0	1
+5726	5726	^DEMONS((\/|\s)[0-9]\.0)?$	2	0	0	1
+5727	5727	^Hakai((\/|\s)[0-9]\.0)?$	2	0	0	1
+5728	5728	^Messiah((\/|\s)[0-9]\.0)?$	2	0	0	1
+5729	5729	^Liquor((\/|\s)[0-9]\.0)?$	2	0	0	1
+5730	5730	^Nija((\/|\s)[0-9]\.0)?$	2	0	0	1
+5731	5731	^Gemini((\/|\s)[0-9]\.0)?$	2	0	0	1
+5732	5732	^Sector((\/|\s)[0-9]\.0)?$	2	0	0	1
+5733	5733	^Kayla((\/|\s)[0-9]\.0)?$	2	0	0	1
+5734	5734	^OSIRIS((\/|\s)[0-9]\.0)?$	2	0	0	1
+5735	5735	^Hello, World((\/|\s)[0-9]\.0)?$	2	0	0	1
+5736	5736	(%U([0-9a-f]{2})){6}	2	0	0	1
+5737	5737	(%U([0-9a-f]{4})){6}	2	0	0	1
+5738	5738	writeByte\x280x[a-z,0-9]{2}.+writeByte\x280x[a-z,0-9]{2}.+writeByte\x280x[a-z,0-9]{2}	2	0	0	1
+5739	5739	\x5Cu[a-f,0-9]{2,4}\x5Cu[a-f,0-9]{2,4}\x5Cu[a-f,0-9]{2,4}	2	0	0	1
+5740	5740	var\x20[a-z,0-9]{1,30}\x20\x3D\x20unescape\x28.\x25u[a-f,0-9]{2,4}\x25u[a-f,0-9]{2,4}	2	0	0	1
+5741	5741	var\x20[a-z,0-9]{1,30}\x20\x3D\x20unescape\x28.\x5Cu[a-f,0-9]{2,4}\x5Cu[a-f,0-9]{2,4}	2	0	0	1
+5742	5742	\x220\x22\x20\x2B\x20\x22[a-d]\x22\x20\x2B\x20\x22	2	0	0	1
+5743	5743	\x7Cu0[a-d](\x7Cu0|0)[a-d]/\x7Cu0[a-d](\x7Cu0|0)[a-d]	2	0	0	1
+5744	5744	\x5Cu0[a-d](\x5Cu0|0)[a-d]/\x5Cu0[a-d](\x5Cu0|0)[a-d]	2	0	0	1
+5745	5745	var\x20[^\n\r]*\x3D[^\n\r]*heap\x2E	2	0	0	1
+5746	5746	u0[a-d]u0[a-d]u0[a-d]u0[a-d]	2	0	0	1
+5747	5747	u0[a-d]0[a-d]u0[a-d]0[a-d]	2	0	0	1
+5748	5748	unescape.+\x25u[0-9,a-f]{2,4}\x25u[0-9,a-f]{2,4}	2	0	0	1
+5749	5749	unescape\x28(\x22|\x27)\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}	2	0	0	1
+5750	5750	^[a-f0-9]{4}	2	0	0	1
+5751	5751	^[a-f0-9]{4}	2	0	0	1
+5752	5752	filename\s*=\s*.*?\.([abcdehijlmnoprsvwx])(a(d[ep]|s[dfx])|c([ho]m|li|md|pp)|d(iz|ll|ot)|e(m[fl]|xe)|h(lp|sq|ta)|jse?|m(d[abew]|s[ip])|p(p[st]|if|[lm]|ot)|r(eg|tf)|s(cr|[hy]s|wf)|v(b[es]?|cf|xd)|w(m[dfsz]|p[dmsz]|s[cfh])|xl[tw]|bat|ini|lnk|nws|ocx)[\x27\x22\n\r\s]	2	0	0	1
+5753	5753	^expn\s+\*@	2	0	0	1
+5754	5754	^expn\s+decode	2	0	0	1
+5755	5755	^expn\s+root	2	0	0	1
+5756	5756	^vrfy\s+decode	2	0	0	1
+5757	5757	^vrfy\s+root	2	0	0	1
+5758	5758	^RCPT TO\x3a\s[^\n]{300}	2	0	0	1
+5759	5759	^EXPN[^\n]{255}	2	0	0	1
+5760	5760	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnBpZ|5waW|ucGlm)	2	0	0	1
+5761	5761	^(<boundary>[\x20\x27-\x29\x2b-\x2f0-9\x3a\x3d\x3fA-Z\x5fa-z]{0,69}?[^\x2d])--(\x0d\x0a(--|\x2e|RSET)[^\r\n]*?)*\x0d\x0a--(=boundary)\x0d\x0a	2	0	0	1
+5762	5762	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*package_prefix[\r\n\s]*=>[\r\n\s]*|package_prefix\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*procedure_prefix[\r\n\s]*=>[\r\n\s]*|procedure_prefix\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5763	5763	TO_CHAR\s*\(\s*SYSTIMESTAMP\s*,\s*(\x27[^\x27]{256}|\x22[^\x22]{256})	2	0	0	1
+5764	5764	CREATE\s.*?FILE\s+((AS|MEMBER|TO)\s+)?(\x27[^\x27]{512}|\x22[^\x22]{512})	2	0	0	1
+5765	5765	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*logfile[\r\n\s]*=>[\r\n\s]*|logfile\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\d+\s*,\s*){3}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5766	5766	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5767	5767	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{512,}\x27|\x22[^\x22]{512,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*|layer\s*=>\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,})|\(\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,}))	2	0	0	1
+5768	5768	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{128,}\x27|\x22[^\x22]{128,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*|layer\s*=>\s*(\x27[^\x27]{128,}|\x22[^\x22]{128,})|\(\s*(\x27[^\x27]{128,}|\x22[^\x22]{128,}))	2	0	0	1
+5769	5769	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*|layer\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5770	5770	numtoyminterval\s*\(\s*\d+\s*,\s*(\x27[^\x27]{32}|\x22[^\x22]{32})	2	0	0	1
+5771	5771	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*qt_name[\r\n\s]*=>[\r\n\s]*|qt_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5772	5772	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5773	5773	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5774	5774	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5775	5775	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*destination[\r\n\s]*=>[\r\n\s]*|destination\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5776	5776	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*dblink[\r\n\s]*=>[\r\n\s]*|dblink\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5777	5777	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5778	5778	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5779	5779	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5780	5780	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*missing_rows_oname1[\r\n\s]*=>[\r\n\s]*|missing_rows_oname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname1[\r\n\s]*=>[\r\n\s]*|sname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5781	5781	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*missing_rows_oname1[\r\n\s]*=>[\r\n\s]*|missing_rows_oname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname1[\r\n\s]*=>[\r\n\s]*|sname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5782	5782	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5783	5783	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*|userid\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5784	5784	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*|userid\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5785	5785	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5786	5786	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5787	5787	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5788	5788	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5789	5789	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5790	5790	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5791	5791	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5792	5792	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5793	5793	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5794	5794	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5795	5795	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5796	5796	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5797	5797	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5798	5798	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5799	5799	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5800	5800	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5801	5801	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5802	5802	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5803	5803	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5804	5804	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5805	5805	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5806	5806	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5807	5807	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5808	5808	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5809	5809	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5810	5810	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5811	5811	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5812	5812	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5813	5813	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5814	5814	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5815	5815	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5816	5816	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5817	5817	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5818	5818	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5819	5819	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5820	5820	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5821	5821	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5822	5822	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5823	5823	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5824	5824	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5825	5825	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5826	5826	\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})	2	0	0	1
+5827	5827	(\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5828	5828	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5829	5829	(\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5830	5830	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5831	5831	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5832	5832	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5833	5833	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5834	5834	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5835	5835	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5836	5836	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5837	5837	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5838	5838	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5839	5839	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5840	5840	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5841	5841	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5842	5842	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5843	5843	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5844	5844	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5845	5845	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5846	5846	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5847	5847	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5848	5848	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5849	5849	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*SCHEMA_NAME[\r\n\s]*=>[\r\n\s]*|SCHEMA_NAME\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5850	5850	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5851	5851	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5852	5852	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname|gowner)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type|gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){7}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5853	5853	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5854	5854	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5855	5855	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5856	5856	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5857	5857	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5858	5858	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5859	5859	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5860	5860	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5861	5861	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5862	5862	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5863	5863	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5864	5864	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5865	5865	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5866	5866	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5867	5867	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5868	5868	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5869	5869	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5870	5870	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5871	5871	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5872	5872	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5873	5873	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5874	5874	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5875	5875	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5876	5876	(\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5877	5877	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*CANON_GNAME[\r\n\s]*=>[\r\n\s]*|CANON_GNAME\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5878	5878	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5879	5879	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*tst[\r\n\s]*=>[\r\n\s]*|tst\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*\d+\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5880	5880	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{512,}\x27|\x22[^\x22]{512,}\x22)[\r\n\s]*\x3b.*repgrpname[\r\n\s]*=>[\r\n\s]*|repgrpname\s*=>\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,})|\(\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,}))	2	0	0	1
+5881	5881	\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})	2	0	0	1
+5882	5882	TIME_ZONE\s*=\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))	2	0	0	1
+5883	5883	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5884	5884	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5885	5885	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))|((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22 ]{1000})))	2	0	0	1
+5886	5886	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5887	5887	\(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){4}\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+5888	5888	\((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){2}\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5889	5889	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))|((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+5890	5890	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5891	5891	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5892	5892	\(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+5893	5893	\((\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))|\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+5894	5894	\(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+5895	5895	\(\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,(\s*(true|false)\s*,\s*){3}((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5896	5896	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5897	5897	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5898	5898	\((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){2}\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5899	5899	\(\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5900	5900	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5901	5901	\(\s*TIMESTAMP\s*(\s*(\x27[^\x27]+'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5902	5902	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5903	5903	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5904	5904	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+5905	5905	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5906	5906	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*logfile[\r\n\s]*=>[\r\n\s]*|logfile\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5907	5907	ALTER\s.*?FILE\s+((AS|MEMBER|TO)\s+)?(\x27[^\x27]{512}|\x22[^\x22]{512})	2	0	0	1
+5908	5908	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5909	5909	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5910	5910	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5911	5911	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+5912	5912	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5913	5913	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5914	5914	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5915	5915	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5916	5916	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5917	5917	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(missing_rows_oname1|missing_rows_oname2)[\r\n\s]*=>[\r\n\s]*|(missing_rows_oname1|missing_rows_oname2)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){10}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5918	5918	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(missing_rows_oname1|missing_rows_oname2)[\r\n\s]*=>[\r\n\s]*|(missing_rows_oname1|missing_rows_oname2)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){8}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5919	5919	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5920	5920	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5921	5921	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5922	5922	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5923	5923	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5924	5924	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5925	5925	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5926	5926	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5927	5927	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5928	5928	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5929	5929	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5930	5930	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5931	5931	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5932	5932	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5933	5933	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5934	5934	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5935	5935	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5936	5936	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5937	5937	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5938	5938	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5939	5939	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5940	5940	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5941	5941	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5942	5942	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5943	5943	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5944	5944	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5945	5945	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5946	5946	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5947	5947	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5948	5948	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5949	5949	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5950	5950	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5951	5951	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gowner|gname)[\r\n\s]*=>[\r\n\s]*|(gowner|gname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5952	5952	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5953	5953	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5954	5954	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5955	5955	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5956	5956	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5957	5957	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5958	5958	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5959	5959	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*operation[\r\n\s]*=>[\r\n\s]*|operation\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5960	5960	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5961	5961	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5962	5962	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*fname[\r\n\s]*=>[\r\n\s]*|fname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5963	5963	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname|gowner)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type|gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){7}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5964	5964	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname)[\r\n\s]*=>[\r\n\s]*|(gname|fname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5965	5965	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type|gname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5966	5966	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5967	5967	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5968	5968	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5969	5969	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5970	5970	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5971	5971	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5972	5972	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5973	5973	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5974	5974	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5975	5975	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5976	5976	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gowner[\r\n\s]*=>[\r\n\s]*|gowner\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+5977	5977	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5978	5978	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5979	5979	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5980	5980	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5981	5981	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5982	5982	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5983	5983	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5984	5984	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5985	5985	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5986	5986	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5987	5987	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5988	5988	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5989	5989	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5990	5990	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5991	5991	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5992	5992	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5993	5993	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5994	5994	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5995	5995	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5996	5996	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|gname)[\r\n\s]*=>[\r\n\s]*|(sname|oname|gname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5997	5997	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5998	5998	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+5999	5999	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6000	6000	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6001	6001	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6002	6002	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6003	6003	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6004	6004	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gowner[\r\n\s]*=>[\r\n\s]*|gowner\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*(true|false)\s*,\s*(true|false)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6005	6005	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6006	6006	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6007	6007	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6008	6008	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6009	6009	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6010	6010	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6011	6011	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6012	6012	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gowner[\r\n\s]*=>[\r\n\s]*|gowner\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6013	6013	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6014	6014	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6015	6015	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*operation[\r\n\s]*=>[\r\n\s]*|operation\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6016	6016	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6017	6017	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6018	6018	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6019	6019	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6020	6020	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6021	6021	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1073,}\x27|\x22[^\x22]{1073,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1073,}|\x22[^\x22]{1073,})|\(\s*(\x27[^\x27]{1073,}|\x22[^\x22]{1073,}))	2	0	0	1
+6022	6022	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6023	6023	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6024	6024	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6025	6025	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6026	6026	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*privilege_type[\r\n\s]*=>[\r\n\s]*|privilege_type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6027	6027	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*privilege_type[\r\n\s]*=>[\r\n\s]*|privilege_type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6028	6028	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*|userid\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6029	6029	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6030	6030	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6031	6031	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6032	6032	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(object_type|user_name)[\r\n\s]*=>[\r\n\s]*|(object_type|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6033	6033	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6034	6034	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*privilege_type[\r\n\s]*=>[\r\n\s]*|privilege_type\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6035	6035	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+6036	6036	\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})	2	0	0	1
+6037	6037	\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})	2	0	0	1
+6038	6038	\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})	2	0	0	1
+6039	6039	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6040	6040	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6041	6041	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6042	6042	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6043	6043	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+6044	6044	username=[^&\x3b\r\n]{250}	2	0	0	1
+6045	6045	^(\r\n)*	2	0	0	1
+6046	6046	^User-Agent\:[^\n]+WHCC/Hmi	2	0	0	1
+6047	6047	User-Agent\:[^\n]+http\:\/\/	2	0	0	1
+6048	6048	\(compatible[^\)]+\n	2	0	0	1
+6049	6049	User-Agent\:[^\n]+sgrunt/Hi	2	0	0	1
+6050	6050	[\/\?][a-z0-9]{60,66}[\;0-9]	2	0	0	1
+6051	6051	^[0-9][0-9]?\.[0-9][0-9]?$	2	0	0	1
+6052	6052	\)ver\d	2	0	0	1
+6053	6053	^\d	2	0	0	1
+6054	6054	^x\w\wx\w\w\!x\w\wx\w\wx\w\w	2	0	0	1
+6055	6055	^Downloader\d+\.\d	2	0	0	1
+6056	6056	^dBrowser\x20\d\x20CallGetResponse\x3a\d$/V	2	0	0	1
+6057	6057	00\d+$	2	0	0	1
+6058	6058	\r?\n\r?\n	2	0	0	1
+6059	6059	^a\x3D[^\n]{1000,}	2	0	0	1
+6060	6060	^\/g($|[?#])	2	0	0	1
+6061	6061	(launch\x28.+-J-jar -J|-J-jar -J.+launch\x28)	2	0	0	1
+6062	6062	<body\s+[^>]*onUnload\s*=\s*[\x22\x27]?\(\)	2	0	0	1
+6063	6063	<img\s+[^>]*onEnd\s*=\s*[\x22\x27]?\(\)	2	0	0	1
+6064	6064	<body\s+[^>]*onURLFlip\s*=\s*[\x22\x27]?\(\)	2	0	0	1
+6065	6065	<img\s+[^>]*onURLFlip\s*=\s*[\x22\x27]?\(\)	2	0	0	1
+6066	6066	<[^>%]*%	2	0	0	1
+6067	6067	(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*vbscript[\:]	2	0	0	1
+6068	6068	(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*j[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*a[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:]	2	0	0	1
+6069	6069	(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*v[\x09\x0a\x0b\x0c\x0d]*b[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*c[\x09\x0a\x0b\x0c\x0d]*r[\x09\x0a\x0b\x0c\x0d]*i[\x09\x0a\x0b\x0c\x0d]*p[\x09\x0a\x0b\x0c\x0d]*t[\x09\x0a\x0b\x0c\x0d]*[\:]	2	0	0	1
+6070	6070	(((URL|SRC|HREF|LOWSRC)[\s]*=)|(url[\s]*[\(]))[\s]*['"]*[\x09\x0a\x0b\x0c\x0d]*s[\x09\x0a\x0b\x0c\x0d]*h[\x09\x0a\x0b\x0c\x0d]*e[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*l[\x09\x0a\x0b\x0c\x0d]*[\:]	2	0	0	1
+6071	6071	expression[\s]*\([\s]*eval[\s]*\([\s]*String\.fromCharCode[\s]*\(([\s]*[\d]+[\s]*,){20}	2	0	0	1
+6072	6072	expression[\s]*\([\s]*eval[\s]*\([\s]*String\.fromCharCode[\s]*\(([\s]*0x[\da-fA-F]+[\s]*,){20}	2	0	0	1
+6073	6073	ftp\://[^\' \"]*%0a	2	0	0	1
+6074	6074	String\x2EFromCharCode\x28[0-9]{1,3}	2	0	0	1
+6075	6075	(window|w)\x2Estop	2	0	0	1
+6076	6076	<object\s*[^>]*\s*classid\s*=\s*(\x22|\x27)\s*clsid\s*\x3a\s*{?\s*4E3770F4-1937-4F05-B9A2-959BE7321909\s*}?(.*)\>	2	0	0	1
+6077	6077	<object\s*[^>]*\s*classid\s*=\s*(\x22|\x27)\s*clsid\s*\x3a\s*{?\s*4E3770F4-1937-4F05-B9A2-959BE7321909\s*}?(.*)\>	2	0	0	1
+6078	6078	\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}	2	0	0	1
+6079	6079	String.fromCharCode|28|[a-z,0-9]{1,20}\x2EcharCodeAt\x28	2	0	0	1
+6080	6080	<object\s*[^>]*\s*classid\s*=\s*(\x22|\x27)\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\>	2	0	0	1
+6081	6081	src\s*\x3d\s*\x22res\x3a\x2f\x2fmshtml\x2edll	2	0	0	1
+6082	6082	stream(\x0D\x0A|\x0A)CWS	2	0	0	1
+6083	6083	\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^OpenAction](O|#4F)(p|#70)(e|#65)(n|#6E)(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|#6E)	2	0	0	1
+6084	6084	\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JS](J|#4A)(S|#53)	2	0	0	1
+6085	6085	\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^EmbeddedFile](E|#45)(m|#6D)(b|#62)(e|#65)(d|#64)(d|#64)(e|#65)(d#64)(F|#46)(i|#69)(l|#6C)(e|#65)	2	0	0	1
+6086	6086	\x3C\x3C[^>]*\x2F[^Type](T|#54)(y|#79)(p|#70)(e|#65)	2	0	0	1
+6087	6087	\x3C\x3C[^\n]*\x2F[^Javascript](J|#4A)(a|#61)(v|#76)(a|#61)(S|#73|#53)(c|#63)(r|#72)(i|#69)(p|#70)(t|#74)	2	0	0	1
+6088	6088	\x3C\x3C[^>]*\x2F[^URL](U|#55)(R|#52)(L|#4C)	2	0	0	1
+6089	6089	(\&lt\;).+(\&gt\;)	2	0	0	1
+6090	6090	(this|doc)\x2EprintSeps	2	0	0	1
+6091	6091	^Content-Type\x3a\s*application\x2fsmi.*?<area[\s\n\r]+href=[\x22\x27]file\x3ajavascript\x3a	2	0	0	1
+6092	6092	^BM	2	0	0	1
+6093	6093	IHDR(.*LTE).*?tRNS	2	0	0	1
+6094	6094	<OBJECT\s+[^>]*type\s*=[\x22\x27]\x2f{32}	2	0	0	1
+6095	6095	(\x5c[^\x5c]{16,}|\x2f[^\x2f]{16,})\.cda$	2	0	0	1
+6096	6096	^Location\x3a\s*URL\s*\x3a	2	0	0	1
+6097	6097	<<[^>]*\x2FU3D\x2FLength\x20172[0-5][0-9]{2}	2	0	0	1
+6098	6098	\x2F(Subtype)(S|#53)(u|#75)(b|#62)(t|#74)(y|#79)(p|#70)(e|#65)	2	0	0	1
+6099	6099	\x2F(Action)(A|#41)(c|#63)(t|#74)(i|#69)(o|#6F)(n|#6E)	2	0	0	1
+6100	6100	\x2F(Pages)(P|#40)(a|#61)(g|#67)(e|#65)(s|#73)	2	0	0	1
+6101	6101	\x2F(Launch)(L|#4C)(a|#61)(u|#75)(n#6E)(c|#63)(h|#68).+\x2F(W|#57)(i|#69)(n|#6E).+\x2Eexe	2	0	0	1
+6102	6102	code=\"[a-z]\.[a-z][\.\"][ c]	2	0	0	1
+6103	6103	\/info.php\?n=\d	2	0	0	1
+6104	6104	\/n\.php\?h=\w*?&s=\w{1,5}$	2	0	0	1
+6105	6105	(\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(	2	0	0	1
+6106	6106	^\/50a[a-f0-9]{21}\/(((\d+,)+\d+)|null)\/	2	0	0	1
+6107	6107	\/[0-9]{6}\.js\?[0-9]{6}&[0-9a-f]{16}$	2	0	0	1
+6108	6108	^\s*?(<var>[a-z]{3,6})\s*[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((=var)\)\x3b<\/script>	2	0	0	1
+6109	6109	^[^\x22\x27\x3b]*?[\x22\x27](<space>[a-f0-9]{2})(<sep>[^0-9a-f])(<f>[a-f0-9]{2})(=sep)[a-f0-9]{2}(=sep)(<n>((=f))[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[a-f0-9]{2})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+6110	6110	^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+6111	6111	^[\r\n\s]*[\r\n\s]*?[\x22\x27]?[a-f0-9]{100}	2	0	0	1
+6112	6112	^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(<f>[a-f0-9]{2})(<sep>[^\x22\x27a-f0-9]{0,10})(<u>((=f))[a-f0-9]{2})(=sep)(<n>(((=f)|(=u)))[a-f0-9]{2})(=sep)(<c>(((=f)|(=u)|(=n)))[a-f0-9]{2})(=sep)(<t>(((=f)|(=u)|(=n)|(=c)))[a-f0-9]{2})(=sep)(<i>(((=f)|(=u)|(=n)|(=c)|(=t)))[a-f0-9]{2})(=sep)(<o>(((=f)|(=u)|(=n)|(=c)|(=t)|(=i)))[a-f0-9]{2})(=sep)(=n)(=sep)(<spc>[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){1,100}(=spc)	2	0	0	1
+6113	6113	^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(<f>[a-f0-9]{2})(<sep>[^\x22\x27a-f0-9]{0,10})(<u>((=f))[a-f0-9]{2})(=sep)(<n>(((=f)|(=u)))[a-f0-9]{2})(=sep)(<c>(((=f)|(=u)|(=n)))[a-f0-9]{2})(=sep)(<t>(((=f)|(=u)|(=n)|(=c)))[a-f0-9]{2})(=sep)(<i>(((=f)|(=u)|(=n)|(=c)|(=t)))[a-f0-9]{2})(=sep)(<o>(((=f)|(=u)|(=n)|(=c)|(=t)|(=i)))[a-f0-9]{2})(=sep)(=n)(=sep)(<spc>[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){1,100}(=spc)	2	0	0	1
+6114	6114	^([a-f0-9]{2}[^\x22\x27a-f0-9]{0,10})?(<f>[a-f0-9]{2})(<sep>[^\x22\x27a-f0-9]{0,10})(<u>((=f))[a-f0-9]{2})(=sep)(<n>(((=f)|(=u)))[a-f0-9]{2})(=sep)(<c>(((=f)|(=u)|(=n)))[a-f0-9]{2})(=sep)(<t>(((=f)|(=u)|(=n)|(=c)))[a-f0-9]{2})(=sep)(<i>(((=f)|(=u)|(=n)|(=c)|(=t)))[a-f0-9]{2})(=sep)(<o>(((=f)|(=u)|(=n)|(=c)|(=t)|(=i)))[a-f0-9]{2})(=sep)(=n)(=sep)(<spc>[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){1,100}(=spc)	2	0	0	1
+6115	6115	\/(app|info)\.php\?message=[A-Za-z0-9\+\/]+={0,2}$	2	0	0	1
+6116	6116	filename=[^\x3b\x3a\r\n]*(\x2e\x2e|\x25\x32\x65)	2	0	0	1
+6117	6117	^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\r$	2	0	0	1
+6118	6118	Host\x3a\x20[a-z]{6}\.best.lt\.ua\r$/Hm	2	0	0	1
+6119	6119	^[\r\n\s]*?[\x22\x27](<sp>[^\x22\x27]+)[\x22\x27].+?eval\([^\)\(]+?\([\x22\x27]\d{2,3}(=sp)\d{2,3}(=sp)	2	0	0	1
+6120	6120	\/\?flow_id=\d+?&\d+\d+?\/case_id=\d+$	2	0	0	1
+6121	6121	^\s+?(<vname>[^\s=]+)\s*\s*?(<q>[\x22\x27])(((=q)).)+?\.exe(=q).+?<applet((<\/applet>).)+?value\s*\s*?(\x22\x27|\x27\x22)\s*?\+\s*?(=vname)\s*?\+\s*?(\x22\x27|\x27\x22)	2	0	0	1
+6122	6122	^\s*?\(	2	0	0	1
+6123	6123	\.php\?b=[A-F0-9]{6}&css=[a-z]+$	2	0	0	1
+6124	6124	^[A-Za-z0-9\+\/]+((LmVvdA=|5lb3Q)=|uZW90)[\x22\x27]	2	0	0	1
+6125	6125	Referer\x3a\x20[^\r\n]+?\/1\.html[\x3a\r]/Hi	2	0	0	1
+6126	6126	\x3Cvalue\x3D\x22([a-z0-9+/]{4})*([a-z0-9+/]{2}==|[a-z0-9+/]{3}=)	2	0	0	1
+6127	6127	^((<\/script>).)*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]+?\/[a-z0-9A-Z]{8}\.php\?id=\d{6,9}[\x22\x27]	2	0	0	1
+6128	6128	^Host\x3a\x20[^\r\n]+(\r\n)?\r\n$/Hi	2	0	0	1
+6129	6129	^\/assets\/js\/jquery-[0-9]\.[0-9]\.[0-9]\.min\.js\?ver=[0-9]+\.[0-9]+\.[0-9]+$	2	0	0	1
+6130	6130	^\/[0-9]{2,3}x[0-9]{2,3}\/[a-z]+\.php\?[a-z]{2}=[0-9a-z]+$	2	0	0	1
+6131	6131	^\/js\/metrika\/watch\.js\?ver=[0-9]+\.[0-9]+\.[0-9]+$	2	0	0	1
+6132	6132	^\s*?(<var>[a-z]{3,6})\s*[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((=var)\)\x3b<\/script>	2	0	0	1
+6133	6133	^((<table>).)+?<tr[\r\n\s\>]((<\/tr>).)*?<span[\r\n\s\>]((<\/span>).)*?<([QU]|S(TR(IKE|ONG)|U[BP]|MALL|AMP)?|B(LINK|DO|IG)?|A(CRONYM|BBR)|R([PT]|UBY)|(NOB|VA)R|C(IT|OD)E|D(EL|FN)|I(NS)?|KBD|EM|TT)[^>]*?\bid[\r\n\s]*	2	0	0	1
+6134	6134	^\s*?(<var>[a-z]{3,6})\s*[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((=var)\)\x3b<\/script>	2	0	0	1
+6135	6135	^\s*?(<var>[a-z]{3,6})\s*[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]+?\+[a-z]{3,6}\.substring([^)]+?)[^\x3b\n]*?\x3bdocument\.write\((=var)\)\x3b<\/script>	2	0	0	1
+6136	6136	(<e>\d{2})(<t>((=e))\d{2})(=e)\d{2}(=t)\d{6}(=e)\d{12}(<q>(((=e)|(=t)))\d{2})\d{2}(<dot>(((=e)|(=t)|(=q)))\d{2})\d{2}(=dot)\d{2}(=q)	2	0	0	1
+6137	6137	^\d+&w=\d+&ua=.+&e=1$	2	0	0	1
+6138	6138	^\s*?(<var1>[^\x29\x5b]+)\x5b\s*?(<cntr>[^\x5d]+)\s*?\x5d\s*?\+\s*?(=var1)\x5b\s*?(=cntr)\s*?\+\s*?1\s*?\x5d\s*?\x29\s*?,\s*?16\s*?\x29\s*?\^\s*?parseInt\x28\x28\s*?(<var2>[^\x29\x5b]+)\x5b\s*?(=cntr)\s*?\x5d\s*?\+\s*?(=var2)\x5b\s*?(=cntr)\s*?\+\s*?1\s*?\x5d\s*?\x29\s*?,\s*16\s*?\x29\x29\s*?\x3b\s*?(=cntr)\s*?\+=\s*?2\s*?\x3b	2	0	0	1
+6139	6139	^(687474703a2f2f)(<h>[a-f0-9]{2})(<t>[a-f0-9]{2})(=t)(<p>[a-f0-9]{2})(<colon>[a-f0-9]{2})(<slash>[a-f0-9]{2})(=slash)	2	0	0	1
+6140	6140	^(25)?20(\x25(25)?20|\s)*reserve	2	0	0	1
+6141	6141	\x3C\x3C[^>]*\x2FEmbeddedfile	2	0	0	1
+6142	6142	^\/[a-z]{10}\/[a-z]{10}\.html$	2	0	0	1
+6143	6143	^[^\x2f\x22]+?\x22>	2	0	0	1
+6144	6144	^\s*?\w+\s*\s*?[\x22\x27]UEsDB	2	0	0	1
+6145	6145	^[^\r\n]+?\.html?\r?$	2	0	0	1
+6146	6146	^[^\x27]*?2[^\x27]*?7[^\x27]*?c[^\x27]*?d[^\x27]*?b[^\x27]*?6[^\x27]*?e[^\x27]*?-[^\x27]*?a[^\x27]*?e[^\x27]*?6[^\x27]*?d[^\x27]*?-[^\x27]*?1[^\x27]*?1[^\x27]*?c[^\x27]*?f[^\x27]*?-[^\x27]*?9[^\x27]*?6[^\x27]*?b[^\x27]*?8[^\x27]*?-[^\x27]*?4[^\x27]*?4[^\x27]*?4[^\x27]*?5[^\x27]*?5[^\x27]*?3[^\x27]*?5[^\x27]*?4[^\x27]*?0[^\x27]*?0[^\x27]*?0[^\x27]*?0	2	0	0	1
+6147	6147	^([a-z]{0,7}[A-Z])([A-Z]{0,7}[a-z])[A-Za-z]{8}\x22[^>]+[A-Za-z]{70}	2	0	0	1
+6148	6148	^\s*?\(\s*?[\x22\x27]chrome\x3a\/\/	2	0	0	1
+6149	6149	http\x3a -J-jar -J\x5C\x5C\x5C\x5C\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x5C\x5C[^\n]*\.jar	2	0	0	1
+6150	6150	^[a-f0-9]{500}	2	0	0	1
+6151	6151	^[a-f0-9]{500}	2	0	0	1
+6152	6152	(obj.data|object.data).+file\x3A\x2F\x2F127\x2E[0-9]	2	0	0	1
+6153	6153	^\/in\/\?_BC=\d+,\d+,\d+,[0-9,-]+,$	2	0	0	1
+6154	6154	\x2A[a-z0-9]{10}\x2A\x2Fwindow\x2Eeval\x28String\x2EfromCharCode\x28[0-9]{1,3}\x2C[0-9]{1,3}\x2C	2	0	0	1
+6155	6155	<title>[a-f0-9]{10}<\/title>	2	0	0	1
+6156	6156	value=.[a-f0-9]{100}	2	0	0	1
+6157	6157	^\s*\([^\)]*\)\s*\.\s*prototype\s*\.\s*(hasFeature|isPrototypeOf)	2	0	0	1
+6158	6158	^[\x52\x5c\x64\x65\x90\x93]	2	0	0	1
+6159	6159	^\s*\(\s*function\s*\(\s*\)\s*\{\s*alert	2	0	0	1
+6160	6160	\x0d\x0aHost\x3a\x20[a-f0-9]{20}-[a-f0-9]{32}\.r[0-9]{1,2}\.cf[0-9]\.rackcdn\.com\x0d\x0a/H	2	0	0	1
+6161	6161	document\s*\.\s*location\s*?\x3d\s*?[\x27\x22]help\x3a\/\/\/[^\x3b]+?\%25252f\.\.\%25252f\.\.\%25252f\.\.\%25252f	2	0	0	1
+6162	6162	^Referer\x3a[^\r\n]+\/b.swf\r$/Hm	2	0	0	1
+6163	6163	^\s*?\(	2	0	0	1
+6164	6164	^\s*\.\s*cookie	2	0	0	1
+6165	6165	^\s*\(\s*force\s*\?\s*true\s*\x3a\s*false\s*,\s*\d+\s*,\s*\d+\s*,\s*[\x22\x27][^\x22\x27]+\.exe[\x22\x27]	2	0	0	1
+6166	6166	^(\]|, 3\.3\])\x3b	2	0	0	1
+6167	6167	^\s*?\[\s*?\d	2	0	0	1
+6168	6168	^[\x22\x27+\s]*\/[\x22\x27+\s]*s[\x22\x27+\s]*c[\x22\x27+\s]*r[\x22\x27+\s]*i[\x22\x27+\s]*p[\x22\x27+\s]*t[\x22\x27+\s]*>	2	0	0	1
+6169	6169	stream(\x0D\x0A|\x0A)FWS	2	0	0	1
+6170	6170	^\s*[^\s]+\x5b\s*?[^\x5d\x7c]+\x7c\s*?0\s*?\x5d\s*?\x7c\s*?0\s*?\x3b	2	0	0	1
+6171	6171	\s+?(<var2>[^\s\x3d]+?)\s*\s*?this\.addField.+?(=var2)\s*\x2e\s*setAction\s*?\x28\s*?[\x22\x27]\s*?OnFocus[^\x29]+popupOpen\s*\s*?true	2	0	0	1
+6172	6172	(<obj>[^\s]{1,25})\s*=\s*document\s*\.\s*createElement.*?(<func>[^\s]{1,25})\s*=\s*function\s*\x28\s*e\s*\x29\s*{[^}]*this\s*\.\s*style\s*\.\s*cssText.*?(=obj)\s*\.\s*addEventListener\s*\x28\s*[\x22\x27]\s*DOMAttrModified\s*[\x22\x27]\s*\x2c\s*(=func)	2	0	0	1
+6173	6173	\.php\?cid=[0-9]+?-w[A-Z0-9]{23}$	2	0	0	1
+6174	6174	&clickid=w[A-Z0-9]{23}$	2	0	0	1
+6175	6175	^\/scan[A-Z][a-z]?\/?$	2	0	0	1
+6176	6176	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\/$	2	0	0	1
+6177	6177	^\s*?\.\s*?decode\s*?\(\s*?msgencoded\s*?\)\s*?\.\s*?replace	2	0	0	1
+6178	6178	^\s*?\(\s*?[\x22\x27]ip[\x22\x27]	2	0	0	1
+6179	6179	&clickid=w[A-Z0-9]{23}$	2	0	0	1
+6180	6180	^\s*?\{\s*?setInterval\s*?\(\s*?function	2	0	0	1
+6181	6181	^[^\r\n]+autoplay=[\x22\x27]autoplay	2	0	0	1
+6182	6182	^[^\r\n]+autoplay=[\x22\x27]autoplay	2	0	0	1
+6183	6183	^\s*?\(\s*?function\s*?\(\s*?\)\s*?\{\s*?alert\s*?\(	2	0	0	1
+6184	6184	^\s*\(\s*function\s*\(\s*\)\s*\{\s*alert\s*\([\x22\x27]\s*Warning	2	0	0	1
+6185	6185	^\s*\(\s*0\s*,\s*0\s*,\s*total\s*\)	2	0	0	1
+6186	6186	\x2E\x2E\x2F\x2E\x2E\x2F.+C\x3A\x5C[a-z]	2	0	0	1
+6187	6187	\x3Clocation\x3D.+smb\x3A\x2F\x2F.{1000}.+\x3C\x2Flocation\x3E	2	0	0	1
+6188	6188	eval\x28(String\x2EfromCharCode\x28|[a-z,0-9]{1,20}\x28String\x2EfromCharCode\x28)	2	0	0	1
+6189	6189	util.printf\x28\x22\x25[^\x2C\x29]*f\x22\x2C	2	0	0	1
+6190	6190	<<[^>]*\x2FPredictor[^>]*\x2FColors\x201073741838	2	0	0	1
+6191	6191	\x5clistoverride\x5c((\x5cls\d{1,4}\s*\}).)+?\x5clistoverride\x5c	2	0	0	1
+6192	6192	^\s*?\(\s*?[\x22\x27]script[\x22\x27].+?\s(<vname>[^\s]+)\.onpropertychange\s*=.+?\s(<vname2>[^\s\x3d]+)\s*\s*?[^\s]*?createElement\s*?\(\s*?[\x22\x27]select[\x22\x27].+?(=vname)\.appendChild\(\s*?[\x22\x27]?(=vname2)[\x22\x27]?	2	0	0	1
+6193	6193	^.+?\bEMET\.DLL	2	0	0	1
+6194	6194	^\s*?(<var>[^\x3d\x3b\)\s]+)\s*\s*?0\s*?\x3b(=var)\s*?\<\s*?(0x)?\d{3,4}\s*?\x3b\s*?(=var)\+\+\s*?\)\s*?\x7b[^\x7d]+?\[\s*?(=var)\s*?\]\s*\s*?document\.createElement\([\x22]div[\x22]\)[^\x7d]+?\[\s*?(=var)\s*?\]	2	0	0	1
+6195	6195	^(0*?[19]\d|[^190])	2	0	0	1
+6196	6196	^(((?i:<\/object>)).)+?data\s*?\=\s*?[\x22\x27][^\x22\x27]*[?&]callback=CWS[a-zA-Z0-9_\.\x0d\x0a]{50,}[&\x22\x27]	2	0	0	1
+6197	6197	^(((?i:<\/object>)).)+?data\s*?\=\s*?[\x22\x27][^\x22\x27]*[?&]callback=FWS[a-zA-Z0-9_\.\x0d\x0a]{50,}[&\x22\x27]	2	0	0	1
+6198	6198	^(((?i:<\/object>)).)+?data\s*?\=\s*?[\x22\x27][^\x22\x27]*[?&]callback=ZWS[a-zA-Z0-9_\.\x0d\x0a]{50,}[&\x22\x27]	2	0	0	1
+6199	6199	^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text/vbscript[\x22\x27]((<\/script>).)+?\WShellExecute)	2	0	0	1
+6200	6200	^\W	2	0	0	1
+6201	6201	^\s*\s*?(undefined|false|null|-?0|NaN|\x22\x22|\x27\x27)	2	0	0	1
+6202	6202	[^.]*\.\s*src\s*\=[\x22\x27][^\x22\x27]*\.php\?[ -~]+?\=[\x22\x27]\s*\+localStorage\.	2	0	0	1
+6203	6203	\b(<varname>[^\s\x3d]+)\s*\x3d\s*open\s*\x28\s*[^\x29]+parent-tab:\/\/.+(=varname)\s*\.\s*document\s*\.\s*body\s*.\s*innerHTML\s*=	2	0	0	1
+6204	6204	(?<var1>[^=\s]*)\s*=\s*0x1000000.+?\x28\s*\x28\s*\x28\s*\w+\s*<<\s*12\s*\x29\s*\|\s*0\s*\x29\s*\+\s*(=var1)\s*\x29\s*\|\s*0	2	0	0	1
+6205	6205	\s*?Default\s+Property((end\s*property).)*?ReDim\s+Preserve\s+array	2	0	0	1
+6206	6206	^\/[a-z]+\.dill\/$	2	0	0	1
+6207	6207	^[\x22\x27]\s*content\s*=\s*[\x22\x27]\s*IE\s*=\s*10	2	0	0	1
+6208	6208	^[a-z]{2,3}\.dll	2	0	0	1
+6209	6209	\/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+6210	6210	^\s*\-\s*	2	0	0	1
+6211	6211	^\s*reserve\s*?(<var1>[a-z]\w{0,254})\s*?\x28\s*?[^\x29]+?\x29.*?redim\s*reserve\s*?(=var1)	2	0	0	1
+6212	6212	Shell.*%0a\s*IconFile\s*=\s*\x5c\x5c	2	0	0	1
+6213	6213	<iframe.*?src.*.*?<\/iframe>	2	0	0	1
+6214	6214	<iframe.*?src.*.*?<\/iframe>	2	0	0	1
+6215	6215	^\s*[\x22\x27]\s*file\x3a\x2f\x2f\x2f\x5c\x5c[^\x20]+\x5cC\$\x5c\s*[\x22\x27]	2	0	0	1
+6216	6216	^Referer\x3a[^\r\n]+\.swf/Hmi	2	0	0	1
+6217	6217	^[^>\r\n<]+>[A-Za-z]{70}	2	0	0	1
+6218	6218	^[^\r\n]+?\.html?\r?$/Hmi	2	0	0	1
+6219	6219	^[^\r\n]+\.html\r?$/Hmi	2	0	0	1
+6220	6220	^\s*=\s*\x5c\x5c	2	0	0	1
+6221	6221	^\s*\.\s*cookie	2	0	0	1
+6222	6222	^((<\/script>).)+?powershell\.exe	2	0	0	1
+6223	6223	^((<\/script>).)+?powershell\.exe	2	0	0	1
+6224	6224	^[^\r\n]+\/\?pcl=([a-zA-Z0-9_-]{86}|[a-zA-Z0-9_-]{43})\x2e{1,2}&cid=	2	0	0	1
+6225	6225	^[a-z0-9]{6,15}$	2	0	0	1
+6226	6226	^https\/\/	2	0	0	1
+6227	6227	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+6228	6228	^WWW-Authenticate\x3a\x20Basic\x20realm=[\x22\x27][^\r\n]*Error[^\r\n]*-	2	0	0	1
+6229	6229	^\/[a-z]{7,11}\.js\?[a-f0-9]{16}$	2	0	0	1
+6230	6230	\/([a-zA-Z\d]{0,6}[a-z][A-Z])[A-Za-z\d]{8}\.php\?id=\d{6,9}$	2	0	0	1
+6231	6231	^((<\/xsl).)+?src\s*=\s*[\x27\x22](<loc>[^\x22\x27]+?)[\x27\x22].+?Content-Location\x3a\s+(=loc)	2	0	0	1
+6232	6232	^[2'][2h'+][2hl'+][2hlY'+][2hlY2'+][2hlY2t'+][2hlY2tv'+][2hlY2tvd'+][2hlY2tvdX'+][2hlY2tvdXQ'+]([2hlY2tvdXQ='+]){1,10}	2	0	0	1
+6233	6233	&name=[a-z0-9\x20]+$	2	0	0	1
+6234	6234	^[A-Z0-9_\-.]{20,300}\x3b	2	0	0	1
+6235	6235	^\s*[a-f0-9]{32}\s*\x2a\x2f	2	0	0	1
+6236	6236	[A-Za-z0-9]{10,20}_14[0-9]{8,}\/index\.html$	2	0	0	1
+6237	6237	^[^\r\n\s>]+\/[a-z]{4,5}\.html\>\<\/iframe\>	2	0	0	1
+6238	6238	^((<\/iframe>).)*?[\r\n\s]+name[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])?(Twitter|Google\+)(=q)?[\r\n\s]+	2	0	0	1
+6239	6239	^((<\/iframe>).)*?[\r\n\s]+name[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])?(Twitter|Google\+)(=q)?[\r\n\s]+	2	0	0	1
+6240	6240	^[A-Z0-9_\-.]{20,300}\x3b	2	0	0	1
+6241	6241	<DIV\s*?id[\s\r\n]*?\x3d[\s\r\n]*?(<divid>[^>]+).+?<img\s*id=\s*?\x22(<imgid>[^\x22]+).+?\<a\s*?href=\x22javascript\x3a(<firstfunction>[^\x28]+)\(\).+?\>.*?\<div[^\>]+?id=\x22(=imgid)\x22[^>]+?on[A-Za-z]+?\s*\s*?\x22(<secondfunction>[^\x28]+)\(\)\x3b\s*?\x22.+?function[\s\r\n]*?(=firstfunction)[\s\r\n]*?\(.*?\).*?\x7b.*?(=divid)\x2einnerHTML\s*?\x3d\s*?(=divid)\x2einnerHTML[\s\r\n]*?\x3b.*?\x7d.*?function[\s\r\n]*?(=secondfunction)[\s\r\n]*?\(.*?\).*?\x7b.*?\x28\x22(=imgid)\x22\x29\x2esrc\s*?\x3d	2	0	0	1
+6242	6242	(\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(	2	0	0	1
+6243	6243	(\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(	2	0	0	1
+6244	6244	^[\r\n\s]*[\x22\x27]selectAll	2	0	0	1
+6245	6245	clsid\s*\x3a\s*\x7B?\s*f5078f3(2|3)-c551-11d3-89b9-0000f81fe221	2	0	0	1
+6246	6246	^[\x20-\x7f]*\(\?[sxXmUJ]*i[sxXmUJ]*(\-[sxXmUJ]*)?\)[\x20-\x7f]*\(\?[sxXmUJ]*\-[sxXmUJ]*i[sxXmUJ]*\)[\x20-\x7f]*\|\|	2	0	0	1
+6247	6247	^[\x20-\x7f]*\(\?[sxXmUJ]*i[sxXmUJ]*(\-[sxXmUJ]*)?\)[\x20-\x7f]*\(\?[sxXmUJ]*\-[sxXmUJ]*i[sxXmUJ]*\)[\x20-\x7f]*\|\|	2	0	0	1
+6248	6248	^[\r\n\s\+\>]((<\/bdo>).)*?<fieldset[\r\n\s\+\>]((<\/fieldset>).)*?<\/bdo>	2	0	0	1
+6249	6249	^[\r\n\s\+]+?(<var>[^\r\n\s\+\x3d]+)[\r\n\s\+]*[\r\n\s\+]*?[^\)]+\.createElement\(.+?\.body.appendChild\([\r\n\s]*?[\x22\x27]?(=var)[\x22\x27]?[\r\n\s]*?\).+\b(=var)\.innerHTML[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(=q)	2	0	0	1
+6250	6250	^(:?([\x22\x27][\r\n\s]*?\])?[\r\n\s]*|[\x22\x27][\r\n\s]*?\,)[\r\n\s]*?(function)(<func>[^\r\n\s]+)\b.+?function[\r\n\s]+(=func)[\r\n\s]*?\([^\)]*?\)[\r\n\s]*?\{((function).)*?(\b(<var>[^\r\n\s\=]+)[\r\n\s]*[\r\n\s]*?(\x22\x22|\x27\x27))?((function).)*?document\.write\([\r\n\s]*?(\x22\x22|\x27\x27|(=var))[\r\n\s]*?\)	2	0	0	1
+6251	6251	^(:?([\x22\x27][\r\n\s]*?\])?[\r\n\s]*|[\x22\x27][\r\n\s]*?\,)[\r\n\s]*?function[\r\n\s]*?\([^\)]*?\)[\r\n\s]*?\{.*?(\b(<var>[^\r\n\s\=]+)[\r\n\s]*[\r\n\s]*?(\x22\x22|\x27\x27))?.*?document\.write\([\r\n\s]*?(\x22\x22|\x27\x27|(=var))[\r\n\s]*?\)	2	0	0	1
+6252	6252	[\x22\x27\<]hr[\x22\x27\>]	2	0	0	1
+6253	6253	^[\r\n\s\+]+?(<var>[^\r\n\s\+\x3d]+)[\r\n\s\+]*[\r\n\s\+]*?[^\)]+\.createElement\(.+?\.appendChild\([\r\n\s]*?[\x22\x27]?(=var)[\x22\x27]?[\r\n\s]*?\).+\b(=var)\.innerHTML[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(=q).+?CollectGarbage\(.+?\b(=var)\.	2	0	0	1
+6254	6254	^[\r\n\s]+(<func>[^\r\n\s]+)[\r\n\s]*?\([^\)]*?\)[\r\n\s]*?\{((function).)*?(\b(<var>[^\r\n\s\=]+)[\r\n\s]*[\r\n\s]*?(\x22\x22|\x27\x27))?((function).)*?document\.write\([\r\n\s]*?(\x22\x22|\x27\x27|(=var))[\r\n\s]*?\).+?onlosecapture(:?([\x22\x27][\r\n\s]*?\])?[\r\n\s]*|[\x22\x27][\r\n\s]*?\,)[\r\n\s]*?(=func)\b	2	0	0	1
+6255	6255	^[\r\n\s]*?[\x27\x22]Unselect[\x27\x22]	2	0	0	1
+6256	6256	node=.*\|.+\|	2	0	0	1
+6257	6257	\x0a\x0dCookie\x3a[^\n]+UNION.+SELECT	2	0	0	1
+6258	6258	\x0d\x0aCookie\x3a[^\n]+SELECT.+FROM	2	0	0	1
+6259	6259	\x0a\x0dCookie\x3a[^\n]DELETE.+FROM	2	0	0	1
+6260	6260	\x0a\x0dCookie\x3a[^\n]INSERT.+INTO	2	0	0	1
+6261	6261	\x0a\x0dCookie\x3a[^\n]INTO.+OUTFILE	2	0	0	1
+6262	6262	\x0a\x0dCookie\x3a[^\n]SELECT.+INSTR	2	0	0	1
+6263	6263	\x0a\x0dCookie\x3a[^\n]SELECT.+SUBSTR	2	0	0	1
+6264	6264	\x2FOvCgi\x2FMain\x2FSnmp\x2Eexe.+id\x3D.{600}	2	0	0	1
+6265	6265	^Authorization|3A|\s*Basic\s+TERBUF9Bbm9ueW1vdXM6TGRhcFBhc3N3b3JkXzE=	2	0	0	1
+6266	6266	([\w\x25]+=[\w\x25]*&){500}/Psmi	2	0	0	1
+6267	6267	(\r\nContent-Disposition\x3a\s+form-data\x3b[^\r\n]+\r\n\r\n.+?){250}/Psmi	2	0	0	1
+6268	6268	\x0a\x0dCookie\x3a[^\n]+xp_cmdshell	2	0	0	1
+6269	6269	>.*?\'\s*?\)\s*?\)*?\s*?\;/P	2	0	0	1
+6270	6270	\bSELECT.*?\bPRIV	2	0	0	1
+6271	6271	^[^\x22\x27\x3b]*?[\x22\x27](<space>[a-f0-9]{2})(<sep>[^0-9a-f])(<f>[a-f0-9]{2})(=sep)[a-f0-9]{2}(=sep)(<n>((=f))[a-f0-9]{2})(=sep)([a-f0-9]{2}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[a-f0-9]{2})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+6272	6272	^Accept-Language\:[^\n]*?[^,\;\n]{17}	2	0	0	1
+6273	6273	^User-Agent\x3a[^\r\n]+?Googlebot[^\-].+?\r$/Hmi	2	0	0	1
+6274	6274	(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+6275	6275	[\?\=\x3a\s\x2f]	2	0	0	1
+6276	6276	[\?\=\x3a\s\x2f]	2	0	0	1
+6277	6277	[\?\=\x3a\s\x2f]	2	0	0	1
+6278	6278	[\?\=\x3a\s\x2f]	2	0	0	1
+6279	6279	[\?\=\x3a\s\x2f]	2	0	0	1
+6280	6280	[\?\=\x3a\s\x2f]	2	0	0	1
+6281	6281	[\?\=\x3a\s\x2f]	2	0	0	1
+6282	6282	[\?\=\x3a\s\x2f]	2	0	0	1
+6283	6283	[\?\=\x3a\s\x2f]	2	0	0	1
+6284	6284	[\?\=\x3a\s\x2f]	2	0	0	1
+6285	6285	[\?\=\x3a\s\x2f]	2	0	0	1
+6286	6286	[\?\=\x3a\s\x2f]	2	0	0	1
+6287	6287	[\?\=\x3a\s\x2f]	2	0	0	1
+6288	6288	[\?\=\x3a\s\x2f]	2	0	0	1
+6289	6289	[\?\=\x3a\s\x2f]	2	0	0	1
+6290	6290	[\?\=\x3a\s\x2f]	2	0	0	1
+6291	6291	[\?\=\x3a\s\x2f]	2	0	0	1
+6292	6292	[\?\=\x3a\s\x2f]	2	0	0	1
+6293	6293	[\?\=\x3a\s\x2f]	2	0	0	1
+6294	6294	[\?\=\x3a\s\x2f]	2	0	0	1
+6295	6295	[\?\=\x3a\s\x2f]	2	0	0	1
+6296	6296	[\?\=\x3a\s\x2f]	2	0	0	1
+6297	6297	[\?\=\x3a\s\x2f]	2	0	0	1
+6298	6298	[\?\=\x3a\s\x2f]	2	0	0	1
+6299	6299	[\?\=\x3a\s\x2f]	2	0	0	1
+6300	6300	[\?\=\x3a\s\x2f]	2	0	0	1
+6301	6301	[\?\=\x3a\s\x2f]	2	0	0	1
+6302	6302	[\?\=\x3a\s\x2f]	2	0	0	1
+6303	6303	[\?\=\x3a\s\x2f]	2	0	0	1
+6304	6304	[\?\=\x3a\s\x2f]	2	0	0	1
+6305	6305	http\x3A\/\/127\.0\.0\.1\/.*\.asp	2	0	0	1
+6306	6306	date=\d{8}\)\;.	2	0	0	1
+6307	6307	migrate\s*=\s*\|	2	0	0	1
+6308	6308	(f=.+\|)	2	0	0	1
+6309	6309	(f=\.\..+)	2	0	0	1
+6310	6310	file=.*\|	2	0	0	1
+6311	6311	file=.+\.\..+\|	2	0	0	1
+6312	6312	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6313	6313	BaseTarget=.*?\"	2	0	0	1
+6314	6314	src=.*\"><\/FRAMESET>.*<script>.*<\/script>	2	0	0	1
+6315	6315	(showenv|parsequery|rwservlet)\?.*CUSTOMIZE=\/	2	0	0	1
+6316	6316	(showenv|parsequery|rwservlet)\?.*destype=file.*desformat=\/	2	0	0	1
+6317	6317	(showenv|parsequery|rwservlet)\?.*report=.*\.(rdf|rep)	2	0	0	1
+6318	6318	\x2Ephp\x3F.{0,300}\x3Dhttp\x3A\x2F[^\x3F\x26]+\x3F	2	0	0	1
+6319	6319	\x2F\x2A.+\x2A\x2F	2	0	0	1
+6320	6320	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6321	6321	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6322	6322	<?(java|vb)?script>?	2	0	0	1
+6323	6323	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6324	6324	^[\r\n\s]*?\x28[\r\n\s]*?base64_decode	2	0	0	1
+6325	6325	^[\r\n\s]*?\x28[\r\n\s]*?gzinflate	2	0	0	1
+6326	6326	^[\r\n\s]*?\x28[\r\n\s]*?str_rot13	2	0	0	1
+6327	6327	^[\r\n\s]*?\x28[\r\n\s]*?gzuncompress	2	0	0	1
+6328	6328	^[\r\n\s]*?\x28[\r\n\s]*?convert_uudecode	2	0	0	1
+6329	6329	c99shcook	2	0	0	1
+6330	6330	^[^\r\n]*?HTTP\/1((\r?\n\r?\n)[\x20-\x7e\s]){1,50}\n[\x20-\x7e]{1,100}\x3a[\x20-\x7e]{0,50}\x28\x29\x20\x7b	2	0	0	1
+6331	6331	(\x2a\x3f){700}	2	0	0	1
+6332	6332	UserName\x3d[^\x26]+\x2500	2	0	0	1
+6333	6333	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+6334	6334	^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|javascript)	2	0	0	1
+6335	6335	name=(<q>[\x22\x27])a(=q)[^\r\n]*\r\n[\r\n\s]+(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php)	2	0	0	1
+6336	6336	\?id=[0-9]{13}&msg=[^&]+$	2	0	0	1
+6337	6337	(%3C%21|\<\!)--[\r\n\s]*?mfunc	2	0	0	1
+6338	6338	(%3C%21|\<\!)--[\r\n\s]*?mclude	2	0	0	1
+6339	6339	(%3C%21|\<\!)--[\r\n\s]*?dynamic-cached-content	2	0	0	1
+6340	6340	^[0-9]{2,3}\)char\([^\x0d\x0a\x20]{98}	2	0	0	1
+6341	6341	^\b	2	0	0	1
+6342	6342	<%[\x00-\x7f]{20}	2	0	0	1
+6343	6343	^\s*\s*?[\x22\x27]?(f(ile|tp)|gopher|https?|mailto)\s*?\x3a	2	0	0	1
+6344	6344	^[a-z0-9\.\_]{5}hC[a-z0-9\.\_]{50}	2	0	0	1
+6345	6345	[&?]cmd=[^\x26\x28]*(cd|\;|echo|cat|perl|curl|wget|id|uname|t?ftp)	2	0	0	1
+6346	6346	(%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))	2	0	0	1
+6347	6347	net(%(25)?20|\s)+user	2	0	0	1
+6348	6348	^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\x3a\d{1,5})?$	2	0	0	1
+6349	6349	^\s*\-\s*	2	0	0	1
+6350	6350	\${\s*?%{	2	0	0	1
+6351	6351	^If\x3a\x20\x3c[^\r\n>]+?([\x7f-\xff])	2	0	0	1
+6352	6352	^[^\n]+([^ -~\x0d\x0a]|,\x20*,)	2	0	0	1
+6353	6353	var wow\s*=\s*\x22[^\x22\n]+?\x22\x3b[^\x3b\n]*?Date[^\x3b\n]*?\x3b	2	0	0	1
+6354	6354	SELECT[^a-z]+USER	2	0	0	1
+6355	6355	\x2Fcgi\x2Dbin\x2F\x3B.+[a-z]	2	0	0	1
+6356	6356	\WUPDATE\s+[A-Za-z0-9_].*?\WSET\s+[A-Za-z0-9$_].*?\x3d	2	0	0	1
+6357	6357	ViewState\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+6358	6358	(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+6359	6359	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+6360	6360	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange).+Apply\x3DApply	2	0	0	1
+6361	6361	(start|stop|continue|pause|querystate)	2	0	0	1
+6362	6362	xp_reg(read|write|delete)	2	0	0	1
+6363	6363	(xp_enumdsn|xp_enumgroups|xp_ntsec_enumdomains)	2	0	0	1
+6364	6364	\x2Ephp\x3F.{0,300}\x3Dhttps\x3A\x2F[^\x3F\x26]+\x3F	2	0	0	1
+6365	6365	\x2Ephp\x3F.{0,300}\x3Dftp\x3A\x2F[^\x3F\x26]+\x3F	2	0	0	1
+6366	6366	\x2Ephp\x3F.{0,300}\x3Dftp\x3A\x2F[^\x3F\x26]+\x3F	2	0	0	1
+6367	6367	^\s+(database|procedure|table|column)	2	0	0	1
+6368	6368	^\s+(database|procedure|table|column)	2	0	0	1
+6369	6369	^\s+(database|procedure|table|column|directory)	2	0	0	1
+6370	6370	^(DATE|TIME)	2	0	0	1
+6371	6371	BENCHMARK\x28[0-9].+\x29	2	0	0	1
+6372	6372	SELECT.+CONCAT	2	0	0	1
+6373	6373	[^\w]REVERSE[^\w]?\(	2	0	0	1
+6374	6374	cid0\x3d.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+6375	6375	\x7C\x7C.+[a-z]	2	0	0	1
+6376	6376	SELECT.+INSTR	2	0	0	1
+6377	6377	SELECT.+SUBSTR	2	0	0	1
+6378	6378	([\*\?]~1|~1\.?[\*\?]|\/~1\/)	2	0	0	1
+6379	6379	^net[0-4]{2}net\.net$	2	0	0	1
+6380	6380	Transfer-Encoding\x3a[^\r\n]*?chunked	2	0	0	1
+6381	6381	\ballow_url_include\s*	2	0	0	1
+6382	6382	\bsafe_mode\s*	2	0	0	1
+6383	6383	\bopen_basedir\s*	2	0	0	1
+6384	6384	\bauto_prepend_file\s*	2	0	0	1
+6385	6385	\bsuhosin\.simulation\s*	2	0	0	1
+6386	6386	\bdisable_functions[\s\+]*	2	0	0	1
+6387	6387	\.asp\?action=(txt(edit|view)|upload|info|del)(&|$)	2	0	0	1
+6388	6388	[\n\r](content-(type|length)|set-cookie|location)\x3a	2	0	0	1
+6389	6389	\/\$\{[^\}\x2c]+	2	0	0	1
+6390	6390	filename[\r\n\s]*[\r\n\s]*?[\x22\x27]?[^\r\n\x22\x27\x3b]+?\.[\r\n\x3b\x22\x27]	2	0	0	1
+6391	6391	[&\?]_SERVER\[[^\]]+?\][^=]*	2	0	0	1
+6392	6392	[&\?]_GET\[[^\]]+?\][^=]*	2	0	0	1
+6393	6393	[&\?]_POST\[[^\]]+?\][^=]*	2	0	0	1
+6394	6394	[&\?]_COOKIE\[[^\]]+?\][^=]*	2	0	0	1
+6395	6395	[&\?]_SESSION\[[^\]]+?\][^=]*	2	0	0	1
+6396	6396	[&\?]_REQUEST\[[^\]]+?\][^=]*	2	0	0	1
+6397	6397	[&\?]_ENV\[[^\]]+?\][^=]*	2	0	0	1
+6398	6398	([&\?\r\n]|^)_SERVER\[[^\]]+?\][^=]*	2	0	0	1
+6399	6399	([&\?\r\n]|^)_GET\[[^\]]+?\][^=]*	2	0	0	1
+6400	6400	([&\?\r\n]|^)_POST\[[^\]]+?\][^=]*	2	0	0	1
+6401	6401	[&\?]_COOKIE\[[^\]]+?\][^=]*	2	0	0	1
+6402	6402	[&\?]_SESSION\[[^\]]+?\][^=]*	2	0	0	1
+6403	6403	[&\?]_REQUEST\[[^\]]+?\][^=]*	2	0	0	1
+6404	6404	[&\?]_ENV\[[^\]]+?\][^=]*	2	0	0	1
+6405	6405	[?&]isn_getlog	2	0	0	1
+6406	6406	^[^&]*?(%(25)?2e(%((25)?2e(%(25)?5c|\/|\\)|2e(25)?%(25)?2f)|\.(%(25)?(2f|5c)|\/|\\))|\.(%(25)?2e(%(25)?(2f|5c)|\/|\\)|\.(%(25)?(2f|5c)|\/|\\)))	2	0	0	1
+6407	6407	^\s+?[^\s\>]+?\s+?SYSTEM\s	2	0	0	1
+6408	6408	^[^\r\n]*?boundary\s*\s*?[^\r\n]	2	0	0	1
+6409	6409	[&?]c99shcook\[	2	0	0	1
+6410	6410	(^|&)c99shcook\[	2	0	0	1
+6411	6411	^[\r\n\s]*?\x28[\r\n\s]*?base64_decode	2	0	0	1
+6412	6412	\/server_sync.php\?(.+?&)?c=	2	0	0	1
+6413	6413	(:?(:?\x5e|%5e)|(:?[=?&]|\x25(:?3d|3f|26)))\s*?(:?%28|\x28)(:?%29|\x29)(:?%20|\x20)(:?%7b|\x7b)(:?%20|\x20)	2	0	0	1
+6414	6414	(^User-Agent\x3a)\bcurl\s[^\r\n]*?-([Oo]|-(remote-name|output))[^\r\n]+(\x3b|&&)	2	0	0	1
+6415	6415	(^User-Agent\x3a)\bwget\s[^\r\n]+(\x3b|&&)	2	0	0	1
+6416	6416	(^User-Agent\x3a)\blwp-download\s[^\r\n]+(\x3b|&&)	2	0	0	1
+6417	6417	[=?&\x2f]\s*?\x28\x29\x20\x7b	2	0	0	1
+6418	6418	(:?(\x5e|%5e)|([=?&]|\x25(3d|3f|26)))\s*?\(\)(%20|\x20)(%7b|\x7b)	2	0	0	1
+6419	6419	^User-Agent\x3a[^\r\n]*?Heimdallbot	2	0	0	1
+6420	6420	[?&]isn_logdel	2	0	0	1
+6421	6421	[?&]isn_logpath	2	0	0	1
+6422	6422	\.war\?cmd=[a-zA-Z0-9+/=]+&winurl=[a-zA-Z0-9+/=]*&linurl=[a-zA-Z0-9+/=]*	2	0	0	1
+6423	6423	^\s*https?\x3a\/\/	2	0	0	1
+6424	6424	^\s*\x3a\s*[./]	2	0	0	1
+6425	6425	^\s*\x3a\s*[./]	2	0	0	1
+6426	6426	^\s*\x3a\s*\x40	2	0	0	1
+6427	6427	https\x3a.+(\x5c)(:[\x22\x27]|\\x2[27])\s*?[\x3b&\x7c><].*?(:[\x22\x27]|\\x2[27])	2	0	0	1
+6428	6428	xlink\s*?\x3a\s*?href\s*\s*?(:[\x22\x27]|\\x2[27])https.+?&quot\s*?\x3b(\x7c|&([gl]t|amp)\s*?\x3b)	2	0	0	1
+6429	6429	^Range\x3a[^\r\n]*?18446744073709551615	2	0	0	1
+6430	6430	\x2Flevel\x2F15\x2Fexec\x2F\x2D\x2F[a-z]	2	0	0	1
+6431	6431	^\s*=\s*([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|[^\x26\x0D\x0A]*\x3B)	2	0	0	1
+6432	6432	^(set|get)	2	0	0	1
+6433	6433	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+6434	6434	^(1|on|true)	2	0	0	1
+6435	6435	(^|[=?&])\s*?\x28\x29\x20\x7b	2	0	0	1
+6436	6436	(is|mx|info|co)$	2	0	0	1
+6437	6437	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6438	6438	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6439	6439	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6440	6440	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6441	6441	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6442	6442	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6443	6443	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6444	6444	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6445	6445	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6446	6446	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6447	6447	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6448	6448	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6449	6449	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6450	6450	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6451	6451	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6452	6452	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6453	6453	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6454	6454	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6455	6455	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6456	6456	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6457	6457	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6458	6458	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6459	6459	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6460	6460	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6461	6461	^(\w{2,6}://|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})	2	0	0	1
+6462	6462	<(<tname>[^\s]+)[^>]*?\stype\s*=\s*(<q>[\x22\x27])yaml(=q)((<\/(=tname)).+?)!ruby	2	0	0	1
+6463	6463	^[^\r\n]*?[\x27\x22\t\\%\x00\x08\x26]	2	0	0	1
+6464	6464	[\?&]redirect\x3a	2	0	0	1
+6465	6465	[\?&]redirectAction\x3a	2	0	0	1
+6466	6466	[\?&]action\x3a	2	0	0	1
+6467	6467	(^|[\n\&])name=(%\d{2}|[^%&]){12}	2	0	0	1
+6468	6468	(^|[\n\&])pwd=(%\d{2}|[^%&]){25}	2	0	0	1
+6469	6469	(^|[\n\&])sess_sid=(%\d{2}|[^%&]){21}	2	0	0	1
+6470	6470	(^|[\n\&])ACT=(%\d{2}|[^%&]){21}	2	0	0	1
+6471	6471	\bredirect\x3a	2	0	0	1
+6472	6472	\bredirectAction\x3a	2	0	0	1
+6473	6473	\baction\x3a	2	0	0	1
+6474	6474	rdsPasswordAllowed[\r\n\s]*[\r\n\s]*?(true|1)	2	0	0	1
+6475	6475	\/proxy\.php(\?|.*[\x26\x3B])url=[^&\;\x0D\x0A]*[<>\"\']	2	0	0	1
+6476	6476	\<a href="[^"]*(script|about|applet|activex|chrome)\s*\:	2	0	0	1
+6477	6477	\<br \/\>_________________\<br \/\>\<a href="[^"]*(script|about|applet|activex|chrome)\s*\:	2	0	0	1
+6478	6478	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6479	6479	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6480	6480	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5622772D-6C27-11D3-95E5-006008D14F3B	2	0	0	1
+6481	6481	LICMGR_ADDLICENSE&[^\x00\n\r@&]{450}	2	0	0	1
+6482	6482	SELECT.+FROM	2	0	0	1
+6483	6483	UNION\s+SELECT	2	0	0	1
+6484	6484	INSERT.+INTO	2	0	0	1
+6485	6485	DELETE.+FROM	2	0	0	1
+6486	6486	ASCII\(.+SELECT	2	0	0	1
+6487	6487	UPDATE.+SET	2	0	0	1
+6488	6488	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6489	6489	.+UNION\s+SELECT	2	0	0	1
+6490	6490	.+INSERT.+INTO	2	0	0	1
+6491	6491	.+DELETE.+FROM	2	0	0	1
+6492	6492	.+ASCII\(.+SELECT	2	0	0	1
+6493	6493	.+UPDATE.+SET	2	0	0	1
+6494	6494	(art=\|.+\|)	2	0	0	1
+6495	6495	\/index\.php(\?|.*\x26)imgdir=([^\x26\x3B\x0D\x0A]*[\x2F\x5C])?\.\.[\x2F\x5C]	2	0	0	1
+6496	6496	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6497	6497	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6498	6498	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6499	6499	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6500	6500	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6501	6501	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6502	6502	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6503	6503	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6504	6504	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6505	6505	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6506	6506	page_include=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6507	6507	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6508	6508	theme_directory=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6509	6509	theme_directory=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6510	6510	forumspath=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6511	6511	sitepath=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6512	6512	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6513	6513	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6514	6514	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6515	6515	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6516	6516	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6517	6517	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6518	6518	loadadminpage=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6519	6519	SELECT.+FROM	2	0	0	1
+6520	6520	UNION\s+SELECT	2	0	0	1
+6521	6521	INSERT.+INTO	2	0	0	1
+6522	6522	DELETE.+FROM	2	0	0	1
+6523	6523	ASCII\(.+SELECT	2	0	0	1
+6524	6524	UPDATE.+SET	2	0	0	1
+6525	6525	UPDATE.+SET	2	0	0	1
+6526	6526	\+UNION\+SELECT	2	0	0	1
+6527	6527	class_dir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6528	6528	mj_config\[src_path\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6529	6529	page=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6530	6530	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6531	6531	dir\[plugins\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6532	6532	dir\[plugins\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6533	6533	sIncPath=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6534	6534	SELECT.+FROM	2	0	0	1
+6535	6535	UNION\s+SELECT	2	0	0	1
+6536	6536	INSERT.+INTO	2	0	0	1
+6537	6537	DELETE.+FROM	2	0	0	1
+6538	6538	ASCII\(.+SELECT	2	0	0	1
+6539	6539	UPDATE.+SET	2	0	0	1
+6540	6540	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6541	6541	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6542	6542	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6543	6543	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6544	6544	SELECT.+FROM	2	0	0	1
+6545	6545	UNION\s+SELECT	2	0	0	1
+6546	6546	INSERT.+INTO	2	0	0	1
+6547	6547	DELETE.+FROM	2	0	0	1
+6548	6548	ASCII\(.+SELECT	2	0	0	1
+6549	6549	UPDATE.+SET	2	0	0	1
+6550	6550	id_menu\x3d.+DELETE.+FROM	2	0	0	1
+6551	6551	id_menu\x3d.+UPDATE.+SET	2	0	0	1
+6552	6552	(file=\|.+\|)	2	0	0	1
+6553	6553	(graph_start=%0a.+%0a)	2	0	0	1
+6554	6554	UNION\s+SELECT	2	0	0	1
+6555	6555	INSERT.+INTO	2	0	0	1
+6556	6556	DELETE.+FROM	2	0	0	1
+6557	6557	UPDATE.+SET	2	0	0	1
+6558	6558	script>?.*<.*script	2	0	0	1
+6559	6559	script>?.*<.+\/script>?	2	0	0	1
+6560	6560	script>?.*<.+\/script>?	2	0	0	1
+6561	6561	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6562	6562	script>?.*<.+\/script>?	2	0	0	1
+6563	6563	script>?.*<.+\/script>?	2	0	0	1
+6564	6564	script>?.*<.+\/script>?	2	0	0	1
+6565	6565	script>?.*<.+\/script>?	2	0	0	1
+6566	6566	GLOBALS\[mosConfig_absolute_path\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6567	6567	mosConfig_absolute_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6568	6568	mosConfig_absolute_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6569	6569	GLOBALS\[mosConfig_absolute_path\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6570	6570	GLOBALS\[mosConfig_absolute_path\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6571	6571	GLOBALS\[mosConfig_absolute_path\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6572	6572	mosConfig_absolute_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6573	6573	minsoft_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6574	6574	minsoft_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6575	6575	DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6576	6576	DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6577	6577	DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6578	6578	DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6579	6579	DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6580	6580	script>?.*<.+\/script>?	2	0	0	1
+6581	6581	script>?.*<.+\/script>?	2	0	0	1
+6582	6582	script>?.*<.+\/script>?	2	0	0	1
+6583	6583	script>?.*<.+\/script>?	2	0	0	1
+6584	6584	sections_file=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6585	6585	INSERT.+INTO	2	0	0	1
+6586	6586	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6587	6587	SELECT.+FROM	2	0	0	1
+6588	6588	UNION\s+SELECT	2	0	0	1
+6589	6589	INSERT.+INTO	2	0	0	1
+6590	6590	ASCII\(.+SELECT	2	0	0	1
+6591	6591	UPDATE.+SET	2	0	0	1
+6592	6592	\/ping\?.+(script|alert|on(mouse[a-z]+|key[a-z]+|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+6593	6593	footer_file=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6594	6594	SELECT.+FROM	2	0	0	1
+6595	6595	UNION\s+SELECT	2	0	0	1
+6596	6596	INSERT.+INTO	2	0	0	1
+6597	6597	DELETE.+FROM	2	0	0	1
+6598	6598	ASCII\(.+SELECT	2	0	0	1
+6599	6599	UPDATE.+SET	2	0	0	1
+6600	6600	script>?.*<.+\/script>?	2	0	0	1
+6601	6601	SECURITY_FILE=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6602	6602	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6603	6603	SELECT.+FROM	2	0	0	1
+6604	6604	SELECT.+FROM	2	0	0	1
+6605	6605	UNION\s+SELECT	2	0	0	1
+6606	6606	INSERT.+INTO	2	0	0	1
+6607	6607	DELETE.+FROM	2	0	0	1
+6608	6608	ASCII\(.+SELECT	2	0	0	1
+6609	6609	UPDATE.+SET	2	0	0	1
+6610	6610	SELECT.+FROM	2	0	0	1
+6611	6611	&TYPEOF\:.+system\s*\(	2	0	0	1
+6612	6612	(..\\)	2	0	0	1
+6613	6613	script>?.*<.+\/script>?	2	0	0	1
+6614	6614	script>?.*<.+\/script>?	2	0	0	1
+6615	6615	dle_config_api\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6616	6616	script>?.*<.+\/script>?	2	0	0	1
+6617	6617	script>?.*<.+\/script>?	2	0	0	1
+6618	6618	script>?.*<.+\/script>?	2	0	0	1
+6619	6619	root=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6620	6620	=\s*(https?|ftps|php)\:\/	2	0	0	1
+6621	6621	SELECT.+FROM	2	0	0	1
+6622	6622	UNION\s+SELECT	2	0	0	1
+6623	6623	INSERT.+INTO	2	0	0	1
+6624	6624	DELETE.+FROM	2	0	0	1
+6625	6625	ASCII\(.+SELECT	2	0	0	1
+6626	6626	UPDATE.+SET	2	0	0	1
+6627	6627	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6628	6628	script>?.*<.+\/script>?	2	0	0	1
+6629	6629	script>?.*<.+\/script>?	2	0	0	1
+6630	6630	SELECT.+FROM	2	0	0	1
+6631	6631	SELECT.+FROM	2	0	0	1
+6632	6632	UNION\s+SELECT	2	0	0	1
+6633	6633	INSERT.+INTO	2	0	0	1
+6634	6634	DELETE.+FROM	2	0	0	1
+6635	6635	ASCII\(.+SELECT	2	0	0	1
+6636	6636	UPDATE.+SET	2	0	0	1
+6637	6637	FSPHP_LIB\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6638	6638	FSPHP_LIB\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6639	6639	dir\[classes\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6640	6640	SELECT.+FROM	2	0	0	1
+6641	6641	UNION\s+SELECT	2	0	0	1
+6642	6642	INSERT.+INTO	2	0	0	1
+6643	6643	DELETE.+FROM	2	0	0	1
+6644	6644	ASCII\(.+SELECT	2	0	0	1
+6645	6645	UPDATE.+SET	2	0	0	1
+6646	6646	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6647	6647	SELECT.+FROM	2	0	0	1
+6648	6648	UNION\s+SELECT	2	0	0	1
+6649	6649	INSERT.+INTO	2	0	0	1
+6650	6650	DELETE.+FROM	2	0	0	1
+6651	6651	ASCII\(.+SELECT	2	0	0	1
+6652	6652	UPDATE.+SET	2	0	0	1
+6653	6653	API_HOME_DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6654	6654	abspath=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6655	6655	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6656	6656	CFG\[PREPEND_FILE\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6657	6657	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6658	6658	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6659	6659	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6660	6660	SELECT.+FROM	2	0	0	1
+6661	6661	SELECT.+FROM	2	0	0	1
+6662	6662	UNION\s+SELECT	2	0	0	1
+6663	6663	INSERT.+INTO	2	0	0	1
+6664	6664	DELETE.+FROM	2	0	0	1
+6665	6665	ASCII\(.+SELECT	2	0	0	1
+6666	6666	UPDATE.+SET	2	0	0	1
+6667	6667	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6668	6668	root_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6669	6669	cur_module=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6670	6670	proxystylesheet=\s*(https?|ftps?|php)	2	0	0	1
+6671	6671	location=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6672	6672	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6673	6673	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6674	6674	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6675	6675	_settings\[pluginpath\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6676	6676	\/horde((2|3|-3\.(0\.[1-9]|1\.0)))?\/{1,2}README	2	0	0	1
+6677	6677	phpbb_root_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6678	6678	phpbb_root_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6679	6679	CONFIG\[LANGUAGE_CPATH\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6680	6680	CONFIG\[BASE_PATH\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6681	6681	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6682	6682	SELECT.+FROM	2	0	0	1
+6683	6683	UNION\s+SELECT	2	0	0	1
+6684	6684	INSERT.+INTO	2	0	0	1
+6685	6685	DELETE.+FROM	2	0	0	1
+6686	6686	ASCII\(.+SELECT	2	0	0	1
+6687	6687	UPDATE.+SET	2	0	0	1
+6688	6688	SELECT.+FROM	2	0	0	1
+6689	6689	UNION\s+SELECT	2	0	0	1
+6690	6690	INSERT.+INTO	2	0	0	1
+6691	6691	DELETE.+FROM	2	0	0	1
+6692	6692	ASCII\(.+SELECT	2	0	0	1
+6693	6693	UPDATE.+SET	2	0	0	1
+6694	6694	SELECT.+FROM	2	0	0	1
+6695	6695	UNION\s+SELECT	2	0	0	1
+6696	6696	INSERT.+INTO	2	0	0	1
+6697	6697	DELETE.+FROM	2	0	0	1
+6698	6698	ASCII\(.+SELECT	2	0	0	1
+6699	6699	UPDATE.+SET	2	0	0	1
+6700	6700	SELECT.+FROM	2	0	0	1
+6701	6701	UNION\s+SELECT	2	0	0	1
+6702	6702	INSERT.+INTO	2	0	0	1
+6703	6703	DELETE.+FROM	2	0	0	1
+6704	6704	ASCII\(.+SELECT	2	0	0	1
+6705	6705	UPDATE.+SET	2	0	0	1
+6706	6706	SELECT.+FROM	2	0	0	1
+6707	6707	UNION\s+SELECT	2	0	0	1
+6708	6708	INSERT.+INTO	2	0	0	1
+6709	6709	DELETE.+FROM	2	0	0	1
+6710	6710	ASCII\(.+SELECT	2	0	0	1
+6711	6711	UPDATE.+SET	2	0	0	1
+6712	6712	SELECT.+FROM	2	0	0	1
+6713	6713	UNION\s+SELECT	2	0	0	1
+6714	6714	INSERT.+INTO	2	0	0	1
+6715	6715	DELETE.+FROM	2	0	0	1
+6716	6716	ASCII\(.+SELECT	2	0	0	1
+6717	6717	UPDATE.+SET	2	0	0	1
+6718	6718	SELECT.+FROM	2	0	0	1
+6719	6719	UNION\s+SELECT	2	0	0	1
+6720	6720	INSERT.+INTO	2	0	0	1
+6721	6721	DELETE.+FROM	2	0	0	1
+6722	6722	ASCII\(.+SELECT	2	0	0	1
+6723	6723	UPDATE.+SET	2	0	0	1
+6724	6724	script>?.*<.+\/script>?	2	0	0	1
+6725	6725	SELECT.+FROM	2	0	0	1
+6726	6726	UNION\s+SELECT	2	0	0	1
+6727	6727	INSERT.+INTO	2	0	0	1
+6728	6728	DELETE.+FROM	2	0	0	1
+6729	6729	ASCII\(.+SELECT	2	0	0	1
+6730	6730	UPDATE.+SET	2	0	0	1
+6731	6731	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6732	6732	SELECT.+FROM	2	0	0	1
+6733	6733	UNION\s+SELECT	2	0	0	1
+6734	6734	INSERT.+INTO	2	0	0	1
+6735	6735	DELETE.+FROM	2	0	0	1
+6736	6736	ASCII\(.+SELECT	2	0	0	1
+6737	6737	UPDATE.+SET	2	0	0	1
+6738	6738	=\s*(https?|ftps|php)\:\/	2	0	0	1
+6739	6739	SELECT.+FROM	2	0	0	1
+6740	6740	UNION\s+SELECT	2	0	0	1
+6741	6741	INSERT.+INTO	2	0	0	1
+6742	6742	DELETE.+FROM	2	0	0	1
+6743	6743	ASCII\(.+SELECT	2	0	0	1
+6744	6744	UPDATE.+SET	2	0	0	1
+6745	6745	SELECT.+FROM	2	0	0	1
+6746	6746	UNION\s+SELECT	2	0	0	1
+6747	6747	INSERT.+INTO	2	0	0	1
+6748	6748	DELETE.+FROM	2	0	0	1
+6749	6749	ASCII\(.+SELECT	2	0	0	1
+6750	6750	UPDATE.+SET	2	0	0	1
+6751	6751	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6752	6752	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6753	6753	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6754	6754	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6755	6755	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6756	6756	mosConfig_absolute_path=(https?|ftps?|php)\:\/	2	0	0	1
+6757	6757	SELECT.+FROM	2	0	0	1
+6758	6758	UNION\s+SELECT	2	0	0	1
+6759	6759	INSERT.+INTO	2	0	0	1
+6760	6760	DELETE.+FROM	2	0	0	1
+6761	6761	ASCII\(.+SELECT	2	0	0	1
+6762	6762	UPDATE.+SET	2	0	0	1
+6763	6763	include_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6764	6764	processName\x3D.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+6765	6765	help\x2Findex\x2Ejsp.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+6766	6766	content\x2Ejsp.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+6767	6767	appMVCPath=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6768	6768	CURRENT_BLOG_PATH=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+6769	6769	appMVCPath=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+6770	6770	CURRENT_BLOG_PATH=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+6771	6771	ASCII\(.+SELECT	2	0	0	1
+6772	6772	_SESSION\[SCRIPT_PATH\]=\s*(https?|ftps?|php)\x3a\/	2	0	0	1
+6773	6773	top_graph_header\.php\?.*=(http|https)\x3a\/	2	0	0	1
+6774	6774	config_settings\.php\?.*=(http|https)\x3a\/	2	0	0	1
+6775	6775	UNION.+SELECT	2	0	0	1
+6776	6776	=\s*(https|ftps|php|http|ftp)\x3A\x2F	2	0	0	1
+6777	6777	\/filediff\?((&?v\d[\d.]+?)+?&f\x3d|f\x3d.+?(&v\d[\d.]+?)+?).+?\x3b.+?\x3b	2	0	0	1
+6778	6778	(configdir|update|pluginmode)=.*(\|.+\||system)	2	0	0	1
+6779	6779	template=[./]	2	0	0	1
+6780	6780	template=[./]	2	0	0	1
+6781	6781	_CONF\[.*\]=(data|https?|ftps?|php)\:\/	2	0	0	1
+6782	6782	(\.\.\/){1}	2	0	0	1
+6783	6783	IP=\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+6784	6784	commandId\x3D[a-z]	2	0	0	1
+6785	6785	search\?q=(ht|f)tp?\:\/	2	0	0	1
+6786	6786	module=[^\;]*\;.*\"	2	0	0	1
+6787	6787	ASCII\(.+SELECT	2	0	0	1
+6788	6788	UNION\s+SELECT	2	0	0	1
+6789	6789	^Host\x3a[^\r\n]+?[\x28\x29\x27\x22\x7b\x7d]/Hmi	2	0	0	1
+6790	6790	Cookie: .*admin-access=	2	0	0	1
+6791	6791	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+6792	6792	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+6793	6793	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+6794	6794	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6795	6795	FSPHP_LIB\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6796	6796	read_xml_include=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6797	6797	root=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6798	6798	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6799	6799	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6800	6800	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6801	6801	CLASSES_ROOT=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6802	6802	.*\[.*\].*\;	2	0	0	1
+6803	6803	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6804	6804	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6805	6805	oe_classpath=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6806	6806	GLOBALS\[preloc\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6807	6807	GLOBALS\[preloc\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6808	6808	.+SELECT.+FROM	2	0	0	1
+6809	6809	.+UNION\s+SELECT	2	0	0	1
+6810	6810	.+INSERT.+INTO	2	0	0	1
+6811	6811	.+DELETE.+FROM	2	0	0	1
+6812	6812	.+ASCII\(.+SELECT	2	0	0	1
+6813	6813	.+UPDATE.+SET	2	0	0	1
+6814	6814	.+SELECT.+FROM	2	0	0	1
+6815	6815	.+UNION\s+SELECT	2	0	0	1
+6816	6816	.+INSERT.+INTO	2	0	0	1
+6817	6817	.+DELETE.+FROM	2	0	0	1
+6818	6818	.+ASCII\(.+SELECT	2	0	0	1
+6819	6819	.+UPDATE.+SET	2	0	0	1
+6820	6820	.+SELECT.+FROM	2	0	0	1
+6821	6821	.+UNION\s+SELECT	2	0	0	1
+6822	6822	.+INSERT.+INTO	2	0	0	1
+6823	6823	.+DELETE.+FROM	2	0	0	1
+6824	6824	.+ASCII\(.+SELECT	2	0	0	1
+6825	6825	.+UPDATE.+SET	2	0	0	1
+6826	6826	include_path=\s*(ftps?|https?|php)\:/	2	0	0	1
+6827	6827	include_path=\s*(ftps?|https?|php)\:/	2	0	0	1
+6828	6828	include_path=\s*(ftps?|https?|php)\:/	2	0	0	1
+6829	6829	highlight=.*?(\'|\%[a-f0-9]{4})(\.|\/|\\|\%[a-f0-9]{4}).+?(\'|\%[a-f0-9]{4})	2	0	0	1
+6830	6830	phpbb_root_path=(ftps?|https?|php)	2	0	0	1
+6831	6831	(\?|&)id=	2	0	0	1
+6832	6832	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6833	6833	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6834	6834	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6835	6835	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6836	6836	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6837	6837	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6838	6838	(text\.ctrl\.php|common\.function\.php)\?level=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6839	6839	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6840	6840	DataDirectory=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6841	6841	.+SELECT.+FROM	2	0	0	1
+6842	6842	.+UNION\s+SELECT	2	0	0	1
+6843	6843	.+INSERT.+INTO	2	0	0	1
+6844	6844	.+DELETE.+FROM	2	0	0	1
+6845	6845	.+ASCII\(.+SELECT	2	0	0	1
+6846	6846	.+UPDATE.+SET	2	0	0	1
+6847	6847	.+SELECT.+FROM	2	0	0	1
+6848	6848	.+UNION\s+SELECT	2	0	0	1
+6849	6849	.+INSERT.+INTO	2	0	0	1
+6850	6850	.+DELETE.+FROM	2	0	0	1
+6851	6851	.+ASCII\(.+SELECT	2	0	0	1
+6852	6852	.+UPDATE.+SET	2	0	0	1
+6853	6853	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6854	6854	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6855	6855	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6856	6856	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6857	6857	confdir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6858	6858	(argv[1]=\|.+)	2	0	0	1
+6859	6859	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6860	6860	UNION.+SELECT	2	0	0	1
+6861	6861	<\s*SCRIPT\s*>	2	0	0	1
+6862	6862	file=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6863	6863	includedir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6864	6864	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6865	6865	GLOBALS\x5bFarmD\x5d\x3d	2	0	0	1
+6866	6866	SELECT.+FROM	2	0	0	1
+6867	6867	UNION\s+SELECT	2	0	0	1
+6868	6868	INSERT.+INTO	2	0	0	1
+6869	6869	DELETE.+FROM	2	0	0	1
+6870	6870	ASCII\(.+SELECT	2	0	0	1
+6871	6871	UPDATE.+SET	2	0	0	1
+6872	6872	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6873	6873	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6874	6874	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6875	6875	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6876	6876	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6877	6877	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6878	6878	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6879	6879	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6880	6880	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6881	6881	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6882	6882	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6883	6883	.+SELECT.+FROM	2	0	0	1
+6884	6884	.+UNION\s+SELECT	2	0	0	1
+6885	6885	.+INSERT.+INTO	2	0	0	1
+6886	6886	.+DELETE.+FROM	2	0	0	1
+6887	6887	.+ASCII\(.+SELECT	2	0	0	1
+6888	6888	.+UPDATE.+SET	2	0	0	1
+6889	6889	PATH_TO_CODE=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6890	6890	includepath=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6891	6891	lib=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6892	6892	_px_config\x5bmanager_path\x5d=(https?|ftps?|php)\:	2	0	0	1
+6893	6893	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6894	6894	sourceFolder=\s*(ftps?|https?|php)\:/	2	0	0	1
+6895	6895	CONFIG\[gameroot\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6896	6896	CONFIG\[gameroot\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6897	6897	qte_web_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6898	6898	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6899	6899	path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6900	6900	INC_DIR=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6901	6901	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6902	6902	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6903	6903	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6904	6904	GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6905	6905	GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6906	6906	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6907	6907	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6908	6908	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6909	6909	.+SELECT.+FROM	2	0	0	1
+6910	6910	.+UNION\s+SELECT	2	0	0	1
+6911	6911	.+INSERT.+INTO	2	0	0	1
+6912	6912	.+DELETE.+FROM	2	0	0	1
+6913	6913	.+ASCII\(.+SELECT	2	0	0	1
+6914	6914	.+UPDATE.+SET	2	0	0	1
+6915	6915	(\.\.\/){1,}	2	0	0	1
+6916	6916	SELECT.+FROM	2	0	0	1
+6917	6917	UNION\s+SELECT	2	0	0	1
+6918	6918	INSERT.+INTO	2	0	0	1
+6919	6919	DELETE.+FROM	2	0	0	1
+6920	6920	ASCII\(.+SELECT	2	0	0	1
+6921	6921	UPDATE.+SET	2	0	0	1
+6922	6922	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6923	6923	.+SELECT.+FROM	2	0	0	1
+6924	6924	.+UNION\s+SELECT	2	0	0	1
+6925	6925	.+INSERT.+INTO	2	0	0	1
+6926	6926	.+DELETE.+FROM	2	0	0	1
+6927	6927	.+ASCII\(.+SELECT	2	0	0	1
+6928	6928	.+UPDATE.+SET	2	0	0	1
+6929	6929	.+SELECT.+FROM	2	0	0	1
+6930	6930	.+UNION\s+SELECT	2	0	0	1
+6931	6931	.+INSERT.+INTO	2	0	0	1
+6932	6932	.+DELETE.+FROM	2	0	0	1
+6933	6933	.+ASCII\(.+SELECT	2	0	0	1
+6934	6934	.+UPDATE.+SET	2	0	0	1
+6935	6935	_page_css=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6936	6936	_page_javascript=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6937	6937	_page_content=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6938	6938	SELECT.+FROM	2	0	0	1
+6939	6939	UNION\s+SELECT	2	0	0	1
+6940	6940	INSERT.+INTO	2	0	0	1
+6941	6941	DELETE.+FROM	2	0	0	1
+6942	6942	ASCII\(.+SELECT	2	0	0	1
+6943	6943	UPDATE.+SET	2	0	0	1
+6944	6944	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6945	6945	IP=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6946	6946	.+SELECT.+FROM	2	0	0	1
+6947	6947	.+UNION\s+SELECT	2	0	0	1
+6948	6948	.+INSERT.+INTO	2	0	0	1
+6949	6949	.+DELETE.+FROM	2	0	0	1
+6950	6950	.+ASCII\(.+SELECT	2	0	0	1
+6951	6951	.+UPDATE.+SET	2	0	0	1
+6952	6952	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6953	6953	slogin_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+6954	6954	SELECT.+FROM	2	0	0	1
+6955	6955	UNION\s+SELECT	2	0	0	1
+6956	6956	INSERT.+INTO	2	0	0	1
+6957	6957	DELETE.+FROM	2	0	0	1
+6958	6958	ASCII\(.+SELECT	2	0	0	1
+6959	6959	UPDATE.+SET	2	0	0	1
+6960	6960	SELECT.+FROM	2	0	0	1
+6961	6961	UNION\s+SELECT	2	0	0	1
+6962	6962	DELETE.+FROM	2	0	0	1
+6963	6963	ASCII\(.+SELECT	2	0	0	1
+6964	6964	UPDATE.+SET	2	0	0	1
+6965	6965	SELECT.+FROM	2	0	0	1
+6966	6966	UNION\s+SELECT	2	0	0	1
+6967	6967	INSERT.+INTO	2	0	0	1
+6968	6968	DELETE.+FROM	2	0	0	1
+6969	6969	ASCII\(.+SELECT	2	0	0	1
+6970	6970	UPDATE.+SET	2	0	0	1
+6971	6971	SELECT.+FROM	2	0	0	1
+6972	6972	UNION\s+SELECT	2	0	0	1
+6973	6973	INSERT.+INTO	2	0	0	1
+6974	6974	DELETE.+FROM	2	0	0	1
+6975	6975	ASCII\(.+SELECT	2	0	0	1
+6976	6976	UPDATE.+SET	2	0	0	1
+6977	6977	g_pcltar_lib_dir=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6978	6978	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6979	6979	SELECT.+FROM	2	0	0	1
+6980	6980	UNION\s+SELECT	2	0	0	1
+6981	6981	INSERT.+INTO	2	0	0	1
+6982	6982	DELETE.+FROM	2	0	0	1
+6983	6983	ASCII\(.+SELECT	2	0	0	1
+6984	6984	UPDATE.+SET	2	0	0	1
+6985	6985	SELECT.+FROM	2	0	0	1
+6986	6986	UNION\s+SELECT	2	0	0	1
+6987	6987	INSERT.+INTO	2	0	0	1
+6988	6988	ASCII\(.+SELECT	2	0	0	1
+6989	6989	UPDATE.+SET	2	0	0	1
+6990	6990	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6991	6991	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6992	6992	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6993	6993	inc_dir=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6994	6994	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+6995	6995	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6996	6996	UNION.+SELECT	2	0	0	1
+6997	6997	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6998	6998	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+6999	6999	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7000	7000	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7001	7001	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7002	7002	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7003	7003	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7004	7004	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7005	7005	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7006	7006	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7007	7007	%INCLUDE\s*{.*rev=\"\d+\|.+\".*}\s*%	2	0	0	1
+7008	7008	UNION.+SELECT	2	0	0	1
+7009	7009	config\[include_dir\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7010	7010	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7011	7011	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7012	7012	vwar_root=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7013	7013	vwar_root=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7014	7014	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7015	7015	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7016	7016	.+SELECT.+FROM	2	0	0	1
+7017	7017	.+UNION\s+SELECT	2	0	0	1
+7018	7018	.+INSERT.+INTO	2	0	0	1
+7019	7019	.+DELETE.+FROM	2	0	0	1
+7020	7020	.+ASCII\(.+SELECT	2	0	0	1
+7021	7021	plancia=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7022	7022	include_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7023	7023	include_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7024	7024	include_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7025	7025	include_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7026	7026	\/ws\/(login|get_reminders|get_events)\.php	2	0	0	1
+7027	7027	SELECT.+FROM	2	0	0	1
+7028	7028	UNION\s+SELECT	2	0	0	1
+7029	7029	INSERT.+INTO	2	0	0	1
+7030	7030	DELETE.+FROM	2	0	0	1
+7031	7031	ASCII\(.+SELECT	2	0	0	1
+7032	7032	UPDATE.+SET	2	0	0	1
+7033	7033	GLOBALS\[RootPath\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7034	7034	GLOBALS\[RootPath\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7035	7035	GLOBALS\[RootPath\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7036	7036	config_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7037	7037	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7038	7038	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7039	7039	redirect_to=(ht|f)tps?\:\/	2	0	0	1
+7040	7040	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7041	7041	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7042	7042	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7043	7043	web_root=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7044	7044	web_root=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7045	7045	id=-?\d+.+UNION.+SELECT	2	0	0	1
+7046	7046	set_menu=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7047	7047	context\[path_to_root\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7048	7048	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7049	7049	.+SELECT.+FROM	2	0	0	1
+7050	7050	.+UNION\s+SELECT	2	0	0	1
+7051	7051	.+INSERT.+INTO	2	0	0	1
+7052	7052	.+DELETE.+FROM	2	0	0	1
+7053	7053	.+ASCII\(.+SELECT	2	0	0	1
+7054	7054	.+UPDATE.+SET	2	0	0	1
+7055	7055	cct_base=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7056	7056	cct_base=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7057	7057	cct_base=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7058	7058	cct_base=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7059	7059	cct_base=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7060	7060	mod_root=\s*(https?|ftps?|php)	2	0	0	1
+7061	7061	GLOBALS\[prefix\]=\s*(ftps?|https?|php)\:/	2	0	0	1
+7062	7062	.+SELECT.+FROM	2	0	0	1
+7063	7063	.+UNION\s+SELECT	2	0	0	1
+7064	7064	.+INSERT.+INTO	2	0	0	1
+7065	7065	.+DELETE.+FROM	2	0	0	1
+7066	7066	.+ASCII\(.+SELECT	2	0	0	1
+7067	7067	.+UPDATE.+SET	2	0	0	1
+7068	7068	.+SELECT.+FROM	2	0	0	1
+7069	7069	.+UNION\s+SELECT	2	0	0	1
+7070	7070	.+DELETE.+FROM	2	0	0	1
+7071	7071	.+ASCII\(.+SELECT	2	0	0	1
+7072	7072	.+UPDATE.+SET	2	0	0	1
+7073	7073	.+SELECT.+FROM	2	0	0	1
+7074	7074	.+UNION\s+SELECT	2	0	0	1
+7075	7075	.+INSERT.+INTO	2	0	0	1
+7076	7076	.+DELETE.+FROM	2	0	0	1
+7077	7077	.+ASCII\(.+SELECT	2	0	0	1
+7078	7078	.+UPDATE.+SET	2	0	0	1
+7079	7079	e107path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7080	7080	inc_ordner=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7081	7081	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7082	7082	dirDepth=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7083	7083	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7084	7084	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7085	7085	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7086	7086	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7087	7087	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7088	7088	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7089	7089	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7090	7090	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7091	7091	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7092	7092	fs_jVroot\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7093	7093	fs_jVroot\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7094	7094	fs_jVroot\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7095	7095	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7096	7096	UPDATE\s+SELECT	2	0	0	1
+7097	7097	INSERT.+INTO	2	0	0	1
+7098	7098	DELETE.+FROM	2	0	0	1
+7099	7099	ASCII\(.+SELECT	2	0	0	1
+7100	7100	UPDATE.+SET	2	0	0	1
+7101	7101	SELECT.+FROM	2	0	0	1
+7102	7102	UNION\s+SELECT	2	0	0	1
+7103	7103	INSERT.+INTO	2	0	0	1
+7104	7104	DELETE.+FROM	2	0	0	1
+7105	7105	ASCII\(.+SELECT	2	0	0	1
+7106	7106	UPDATE.+SET	2	0	0	1
+7107	7107	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7108	7108	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7109	7109	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7110	7110	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7111	7111	.*<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7112	7112	content=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7113	7113	.+SELECT.+FROM	2	0	0	1
+7114	7114	.+UNION\s+SELECT	2	0	0	1
+7115	7115	.+INSERT.+INTO	2	0	0	1
+7116	7116	.+DELETE.+FROM	2	0	0	1
+7117	7117	.+ASCII\(.+SELECT	2	0	0	1
+7118	7118	.+UPDATE.+SET	2	0	0	1
+7119	7119	_path\[counter\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7120	7120	CFG\[txtsql\]\[class\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7121	7121	<?(java|vb)?script>?.*<.+\/script>?	2	0	0	1
+7122	7122	SELECT.+FROM	2	0	0	1
+7123	7123	UNION\s+SELECT	2	0	0	1
+7124	7124	INSERT.+INTO	2	0	0	1
+7125	7125	DELETE.+FROM	2	0	0	1
+7126	7126	ASCII\(.+SELECT	2	0	0	1
+7127	7127	UPDATE.+SET	2	0	0	1
+7128	7128	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7129	7129	target=\w*\;	2	0	0	1
+7130	7130	SELECT.+FROM	2	0	0	1
+7131	7131	INSERT.+INTO	2	0	0	1
+7132	7132	DELETE.+FROM	2	0	0	1
+7133	7133	.+SELECT.+FROM	2	0	0	1
+7134	7134	DELETE.+FROM	2	0	0	1
+7135	7135	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7136	7136	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7137	7137	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7138	7138	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7139	7139	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7140	7140	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7141	7141	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7142	7142	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7143	7143	=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7144	7144	GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7145	7145	apps_path\[themes\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7146	7146	apps_path\[libs\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7147	7147	UPDATE.+SET	2	0	0	1
+7148	7148	site_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7149	7149	(\.\.\/){1}	2	0	0	1
+7150	7150	(\.\.\/){1}	2	0	0	1
+7151	7151	\/[a-z_]+\.php\/[a-z_]+\.php	2	0	0	1
+7152	7152	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x0d\x0a	2	0	0	1
+7153	7153	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*952E3F80-0C34-48CD-829B-A45913B29670	2	0	0	1
+7154	7154	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7155	7155	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7156	7156	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7157	7157	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7158	7158	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7159	7159	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7160	7160	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7161	7161	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7162	7162	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7163	7163	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7164	7164	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7165	7165	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7166	7166	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7167	7167	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7168	7168	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7169	7169	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7170	7170	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7171	7171	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7172	7172	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7173	7173	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7174	7174	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7175	7175	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7176	7176	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7177	7177	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7178	7178	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7179	7179	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7180	7180	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7181	7181	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7182	7182	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7183	7183	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7184	7184	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7185	7185	^\s*(https?|ftps?|php)\:\/	2	0	0	1
+7186	7186	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7187	7187	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7188	7188	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7189	7189	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7190	7190	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7191	7191	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7192	7192	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7193	7193	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7194	7194	^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7195	7195	^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7196	7196	cmd\x3D(filterHelper|getDeviceData\x26group\x3D).+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7197	7197	\x2Ejsp\x3F(clusterName|deviceName)\x3D.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7198	7198	^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7199	7199	^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7200	7200	^.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7201	7201	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7202	7202	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7203	7203	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7204	7204	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7205	7205	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7206	7206	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7207	7207	^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+7208	7208	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7209	7209	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7210	7210	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7211	7211	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7212	7212	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7213	7213	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7214	7214	^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+7215	7215	^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+7216	7216	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7217	7217	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7218	7218	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7219	7219	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7220	7220	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7221	7221	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7222	7222	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7223	7223	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7224	7224	^.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+7225	7225	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D)	2	0	0	1
+7226	7226	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D)	2	0	0	1
+7227	7227	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D)	2	0	0	1
+7228	7228	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D)	2	0	0	1
+7229	7229	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7230	7230	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7231	7231	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset onselect|onchange|style\x3D)	2	0	0	1
+7232	7232	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset onselect|onchange|style\x3D)	2	0	0	1
+7233	7233	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7234	7234	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7235	7235	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D)	2	0	0	1
+7236	7236	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect onchange|style\x3D)	2	0	0	1
+7237	7237	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7238	7238	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7239	7239	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7240	7240	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7241	7241	(Loging|Hidden)Password\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+7242	7242	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7243	7243	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7244	7244	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7245	7245	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7246	7246	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7247	7247	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7248	7248	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7249	7249	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7250	7250	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7251	7251	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7252	7252	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7253	7253	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7254	7254	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7255	7255	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7256	7256	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7257	7257	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7258	7258	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7259	7259	abspath=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7260	7260	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7261	7261	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7262	7262	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7263	7263	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7264	7264	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7265	7265	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7266	7266	basedir_save=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7267	7267	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7268	7268	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|marquee|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7269	7269	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7270	7270	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7271	7271	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7272	7272	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7273	7273	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7274	7274	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7275	7275	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7276	7276	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7277	7277	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7278	7278	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7279	7279	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7280	7280	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7281	7281	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7282	7282	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7283	7283	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7284	7284	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7285	7285	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7286	7286	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7287	7287	^.{0,300}=(https|ftps)	2	0	0	1
+7288	7288	^-?\d+ 	2	0	0	1
+7289	7289	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7290	7290	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7291	7291	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7292	7292	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7293	7293	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7294	7294	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset onselect|onchange|style\x3D)	2	0	0	1
+7295	7295	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange style\x3D)	2	0	0	1
+7296	7296	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7297	7297	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7298	7298	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7299	7299	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7300	7300	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7301	7301	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7302	7302	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7303	7303	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7304	7304	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7305	7305	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7306	7306	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7307	7307	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7308	7308	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7309	7309	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7310	7310	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7311	7311	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7312	7312	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7313	7313	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7314	7314	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7315	7315	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7316	7316	^.*(ftps?|https?|php)\:\/	2	0	0	1
+7317	7317	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7318	7318	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7319	7319	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7320	7320	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7321	7321	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7322	7322	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7323	7323	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7324	7324	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7325	7325	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7326	7326	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7327	7327	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7328	7328	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7329	7329	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7330	7330	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7331	7331	^.+?(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change|error))	2	0	0	1
+7332	7332	^.+?(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7333	7333	^.+?(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7334	7334	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7335	7335	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7336	7336	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7337	7337	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7338	7338	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7339	7339	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7340	7340	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7341	7341	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7342	7342	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7343	7343	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7344	7344	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7345	7345	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7346	7346	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7347	7347	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7348	7348	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7349	7349	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7350	7350	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7351	7351	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7352	7352	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7353	7353	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7354	7354	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7355	7355	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+7356	7356	id=-?\d+\s+UNION\s	2	0	0	1
+7357	7357	output=\w	2	0	0	1
+7358	7358	^\w	2	0	0	1
+7359	7359	^\w	2	0	0	1
+7360	7360	^\w	2	0	0	1
+7361	7361	^\w	2	0	0	1
+7362	7362	^\w	2	0	0	1
+7363	7363	^\w	2	0	0	1
+7364	7364	cmd=\w	2	0	0	1
+7365	7365	(\?|&)(host|service|opt|end|start)=[^&]+?\x60.+?\x60	2	0	0	1
+7366	7366	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7367	7367	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7368	7368	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7369	7369	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7370	7370	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7371	7371	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7372	7372	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7373	7373	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7374	7374	(\x3c|\x253c)dbInfo(\x3e|\x253e)[\r\n\s]*?(\x3c|\x253c)dbInfoRequest(\x3e|\x253e).+?(\x3c|\x253c)searchStr(\x3e|\x253e)(((\x3c|\x253c)(\/|\x252f)searchStr(\x3e|\x253e)).)+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=)).+?(\x3c|\x253c)(\/|\x252f)searchStr(\x3e|\x253e)	2	0	0	1
+7375	7375	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7376	7376	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7377	7377	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7378	7378	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7379	7379	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7380	7380	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7381	7381	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7382	7382	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|error|focus|blur)|s(cript|tyle=))	2	0	0	1
+7383	7383	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7384	7384	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7385	7385	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|error|focus|blur)|s(cript|tyle=))	2	0	0	1
+7386	7386	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7387	7387	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7388	7388	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7389	7389	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7390	7390	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7391	7391	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7392	7392	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7393	7393	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7394	7394	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7395	7395	^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=))	2	0	0	1
+7396	7396	^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=))	2	0	0	1
+7397	7397	^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=))	2	0	0	1
+7398	7398	^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=))	2	0	0	1
+7399	7399	^\/?$	2	0	0	1
+7400	7400	^\/?$	2	0	0	1
+7401	7401	^\/?$	2	0	0	1
+7402	7402	^.+(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|c(hange|lick)|(un)?load|focus|mouse|blur|key)|s(cript|tyle=))	2	0	0	1
+7403	7403	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7404	7404	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7405	7405	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7406	7406	^.+\)\)\}catch\(.+\)\{	2	0	0	1
+7407	7407	a\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7408	7408	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+7409	7409	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+7410	7410	^(-lncthumb|-sq_button)?\.php	2	0	0	1
+7411	7411	[&?]f=	2	0	0	1
+7412	7412	^\s*\s*?[\x22\x27]?[^&]*?(%(25)?2e(%((25)?2e(%(25)?5c|\/|\\)|2e(25)?%(25)?2f)|\.(%(25)?(2f|5c)|\/|\\))|\.(%(25)?2e(%(25)?(2f|5c)|\/|\\)|\.(%(25)?(2f|5c)|\/|\\)))	2	0	0	1
+7413	7413	^((ht|f)tps?|data|php)	2	0	0	1
+7414	7414	[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+7415	7415	[&?]highlight=[^&]*?\x2525[a-f0-9]{2}	2	0	0	1
+7416	7416	btask\x3d.+?(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change|error))	2	0	0	1
+7417	7417	&list\[select\]=[^\r\n&]*((S(HOW (C(UR(DAT|TIM)E|HARACTER SET)|(VARI|T)ABLES)|ELECT (FROM|USER))|U(NION SELEC|PDATE SE)T|DELETE FROM|INSERT INTO)|S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/)?	2	0	0	1
+7418	7418	^\{\d(\|\d){1,}\}\.\{\d(\|\d){1,}\}\{\d(\|\d){1,}\}	2	0	0	1
+7419	7419	^[^\r\n]*filename\s*=\s*[^\x3b\x3a\r\n]*[\x25\x24]\s*\{[^\r\n]{20,}\}	2	0	0	1
+7420	7420	^Host\x3a[^\r\n]+?[\x28\x29\x27\x22\x7b\x7d]	2	0	0	1
+7421	7421	^Host\x3a[^\r\n]+?[\x28\x29\x27\x22\x7b\x7d]	2	0	0	1
+7422	7422	sort\x3D.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7423	7423	orderby\x3D.+(alert|script|onmouse|onkey|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7424	7424	UNION\s+SELECT	2	0	0	1
+7425	7425	((S(HOW (C(UR(DAT|TIM)E|HARACTER SET)|(VARI|T)ABLES)|ELECT (FROM|USER))|U(NION SELEC|PDATE SE)T|DELETE FROM|INSERT INTO)|S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO)	2	0	0	1
+7426	7426	((S(HOW (C(UR(DAT|TIM)E|HARACTER SET)|(VARI|T)ABLES)|ELECT (FROM|USER))|U(NION SELEC|PDATE SE)T|DELETE FROM|INSERT INTO)|S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO)/Pmi	2	0	0	1
+7427	7427	((S(HOW (C(UR(DAT|TIM)E|HARACTER SET)|(VARI|T)ABLES)|ELECT (FROM|USER))|U(NION SELEC|PDATE SE)T|DELETE FROM|INSERT INTO)|S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO)	2	0	0	1
+7428	7428	(%23|#)(access_callback|pre_render|post_render|lazy_builder)	2	0	0	1
+7429	7429	(%(25)?23|#)	2	0	0	1
+7430	7430	(%(25)?23|#)\s*(access_callback|pre_render|post_render|lazy_builder)	2	0	0	1
+7431	7431	&orderby=([a-zA-Z0-9_])*[\x2c\x22\x27\x28]	2	0	0	1
+7432	7432	^([a-zA-Z0-9_])*[\x2c\x22\x27\x28]	2	0	0	1
+7433	7433	^([a-zA-Z0-9_])*[\x2c\x22\x27\x28]	2	0	0	1
+7434	7434	^([a-zA-Z0-9_%+])*([\x2c\x22\x27\x28]|\x252[c278])	2	0	0	1
+7435	7435	^([a-zA-Z0-9_%+])*([\x2c\x22\x27\x28]|\x252[c278])	2	0	0	1
+7436	7436	^([a-zA-Z0-9_])*[\x2c\x22\x27\x28]	2	0	0	1
+7437	7437	^[a-z0-9A-Z]+[^&]+[\x27\x22]	2	0	0	1
+7438	7438	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7439	7439	^[^&]*[\x22\x27\x28]	2	0	0	1
+7440	7440	^\[(%(25)?23|#)\s*(access_callback|pre_render|post_render|lazy_builder)	2	0	0	1
+7441	7441	(Y21kIC9jIHBvd2Vyc2hlbGwuZXhl|NtZCAvYyBwb3dlcnNoZWxsLmV4Z|jbWQgL2MgcG93ZXJzaGVsbC5leG)	2	0	0	1
+7442	7442	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7443	7443	(f0VM|9FT|\/RU)	2	0	0	1
+7444	7444	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7445	7445	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7446	7446	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7447	7447	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7448	7448	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7449	7449	^[^&]+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+7450	7450	^[a-z0-9A-Z]+\x252[270]	2	0	0	1
+7451	7451	^(\.\.\/){2,}	2	0	0	1
+7452	7452	action\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7453	7453	url\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7454	7454	fm_includes_special=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7455	7455	UNION\s+SELECT	2	0	0	1
+7456	7456	UNION\s+SELECT	2	0	0	1
+7457	7457	INSERT.+INTO	2	0	0	1
+7458	7458	DELETE.+FROM	2	0	0	1
+7459	7459	ASCII\(.+SELECT	2	0	0	1
+7460	7460	UPDATE.+SET	2	0	0	1
+7461	7461	SELECT.+FROM	2	0	0	1
+7462	7462	UNION\s+SELECT	2	0	0	1
+7463	7463	INSERT.+INTO	2	0	0	1
+7464	7464	DELETE.+FROM	2	0	0	1
+7465	7465	ASCII\(.+SELECT	2	0	0	1
+7466	7466	UPDATE.+SET	2	0	0	1
+7467	7467	SELECT.+FROM	2	0	0	1
+7468	7468	UNION\s+SELECT	2	0	0	1
+7469	7469	INSERT.+INTO	2	0	0	1
+7470	7470	DELETE.+FROM	2	0	0	1
+7471	7471	ASCII\(.+SELECT	2	0	0	1
+7472	7472	UPDATE.+SET	2	0	0	1
+7473	7473	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7474	7474	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7475	7475	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7476	7476	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7477	7477	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7478	7478	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7479	7479	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7480	7480	config\[installdir\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7481	7481	SELECT.+FROM	2	0	0	1
+7482	7482	UNION\s+SELECT	2	0	0	1
+7483	7483	INSERT.+INTO	2	0	0	1
+7484	7484	DELETE.+FROM	2	0	0	1
+7485	7485	ASCII\(.+SELECT	2	0	0	1
+7486	7486	UPDATE.+SET	2	0	0	1
+7487	7487	UNION\s+SELECT	2	0	0	1
+7488	7488	UNION\s+SELECT	2	0	0	1
+7489	7489	INSERT.+INTO	2	0	0	1
+7490	7490	DELETE.+FROM	2	0	0	1
+7491	7491	ASCII\(.+SELECT	2	0	0	1
+7492	7492	UPDATE.+SET	2	0	0	1
+7493	7493	SELECT.+FROM	2	0	0	1
+7494	7494	UNION\s+SELECT	2	0	0	1
+7495	7495	INSERT.+INTO	2	0	0	1
+7496	7496	DELETE.+FROM	2	0	0	1
+7497	7497	ASCII\(.+SELECT	2	0	0	1
+7498	7498	UPDATE.+SET	2	0	0	1
+7499	7499	DELETE.+FROM	2	0	0	1
+7500	7500	UNION\s+SELECT	2	0	0	1
+7501	7501	DELETE.+FROM	2	0	0	1
+7502	7502	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+7503	7503	UNION\s+SELECT	2	0	0	1
+7504	7504	INSERT.+INTO	2	0	0	1
+7505	7505	SELECT.+FROM	2	0	0	1
+7506	7506	UNION\s+SELECT	2	0	0	1
+7507	7507	DELETE.+FROM	2	0	0	1
+7508	7508	ASCII\(.+SELECT	2	0	0	1
+7509	7509	UPDATE.+SET	2	0	0	1
+7510	7510	SELECT.+FROM	2	0	0	1
+7511	7511	UNION\s+SELECT	2	0	0	1
+7512	7512	SELECT.+FROM	2	0	0	1
+7513	7513	UNION\s+SELECT	2	0	0	1
+7514	7514	INSERT.+INTO	2	0	0	1
+7515	7515	DELETE.+FROM	2	0	0	1
+7516	7516	ASCII\(.+SELECT	2	0	0	1
+7517	7517	UPDATE.+SET	2	0	0	1
+7518	7518	SELECT.+FROM	2	0	0	1
+7519	7519	UNION\s+SELECT	2	0	0	1
+7520	7520	INSERT.+INTO	2	0	0	1
+7521	7521	DELETE.+FROM	2	0	0	1
+7522	7522	ASCII\(.+SELECT	2	0	0	1
+7523	7523	UPDATE.+SET	2	0	0	1
+7524	7524	SELECT.+FROM	2	0	0	1
+7525	7525	UNION\s+SELECT	2	0	0	1
+7526	7526	INSERT.+INTO	2	0	0	1
+7527	7527	DELETE.+FROM	2	0	0	1
+7528	7528	ASCII\(.+SELECT	2	0	0	1
+7529	7529	UPDATE.+SET	2	0	0	1
+7530	7530	SELECT.+FROM	2	0	0	1
+7531	7531	UNION\s+SELECT	2	0	0	1
+7532	7532	INSERT.+INTO	2	0	0	1
+7533	7533	DELETE.+FROM	2	0	0	1
+7534	7534	ASCII\(.+SELECT	2	0	0	1
+7535	7535	UPDATE.+SET	2	0	0	1
+7536	7536	SELECT.+FROM	2	0	0	1
+7537	7537	UNION\s+SELECT	2	0	0	1
+7538	7538	INSERT.+INTO	2	0	0	1
+7539	7539	DELETE.+FROM	2	0	0	1
+7540	7540	ASCII\(.+SELECT	2	0	0	1
+7541	7541	UPDATE.+SET	2	0	0	1
+7542	7542	SELECT.+FROM	2	0	0	1
+7543	7543	UNION\s+SELECT	2	0	0	1
+7544	7544	INSERT.+INTO	2	0	0	1
+7545	7545	DELETE.+FROM	2	0	0	1
+7546	7546	ASCII\(.+SELECT	2	0	0	1
+7547	7547	UPDATE.+SET	2	0	0	1
+7548	7548	customer_login.*\">	2	0	0	1
+7549	7549	UNION\s+SELECT	2	0	0	1
+7550	7550	SELECT.+FROM	2	0	0	1
+7551	7551	UNION\s+SELECT	2	0	0	1
+7552	7552	INSERT.+INTO	2	0	0	1
+7553	7553	DELETE.+FROM	2	0	0	1
+7554	7554	ASCII\(.+SELECT	2	0	0	1
+7555	7555	UPDATE.+SET	2	0	0	1
+7556	7556	(\.\.\/){1,}	2	0	0	1
+7557	7557	INSERT.+INTO	2	0	0	1
+7558	7558	SELECT.+FROM	2	0	0	1
+7559	7559	site_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7560	7560	mosConfig_live_site=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7561	7561	SELECT.+FROM	2	0	0	1
+7562	7562	UNION.+SELECT	2	0	0	1
+7563	7563	UPDATE.+SET	2	0	0	1
+7564	7564	INSERT.+INTO	2	0	0	1
+7565	7565	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7566	7566	intPassedLocationID\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7567	7567	task=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7568	7568	bn\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7569	7569	cat=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7570	7570	gid\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7571	7571	SELECT.+FROM	2	0	0	1
+7572	7572	DELETE.+FROM	2	0	0	1
+7573	7573	INSERT.+INTO	2	0	0	1
+7574	7574	UPDATE.+SET	2	0	0	1
+7575	7575	theme_file=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7576	7576	lang_file=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7577	7577	theme_file=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7578	7578	UNION.+SELECT	2	0	0	1
+7579	7579	UNION\s+SELECT	2	0	0	1
+7580	7580	GLOBALS\[MM_ROOT_DIRECTORY\]=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7581	7581	skin_file=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7582	7582	i\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7583	7583	fm_id\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7584	7584	mosConfig_absolute_path=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7585	7585	doc_root=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7586	7586	HomeCurrent_Date\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7587	7587	newlangsel=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+7588	7588	UNION.+SELECT	2	0	0	1
+7589	7589	INSERT.+INTO	2	0	0	1
+7590	7590	UPDATE.+SET	2	0	0	1
+7591	7591	idart\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7592	7592	INSERT.+INTO	2	0	0	1
+7593	7593	Login=[^\r\n]{300}	2	0	0	1
+7594	7594	UNION\s+SELECT	2	0	0	1
+7595	7595	(\?|&)pid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+7596	7596	(\?|&)Itemid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+7597	7597	SELECT.+FROM	2	0	0	1
+7598	7598	UNION\s+SELECT	2	0	0	1
+7599	7599	INSERT.+INTO	2	0	0	1
+7600	7600	DELETE.+FROM	2	0	0	1
+7601	7601	ASCII\(.+SELECT	2	0	0	1
+7602	7602	UPDATE.+SET	2	0	0	1
+7603	7603	UNION\s+SELECT	2	0	0	1
+7604	7604	(script|img|src|onmouse|onkey|onload)	2	0	0	1
+7605	7605	UNION\s+SELECT	2	0	0	1
+7606	7606	UNION\s+SELECT	2	0	0	1
+7607	7607	UNION\s+SELECT	2	0	0	1
+7608	7608	INSERT.+INTO	2	0	0	1
+7609	7609	DELETE.+FROM	2	0	0	1
+7610	7610	ASCII\(.+SELECT	2	0	0	1
+7611	7611	UPDATE.+SET	2	0	0	1
+7612	7612	SELECT.+FROM	2	0	0	1
+7613	7613	UNION\s+SELECT	2	0	0	1
+7614	7614	INSERT.+INTO	2	0	0	1
+7615	7615	DELETE.+FROM	2	0	0	1
+7616	7616	ASCII\(.+SELECT	2	0	0	1
+7617	7617	UPDATE.+SET	2	0	0	1
+7618	7618	UNION\s+SELECT	2	0	0	1
+7619	7619	chemin_lib\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7620	7620	SELECT.+FROM	2	0	0	1
+7621	7621	DELETE.+FROM	2	0	0	1
+7622	7622	UNION.+SELECT	2	0	0	1
+7623	7623	INSERT.+INTO	2	0	0	1
+7624	7624	UPDATE.+SET	2	0	0	1
+7625	7625	Tipo=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7626	7626	UNION\s+SELECT	2	0	0	1
+7627	7627	INSERT.+INTO	2	0	0	1
+7628	7628	DELETE.+FROM	2	0	0	1
+7629	7629	ASCII\(.+SELECT	2	0	0	1
+7630	7630	UPDATE.+SET	2	0	0	1
+7631	7631	SELECT.+FROM	2	0	0	1
+7632	7632	UNION\s+SELECT	2	0	0	1
+7633	7633	INSERT.+INTO	2	0	0	1
+7634	7634	DELETE.+FROM	2	0	0	1
+7635	7635	ASCII\(.+SELECT	2	0	0	1
+7636	7636	UPDATE.+SET	2	0	0	1
+7637	7637	UNION\s+SELECT	2	0	0	1
+7638	7638	INSERT.+INTO	2	0	0	1
+7639	7639	DELETE.+FROM	2	0	0	1
+7640	7640	ASCII\(.+SELECT	2	0	0	1
+7641	7641	UPDATE.+SET	2	0	0	1
+7642	7642	phpAds_geoPlugin=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7643	7643	SELECT.+FROM	2	0	0	1
+7644	7644	DELETE.+FROM	2	0	0	1
+7645	7645	UNION.+SELECT	2	0	0	1
+7646	7646	INSERT.+INTO	2	0	0	1
+7647	7647	UPDATE.+SET	2	0	0	1
+7648	7648	context\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7649	7649	SELECT.+FROM	2	0	0	1
+7650	7650	UNION\s+SELECT	2	0	0	1
+7651	7651	INSERT.+INTO	2	0	0	1
+7652	7652	DELETE.+FROM	2	0	0	1
+7653	7653	ASCII\(.+SELECT	2	0	0	1
+7654	7654	UPDATE.+SET	2	0	0	1
+7655	7655	SELECT.+FROM	2	0	0	1
+7656	7656	UNION\s+SELECT	2	0	0	1
+7657	7657	INSERT.+INTO	2	0	0	1
+7658	7658	DELETE.+FROM	2	0	0	1
+7659	7659	ASCII\(.+SELECT	2	0	0	1
+7660	7660	UPDATE.+SET	2	0	0	1
+7661	7661	UNION.+SELECT	2	0	0	1
+7662	7662	UNION.+SELECT	2	0	0	1
+7663	7663	UNION.+SELECT	2	0	0	1
+7664	7664	SELECT.+FROM	2	0	0	1
+7665	7665	UNION\s+SELECT	2	0	0	1
+7666	7666	INSERT.+INTO	2	0	0	1
+7667	7667	DELETE.+FROM	2	0	0	1
+7668	7668	ASCII\(.+SELECT	2	0	0	1
+7669	7669	UPDATE.+SET	2	0	0	1
+7670	7670	UNION.+SELECT	2	0	0	1
+7671	7671	UNION.+SELECT	2	0	0	1
+7672	7672	.+UPDATE.+SET	2	0	0	1
+7673	7673	.+UNION\s+SELECT	2	0	0	1
+7674	7674	UNION\s+SELECT	2	0	0	1
+7675	7675	INSERT.+INTO	2	0	0	1
+7676	7676	DELETE.+FROM	2	0	0	1
+7677	7677	ASCII\(.+SELECT	2	0	0	1
+7678	7678	UPDATE.+SET	2	0	0	1
+7679	7679	.+SELECT.+FROM	2	0	0	1
+7680	7680	.+UNION\s+SELECT	2	0	0	1
+7681	7681	.+INSERT.+INTO	2	0	0	1
+7682	7682	.+DELETE.+FROM	2	0	0	1
+7683	7683	.+ASCII\(.+SELECT	2	0	0	1
+7684	7684	.+UPDATE.+SET	2	0	0	1
+7685	7685	UNION\s+SELECT	2	0	0	1
+7686	7686	UNION\s+SELECT	2	0	0	1
+7687	7687	UNION\s+SELECT	2	0	0	1
+7688	7688	(\.\.\/){1,}	2	0	0	1
+7689	7689	PHPOF_INCLUDE_PATH=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7690	7690	UNION\s+SELECT	2	0	0	1
+7691	7691	UNION\s+SELECT	2	0	0	1
+7692	7692	UNION\s+SELECT	2	0	0	1
+7693	7693	UNION\s+SELECT	2	0	0	1
+7694	7694	UNION\s+SELECT	2	0	0	1
+7695	7695	UNION\s+SELECT	2	0	0	1
+7696	7696	UNION\s+SELECT	2	0	0	1
+7697	7697	UNION\s+SELECT	2	0	0	1
+7698	7698	UNION\s+SELECT	2	0	0	1
+7699	7699	UNION\s+SELECT	2	0	0	1
+7700	7700	INSERT.+INTO	2	0	0	1
+7701	7701	DELETE.+FROM	2	0	0	1
+7702	7702	ASCII\(.+SELECT	2	0	0	1
+7703	7703	UPDATE.+SET	2	0	0	1
+7704	7704	UNION\s+SELECT	2	0	0	1
+7705	7705	UNION\s+SELECT	2	0	0	1
+7706	7706	UNION\s+SELECT	2	0	0	1
+7707	7707	(\?|&)category_id=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+7708	7708	SELECT.+FROM	2	0	0	1
+7709	7709	DELETE.+FROM	2	0	0	1
+7710	7710	UNION.+SELECT	2	0	0	1
+7711	7711	INSERT.+INTO	2	0	0	1
+7712	7712	UPDATE.+SET	2	0	0	1
+7713	7713	SELECT.+FROM	2	0	0	1
+7714	7714	DELETE.+FROM	2	0	0	1
+7715	7715	UNION.+SELECT	2	0	0	1
+7716	7716	INSERT.+INTO	2	0	0	1
+7717	7717	UPDATE.+SET	2	0	0	1
+7718	7718	UNION.+SELECT	2	0	0	1
+7719	7719	UNION.+SELECT	2	0	0	1
+7720	7720	SELECT.+FROM	2	0	0	1
+7721	7721	UNION\s+SELECT	2	0	0	1
+7722	7722	INSERT.+INTO	2	0	0	1
+7723	7723	DELETE.+FROM	2	0	0	1
+7724	7724	ASCII\(.+SELECT	2	0	0	1
+7725	7725	UPDATE.+SET	2	0	0	1
+7726	7726	SELECT.+FROM	2	0	0	1
+7727	7727	UNION\s+SELECT	2	0	0	1
+7728	7728	INSERT.+INTO	2	0	0	1
+7729	7729	DELETE.+FROM	2	0	0	1
+7730	7730	ASCII\(.+SELECT	2	0	0	1
+7731	7731	UPDATE.+SET	2	0	0	1
+7732	7732	SELECT.+FROM	2	0	0	1
+7733	7733	UNION\s+SELECT	2	0	0	1
+7734	7734	INSERT.+INTO	2	0	0	1
+7735	7735	DELETE.+FROM	2	0	0	1
+7736	7736	ASCII\(.+SELECT	2	0	0	1
+7737	7737	UPDATE.+SET	2	0	0	1
+7738	7738	SELECT.+FROM	2	0	0	1
+7739	7739	UNION\s+SELECT	2	0	0	1
+7740	7740	INSERT.+INTO	2	0	0	1
+7741	7741	DELETE.+FROM	2	0	0	1
+7742	7742	ASCII\(.+SELECT	2	0	0	1
+7743	7743	UPDATE.+SET	2	0	0	1
+7744	7744	SELECT.+FROM	2	0	0	1
+7745	7745	UNION\s+SELECT	2	0	0	1
+7746	7746	INSERT.+INTO	2	0	0	1
+7747	7747	DELETE.+FROM	2	0	0	1
+7748	7748	ASCII\(.+SELECT	2	0	0	1
+7749	7749	UPDATE.+SET	2	0	0	1
+7750	7750	.+SELECT.+FROM	2	0	0	1
+7751	7751	.+UNION\s+SELECT	2	0	0	1
+7752	7752	.+INSERT.+INTO	2	0	0	1
+7753	7753	.+DELETE.+FROM	2	0	0	1
+7754	7754	.+ASCII\(.+SELECT	2	0	0	1
+7755	7755	.+UPDATE.+SET	2	0	0	1
+7756	7756	UNION.+SELECT	2	0	0	1
+7757	7757	SELECT.+FROM	2	0	0	1
+7758	7758	UNION\s+SELECT	2	0	0	1
+7759	7759	INSERT.+INTO	2	0	0	1
+7760	7760	DELETE.+FROM	2	0	0	1
+7761	7761	ASCII\(.+SELECT	2	0	0	1
+7762	7762	UPDATE.+SET	2	0	0	1
+7763	7763	SELECT.+FROM	2	0	0	1
+7764	7764	UNION\s+SELECT	2	0	0	1
+7765	7765	INSERT.+INTO	2	0	0	1
+7766	7766	DELETE.+FROM	2	0	0	1
+7767	7767	ASCII\(.+SELECT	2	0	0	1
+7768	7768	UPDATE.+SET	2	0	0	1
+7769	7769	SELECT.+FROM	2	0	0	1
+7770	7770	UNION\s+SELECT	2	0	0	1
+7771	7771	INSERT.+INTO	2	0	0	1
+7772	7772	DELETE.+FROM	2	0	0	1
+7773	7773	ASCII\(.+SELECT	2	0	0	1
+7774	7774	UPDATE.+SET	2	0	0	1
+7775	7775	SELECT.+FROM	2	0	0	1
+7776	7776	UNION\s+SELECT	2	0	0	1
+7777	7777	INSERT.+INTO	2	0	0	1
+7778	7778	DELETE.+FROM	2	0	0	1
+7779	7779	ASCII\(.+SELECT	2	0	0	1
+7780	7780	UPDATE.+SET	2	0	0	1
+7781	7781	UNION.+SELECT	2	0	0	1
+7782	7782	UNION.+SELECT	2	0	0	1
+7783	7783	UNION.+SELECT	2	0	0	1
+7784	7784	UNION.+SELECT	2	0	0	1
+7785	7785	pcConfig\[smartyPath\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7786	7786	SELECT.+FROM	2	0	0	1
+7787	7787	UNION\s+SELECT	2	0	0	1
+7788	7788	INSERT.+INTO	2	0	0	1
+7789	7789	DELETE.+FROM	2	0	0	1
+7790	7790	ASCII\(.+SELECT	2	0	0	1
+7791	7791	UPDATE.+SET	2	0	0	1
+7792	7792	SELECT.+FROM	2	0	0	1
+7793	7793	UNION\s+SELECT	2	0	0	1
+7794	7794	INSERT.+INTO	2	0	0	1
+7795	7795	DELETE.+FROM	2	0	0	1
+7796	7796	ASCII\(.+SELECT	2	0	0	1
+7797	7797	UPDATE.+SET	2	0	0	1
+7798	7798	SELECT.+FROM	2	0	0	1
+7799	7799	UNION\s+SELECT	2	0	0	1
+7800	7800	INSERT.+INTO	2	0	0	1
+7801	7801	DELETE.+FROM	2	0	0	1
+7802	7802	ASCII\(.+SELECT	2	0	0	1
+7803	7803	UPDATE.+SET	2	0	0	1
+7804	7804	SELECT.+FROM	2	0	0	1
+7805	7805	UNION\s+SELECT	2	0	0	1
+7806	7806	INSERT.+INTO	2	0	0	1
+7807	7807	DELETE.+FROM	2	0	0	1
+7808	7808	ASCII\(.+SELECT	2	0	0	1
+7809	7809	UPDATE.+SET	2	0	0	1
+7810	7810	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+7811	7811	UNION.+SELECT	2	0	0	1
+7812	7812	UNION.+SELECT	2	0	0	1
+7813	7813	(\?|&)id=[^\x26\x3B]*[^\d\x2D]	2	0	0	1
+7814	7814	UNION.+SELECT	2	0	0	1
+7815	7815	DELETE.+FROM	2	0	0	1
+7816	7816	ASCII\(.+SELECT	2	0	0	1
+7817	7817	UPDATE.+SET	2	0	0	1
+7818	7818	sPath\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7819	7819	UNION.+SELECT	2	0	0	1
+7820	7820	SELECT.+FROM	2	0	0	1
+7821	7821	DELETE.+FROM	2	0	0	1
+7822	7822	UNION.+SELECT	2	0	0	1
+7823	7823	INSERT.+INTO	2	0	0	1
+7824	7824	UPDATE.+SET	2	0	0	1
+7825	7825	UNION.+SELECT	2	0	0	1
+7826	7826	config\[library_path\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7827	7827	UNION.+SELECT	2	0	0	1
+7828	7828	SELECT.+FROM	2	0	0	1
+7829	7829	UNION\s+SELECT	2	0	0	1
+7830	7830	INSERT.+INTO	2	0	0	1
+7831	7831	DELETE.+FROM	2	0	0	1
+7832	7832	ASCII\(.+SELECT	2	0	0	1
+7833	7833	UPDATE.+SET	2	0	0	1
+7834	7834	SELECT.+FROM	2	0	0	1
+7835	7835	UNION\s+SELECT	2	0	0	1
+7836	7836	INSERT.+INTO	2	0	0	1
+7837	7837	DELETE.+FROM	2	0	0	1
+7838	7838	ASCII\(.+SELECT	2	0	0	1
+7839	7839	UPDATE.+SET	2	0	0	1
+7840	7840	SELECT.+FROM	2	0	0	1
+7841	7841	UNION\s+SELECT	2	0	0	1
+7842	7842	INSERT.+INTO	2	0	0	1
+7843	7843	DELETE.+FROM	2	0	0	1
+7844	7844	ASCII\(.+SELECT	2	0	0	1
+7845	7845	UPDATE.+SET	2	0	0	1
+7846	7846	SELECT.+FROM	2	0	0	1
+7847	7847	UNION\s+SELECT	2	0	0	1
+7848	7848	INSERT.+INTO	2	0	0	1
+7849	7849	DELETE.+FROM	2	0	0	1
+7850	7850	ASCII\(.+SELECT	2	0	0	1
+7851	7851	UPDATE.+SET	2	0	0	1
+7852	7852	SELECT.+FROM	2	0	0	1
+7853	7853	UNION\s+SELECT	2	0	0	1
+7854	7854	INSERT.+INTO	2	0	0	1
+7855	7855	DELETE.+FROM	2	0	0	1
+7856	7856	ASCII\(.+SELECT	2	0	0	1
+7857	7857	UPDATE.+SET	2	0	0	1
+7858	7858	UNION.+SELECT	2	0	0	1
+7859	7859	UNION.+SELECT	2	0	0	1
+7860	7860	UNION.+SELECT	2	0	0	1
+7861	7861	.+SELECT.+FROM	2	0	0	1
+7862	7862	.+UNION\s+SELECT	2	0	0	1
+7863	7863	.+INSERT.+INTO	2	0	0	1
+7864	7864	.+DELETE.+FROM	2	0	0	1
+7865	7865	.+ASCII\(.+SELECT	2	0	0	1
+7866	7866	.+UPDATE.+SET	2	0	0	1
+7867	7867	.+SELECT.+FROM	2	0	0	1
+7868	7868	.+UNION\s+SELECT	2	0	0	1
+7869	7869	.+INSERT.+INTO	2	0	0	1
+7870	7870	.+DELETE.+FROM	2	0	0	1
+7871	7871	.+ASCII\(.+SELECT	2	0	0	1
+7872	7872	.+UPDATE.+SET	2	0	0	1
+7873	7873	REX\[INCLUDE_PATH\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7874	7874	REX\[INCLUDE_PATH\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7875	7875	UNION.+SELECT	2	0	0	1
+7876	7876	UNION.+SELECT	2	0	0	1
+7877	7877	SELECT.+FROM	2	0	0	1
+7878	7878	UNION\s+SELECT	2	0	0	1
+7879	7879	INSERT.+INTO	2	0	0	1
+7880	7880	DELETE.+FROM	2	0	0	1
+7881	7881	ASCII\(.+SELECT	2	0	0	1
+7882	7882	UPDATE.+SET	2	0	0	1
+7883	7883	SELECT.+FROM	2	0	0	1
+7884	7884	UNION\s+SELECT	2	0	0	1
+7885	7885	INSERT.+INTO	2	0	0	1
+7886	7886	DELETE.+FROM	2	0	0	1
+7887	7887	ASCII\(.+SELECT	2	0	0	1
+7888	7888	UPDATE.+SET	2	0	0	1
+7889	7889	SELECT.+FROM	2	0	0	1
+7890	7890	UNION\s+SELECT	2	0	0	1
+7891	7891	INSERT.+INTO	2	0	0	1
+7892	7892	DELETE.+FROM	2	0	0	1
+7893	7893	ASCII\(.+SELECT	2	0	0	1
+7894	7894	UPDATE.+SET	2	0	0	1
+7895	7895	SELECT.+FROM	2	0	0	1
+7896	7896	UNION\s+SELECT	2	0	0	1
+7897	7897	INSERT.+INTO	2	0	0	1
+7898	7898	DELETE.+FROM	2	0	0	1
+7899	7899	ASCII\(.+SELECT	2	0	0	1
+7900	7900	UPDATE.+SET	2	0	0	1
+7901	7901	SELECT.+FROM	2	0	0	1
+7902	7902	UNION\s+SELECT	2	0	0	1
+7903	7903	INSERT.+INTO	2	0	0	1
+7904	7904	DELETE.+FROM	2	0	0	1
+7905	7905	ASCII\(.+SELECT	2	0	0	1
+7906	7906	UPDATE.+SET	2	0	0	1
+7907	7907	SELECT.+FROM	2	0	0	1
+7908	7908	UNION\s+SELECT	2	0	0	1
+7909	7909	INSERT.+INTO	2	0	0	1
+7910	7910	DELETE.+FROM	2	0	0	1
+7911	7911	ASCII\(.+SELECT	2	0	0	1
+7912	7912	UPDATE.+SET	2	0	0	1
+7913	7913	SELECT.+FROM	2	0	0	1
+7914	7914	UNION\s+SELECT	2	0	0	1
+7915	7915	INSERT.+INTO	2	0	0	1
+7916	7916	DELETE.+FROM	2	0	0	1
+7917	7917	ASCII\(.+SELECT	2	0	0	1
+7918	7918	UPDATE.+SET	2	0	0	1
+7919	7919	SELECT.+FROM	2	0	0	1
+7920	7920	UNION\s+SELECT	2	0	0	1
+7921	7921	INSERT.+INTO	2	0	0	1
+7922	7922	DELETE.+FROM	2	0	0	1
+7923	7923	ASCII\(.+SELECT	2	0	0	1
+7924	7924	UPDATE.+SET	2	0	0	1
+7925	7925	SELECT.+FROM	2	0	0	1
+7926	7926	UNION\s+SELECT	2	0	0	1
+7927	7927	INSERT.+INTO	2	0	0	1
+7928	7928	DELETE.+FROM	2	0	0	1
+7929	7929	ASCII\(.+SELECT	2	0	0	1
+7930	7930	UPDATE.+SET	2	0	0	1
+7931	7931	SELECT.+FROM	2	0	0	1
+7932	7932	UNION\s+SELECT	2	0	0	1
+7933	7933	INSERT.+INTO	2	0	0	1
+7934	7934	DELETE.+FROM	2	0	0	1
+7935	7935	ASCII\(.+SELECT	2	0	0	1
+7936	7936	UPDATE.+SET	2	0	0	1
+7937	7937	SELECT.+FROM	2	0	0	1
+7938	7938	UNION\s+SELECT	2	0	0	1
+7939	7939	INSERT.+INTO	2	0	0	1
+7940	7940	DELETE.+FROM	2	0	0	1
+7941	7941	ASCII\(.+SELECT	2	0	0	1
+7942	7942	UPDATE.+SET	2	0	0	1
+7943	7943	SELECT.+FROM	2	0	0	1
+7944	7944	UNION\s+SELECT	2	0	0	1
+7945	7945	INSERT.+INTO	2	0	0	1
+7946	7946	DELETE.+FROM	2	0	0	1
+7947	7947	ASCII\(.+SELECT	2	0	0	1
+7948	7948	UPDATE.+SET	2	0	0	1
+7949	7949	SELECT.+FROM	2	0	0	1
+7950	7950	UNION\s+SELECT	2	0	0	1
+7951	7951	INSERT.+INTO	2	0	0	1
+7952	7952	DELETE.+FROM	2	0	0	1
+7953	7953	ASCII\(.+SELECT	2	0	0	1
+7954	7954	UPDATE.+SET	2	0	0	1
+7955	7955	SELECT.+FROM	2	0	0	1
+7956	7956	UNION\s+SELECT	2	0	0	1
+7957	7957	INSERT.+INTO	2	0	0	1
+7958	7958	DELETE.+FROM	2	0	0	1
+7959	7959	ASCII\(.+SELECT	2	0	0	1
+7960	7960	UPDATE.+SET	2	0	0	1
+7961	7961	SELECT.+FROM	2	0	0	1
+7962	7962	DELETE.+FROM	2	0	0	1
+7963	7963	UNION.+SELECT	2	0	0	1
+7964	7964	(\?|&)admin=[^\x26\x3B]*([\x2F\x5C\x00]|\x2E\x2E)	2	0	0	1
+7965	7965	_SERWEB\[configdir\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7966	7966	_SERWEB\[functionsdir\]=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7967	7967	UNION.+SELECT	2	0	0	1
+7968	7968	UNION.+SELECT	2	0	0	1
+7969	7969	cs_base_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+7970	7970	SELECT.+FROM	2	0	0	1
+7971	7971	UNION\s+SELECT	2	0	0	1
+7972	7972	INSERT.+INTO	2	0	0	1
+7973	7973	DELETE.+FROM	2	0	0	1
+7974	7974	ASCII\(.+SELECT	2	0	0	1
+7975	7975	UPDATE.+SET	2	0	0	1
+7976	7976	class_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7977	7977	class_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+7978	7978	SELECT.+FROM	2	0	0	1
+7979	7979	UNION\s+SELECT	2	0	0	1
+7980	7980	INSERT.+INTO	2	0	0	1
+7981	7981	DELETE.+FROM	2	0	0	1
+7982	7982	ASCII\(.+SELECT	2	0	0	1
+7983	7983	UPDATE.+SET	2	0	0	1
+7984	7984	SELECT.+FROM	2	0	0	1
+7985	7985	UNION\s+SELECT	2	0	0	1
+7986	7986	INSERT.+INTO	2	0	0	1
+7987	7987	DELETE.+FROM	2	0	0	1
+7988	7988	ASCII\(.+SELECT	2	0	0	1
+7989	7989	UPDATE.+SET	2	0	0	1
+7990	7990	SELECT.+FROM	2	0	0	1
+7991	7991	UNION\s+SELECT	2	0	0	1
+7992	7992	INSERT.+INTO	2	0	0	1
+7993	7993	DELETE.+FROM	2	0	0	1
+7994	7994	ASCII\(.+SELECT	2	0	0	1
+7995	7995	UPDATE.+SET	2	0	0	1
+7996	7996	SELECT.+FROM	2	0	0	1
+7997	7997	UNION\s+SELECT	2	0	0	1
+7998	7998	INSERT.+INTO	2	0	0	1
+7999	7999	DELETE.+FROM	2	0	0	1
+8000	8000	ASCII\(.+SELECT	2	0	0	1
+8001	8001	UPDATE.+SET	2	0	0	1
+8002	8002	SELECT.+FROM	2	0	0	1
+8003	8003	UNION\s+SELECT	2	0	0	1
+8004	8004	INSERT.+INTO	2	0	0	1
+8005	8005	DELETE.+FROM	2	0	0	1
+8006	8006	ASCII\(.+SELECT	2	0	0	1
+8007	8007	UPDATE.+SET	2	0	0	1
+8008	8008	SELECT.+FROM	2	0	0	1
+8009	8009	DELETE.+FROM	2	0	0	1
+8010	8010	UNION.+SELECT	2	0	0	1
+8011	8011	INSERT.+INTO	2	0	0	1
+8012	8012	UPDATE.+SET	2	0	0	1
+8013	8013	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8014	8014	SELECT.+FROM	2	0	0	1
+8015	8015	UNION\s+SELECT	2	0	0	1
+8016	8016	INSERT.+INTO	2	0	0	1
+8017	8017	DELETE.+FROM	2	0	0	1
+8018	8018	ASCII\(.+SELECT	2	0	0	1
+8019	8019	UPDATE.+SET	2	0	0	1
+8020	8020	UNION.+SELECT	2	0	0	1
+8021	8021	UNION.+SELECT	2	0	0	1
+8022	8022	SELECT.+FROM	2	0	0	1
+8023	8023	UNION\s+SELECT	2	0	0	1
+8024	8024	INSERT.+INTO	2	0	0	1
+8025	8025	DELETE.+FROM	2	0	0	1
+8026	8026	ASCII\(.+SELECT	2	0	0	1
+8027	8027	UPDATE.+SET	2	0	0	1
+8028	8028	UNION.+SELECT	2	0	0	1
+8029	8029	UNION\s+SELECT	2	0	0	1
+8030	8030	SELECT.+FROM	2	0	0	1
+8031	8031	UNION\s+SELECT	2	0	0	1
+8032	8032	INSERT.+INTO	2	0	0	1
+8033	8033	DELETE.+FROM	2	0	0	1
+8034	8034	ASCII\(.+SELECT	2	0	0	1
+8035	8035	UPDATE.+SET	2	0	0	1
+8036	8036	UNION\s+SELECT	2	0	0	1
+8037	8037	SELECT.+FROM	2	0	0	1
+8038	8038	UNION\s+SELECT	2	0	0	1
+8039	8039	INSERT.+INTO	2	0	0	1
+8040	8040	DELETE.+FROM	2	0	0	1
+8041	8041	ASCII\(.+SELECT	2	0	0	1
+8042	8042	UPDATE.+SET	2	0	0	1
+8043	8043	SELECT.+FROM	2	0	0	1
+8044	8044	UNION\s+SELECT	2	0	0	1
+8045	8045	INSERT.+INTO	2	0	0	1
+8046	8046	DELETE.+FROM	2	0	0	1
+8047	8047	ASCII\(.+SELECT	2	0	0	1
+8048	8048	UPDATE.+SET	2	0	0	1
+8049	8049	SELECT.+FROM	2	0	0	1
+8050	8050	UNION\s+SELECT	2	0	0	1
+8051	8051	INSERT.+INTO	2	0	0	1
+8052	8052	DELETE.+FROM	2	0	0	1
+8053	8053	ASCII\(.+SELECT	2	0	0	1
+8054	8054	UPDATE.+SET	2	0	0	1
+8055	8055	site_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8056	8056	theme=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8057	8057	UNION.+SELECT	2	0	0	1
+8058	8058	SELECT.+FROM	2	0	0	1
+8059	8059	UNION\s+SELECT	2	0	0	1
+8060	8060	INSERT.+INTO	2	0	0	1
+8061	8061	DELETE.+FROM	2	0	0	1
+8062	8062	ASCII\(.+SELECT	2	0	0	1
+8063	8063	UPDATE.+SET	2	0	0	1
+8064	8064	SELECT.+FROM	2	0	0	1
+8065	8065	UNION\s+SELECT	2	0	0	1
+8066	8066	INSERT.+INTO	2	0	0	1
+8067	8067	DELETE.+FROM	2	0	0	1
+8068	8068	ASCII\(.+SELECT	2	0	0	1
+8069	8069	UPDATE.+SET	2	0	0	1
+8070	8070	SELECT.+FROM	2	0	0	1
+8071	8071	UNION\s+SELECT	2	0	0	1
+8072	8072	INSERT.+INTO	2	0	0	1
+8073	8073	DELETE.+FROM	2	0	0	1
+8074	8074	ASCII\(.+SELECT	2	0	0	1
+8075	8075	UPDATE.+SET	2	0	0	1
+8076	8076	SELECT.+FROM	2	0	0	1
+8077	8077	UNION\s+SELECT	2	0	0	1
+8078	8078	INSERT.+INTO	2	0	0	1
+8079	8079	DELETE.+FROM	2	0	0	1
+8080	8080	ASCII\(.+SELECT	2	0	0	1
+8081	8081	UPDATE.+SET	2	0	0	1
+8082	8082	SELECT.+FROM	2	0	0	1
+8083	8083	UNION\s+SELECT	2	0	0	1
+8084	8084	INSERT.+INTO	2	0	0	1
+8085	8085	DELETE.+FROM	2	0	0	1
+8086	8086	ASCII\(.+SELECT	2	0	0	1
+8087	8087	UPDATE.+SET	2	0	0	1
+8088	8088	UNION.+SELECT	2	0	0	1
+8089	8089	objects_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8090	8090	objects_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8091	8091	SELECT.+FROM	2	0	0	1
+8092	8092	UNION\s+SELECT	2	0	0	1
+8093	8093	INSERT.+INTO	2	0	0	1
+8094	8094	DELETE.+FROM	2	0	0	1
+8095	8095	ASCII\(.+SELECT	2	0	0	1
+8096	8096	UPDATE.+SET	2	0	0	1
+8097	8097	.+SELECT.+FROM	2	0	0	1
+8098	8098	.+UNION\s+SELECT	2	0	0	1
+8099	8099	.+INSERT.+INTO	2	0	0	1
+8100	8100	.+DELETE.+FROM	2	0	0	1
+8101	8101	.+ASCII\(.+SELECT	2	0	0	1
+8102	8102	.+UPDATE.+SET	2	0	0	1
+8103	8103	\/servlet\/dea\/register\?fwReg=[>\"]	2	0	0	1
+8104	8104	\/sgms\/caption\.jsp\?.*scrn_name=.*[>\"]	2	0	0	1
+8105	8105	neededFiles\[patForms\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8106	8106	SELECT.+FROM	2	0	0	1
+8107	8107	UNION\s+SELECT	2	0	0	1
+8108	8108	INSERT.+INTO	2	0	0	1
+8109	8109	DELETE.+FROM	2	0	0	1
+8110	8110	ASCII\(.+SELECT	2	0	0	1
+8111	8111	UPDATE.+SET	2	0	0	1
+8112	8112	SELECT.+FROM	2	0	0	1
+8113	8113	UNION\s+SELECT	2	0	0	1
+8114	8114	INSERT.+INTO	2	0	0	1
+8115	8115	DELETE.+FROM	2	0	0	1
+8116	8116	ASCII\(.+SELECT	2	0	0	1
+8117	8117	UPDATE.+SET	2	0	0	1
+8118	8118	UNION.+SELECT	2	0	0	1
+8119	8119	UNION.+SELECT	2	0	0	1
+8120	8120	SELECT.+FROM	2	0	0	1
+8121	8121	UNION\s+SELECT	2	0	0	1
+8122	8122	INSERT.+INTO	2	0	0	1
+8123	8123	DELETE.+FROM	2	0	0	1
+8124	8124	ASCII\(.+SELECT	2	0	0	1
+8125	8125	UPDATE.+SET	2	0	0	1
+8126	8126	.+SELECT.+FROM	2	0	0	1
+8127	8127	.+UNION\s+SELECT	2	0	0	1
+8128	8128	.+INSERT.+INTO	2	0	0	1
+8129	8129	.+DELETE.+FROM	2	0	0	1
+8130	8130	.+ASCII\(.+SELECT	2	0	0	1
+8131	8131	.+UPDATE.+SET	2	0	0	1
+8132	8132	.+SELECT.+FROM	2	0	0	1
+8133	8133	.+UNION\s+SELECT	2	0	0	1
+8134	8134	.+INSERT.+INTO	2	0	0	1
+8135	8135	.+DELETE.+FROM	2	0	0	1
+8136	8136	.+ASCII\(.+SELECT	2	0	0	1
+8137	8137	.+UPDATE.+SET	2	0	0	1
+8138	8138	.+SELECT.+FROM	2	0	0	1
+8139	8139	.+UNION\s+SELECT	2	0	0	1
+8140	8140	.+INSERT.+INTO	2	0	0	1
+8141	8141	.+DELETE.+FROM	2	0	0	1
+8142	8142	.+ASCII\(.+SELECT	2	0	0	1
+8143	8143	.+SELECT.+FROM	2	0	0	1
+8144	8144	.+UNION\s+SELECT	2	0	0	1
+8145	8145	.+INSERT.+INTO	2	0	0	1
+8146	8146	.+DELETE.+FROM	2	0	0	1
+8147	8147	.+ASCII\(.+SELECT	2	0	0	1
+8148	8148	.+UPDATE.+SET	2	0	0	1
+8149	8149	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8150	8150	UNION.+SELECT	2	0	0	1
+8151	8151	SELECT.+FROM	2	0	0	1
+8152	8152	UNION\s+SELECT	2	0	0	1
+8153	8153	INSERT.+INTO	2	0	0	1
+8154	8154	DELETE.+FROM	2	0	0	1
+8155	8155	ASCII\(.+SELECT	2	0	0	1
+8156	8156	UPDATE.+SET	2	0	0	1
+8157	8157	SELECT.+FROM	2	0	0	1
+8158	8158	UNION\s+SELECT	2	0	0	1
+8159	8159	INSERT.+INTO	2	0	0	1
+8160	8160	DELETE.+FROM	2	0	0	1
+8161	8161	ASCII\(.+SELECT	2	0	0	1
+8162	8162	UPDATE.+SET	2	0	0	1
+8163	8163	SELECT.+FROM	2	0	0	1
+8164	8164	UNION\s+SELECT	2	0	0	1
+8165	8165	INSERT.+INTO	2	0	0	1
+8166	8166	DELETE.+FROM	2	0	0	1
+8167	8167	ASCII\(.+SELECT	2	0	0	1
+8168	8168	UPDATE.+SET	2	0	0	1
+8169	8169	SELECT.+FROM	2	0	0	1
+8170	8170	INSERT.+INTO	2	0	0	1
+8171	8171	DELETE.+FROM	2	0	0	1
+8172	8172	ASCII\(.+SELECT	2	0	0	1
+8173	8173	UPDATE.+SET	2	0	0	1
+8174	8174	SELECT.+FROM	2	0	0	1
+8175	8175	UNION\s+SELECT	2	0	0	1
+8176	8176	INSERT.+INTO	2	0	0	1
+8177	8177	DELETE.+FROM	2	0	0	1
+8178	8178	ASCII\(.+SELECT	2	0	0	1
+8179	8179	UPDATE.+SET	2	0	0	1
+8180	8180	SELECT.+FROM	2	0	0	1
+8181	8181	UNION\s+SELECT	2	0	0	1
+8182	8182	INSERT.+INTO	2	0	0	1
+8183	8183	DELETE.+FROM	2	0	0	1
+8184	8184	ASCII\(.+SELECT	2	0	0	1
+8185	8185	UPDATE.+SET	2	0	0	1
+8186	8186	SELECT.+FROM	2	0	0	1
+8187	8187	UNION\s+SELECT	2	0	0	1
+8188	8188	INSERT.+INTO	2	0	0	1
+8189	8189	DELETE.+FROM	2	0	0	1
+8190	8190	ASCII\(.+SELECT	2	0	0	1
+8191	8191	UPDATE.+SET	2	0	0	1
+8192	8192	SELECT.+FROM	2	0	0	1
+8193	8193	UNION\s+SELECT	2	0	0	1
+8194	8194	INSERT.+INTO	2	0	0	1
+8195	8195	DELETE.+FROM	2	0	0	1
+8196	8196	ASCII\(.+SELECT	2	0	0	1
+8197	8197	UPDATE.+SET	2	0	0	1
+8198	8198	SELECT.+FROM	2	0	0	1
+8199	8199	UNION\s+SELECT	2	0	0	1
+8200	8200	INSERT.+INTO	2	0	0	1
+8201	8201	DELETE.+FROM	2	0	0	1
+8202	8202	ASCII\(.+SELECT	2	0	0	1
+8203	8203	UPDATE.+SET	2	0	0	1
+8204	8204	SELECT.+FROM	2	0	0	1
+8205	8205	UNION\s+SELECT	2	0	0	1
+8206	8206	INSERT.+INTO	2	0	0	1
+8207	8207	DELETE.+FROM	2	0	0	1
+8208	8208	ASCII\(.+SELECT	2	0	0	1
+8209	8209	UPDATE.+SET	2	0	0	1
+8210	8210	SELECT.+FROM	2	0	0	1
+8211	8211	UNION\s+SELECT	2	0	0	1
+8212	8212	INSERT.+INTO	2	0	0	1
+8213	8213	DELETE.+FROM	2	0	0	1
+8214	8214	ASCII\(.+SELECT	2	0	0	1
+8215	8215	UPDATE.+SET	2	0	0	1
+8216	8216	SELECT.+FROM	2	0	0	1
+8217	8217	UNION\s+SELECT	2	0	0	1
+8218	8218	INSERT.+INTO	2	0	0	1
+8219	8219	DELETE.+FROM	2	0	0	1
+8220	8220	ASCII\(.+SELECT	2	0	0	1
+8221	8221	UPDATE.+SET	2	0	0	1
+8222	8222	SELECT.+FROM	2	0	0	1
+8223	8223	UNION\s+SELECT	2	0	0	1
+8224	8224	INSERT.+INTO	2	0	0	1
+8225	8225	DELETE.+FROM	2	0	0	1
+8226	8226	ASCII\(.+SELECT	2	0	0	1
+8227	8227	UPDATE.+SET	2	0	0	1
+8228	8228	UNION.+SELECT	2	0	0	1
+8229	8229	UNION.+SELECT	2	0	0	1
+8230	8230	UNION.+SELECT	2	0	0	1
+8231	8231	UNION.+SELECT	2	0	0	1
+8232	8232	UNION.+SELECT	2	0	0	1
+8233	8233	UNION.+SELECT	2	0	0	1
+8234	8234	SELECT.+FROM	2	0	0	1
+8235	8235	UNION\s+SELECT	2	0	0	1
+8236	8236	INSERT.+INTO	2	0	0	1
+8237	8237	DELETE.+FROM	2	0	0	1
+8238	8238	ASCII\(.+SELECT	2	0	0	1
+8239	8239	UPDATE.+SET	2	0	0	1
+8240	8240	SELECT.+FROM	2	0	0	1
+8241	8241	UNION\s+SELECT	2	0	0	1
+8242	8242	INSERT.+INTO	2	0	0	1
+8243	8243	DELETE.+FROM	2	0	0	1
+8244	8244	ASCII\(.+SELECT	2	0	0	1
+8245	8245	UPDATE.+SET	2	0	0	1
+8246	8246	SELECT.+FROM	2	0	0	1
+8247	8247	UNION\s+SELECT	2	0	0	1
+8248	8248	INSERT.+INTO	2	0	0	1
+8249	8249	DELETE.+FROM	2	0	0	1
+8250	8250	ASCII\(.+SELECT	2	0	0	1
+8251	8251	UPDATE.+SET	2	0	0	1
+8252	8252	SELECT.+FROM	2	0	0	1
+8253	8253	UNION\s+SELECT	2	0	0	1
+8254	8254	INSERT.+INTO	2	0	0	1
+8255	8255	DELETE.+FROM	2	0	0	1
+8256	8256	ASCII\(.+SELECT	2	0	0	1
+8257	8257	UPDATE.+SET	2	0	0	1
+8258	8258	.+SELECT.+FROM	2	0	0	1
+8259	8259	.+UNION\s+SELECT	2	0	0	1
+8260	8260	.+INSERT.+INTO	2	0	0	1
+8261	8261	.+DELETE.+FROM	2	0	0	1
+8262	8262	.+ASCII\(.+SELECT	2	0	0	1
+8263	8263	.+UPDATE.+SET	2	0	0	1
+8264	8264	.+SELECT.+FROM	2	0	0	1
+8265	8265	.+UNION\s+SELECT	2	0	0	1
+8266	8266	.+INSERT.+INTO	2	0	0	1
+8267	8267	.+DELETE.+FROM	2	0	0	1
+8268	8268	.+ASCII\(.+SELECT	2	0	0	1
+8269	8269	.+UPDATE.+SET	2	0	0	1
+8270	8270	SELECT.+FROM	2	0	0	1
+8271	8271	UNION\s+SELECT	2	0	0	1
+8272	8272	INSERT.+INTO	2	0	0	1
+8273	8273	DELETE.+FROM	2	0	0	1
+8274	8274	ASCII\(.+SELECT	2	0	0	1
+8275	8275	UPDATE.+SET	2	0	0	1
+8276	8276	.+SELECT.+FROM	2	0	0	1
+8277	8277	.+UNION\s+SELECT	2	0	0	1
+8278	8278	.+INSERT.+INTO	2	0	0	1
+8279	8279	.+DELETE.+FROM	2	0	0	1
+8280	8280	.+ASCII\(.+SELECT	2	0	0	1
+8281	8281	.+UPDATE.+SET	2	0	0	1
+8282	8282	.+SELECT.+FROM	2	0	0	1
+8283	8283	.+UNION\s+SELECT	2	0	0	1
+8284	8284	.+INSERT.+INTO	2	0	0	1
+8285	8285	.+DELETE.+FROM	2	0	0	1
+8286	8286	.+ASCII\(.+SELECT	2	0	0	1
+8287	8287	.+UPDATE.+SET	2	0	0	1
+8288	8288	SELECT.+FROM	2	0	0	1
+8289	8289	UNION\s+SELECT	2	0	0	1
+8290	8290	INSERT.+INTO	2	0	0	1
+8291	8291	DELETE.+FROM	2	0	0	1
+8292	8292	ASCII\(.+SELECT	2	0	0	1
+8293	8293	UPDATE.+SET	2	0	0	1
+8294	8294	UNION.+SELECT	2	0	0	1
+8295	8295	.+SELECT.+FROM	2	0	0	1
+8296	8296	.+UNION\s+SELECT	2	0	0	1
+8297	8297	.+INSERT.+INTO	2	0	0	1
+8298	8298	.+DELETE.+FROM	2	0	0	1
+8299	8299	.+ASCII\(.+SELECT	2	0	0	1
+8300	8300	.+UPDATE.+SET	2	0	0	1
+8301	8301	highlighter\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8302	8302	UNION.+SELECT	2	0	0	1
+8303	8303	SELECT.+FROM	2	0	0	1
+8304	8304	UNION\s+SELECT	2	0	0	1
+8305	8305	INSERT.+INTO	2	0	0	1
+8306	8306	DELETE.+FROM	2	0	0	1
+8307	8307	ASCII\(.+SELECT	2	0	0	1
+8308	8308	UPDATE.+SET	2	0	0	1
+8309	8309	SELECT.+FROM	2	0	0	1
+8310	8310	UNION\s+SELECT	2	0	0	1
+8311	8311	INSERT.+INTO	2	0	0	1
+8312	8312	DELETE.+FROM	2	0	0	1
+8313	8313	ASCII\(.+SELECT	2	0	0	1
+8314	8314	UPDATE.+SET	2	0	0	1
+8315	8315	SELECT.+FROM	2	0	0	1
+8316	8316	UNION\s+SELECT	2	0	0	1
+8317	8317	INSERT.+INTO	2	0	0	1
+8318	8318	DELETE.+FROM	2	0	0	1
+8319	8319	ASCII\(.+SELECT	2	0	0	1
+8320	8320	UPDATE.+SET	2	0	0	1
+8321	8321	SELECT.+FROM	2	0	0	1
+8322	8322	UNION\s+SELECT	2	0	0	1
+8323	8323	INSERT.+INTO	2	0	0	1
+8324	8324	DELETE.+FROM	2	0	0	1
+8325	8325	ASCII\(.+SELECT	2	0	0	1
+8326	8326	UPDATE.+SET	2	0	0	1
+8327	8327	UNION.+SELECT	2	0	0	1
+8328	8328	SELECT.+FROM	2	0	0	1
+8329	8329	UNION\s+SELECT	2	0	0	1
+8330	8330	INSERT.+INTO	2	0	0	1
+8331	8331	DELETE.+FROM	2	0	0	1
+8332	8332	ASCII\(.+SELECT	2	0	0	1
+8333	8333	UPDATE.+SET	2	0	0	1
+8334	8334	SELECT.+FROM	2	0	0	1
+8335	8335	UNION\s+SELECT	2	0	0	1
+8336	8336	INSERT.+INTO	2	0	0	1
+8337	8337	DELETE.+FROM	2	0	0	1
+8338	8338	ASCII\(.+SELECT	2	0	0	1
+8339	8339	UPDATE.+SET	2	0	0	1
+8340	8340	SELECT.+FROM	2	0	0	1
+8341	8341	UNION\s+SELECT	2	0	0	1
+8342	8342	INSERT.+INTO	2	0	0	1
+8343	8343	DELETE.+FROM	2	0	0	1
+8344	8344	ASCII\(.+SELECT	2	0	0	1
+8345	8345	UPDATE.+SET	2	0	0	1
+8346	8346	SELECT.+FROM	2	0	0	1
+8347	8347	UNION\s+SELECT	2	0	0	1
+8348	8348	INSERT.+INTO	2	0	0	1
+8349	8349	DELETE.+FROM	2	0	0	1
+8350	8350	ASCII\(.+SELECT	2	0	0	1
+8351	8351	UPDATE.+SET	2	0	0	1
+8352	8352	UNION.+SELECT	2	0	0	1
+8353	8353	.+SELECT.+FROM	2	0	0	1
+8354	8354	.+UNION\s+SELECT	2	0	0	1
+8355	8355	.+INSERT.+INTO	2	0	0	1
+8356	8356	.+DELETE.+FROM	2	0	0	1
+8357	8357	.+ASCII\(.+SELECT	2	0	0	1
+8358	8358	.+UPDATE.+SET	2	0	0	1
+8359	8359	.+SELECT.+FROM	2	0	0	1
+8360	8360	.+UNION\s+SELECT	2	0	0	1
+8361	8361	.+INSERT.+INTO	2	0	0	1
+8362	8362	.+DELETE.+FROM	2	0	0	1
+8363	8363	.+ASCII\(.+SELECT	2	0	0	1
+8364	8364	.+UPDATE.+SET	2	0	0	1
+8365	8365	.+SELECT.+FROM	2	0	0	1
+8366	8366	.+UNION\s+SELECT	2	0	0	1
+8367	8367	.+INSERT.+INTO	2	0	0	1
+8368	8368	.+DELETE.+FROM	2	0	0	1
+8369	8369	.+ASCII\(.+SELECT	2	0	0	1
+8370	8370	.+UPDATE.+SET	2	0	0	1
+8371	8371	.+SELECT.+FROM	2	0	0	1
+8372	8372	.+UNION\s+SELECT	2	0	0	1
+8373	8373	.+INSERT.+INTO	2	0	0	1
+8374	8374	.+DELETE.+FROM	2	0	0	1
+8375	8375	.+ASCII\(.+SELECT	2	0	0	1
+8376	8376	.+UPDATE.+SET	2	0	0	1
+8377	8377	.+SELECT.+FROM	2	0	0	1
+8378	8378	.+UNION\s+SELECT	2	0	0	1
+8379	8379	.+INSERT.+INTO	2	0	0	1
+8380	8380	.+DELETE.+FROM	2	0	0	1
+8381	8381	.+ASCII\(.+SELECT	2	0	0	1
+8382	8382	.+UPDATE.+SET	2	0	0	1
+8383	8383	.+SELECT.+FROM	2	0	0	1
+8384	8384	.+UNION\s+SELECT	2	0	0	1
+8385	8385	.+INSERT.+INTO	2	0	0	1
+8386	8386	.+DELETE.+FROM	2	0	0	1
+8387	8387	.+ASCII\(.+SELECT	2	0	0	1
+8388	8388	.+UPDATE.+SET	2	0	0	1
+8389	8389	SELECT.+FROM	2	0	0	1
+8390	8390	UNION\s+SELECT	2	0	0	1
+8391	8391	INSERT.+INTO	2	0	0	1
+8392	8392	DELETE.+FROM	2	0	0	1
+8393	8393	.+SELECT.+FROM	2	0	0	1
+8394	8394	.+UNION\s+SELECT	2	0	0	1
+8395	8395	.+INSERT.+INTO	2	0	0	1
+8396	8396	.+ASCII\(.+SELECT	2	0	0	1
+8397	8397	.+UPDATE.+SET	2	0	0	1
+8398	8398	.+SELECT.+FROM	2	0	0	1
+8399	8399	.+UNION\s+SELECT	2	0	0	1
+8400	8400	.+INSERT.+INTO	2	0	0	1
+8401	8401	.+DELETE.+FROM	2	0	0	1
+8402	8402	.+ASCII\(.+SELECT	2	0	0	1
+8403	8403	.+UPDATE.+SET	2	0	0	1
+8404	8404	.+SELECT.+FROM	2	0	0	1
+8405	8405	.+UNION\s+SELECT	2	0	0	1
+8406	8406	.+INSERT.+INTO	2	0	0	1
+8407	8407	.+DELETE.+FROM	2	0	0	1
+8408	8408	.+ASCII\(.+SELECT	2	0	0	1
+8409	8409	.+UPDATE.+SET	2	0	0	1
+8410	8410	.+SELECT.+FROM	2	0	0	1
+8411	8411	.+UNION\s+SELECT	2	0	0	1
+8412	8412	.+INSERT.+INTO	2	0	0	1
+8413	8413	.+DELETE.+FROM	2	0	0	1
+8414	8414	.+ASCII\(.+SELECT	2	0	0	1
+8415	8415	.+UPDATE.+SET	2	0	0	1
+8416	8416	.+SELECT.+FROM	2	0	0	1
+8417	8417	.+UNION\s+SELECT	2	0	0	1
+8418	8418	.+INSERT.+INTO	2	0	0	1
+8419	8419	.+DELETE.+FROM	2	0	0	1
+8420	8420	.+ASCII\(.+SELECT	2	0	0	1
+8421	8421	.+UPDATE.+SET	2	0	0	1
+8422	8422	UNION.+SELECT	2	0	0	1
+8423	8423	UNION.+SELECT	2	0	0	1
+8424	8424	SELECT.+FROM	2	0	0	1
+8425	8425	UNION\s+SELECT	2	0	0	1
+8426	8426	INSERT.+INTO	2	0	0	1
+8427	8427	DELETE.+FROM	2	0	0	1
+8428	8428	ASCII\(.+SELECT	2	0	0	1
+8429	8429	UPDATE.+SET	2	0	0	1
+8430	8430	UNION.+SELECT	2	0	0	1
+8431	8431	UNION.+SELECT	2	0	0	1
+8432	8432	UNION.+SELECT	2	0	0	1
+8433	8433	UNION.+SELECT	2	0	0	1
+8434	8434	UNION.+SELECT	2	0	0	1
+8435	8435	SELECT.+FROM	2	0	0	1
+8436	8436	UNION\s+SELECT	2	0	0	1
+8437	8437	INSERT.+INTO	2	0	0	1
+8438	8438	DELETE.+FROM	2	0	0	1
+8439	8439	ASCII\(.+SELECT	2	0	0	1
+8440	8440	UPDATE.+SET	2	0	0	1
+8441	8441	SELECT.+FROM	2	0	0	1
+8442	8442	UNION\s+SELECT	2	0	0	1
+8443	8443	INSERT.+INTO	2	0	0	1
+8444	8444	DELETE.+FROM	2	0	0	1
+8445	8445	ASCII\(.+SELECT	2	0	0	1
+8446	8446	UPDATE.+SET	2	0	0	1
+8447	8447	SELECT.+FROM	2	0	0	1
+8448	8448	UNION\s+SELECT	2	0	0	1
+8449	8449	INSERT.+INTO	2	0	0	1
+8450	8450	DELETE.+FROM	2	0	0	1
+8451	8451	ASCII\(.+SELECT	2	0	0	1
+8452	8452	UPDATE.+SET	2	0	0	1
+8453	8453	SELECT.+FROM	2	0	0	1
+8454	8454	UNION\s+SELECT	2	0	0	1
+8455	8455	INSERT.+INTO	2	0	0	1
+8456	8456	DELETE.+FROM	2	0	0	1
+8457	8457	ASCII\(.+SELECT	2	0	0	1
+8458	8458	UPDATE.+SET	2	0	0	1
+8459	8459	SELECT.+FROM	2	0	0	1
+8460	8460	UNION\s+SELECT	2	0	0	1
+8461	8461	INSERT.+INTO	2	0	0	1
+8462	8462	DELETE.+FROM	2	0	0	1
+8463	8463	ASCII\(.+SELECT	2	0	0	1
+8464	8464	UPDATE.+SET	2	0	0	1
+8465	8465	page=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8466	8466	page=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8467	8467	Queue\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8468	8468	Filename\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8469	8469	IsolatedMessageID\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8470	8470	ServerName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8471	8471	FileName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8472	8472	IsolatedMessageID\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8473	8473	ServerName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8474	8474	Dictionary\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8475	8475	Scoring\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8476	8476	MessagePart\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8477	8477	Queue\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8478	8478	FileName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8479	8479	IsolatedMessageID\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8480	8480	ServerName\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8481	8481	SELECT.+FROM	2	0	0	1
+8482	8482	UNION\s+SELECT	2	0	0	1
+8483	8483	INSERT.+INTO	2	0	0	1
+8484	8484	DELETE.+FROM	2	0	0	1
+8485	8485	ASCII\(.+SELECT	2	0	0	1
+8486	8486	UPDATE.+SET	2	0	0	1
+8487	8487	SELECT.+FROM	2	0	0	1
+8488	8488	UNION\s+SELECT	2	0	0	1
+8489	8489	INSERT.+INTO	2	0	0	1
+8490	8490	DELETE.+FROM	2	0	0	1
+8491	8491	ASCII\(.+SELECT	2	0	0	1
+8492	8492	UPDATE.+SET	2	0	0	1
+8493	8493	SELECT.+FROM	2	0	0	1
+8494	8494	UNION\s+SELECT	2	0	0	1
+8495	8495	INSERT.+INTO	2	0	0	1
+8496	8496	DELETE.+FROM	2	0	0	1
+8497	8497	ASCII\(.+SELECT	2	0	0	1
+8498	8498	UPDATE.+SET	2	0	0	1
+8499	8499	SELECT.+FROM	2	0	0	1
+8500	8500	UNION\s+SELECT	2	0	0	1
+8501	8501	INSERT.+INTO	2	0	0	1
+8502	8502	DELETE.+FROM	2	0	0	1
+8503	8503	ASCII\(.+SELECT	2	0	0	1
+8504	8504	UPDATE.+SET	2	0	0	1
+8505	8505	SELECT.+FROM	2	0	0	1
+8506	8506	UNION\s+SELECT	2	0	0	1
+8507	8507	INSERT.+INTO	2	0	0	1
+8508	8508	DELETE.+FROM	2	0	0	1
+8509	8509	ASCII\(.+SELECT	2	0	0	1
+8510	8510	UPDATE.+SET	2	0	0	1
+8511	8511	SELECT.+FROM	2	0	0	1
+8512	8512	UNION\s+SELECT	2	0	0	1
+8513	8513	INSERT.+INTO	2	0	0	1
+8514	8514	DELETE.+FROM	2	0	0	1
+8515	8515	ASCII\(.+SELECT	2	0	0	1
+8516	8516	UPDATE.+SET	2	0	0	1
+8517	8517	.+SELECT.+FROM	2	0	0	1
+8518	8518	.+UNION\s+SELECT	2	0	0	1
+8519	8519	.+INSERT.+INTO	2	0	0	1
+8520	8520	.+DELETE.+FROM	2	0	0	1
+8521	8521	.+ASCII\(.+SELECT	2	0	0	1
+8522	8522	.+UPDATE.+SET	2	0	0	1
+8523	8523	SELECT.+FROM	2	0	0	1
+8524	8524	UNION\s+SELECT	2	0	0	1
+8525	8525	INSERT.+INTO	2	0	0	1
+8526	8526	DELETE.+FROM	2	0	0	1
+8527	8527	ASCII\(.+SELECT	2	0	0	1
+8528	8528	UPDATE.+SET	2	0	0	1
+8529	8529	SELECT.+FROM	2	0	0	1
+8530	8530	UNION\s+SELECT	2	0	0	1
+8531	8531	INSERT.+INTO	2	0	0	1
+8532	8532	DELETE.+FROM	2	0	0	1
+8533	8533	ASCII\(.+SELECT	2	0	0	1
+8534	8534	UPDATE.+SET	2	0	0	1
+8535	8535	SELECT.+FROM	2	0	0	1
+8536	8536	UNION\s+SELECT	2	0	0	1
+8537	8537	INSERT.+INTO	2	0	0	1
+8538	8538	DELETE.+FROM	2	0	0	1
+8539	8539	ASCII\(.+SELECT	2	0	0	1
+8540	8540	UPDATE.+SET	2	0	0	1
+8541	8541	UNION\s+SELECT	2	0	0	1
+8542	8542	ABSPATH\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8543	8543	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8544	8544	SELECT.+FROM	2	0	0	1
+8545	8545	DELETE.+FROM	2	0	0	1
+8546	8546	UNION.+SELECT	2	0	0	1
+8547	8547	INSERT.+INTO	2	0	0	1
+8548	8548	UPDATE.+SET	2	0	0	1
+8549	8549	tagcloud\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8550	8550	SELECT.+FROM	2	0	0	1
+8551	8551	UNION\s+SELECT	2	0	0	1
+8552	8552	INSERT.+INTO	2	0	0	1
+8553	8553	DELETE.+FROM	2	0	0	1
+8554	8554	ASCII\(.+SELECT	2	0	0	1
+8555	8555	UPDATE.+SET	2	0	0	1
+8556	8556	SELECT.+FROM	2	0	0	1
+8557	8557	UNION\s+SELECT	2	0	0	1
+8558	8558	INSERT.+INTO	2	0	0	1
+8559	8559	DELETE.+FROM	2	0	0	1
+8560	8560	ASCII\(.+SELECT	2	0	0	1
+8561	8561	UPDATE.+SET	2	0	0	1
+8562	8562	SELECT.+FROM	2	0	0	1
+8563	8563	UNION\s+SELECT	2	0	0	1
+8564	8564	INSERT.+INTO	2	0	0	1
+8565	8565	DELETE.+FROM	2	0	0	1
+8566	8566	ASCII\(.+SELECT	2	0	0	1
+8567	8567	UPDATE.+SET	2	0	0	1
+8568	8568	SELECT.+FROM	2	0	0	1
+8569	8569	UNION\s+SELECT	2	0	0	1
+8570	8570	INSERT.+INTO	2	0	0	1
+8571	8571	DELETE.+FROM	2	0	0	1
+8572	8572	ASCII\(.+SELECT	2	0	0	1
+8573	8573	UPDATE.+SET	2	0	0	1
+8574	8574	(onmouse|onkey|onload=|onblur=|ondragdrop=|onclick=|alert|<script|<img|<src)	2	0	0	1
+8575	8575	(onmouse|onkey|onload=|onblur=|ondragdrop=|onclick=|alert|<script|<img|<src)	2	0	0	1
+8576	8576	UNION.+SELECT	2	0	0	1
+8577	8577	SELECT.+FROM	2	0	0	1
+8578	8578	UNION\s+SELECT	2	0	0	1
+8579	8579	INSERT.+INTO	2	0	0	1
+8580	8580	DELETE.+FROM	2	0	0	1
+8581	8581	ASCII\(.+SELECT	2	0	0	1
+8582	8582	UPDATE.+SET	2	0	0	1
+8583	8583	include_directory=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8584	8584	SELECT.+FROM	2	0	0	1
+8585	8585	UNION\s+SELECT	2	0	0	1
+8586	8586	INSERT.+INTO	2	0	0	1
+8587	8587	DELETE.+FROM	2	0	0	1
+8588	8588	ASCII\(.+SELECT	2	0	0	1
+8589	8589	UPDATE.+SET	2	0	0	1
+8590	8590	SELECT.+FROM	2	0	0	1
+8591	8591	UNION\s+SELECT	2	0	0	1
+8592	8592	INSERT.+INTO	2	0	0	1
+8593	8593	DELETE.+FROM	2	0	0	1
+8594	8594	ASCII\(.+SELECT	2	0	0	1
+8595	8595	UPDATE.+SET	2	0	0	1
+8596	8596	.+SELECT.+FROM	2	0	0	1
+8597	8597	.+UNION\s+SELECT	2	0	0	1
+8598	8598	.+INSERT.+INTO	2	0	0	1
+8599	8599	.+DELETE.+FROM	2	0	0	1
+8600	8600	.+ASCII\(.+SELECT	2	0	0	1
+8601	8601	.+UPDATE.+SET	2	0	0	1
+8602	8602	UNION\s+SELECT	2	0	0	1
+8603	8603	UNION.+SELECT	2	0	0	1
+8604	8604	(\?|&)id=[^\x26\x3B]*[^\d\x2D]	2	0	0	1
+8605	8605	SELECT.+FROM	2	0	0	1
+8606	8606	UNION\s+SELECT	2	0	0	1
+8607	8607	INSERT.+INTO	2	0	0	1
+8608	8608	DELETE.+FROM	2	0	0	1
+8609	8609	ASCII\(.+SELECT	2	0	0	1
+8610	8610	UPDATE.+SET	2	0	0	1
+8611	8611	SELECT.+FROM	2	0	0	1
+8612	8612	UNION\s+SELECT	2	0	0	1
+8613	8613	INSERT.+INTO	2	0	0	1
+8614	8614	DELETE.+FROM	2	0	0	1
+8615	8615	ASCII\(.+SELECT	2	0	0	1
+8616	8616	UPDATE.+SET	2	0	0	1
+8617	8617	YAPIG_PATH=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8618	8618	cfgIncludeDirectory=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8619	8619	UNION.+SELECT	2	0	0	1
+8620	8620	UNION.+SELECT	2	0	0	1
+8621	8621	UNION.+SELECT	2	0	0	1
+8622	8622	UNION.+SELECT	2	0	0	1
+8623	8623	SELECT.+FROM	2	0	0	1
+8624	8624	UNION\s+SELECT	2	0	0	1
+8625	8625	INSERT.+INTO	2	0	0	1
+8626	8626	DELETE.+FROM	2	0	0	1
+8627	8627	ASCII\(.+SELECT	2	0	0	1
+8628	8628	UPDATE.+SET	2	0	0	1
+8629	8629	SELECT.+FROM	2	0	0	1
+8630	8630	UNION\s+SELECT	2	0	0	1
+8631	8631	INSERT.+INTO	2	0	0	1
+8632	8632	DELETE.+FROM	2	0	0	1
+8633	8633	ASCII\(.+SELECT	2	0	0	1
+8634	8634	UPDATE.+SET	2	0	0	1
+8635	8635	SELECT.+FROM	2	0	0	1
+8636	8636	UNION\s+SELECT	2	0	0	1
+8637	8637	INSERT.+INTO	2	0	0	1
+8638	8638	DELETE.+FROM	2	0	0	1
+8639	8639	ASCII\(.+SELECT	2	0	0	1
+8640	8640	UPDATE.+SET	2	0	0	1
+8641	8641	SELECT.+FROM	2	0	0	1
+8642	8642	UNION\s+SELECT	2	0	0	1
+8643	8643	INSERT.+INTO	2	0	0	1
+8644	8644	DELETE.+FROM	2	0	0	1
+8645	8645	ASCII\(.+SELECT	2	0	0	1
+8646	8646	UPDATE.+SET	2	0	0	1
+8647	8647	SELECT.+FROM	2	0	0	1
+8648	8648	UNION\s+SELECT	2	0	0	1
+8649	8649	INSERT.+INTO	2	0	0	1
+8650	8650	DELETE.+FROM	2	0	0	1
+8651	8651	ASCII\(.+SELECT	2	0	0	1
+8652	8652	UPDATE.+SET	2	0	0	1
+8653	8653	SELECT.+FROM	2	0	0	1
+8654	8654	UNION\s+SELECT	2	0	0	1
+8655	8655	INSERT.+INTO	2	0	0	1
+8656	8656	DELETE.+FROM	2	0	0	1
+8657	8657	ASCII\(.+SELECT	2	0	0	1
+8658	8658	UPDATE.+SET	2	0	0	1
+8659	8659	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8660	8660	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8661	8661	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8662	8662	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8663	8663	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8664	8664	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8665	8665	row_y5_site_configuration\[templates_folder\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8666	8666	SELECT.+FROM	2	0	0	1
+8667	8667	UNION\s+SELECT	2	0	0	1
+8668	8668	INSERT.+INTO	2	0	0	1
+8669	8669	DELETE.+FROM	2	0	0	1
+8670	8670	ASCII\(.+SELECT	2	0	0	1
+8671	8671	UPDATE.+SET	2	0	0	1
+8672	8672	UNION.+SELECT	2	0	0	1
+8673	8673	SELECT.+FROM	2	0	0	1
+8674	8674	UNION\s+SELECT	2	0	0	1
+8675	8675	INSERT.+INTO	2	0	0	1
+8676	8676	DELETE.+FROM	2	0	0	1
+8677	8677	ASCII\(.+SELECT	2	0	0	1
+8678	8678	UPDATE.+SET	2	0	0	1
+8679	8679	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8680	8680	UNION.+SELECT	2	0	0	1
+8681	8681	SELECT.+FROM	2	0	0	1
+8682	8682	UNION\s+SELECT	2	0	0	1
+8683	8683	INSERT.+INTO	2	0	0	1
+8684	8684	DELETE.+FROM	2	0	0	1
+8685	8685	ASCII\(.+SELECT	2	0	0	1
+8686	8686	UPDATE.+SET	2	0	0	1
+8687	8687	SELECT.+FROM	2	0	0	1
+8688	8688	UNION\s+SELECT	2	0	0	1
+8689	8689	INSERT.+INTO	2	0	0	1
+8690	8690	DELETE.+FROM	2	0	0	1
+8691	8691	ASCII\(.+SELECT	2	0	0	1
+8692	8692	UPDATE.+SET	2	0	0	1
+8693	8693	controller\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8694	8694	.+SELECT.+FROM	2	0	0	1
+8695	8695	.+UNION\s+SELECT	2	0	0	1
+8696	8696	.+INSERT.+INTO	2	0	0	1
+8697	8697	.+DELETE.+FROM	2	0	0	1
+8698	8698	.+ASCII\(.+SELECT	2	0	0	1
+8699	8699	.+UPDATE.+SET	2	0	0	1
+8700	8700	.+SELECT.+FROM	2	0	0	1
+8701	8701	.+UNION\s+SELECT	2	0	0	1
+8702	8702	.+INSERT.+INTO	2	0	0	1
+8703	8703	.+DELETE.+FROM	2	0	0	1
+8704	8704	.+ASCII\(.+SELECT	2	0	0	1
+8705	8705	.+UPDATE.+SET	2	0	0	1
+8706	8706	SELECT.+FROM	2	0	0	1
+8707	8707	UNION\s+SELECT	2	0	0	1
+8708	8708	INSERT.+INTO	2	0	0	1
+8709	8709	DELETE.+FROM	2	0	0	1
+8710	8710	ASCII\(.+SELECT	2	0	0	1
+8711	8711	UPDATE.+SET	2	0	0	1
+8712	8712	.+SELECT.+FROM	2	0	0	1
+8713	8713	.+UNION\s+SELECT	2	0	0	1
+8714	8714	.+INSERT.+INTO	2	0	0	1
+8715	8715	.+DELETE.+FROM	2	0	0	1
+8716	8716	.+ASCII\(.+SELECT	2	0	0	1
+8717	8717	.+UPDATE.+SET	2	0	0	1
+8718	8718	.+SELECT.+FROM	2	0	0	1
+8719	8719	.+UNION\s+SELECT	2	0	0	1
+8720	8720	.+INSERT.+INTO	2	0	0	1
+8721	8721	.+DELETE.+FROM	2	0	0	1
+8722	8722	.+ASCII\(.+SELECT	2	0	0	1
+8723	8723	.+UPDATE.+SET	2	0	0	1
+8724	8724	a_name='	2	0	0	1
+8725	8725	UNION.+SELECT	2	0	0	1
+8726	8726	UNION.+SELECT	2	0	0	1
+8727	8727	UNION.+SELECT	2	0	0	1
+8728	8728	\x2Ephp\x3F.{0,300}\x3D(http\x3A|ftp\x3A|https\x3A|ftps\x3A)	2	0	0	1
+8729	8729	SELECT.+FROM	2	0	0	1
+8730	8730	UNION\s+SELECT	2	0	0	1
+8731	8731	INSERT.+INTO	2	0	0	1
+8732	8732	DELETE.+FROM	2	0	0	1
+8733	8733	ASCII\(.+SELECT	2	0	0	1
+8734	8734	UPDATE.+SET	2	0	0	1
+8735	8735	SELECT.+FROM	2	0	0	1
+8736	8736	UNION\s+SELECT	2	0	0	1
+8737	8737	INSERT.+INTO	2	0	0	1
+8738	8738	DELETE.+FROM	2	0	0	1
+8739	8739	ASCII\(.+SELECT	2	0	0	1
+8740	8740	UPDATE.+SET	2	0	0	1
+8741	8741	(\.\.\/){1,}	2	0	0	1
+8742	8742	(\.\.\/){1,}	2	0	0	1
+8743	8743	(\.\.\/){1,}	2	0	0	1
+8744	8744	(\.\.\/){1,}	2	0	0	1
+8745	8745	(\.\.\/){1,}	2	0	0	1
+8746	8746	(\.\.\/){1,}	2	0	0	1
+8747	8747	(\.\.\/){1,}	2	0	0	1
+8748	8748	(\.\.\/){1,}	2	0	0	1
+8749	8749	(\.\.\/){1,}	2	0	0	1
+8750	8750	(\.\.\/){1,}	2	0	0	1
+8751	8751	_REQUEST\[read\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8752	8752	.+SELECT.+FROM	2	0	0	1
+8753	8753	.+UNION\s+SELECT	2	0	0	1
+8754	8754	.+INSERT.+INTO	2	0	0	1
+8755	8755	.+DELETE.+FROM	2	0	0	1
+8756	8756	.+ASCII\(.+SELECT	2	0	0	1
+8757	8757	.+UPDATE.+SET	2	0	0	1
+8758	8758	.+SELECT.+FROM	2	0	0	1
+8759	8759	.+UNION\s+SELECT	2	0	0	1
+8760	8760	.+INSERT.+INTO	2	0	0	1
+8761	8761	.+DELETE.+FROM	2	0	0	1
+8762	8762	.+ASCII\(.+SELECT	2	0	0	1
+8763	8763	.+UPDATE.+SET	2	0	0	1
+8764	8764	.+SELECT.+FROM	2	0	0	1
+8765	8765	.+UNION\s+SELECT	2	0	0	1
+8766	8766	.+INSERT.+INTO	2	0	0	1
+8767	8767	.+DELETE.+FROM	2	0	0	1
+8768	8768	.+ASCII\(.+SELECT	2	0	0	1
+8769	8769	.+UPDATE.+SET	2	0	0	1
+8770	8770	.+SELECT.+FROM	2	0	0	1
+8771	8771	.+INSERT.+INTO	2	0	0	1
+8772	8772	.+DELETE.+FROM	2	0	0	1
+8773	8773	.+UPDATE.+SET	2	0	0	1
+8774	8774	SELECT.+FROM	2	0	0	1
+8775	8775	UNION\s+SELECT	2	0	0	1
+8776	8776	INSERT.+INTO	2	0	0	1
+8777	8777	(\?|&)GID=[^\x26\x3B]*[^\d\x2D]	2	0	0	1
+8778	8778	net2ftp_globals\[application_skinsdir\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8779	8779	UNION\s+SELECT	2	0	0	1
+8780	8780	icerikyolu=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8781	8781	sayfaid=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8782	8782	uzanti=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8783	8783	SELECT.+FROM	2	0	0	1
+8784	8784	DELETE.+FROM	2	0	0	1
+8785	8785	INSERT.+INTO	2	0	0	1
+8786	8786	UPDATE.+SET	2	0	0	1
+8787	8787	rootagenda=(https?|ftps?|php)	2	0	0	1
+8788	8788	(\.\.\/){1,}	2	0	0	1
+8789	8789	GLOBALS\[BASE\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8790	8790	[\?&]name=[^&\;\?]+\x27	2	0	0	1
+8791	8791	id_livello\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8792	8792	page\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8793	8793	input_file=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8794	8794	lang_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8795	8795	INSERT.+INTO	2	0	0	1
+8796	8796	UPDATE.+SET	2	0	0	1
+8797	8797	SELECT.+FROM	2	0	0	1
+8798	8798	DELETE.+FROM	2	0	0	1
+8799	8799	current_user_id=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8800	8800	current_user_id=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8801	8801	SELECT.+FROM	2	0	0	1
+8802	8802	fingerprint=\w*\;	2	0	0	1
+8803	8803	class_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8804	8804	filter\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8805	8805	SELECT.+FROM	2	0	0	1
+8806	8806	DELETE.+FROM	2	0	0	1
+8807	8807	INSERT.+INTO	2	0	0	1
+8808	8808	UPDATE.+SET	2	0	0	1
+8809	8809	date\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8810	8810	db_servertype=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8811	8811	(\.\.\/){1,}	2	0	0	1
+8812	8812	(\.\.\/){1,}	2	0	0	1
+8813	8813	(\.\.\/){1,}	2	0	0	1
+8814	8814	mosConfig_absolute_path=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+8815	8815	UPDATE.+SET	2	0	0	1
+8816	8816	ABTPV_BLOQUE_CENTRAL=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8817	8817	forum=.*'	2	0	0	1
+8818	8818	shop_this_skin_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8819	8819	pathForArdeaCore=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8820	8820	LibDir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8821	8821	LibDir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8822	8822	SELECT.+FROM	2	0	0	1
+8823	8823	UNION\s+SELECT	2	0	0	1
+8824	8824	INSERT.+INTO	2	0	0	1
+8825	8825	DELETE.+FROM	2	0	0	1
+8826	8826	ASCII\(.+SELECT	2	0	0	1
+8827	8827	UPDATE.+SET	2	0	0	1
+8828	8828	SELECT.+FROM	2	0	0	1
+8829	8829	UNION\s+SELECT	2	0	0	1
+8830	8830	INSERT.+INTO	2	0	0	1
+8831	8831	DELETE.+FROM	2	0	0	1
+8832	8832	ASCII\(.+SELECT	2	0	0	1
+8833	8833	UPDATE.+SET	2	0	0	1
+8834	8834	SELECT.+FROM	2	0	0	1
+8835	8835	DELETE.+FROM	2	0	0	1
+8836	8836	INSERT.+INTO	2	0	0	1
+8837	8837	UPDATE.+SET	2	0	0	1
+8838	8838	LibDir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8839	8839	LibDir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8840	8840	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8841	8841	&CONFIG\x5bpath\x5d=(https?|ftps?|php)\:	2	0	0	1
+8842	8842	SELECT.+FROM	2	0	0	1
+8843	8843	UNION\s+SELECT	2	0	0	1
+8844	8844	INSERT.+INTO	2	0	0	1
+8845	8845	DELETE.+FROM	2	0	0	1
+8846	8846	ASCII\(.+SELECT	2	0	0	1
+8847	8847	UPDATE.+SET	2	0	0	1
+8848	8848	SELECT.+FROM	2	0	0	1
+8849	8849	UPDATE.+SET	2	0	0	1
+8850	8850	config_atkroot\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8851	8851	index.template.html.+(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8852	8852	pathtoserverdata\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8853	8853	(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8854	8854	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8855	8855	UNION\s+SELECT	2	0	0	1
+8856	8856	master\[currentskin\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8857	8857	UNION.+SELECT	2	0	0	1
+8858	8858	(onmouse|onkey|onload=|onblur=|ondragdrop=|onclick=|alert|<script|<img|<src)	2	0	0	1
+8859	8859	UNION\s+SELECT	2	0	0	1
+8860	8860	\/cgi-mod\/index\.cgi\?.*backup_username=[^&\;]*[>\"]	2	0	0	1
+8861	8861	\/cgi-mod\/index\.cgi\?.*backup_server=[^&\;]*[>\"]	2	0	0	1
+8862	8862	\/cgi-mod\/index\.cgi\?.*backup_path=[^&\;]*[>\"]	2	0	0	1
+8863	8863	\/cgi-mod\/index\.cgi\?.*backup_password=[^&\;]*[>\"]	2	0	0	1
+8864	8864	(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8865	8865	UNION.+SELECT	2	0	0	1
+8866	8866	(alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8867	8867	UNION.+SELECT	2	0	0	1
+8868	8868	UNION.+SELECT	2	0	0	1
+8869	8869	dest\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8870	8870	(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8871	8871	(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8872	8872	(onmouse|onkey|onload=|onblur=|ondragdrop=|onclick=|alert|<script|<img|<src)	2	0	0	1
+8873	8873	(script|img|src|alert|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8874	8874	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8875	8875	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8876	8876	SELECT.+FROM	2	0	0	1
+8877	8877	lgsl_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8878	8878	lgsl_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8879	8879	app_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8880	8880	app_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8881	8881	(modname=meta_certificate|modname=certificate|modname=link).+UPTDATE.+SET	2	0	0	1
+8882	8882	(modname=meta_certificate|modname=certificate|modname=link).+UNION.+SELECT	2	0	0	1
+8883	8883	(modname=meta_certificate|modname=certificate|modname=link).+SELECT.+FROM	2	0	0	1
+8884	8884	(modname=meta_certificate|modname=certificate|modname=link).+DELETE.+FROM	2	0	0	1
+8885	8885	smarty\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8886	8886	smarty\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8887	8887	_compile_file\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8888	8888	UNION.+SELECT	2	0	0	1
+8889	8889	tpl_base_dir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8890	8890	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8891	8891	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8892	8892	(\.\.\/){1,}	2	0	0	1
+8893	8893	path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8894	8894	(\?|&)GLOBALS\[nlang\]=[^\x26\x3B\x2f\x5c]*[\x2f\x5c]	2	0	0	1
+8895	8895	(\?|&)GLOBALS\[nlang\]=[^\x26\x3B\x2f\x5c]*[\x2f\x5c]	2	0	0	1
+8896	8896	kal_class_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8897	8897	kal_class_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8898	8898	edit\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8899	8899	edit\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8900	8900	site_id\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8901	8901	BASE_DIR\[jax_formmailer\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8902	8902	(\.\.\/){1,}	2	0	0	1
+8903	8903	ADODB_LANG\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8904	8904	config\[gfwroot\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8905	8905	(\.\.\/){1,}	2	0	0	1
+8906	8906	servercert\x3D.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8907	8907	c_temp_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8908	8908	c_temp_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8909	8909	(\?|&)article_id=[^\x26\x3B]*[^\d\x2D]	2	0	0	1
+8910	8910	colorpicker\x2Ephp\x3F[^\x0A\x0D]*(form|target)\x3D[^\x0A\x0D\x26]*[\x3E\x3C\x29\x22\x27\x3B]	2	0	0	1
+8911	8911	test\x2Ephp\x3F[^\x0A\x0D]*ext\x3D[^\x0A\x0D\x26]*[\x3E\x3C\x22\x27]	2	0	0	1
+8912	8912	passwd/main\x2Ephp\x3F[^\x0A\x0D]*backend\x3D[^\x0A\x0D\x26]*\x22	2	0	0	1
+8913	8913	colorpicker\x2Ephp\x3F[^\x0A\x0D]*(form|target)\x3D[^\x0A\x0D\x26]*[\x3E\x3C\x29\x22\x27\x3B]	2	0	0	1
+8914	8914	test\x2Ephp\x3F[^\x0A\x0D]*ext\x3D[^\x0A\x0D\x26]*[\x3E\x3C\x22\x27]	2	0	0	1
+8915	8915	passwd/main\x2Ephp\x3F[^\x0A\x0D]*backend\x3D[^\x0A\x0D\x26]*\x22	2	0	0	1
+8916	8916	(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8917	8917	searchWord\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8918	8918	maxHits\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8919	8919	scopedSearch\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8920	8920	scope\s*=[\x22\x27\x3c\x3e\x20]*(script|img|src|onmouse|onkey|onload|ondragdrop|onblur|onfocus|onclick)	2	0	0	1
+8921	8921	BaseTarget\x3D.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8922	8922	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8923	8923	INDEX\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8924	8924	domain\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8925	8925	slot\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8926	8926	slot\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8927	8927	WEBINDEX\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8928	8928	SLOT\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+8929	8929	UNION.+SELECT	2	0	0	1
+8930	8930	mosConfig_live_site=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8931	8931	\x2Ephp\x3F.{0,300}\x3D(http\x3A|ftp\x3A|https\x3A|ftps\x3A)	2	0	0	1
+8932	8932	GLOBALS\[mosConfig_absolute_path\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8933	8933	GLOBALS\[mosConfig_absolute_path\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8934	8934	user_id=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8935	8935	newsid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8936	8936	(\?|&)Itemid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8937	8937	(\?|&)id=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8938	8938	(\?|&)eid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8939	8939	(\?|&)Itemid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8940	8940	(\?|&)id=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8941	8941	(\?|&)secid=[^\s\x26\x3B\x2f]*[\s\x2f]	2	0	0	1
+8942	8942	(\?|&)catID=[^\x26\x3B]*[^\d\x2D]	2	0	0	1
+8943	8943	mosConfig_absolute_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8944	8944	mosConfig_absolute_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8945	8945	mosConfig_absolute_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8946	8946	user_id\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8947	8947	mosConfig_absolute_path\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8948	8948	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8949	8949	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8950	8950	GLOBALS\[mosConfig_absolute_path\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8951	8951	mosConfig_absolute_path=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8952	8952	DOCUMENT_ROOT\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8953	8953	CONFIG\[AdminPath\]\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8954	8954	cwd=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8955	8955	cfile\s*=\s*(https?|ftps?|php)\:\/	2	0	0	1
+8956	8956	\.php(\?|.*\x26)pathToIndex=(https?|ftps?)\:\/\/[^\x26\x3B]+\?\?	2	0	0	1
+8957	8957	name=.+(IMG|SCRIPT|SRC|onkey|onmouse|onload)	2	0	0	1
+8958	8958	SELECT.+FROM	2	0	0	1
+8959	8959	db_type\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8960	8960	v1\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8961	8961	SELECT.+FROM	2	0	0	1
+8962	8962	SELECT.+FROM	2	0	0	1
+8963	8963	reflect_base=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8964	8964	(\.\.\/){1,}	2	0	0	1
+8965	8965	determined_format\[include\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8966	8966	determined_format\[include\]=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8967	8967	(\?|&)listing_id=[^\x26\x3B]*[^\d\x2D]	2	0	0	1
+8968	8968	fm_includes_special=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8969	8969	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8970	8970	(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8971	8971	SELECT.+FROM	2	0	0	1
+8972	8972	SELECT.+FROM	2	0	0	1
+8973	8973	SELECT.+FROM	2	0	0	1
+8974	8974	SELECT.+FROM	2	0	0	1
+8975	8975	SELECT.+FROM	2	0	0	1
+8976	8976	SELECT.+FROM	2	0	0	1
+8977	8977	UNION\s+SELECT	2	0	0	1
+8978	8978	UNION.+SELECT	2	0	0	1
+8979	8979	mybloggie_root_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8980	8980	email\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8981	8981	DIR_FILES_BLOCK_TYPES_CORE=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8982	8982	AND.*IF\(	2	0	0	1
+8983	8983	DIR_LIBS=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+8984	8984	DIR_LIBS=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+8985	8985	DIR_LIBS=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+8986	8986	DIR_LIBS=\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+8987	8987	f_srch\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8988	8988	client\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8989	8989	file\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8990	8990	tagcloud\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8991	8991	tagcloud\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8992	8992	id=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8993	8993	and.*substring\(	2	0	0	1
+8994	8994	lang\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8995	8995	basedir=\s*(ftps?|https?|php)\:\/	2	0	0	1
+8996	8996	k\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8997	8997	and.*substring\(	2	0	0	1
+8998	8998	showfile\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+8999	8999	PHPCOVERAGE_HOME\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9000	9000	param\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9001	9001	ORDER.+BY	2	0	0	1
+9002	9002	mosConfig_absolute_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+9003	9003	explain\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9004	9004	relocate\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9005	9005	and.*substring\(	2	0	0	1
+9006	9006	L_failedopentheme\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9007	9007	and.*substring\(	2	0	0	1
+9008	9008	messageString\x3D.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9009	9009	stconf.nsf.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D).+unescape	2	0	0	1
+9010	9010	\&(width|height)\=([2-9][0-9][0-9][0-9]*)	2	0	0	1
+9011	9011	post_id\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9012	9012	form\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9013	9013	form\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9014	9014	f\x3Dvsr\x27\x7C\x7C.+(or|and|select|delete|union|delete|update|insert)	2	0	0	1
+9015	9015	\x2Ephp\x3F.{0,300}\x3D(http\x3A|ftp\x3A|https\x3A|ftps\x3A)	2	0	0	1
+9016	9016	(\.\.\/){1}	2	0	0	1
+9017	9017	modname=((meta_)?certificate|link).+?\bINSERT\b.*?INTO\b	2	0	0	1
+9018	9018	modname=((meta_)?certificate|link).+?\bUPDATE\b.*?SET\b	2	0	0	1
+9019	9019	UNION\s+?SELECT	2	0	0	1
+9020	9020	UNION\s+?SELECT	2	0	0	1
+9021	9021	ccf_((clear|merge)_im|ex)port	2	0	0	1
+9022	9022	and.*substring\(	2	0	0	1
+9023	9023	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+9024	9024	^[^>]+\x22\s*http\x3a\x2f\x2f.+\.dtd	2	0	0	1
+9025	9025	^[^>]+\x22\s*ftp\x3a\x2f\x2f	2	0	0	1
+9026	9026	^[^>]+\x22\s*http\x3a\x2f\x2f.+\.dtd	2	0	0	1
+9027	9027	lien_2=\s*(ftps?|https?|php)\:\/	2	0	0	1
+9028	9028	root\_folder\_path=\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+9029	9029	root\_folder\_path=\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+9030	9030	root\_folder\_path=\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+9031	9031	fact_num\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9032	9032	sn\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9033	9033	ref\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9034	9034	userId\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9035	9035	having\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9036	9036	view\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9037	9037	query\x3d.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9038	9038	[&?]cmd=	2	0	0	1
+9039	9039	[&?]src=https?[^&]+\x24\x28	2	0	0	1
+9040	9040	^[^\r\n]*(%2(52e(%2(52e(%(c(0%af|1%9c)|(25)?2f)|5c|\/)|e(%(c(0%af|1%9c)|(25)?2f)|5c|\/))|\.(%(c(0%af|1%9c)|(25)?2f)|5c|\/))|e(%2(52e(%(c(0%af|1%9c)|(25)?2f)|5c|\/)|e(%(c(0%af|1%9c)|(25)?2f)|5c|\/))|\.(%(c(0%af|1%9c)|(25)?2f)|5c|\/)))|\.(%2(52e(%(c(0%af|1%9c)|(25)?2f)|5c|\/)|e(%(c(0%af|1%9c)|(25)?2f)|5c|\/))|\.(%(c(0%af|1%9c)|(25)?2f)|5c|\/)))	2	0	0	1
+9041	9041	^\d[\d\x2e]{255}	2	0	0	1
+9042	9042	[?&]id=\d*?[^\d]\d*?(&|$)	2	0	0	1
+9043	9043	&list\[fullordering\]=([a-zA-Z0-9])*[\x22\x27\x28]	2	0	0	1
+9044	9044	\.jsp\/[^\x2f]*$	2	0	0	1
+9045	9045	\.jspx\/[^\x2f]*$	2	0	0	1
+9046	9046	\.shtml\/[^\x2f]*$	2	0	0	1
+9047	9047	\.jsp\/[^\x2f]*$	2	0	0	1
+9048	9048	\.jspx\/[^\x2f]*$	2	0	0	1
+9049	9049	\.shtml\/[^\x2f]*$	2	0	0	1
+9050	9050	new\s+(java|org|sun)	2	0	0	1
+9051	9051	\/sem\/\w+\.php.*(\?|&)uniqueid=\d*\;	2	0	0	1
+9052	9052	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+9053	9053	^\s+SELECT	2	0	0	1
+9054	9054	(\.\.\/){1,}	2	0	0	1
+9055	9055	(\.\.\/){1,}	2	0	0	1
+9056	9056	^([a-zA-Z0-9_])*[\x2c\x22\x27\x28]	2	0	0	1
+9057	9057	.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9058	9058	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9059	9059	^\s*(ftps?|https?|php)\x3a\/	2	0	0	1
+9060	9060	^.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+9061	9061	\x2Fwp\x2Dadmin\x2Fadmin\x2Ephp.+page\x3D(\x2Fcollapsing\x2Darchives\x2Foptions\x2Etxt|akismet\x2Freadme\x2Etxt|related\x2Dways\x2Dto\x2Dtake\x2Daction\x2Foptions\x2Ephp|wp\x2Dsecurity\x2Dscan\x2Fsecurityscan\x2Ephp)	2	0	0	1
+9062	9062	id\x3d.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+9063	9063	^[^\r]*?name=[\x22\x27]image_file"\x3b[^(\r\n|\n|\r)]*?(\r\n|\n|\r)(\r\n|\n|\r)?Content-Type: application\/x-httpd-php	2	0	0	1
+9064	9064	^(\x28|%28)	2	0	0	1
+9065	9065	^\x22[^\x22]*\x7b[^\x22]*\x7d[^\x22]*\x22[^\x22]*\x22{2}	2	0	0	1
+9066	9066	^%(3B|0A|26|60|7C|24)	2	0	0	1
+9067	9067	^\s?.{0,100}(SELECT|UNION|CHAR|LONGVARCHAR|SCHEMA|FROM|WHERE|IFNULL|INSERT|UPDATE)	2	0	0	1
+9068	9068	^.+?(on((s(elec|ubmi)|rese)t|d(blclick|ragdrop)|(mouse|key)[a-z]|c(hange|lick)|(un)?load|focus|blur)|s(cript|tyle=))	2	0	0	1
+9069	9069	^.+(s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+9070	9070	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+9071	9071	^\s*((ht|f)tps?|data|php)\x3a\/	2	0	0	1
+9072	9072	^\s*(ftps?|https?|php)\:\/	2	0	0	1
+9073	9073	UPDATE.+SET	2	0	0	1
+9074	9074	source(\x22\x3b\w\x3a|%22%3b\w%3a)\d+(\x3a\x22|%3a%22)((ftps?|%66%74%70(%73)?)|(https?|%68%74%74%70(%73)?)|(php|%70%68%70))(\x3a|%3A)(\x2f|%2f)	2	0	0	1
+9075	9075	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+9076	9076	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5	2	0	0	1
+9077	9077	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980	2	0	0	1
+9078	9078	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E	2	0	0	1
+9079	9079	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333	2	0	0	1
+9080	9080	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C	2	0	0	1
+9081	9081	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E	2	0	0	1
+9082	9082	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+9083	9083	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+9084	9084	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+9085	9085	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08	2	0	0	1
+9086	9086	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42	2	0	0	1
+9087	9087	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4	2	0	0	1
+9088	9088	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980	2	0	0	1
+9089	9089	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3	2	0	0	1
+9090	9090	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980	2	0	0	1
+9091	9091	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB	2	0	0	1
+9092	9092	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+9093	9093	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+9094	9094	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664	2	0	0	1
+9095	9095	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C	2	0	0	1
+9096	9096	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980	2	0	0	1
+9097	9097	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+9098	9098	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+9099	9099	(EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters)	2	0	0	1
+9100	9100	(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+9101	9101	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+9102	9102	(ReadMolFile|SaveasMolFile)	2	0	0	1
+9103	9103	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+9104	9104	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+9105	9105	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C	2	0	0	1
+9106	9106	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+9107	9107	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+9108	9108	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000	2	0	0	1
+9109	9109	file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+9110	9110	[0-9]{3,}	2	0	0	1
+9111	9111	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194	2	0	0	1
+9112	9112	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2	2	0	0	1
+9113	9113	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510	2	0	0	1
+9114	9114	(setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch)	2	0	0	1
+9115	9115	param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20}	2	0	0	1
+9116	9116	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C	2	0	0	1
+9117	9117	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+9118	9118	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79	2	0	0	1
+9119	9119	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD	2	0	0	1
+9120	9120	(Text|EditSelText|EditText|CellFontName|Archive)	2	0	0	1
+9121	9121	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+9122	9122	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c	2	0	0	1
+9123	9123	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B	2	0	0	1
+9124	9124	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA	2	0	0	1
+9125	9125	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted)	2	0	0	1
+9126	9126	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam)	2	0	0	1
+9127	9127	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+9128	9128	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8	2	0	0	1
+9129	9129	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E	2	0	0	1
+9130	9130	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726	2	0	0	1
+9131	9131	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598	2	0	0	1
+9132	9132	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E	2	0	0	1
+9133	9133	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E	2	0	0	1
+9134	9134	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E	2	0	0	1
+9135	9135	(exe|bat|com|dll|ini)	2	0	0	1
+9136	9136	(exe|bat|com|dll|ini)	2	0	0	1
+9137	9137	(exe|bat|com|dll|ini)	2	0	0	1
+9138	9138	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E	2	0	0	1
+9139	9139	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7	2	0	0	1
+9140	9140	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91	2	0	0	1
+9141	9141	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980	2	0	0	1
+9142	9142	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02	2	0	0	1
+9143	9143	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3	2	0	0	1
+9144	9144	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90	2	0	0	1
+9145	9145	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E	2	0	0	1
+9146	9146	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E	2	0	0	1
+9147	9147	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112	2	0	0	1
+9148	9148	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1	2	0	0	1
+9149	9149	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6	2	0	0	1
+9150	9150	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F	2	0	0	1
+9151	9151	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+9152	9152	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA	2	0	0	1
+9153	9153	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258	2	0	0	1
+9154	9154	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B	2	0	0	1
+9155	9155	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1	2	0	0	1
+9156	9156	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7	2	0	0	1
+9157	9157	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D	2	0	0	1
+9158	9158	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61	2	0	0	1
+9159	9159	(Src|Background|PackageXml)	2	0	0	1
+9160	9160	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters)	2	0	0	1
+9161	9161	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+9162	9162	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+9163	9163	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+9164	9164	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+9165	9165	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755	2	0	0	1
+9166	9166	(Save|SaveLayoutChanges|SaveMenuUsageData)	2	0	0	1
+9167	9167	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61	2	0	0	1
+9168	9168	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+9169	9169	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+9170	9170	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+9171	9171	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+9172	9172	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0	2	0	0	1
+9173	9173	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3	2	0	0	1
+9174	9174	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679	2	0	0	1
+9175	9175	(SaveFile|ExportToXML)	2	0	0	1
+9176	9176	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE	2	0	0	1
+9177	9177	(SnapShotToFile|SnapShotX)	2	0	0	1
+9178	9178	(SnapShotToFile|SnapShotX)	2	0	0	1
+9179	9179	(SnapShotToFile|SnapShotX)	2	0	0	1
+9180	9180	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+9181	9181	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28	2	0	0	1
+9182	9182	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003	2	0	0	1
+9183	9183	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+9184	9184	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+9185	9185	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+9186	9186	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+9187	9187	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE	2	0	0	1
+9188	9188	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB	2	0	0	1
+9189	9189	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile)	2	0	0	1
+9190	9190	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD	2	0	0	1
+9191	9191	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA	2	0	0	1
+9192	9192	(Run|SetRegistryValueAsString|PerformUpdateAsync)	2	0	0	1
+9193	9193	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+9194	9194	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+9195	9195	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084	2	0	0	1
+9196	9196	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6	2	0	0	1
+9197	9197	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF	2	0	0	1
+9198	9198	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5	2	0	0	1
+9199	9199	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C	2	0	0	1
+9200	9200	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA	2	0	0	1
+9201	9201	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020	2	0	0	1
+9202	9202	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020	2	0	0	1
+9203	9203	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B	2	0	0	1
+9204	9204	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356	2	0	0	1
+9205	9205	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520	2	0	0	1
+9206	9206	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C	2	0	0	1
+9207	9207	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26	2	0	0	1
+9208	9208	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0	2	0	0	1
+9209	9209	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF	2	0	0	1
+9210	9210	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142	2	0	0	1
+9211	9211	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB	2	0	0	1
+9212	9212	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7	2	0	0	1
+9213	9213	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747	2	0	0	1
+9214	9214	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456	2	0	0	1
+9215	9215	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0	2	0	0	1
+9216	9216	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999	2	0	0	1
+9217	9217	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899	2	0	0	1
+9218	9218	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5	2	0	0	1
+9219	9219	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E	2	0	0	1
+9220	9220	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F	2	0	0	1
+9221	9221	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9	2	0	0	1
+9222	9222	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F	2	0	0	1
+9223	9223	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448	2	0	0	1
+9224	9224	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92	2	0	0	1
+9225	9225	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F	2	0	0	1
+9226	9226	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED	2	0	0	1
+9227	9227	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB	2	0	0	1
+9228	9228	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305	2	0	0	1
+9229	9229	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7	2	0	0	1
+9230	9230	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B	2	0	0	1
+9231	9231	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C	2	0	0	1
+9232	9232	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627	2	0	0	1
+9233	9233	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E	2	0	0	1
+9234	9234	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE	2	0	0	1
+9235	9235	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496	2	0	0	1
+9236	9236	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0	2	0	0	1
+9237	9237	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E	2	0	0	1
+9238	9238	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C	2	0	0	1
+9239	9239	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53	2	0	0	1
+9240	9240	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014	2	0	0	1
+9241	9241	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+9242	9242	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+9243	9243	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741	2	0	0	1
+9244	9244	(SaveToBMP|SaveToFile)	2	0	0	1
+9245	9245	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2	2	0	0	1
+9246	9246	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667	2	0	0	1
+9247	9247	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+9248	9248	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+9249	9249	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+9250	9250	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D	2	0	0	1
+9251	9251	(SaveBarCode|SaveEnhWMF)	2	0	0	1
+9252	9252	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B	2	0	0	1
+9253	9253	<object\s*[^>]*\s*classid\s*=\s*(.+<q1>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>)	2	0	0	1
+9254	9254	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000	2	0	0	1
+9255	9255	(exe|bat|com|dll|ini)	2	0	0	1
+9256	9256	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E	2	0	0	1
+9257	9257	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E	2	0	0	1
+9258	9258	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87	2	0	0	1
+9259	9259	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+9260	9260	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+9261	9261	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+9262	9262	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+9263	9263	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+9264	9264	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E	2	0	0	1
+9265	9265	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344	2	0	0	1
+9266	9266	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C	2	0	0	1
+9267	9267	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30	2	0	0	1
+9268	9268	(Packagefiles|SaveDna|SetIdentity|AddFile)	2	0	0	1
+9269	9269	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9	2	0	0	1
+9270	9270	(_DOWText)|(_MonthText)	2	0	0	1
+9271	9271	(SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour)	2	0	0	1
+9272	9272	classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE	2	0	0	1
+9273	9273	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+9274	9274	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+9275	9275	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F	2	0	0	1
+9276	9276	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5	2	0	0	1
+9277	9277	[\w\W]{2500,}	2	0	0	1
+9278	9278	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3	2	0	0	1
+9279	9279	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8	2	0	0	1
+9280	9280	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04	2	0	0	1
+9281	9281	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue)	2	0	0	1
+9282	9282	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356	2	0	0	1
+9283	9283	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E	2	0	0	1
+9284	9284	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574	2	0	0	1
+9285	9285	(WriteIniFileString|ShellExecute)	2	0	0	1
+9286	9286	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906	2	0	0	1
+9287	9287	(txt|ini|com|exe|bat|dll|dat)	2	0	0	1
+9288	9288	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8	2	0	0	1
+9289	9289	42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733	2	0	0	1
+9290	9290	(Save|ExportImage)	2	0	0	1
+9291	9291	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790	2	0	0	1
+9292	9292	(DeleteFile|write)	2	0	0	1
+9293	9293	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+9294	9294	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+9295	9295	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+9296	9296	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+9297	9297	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967	2	0	0	1
+9298	9298	WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext)	2	0	0	1
+9299	9299	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9	2	0	0	1
+9300	9300	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5	2	0	0	1
+9301	9301	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6	2	0	0	1
+9302	9302	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+9303	9303	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+9304	9304	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24	2	0	0	1
+9305	9305	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9	2	0	0	1
+9306	9306	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA	2	0	0	1
+9307	9307	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec)	2	0	0	1
+9308	9308	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5	2	0	0	1
+9309	9309	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+9310	9310	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+9311	9311	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+9312	9312	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83	2	0	0	1
+9313	9313	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA	2	0	0	1
+9314	9314	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566	2	0	0	1
+9315	9315	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+9316	9316	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+9317	9317	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B	2	0	0	1
+9318	9318	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F	2	0	0	1
+9319	9319	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+9320	9320	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+9321	9321	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED	2	0	0	1
+9322	9322	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619	2	0	0	1
+9323	9323	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E	2	0	0	1
+9324	9324	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258	2	0	0	1
+9325	9325	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196	2	0	0	1
+9326	9326	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E	2	0	0	1
+9327	9327	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD	2	0	0	1
+9328	9328	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4	2	0	0	1
+9329	9329	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118	2	0	0	1
+9330	9330	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616	2	0	0	1
+9331	9331	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+9332	9332	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+9333	9333	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+9334	9334	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11	2	0	0	1
+9335	9335	(ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1	2	0	0	1
+9336	9336	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020	2	0	0	1
+9337	9337	(PostURL|AddSeperator|AddString|Post)	2	0	0	1
+9338	9338	(SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF)	2	0	0	1
+9339	9339	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>)	2	0	0	1
+9340	9340	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\>	2	0	0	1
+9341	9341	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\>	2	0	0	1
+9342	9342	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\>	2	0	0	1
+9343	9343	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\>	2	0	0	1
+9344	9344	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+9345	9345	(Buildpath|GetDriveName|DriveExists|DeleteFile)	2	0	0	1
+9346	9346	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+9347	9347	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+9348	9348	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+9349	9349	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>)	2	0	0	1
+9350	9350	\x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission]	2	0	0	1
+9351	9351	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\>	2	0	0	1
+9352	9352	000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F	2	0	0	1
+9353	9353	(javascript|http|ftp|vbscript)	2	0	0	1
+9354	9354	(SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen)	2	0	0	1
+9355	9355	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000	2	0	0	1
+9356	9356	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407	2	0	0	1
+9357	9357	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414	2	0	0	1
+9358	9358	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+9359	9359	(AddAttachment|SubmitToExpress)	2	0	0	1
+9360	9360	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6	2	0	0	1
+9361	9361	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0	2	0	0	1
+9362	9362	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D	2	0	0	1
+9363	9363	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile)	2	0	0	1
+9364	9364	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\>	2	0	0	1
+9365	9365	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\>	2	0	0	1
+9366	9366	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC	2	0	0	1
+9367	9367	src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape	2	0	0	1
+9368	9368	(LogFile|ClearLogFile|SaveToFile)	2	0	0	1
+9369	9369	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)	2	0	0	1
+9370	9370	^User-Agent\x3a Downloader \d\.\d\r?$/Hm	2	0	0	1
+9371	9371	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P	2	0	0	1
+9372	9372	^((\r?\n\r?\n).)*?\r?\n\r?\nMZ	2	0	0	1
+9373	9373	instructions\/\d{2}\.xml	2	0	0	1
+9374	9374	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp	2	0	0	1
+9375	9375	\/updatestats\/update\d+?\.xml$	2	0	0	1
+9376	9376	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab	2	0	0	1
+9377	9377	ctxad-\d+\.sig	2	0	0	1
+9378	9378	/user\d+/counter\.htm	2	0	0	1
+9379	9379	(cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr	2	0	0	1
+9380	9380	(discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe	2	0	0	1
+9381	9381	loaderadv\d+\.jar	2	0	0	1
+9382	9382	\/adv\/\d+\/win32\.exe	2	0	0	1
+9383	9383	\/Message\/\S+\/\S+\.xml	2	0	0	1
+9384	9384	\/abt\?data=\S{150}	2	0	0	1
+9385	9385	^User-Agent\x3a.+ZangoToolbar.+\r$/Hmi	2	0	0	1
+9386	9386	User-Agent\:[^\n]+wbi_v\d/iH	2	0	0	1
+9387	9387	User-Agent\x3a[^\n]+AskBar/iH	2	0	0	1
+9388	9388	\/tbrequest\d+\.php	2	0	0	1
+9389	9389	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+9390	9390	sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+9391	9391	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+9392	9392	cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+9393	9393	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+9394	9394	UID=\d	2	0	0	1
+9395	9395	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+9396	9396	REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P	2	0	0	1
+9397	9397	victim\.php\?\d\d\d\d\d	2	0	0	1
+9398	9398	\/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d	2	0	0	1
+9399	9399	\/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+	2	0	0	1
+9400	9400	&ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d	2	0	0	1
+9401	9401	\/sd\?s=\d+&f=\d&C=\d	2	0	0	1
+9402	9402	\.txt$	2	0	0	1
+9403	9403	\.cfg$	2	0	0	1
+9404	9404	User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H	2	0	0	1
+9405	9405	^Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r?$/Hi	2	0	0	1
+9406	9406	\x00[\x02-\x1E][0-9]{2,30}\x02cn\x00	2	0	0	1
+9407	9407	\x00[\x02-\x1E][0-9]{2,30}\x02ru\x00	2	0	0	1
+9408	9408	^[A-F0-9]+$	2	0	0	1
+9409	9409	\/sd\?s=\d+&f=\d	2	0	0	1
+9410	9410	loadadv\d+\.exe	2	0	0	1
+9411	9411	\/ms\d\d\dcfg\.jsp	2	0	0	1
+9412	9412	^0x[0-9a-f]+$	2	0	0	1
+9413	9413	^[^a-z]*?[0-9]{2,30}\.ru$	2	0	0	1
+9414	9414	filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe	2	0	0	1
+9415	9415	^MM \d\.\d+$	2	0	0	1
+9416	9416	^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4}	2	0	0	1
+9417	9417	^\w+pcsetup_\w+	2	0	0	1
+9418	9418	\x2Fv[0-9]{3,4}[\x2F\x3F]	2	0	0	1
+9419	9419	[a-f0-9]{32}\?v=	2	0	0	1
+9420	9420	^\/[a-z]{2}\x3Fv\x3D[0-9]$	2	0	0	1
+9421	9421	^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$	2	0	0	1
+9422	9422	^\/entrance\?s1=[a-f0-9]{100,}$	2	0	0	1
+9423	9423	^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=	2	0	0	1
+9424	9424	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+9425	9425	^[0-9][a-z]+	2	0	0	1
+9426	9426	\.php$	2	0	0	1
+9427	9427	^\/([^\x2f]+\/)*log\/\?[bc]=	2	0	0	1
+9428	9428	^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/))	2	0	0	1
+9429	9429	^\/\?pcrc=\d+&v=[\d.]+$	2	0	0	1
+9430	9430	^\/\?v=[\d.]+&pcrc=\d+$	2	0	0	1
+9431	9431	\/v\d\/[^.]+\.asp$	2	0	0	1
+9432	9432	\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$	2	0	0	1
+9433	9433	\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$	2	0	0	1
+9434	9434	^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$	2	0	0	1
+9435	9435	^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$	2	0	0	1
+9436	9436	\?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})	2	0	0	1
+9437	9437	^Downloader\s\d+\.\d+$	2	0	0	1
+9438	9438	^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100}	2	0	0	1
+9439	9439	\/get_xml\?(file_id|stb)=	2	0	0	1
+9440	9440	(_[a-z]{2}){1,3}_[a-z]{3}_install\.exe	2	0	0	1
+9441	9441	\d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows	2	0	0	1
+9442	9442	^[a-zA-Z0-9_-]+$	2	0	0	1
+9443	9443	^\/([a-zA-Z0-9]|%2[fb]){400,}$	2	0	0	1
+9444	9444	User-Agent\:[^\n]+searchengine	2	0	0	1
+9445	9445	User-Agent\:[^\n]+SurferPlugin	2	0	0	1
+9446	9446	User-Agent\:[^\n]+THNALL[^\n]+\.EXE	2	0	0	1
+9447	9447	User-Agent\:[^\n]+XupiterToolbar	2	0	0	1
+9448	9448	User-Agent\:[^\n]+spywareaxe	2	0	0	1
+9449	9449	User-Agent\:[^\n]+iMeshBar	2	0	0	1
+9450	9450	User-Agent\:[^\n]+Oemji	2	0	0	1
+9451	9451	^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$	2	0	0	1
+9452	9452	^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$	2	0	0	1
+9453	9453	^\/(get|install)\/\?q=	2	0	0	1
+9454	9454	^\/[a-f0-9]{50,}$	2	0	0	1
+9455	9455	^\/[\w-]{50,}$	2	0	0	1
+9456	9456	^\/\?pcrc=[0-9]{7,10}$	2	0	0	1
+9457	9457	^Downloader \d\.\d$	2	0	0	1
+9458	9458	\/Socks[45]\.txt$	2	0	0	1
+9459	9459	^Feat[^\r\n]+(Install|Updat)er	2	0	0	1
+9460	9460	User-Agent\:[^\n]+host(ie|oe|oi|ol)	2	0	0	1
+9461	9461	User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}	2	0	0	1
+9462	9462	^BWL(\sToplist|\d_UPDATE)	2	0	0	1
+9463	9463	^\x2F[A-F0-9]{25,40}$	2	0	0	1
+9464	9464	^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$	2	0	0	1
+9465	9465	^\d+\sHTTP/1.1$	2	0	0	1
+9466	9466	^[a-zA-Z0-9_-]+	2	0	0	1
+9467	9467	[a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12}	2	0	0	1
+9468	9468	\/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id=	2	0	0	1
+9469	9469	\{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\}	2	0	0	1
+9470	9470	CN=([^\r\n]+?\.)?showmypc\.com(\.)	2	0	0	1
+9471	9471	^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$	2	0	0	1
+9472	9472	(SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk)	2	0	0	1
+9473	9473	(DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog)	2	0	0	1
+9474	9474	\d{13}$	2	0	0	1
+9475	9475	^[a-f0-9]{32}	2	0	0	1
+9476	9476	^[a-f0-9]{32}\"	2	0	0	1
+9477	9477	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+9478	9478	^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}	2	0	0	1
+9479	9479	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+9480	9480	^[A-F0-9]{12}	2	0	0	1
+9481	9481	^[A-Z0-9]{9}	2	0	0	1
+9482	9482	^\d+[^\r\n\s]+	2	0	0	1
+9483	9483	^ SQL[-_ ]Server	2	0	0	1
+9484	9484	^ \d+ Driver	2	0	0	1
+9485	9485	ORA-\d{4}	2	0	0	1
+9486	9486	Warning.*\Woci_	2	0	0	1
+9487	9487	Warning.*\Wora_	2	0	0	1
+9488	9488	CLI Driver.*DB2	2	0	0	1
+9489	9489	bdb2_\w+\(	2	0	0	1
+9490	9490	Exception.*Informix	2	0	0	1
+9491	9491	Warning.*SQLite3::	2	0	0	1
+9492	9492	SQL error.*POS\([0-9]+\)	2	0	0	1
+9493	9493	Warning.*maxdb	2	0	0	1
+9494	9494	i?Warning.*sybase	2	0	0	1
+9495	9495	Warning.*ingres_	2	0	0	1
+9496	9496	Warning.*sqlite_	2	0	0	1
+9497	9497	Ingres\W.*Driver	2	0	0	1
+9498	9498	Exception (condition )\d+\. Transaction rollback\.	2	0	0	1
+9499	9499	SQL Server.*?error \x27[0-9a-f]{8}	2	0	0	1
+9500	9500	^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$	2	0	0	1
+9501	9501	^(<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll	2	0	0	1
+9502	9502	^...\x30\x82..\x02\x82...{256,257}	2	0	0	1
+9503	9503	\/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php	2	0	0	1
+9504	9504	\/notify\/(single|mass)$	2	0	0	1
+9505	9505	a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php)	2	0	0	1
+9506	9506	Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a	2	0	0	1
+9507	9507	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+9508	9508	[-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10}	2	0	0	1
+9509	9509	^\d+(\+|\-|\\|\*)\d+	2	0	0	1
+9510	9510	^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9	2	0	0	1
+9511	9511	^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u	2	0	0	1
+9512	9512	ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b	2	0	0	1
+9513	9513	^\d{4}[01]	2	0	0	1
+9514	9514	^\d{4}[01]	2	0	0	1
+9515	9515	^\d{4}[01]	2	0	0	1
+9516	9516	^\d{4}[01]	2	0	0	1
+9517	9517	^\d{4}[01]	2	0	0	1
+9518	9518	^\d{4}[01]	2	0	0	1
+9519	9519	^\d{4}[01]	2	0	0	1
+9520	9520	^\d{4}[01]	2	0	0	1
+9521	9521	^\d{4}[01]	2	0	0	1
+9522	9522	^\d{4}[01]	2	0	0	1
+9523	9523	^\d{4}[01]	2	0	0	1
+9524	9524	^\d{4}[01]	2	0	0	1
+9525	9525	^\d{4}[01]	2	0	0	1
+9526	9526	^\d{4}[01]	2	0	0	1
+9527	9527	^\d{4}[01]	2	0	0	1
+9528	9528	^\d{4}[01]	2	0	0	1
+9529	9529	^\d{4}[01]	2	0	0	1
+9530	9530	^\d{4}[01]	2	0	0	1
+9531	9531	^\d{4}[01]	2	0	0	1
+9532	9532	^\d{4}[01]	2	0	0	1
+9533	9533	^\d{4}[01]	2	0	0	1
+9534	9534	^\d{4}[01]	2	0	0	1
+9535	9535	^\d{4}[01]	2	0	0	1
+9536	9536	^\d{4}[01]	2	0	0	1
+9537	9537	^\d{4}[01]	2	0	0	1
+9538	9538	^\d{4}[01]	2	0	0	1
+9539	9539	^\d{4}[01]	2	0	0	1
+9540	9540	^\d{4}[01]	2	0	0	1
+9541	9541	^\d{4}[01]	2	0	0	1
+9542	9542	^\d{4}[01]	2	0	0	1
+9543	9543	^\d{4}[01]	2	0	0	1
+9544	9544	^\d{4}[01]	2	0	0	1
+9545	9545	^\d{4}[01]	2	0	0	1
+9546	9546	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9547	9547	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9548	9548	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9549	9549	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9550	9550	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9551	9551	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9552	9552	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9553	9553	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9554	9554	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9555	9555	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9556	9556	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9557	9557	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9558	9558	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9559	9559	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9560	9560	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9561	9561	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9562	9562	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9563	9563	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9564	9564	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9565	9565	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9566	9566	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9567	9567	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9568	9568	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9569	9569	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9570	9570	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9571	9571	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9572	9572	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9573	9573	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9574	9574	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9575	9575	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9576	9576	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9577	9577	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9578	9578	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9579	9579	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9580	9580	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9581	9581	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9582	9582	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9583	9583	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9584	9584	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9585	9585	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9586	9586	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9587	9587	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9588	9588	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9589	9589	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9590	9590	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9591	9591	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9592	9592	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9593	9593	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9594	9594	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9595	9595	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9596	9596	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9597	9597	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9598	9598	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9599	9599	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9600	9600	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9601	9601	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9602	9602	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9603	9603	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9604	9604	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9605	9605	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9606	9606	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9607	9607	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9608	9608	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9609	9609	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9610	9610	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9611	9611	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9612	9612	^\d{4}[01]	2	0	0	1
+9613	9613	^\d{4}[01]	2	0	0	1
+9614	9614	^\d{4}[01]	2	0	0	1
+9615	9615	^\d{4}[01]	2	0	0	1
+9616	9616	^\d{4}[01]	2	0	0	1
+9617	9617	^\d{4}[01]	2	0	0	1
+9618	9618	^\d{4}[01]	2	0	0	1
+9619	9619	^\d{4}[01]	2	0	0	1
+9620	9620	^\d{4}[01]	2	0	0	1
+9621	9621	^\d{4}[01]	2	0	0	1
+9622	9622	^\d{4}[01]	2	0	0	1
+9623	9623	^\d{4}[01]	2	0	0	1
+9624	9624	^\d{4}[01]	2	0	0	1
+9625	9625	^\d{4}[01]	2	0	0	1
+9626	9626	^\d{4}[01]	2	0	0	1
+9627	9627	^\d{4}[01]	2	0	0	1
+9628	9628	^\d{4}[01]	2	0	0	1
+9629	9629	^\d{4}[01]	2	0	0	1
+9630	9630	^\d{4}[01]	2	0	0	1
+9631	9631	^\d{4}[01]	2	0	0	1
+9632	9632	^\d{4}[01]	2	0	0	1
+9633	9633	^\d{4}[01]	2	0	0	1
+9634	9634	^\d{4}[01]	2	0	0	1
+9635	9635	^\d{4}[01]	2	0	0	1
+9636	9636	^\d{4}[01]	2	0	0	1
+9637	9637	^\d{4}[01]	2	0	0	1
+9638	9638	^\d{4}[01]	2	0	0	1
+9639	9639	^\d{4}[01]	2	0	0	1
+9640	9640	^\d{4}[01]	2	0	0	1
+9641	9641	^\d{4}[01]	2	0	0	1
+9642	9642	^\d{4}[01]	2	0	0	1
+9643	9643	^\d{4}[01]	2	0	0	1
+9644	9644	^\d{4}[01]	2	0	0	1
+9645	9645	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9646	9646	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9647	9647	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9648	9648	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9649	9649	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9650	9650	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9651	9651	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9652	9652	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9653	9653	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9654	9654	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9655	9655	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9656	9656	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9657	9657	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9658	9658	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9659	9659	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9660	9660	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9661	9661	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9662	9662	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9663	9663	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9664	9664	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9665	9665	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9666	9666	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9667	9667	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9668	9668	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9669	9669	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9670	9670	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9671	9671	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9672	9672	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9673	9673	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9674	9674	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9675	9675	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9676	9676	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9677	9677	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9678	9678	^\d{4}[01]	2	0	0	1
+9679	9679	^\d{4}[01]	2	0	0	1
+9680	9680	^\d{4}[01]	2	0	0	1
+9681	9681	^\d{4}[01]	2	0	0	1
+9682	9682	^\d{4}[01]	2	0	0	1
+9683	9683	^\d{4}[01]	2	0	0	1
+9684	9684	^\d{4}[01]	2	0	0	1
+9685	9685	^\d{4}[01]	2	0	0	1
+9686	9686	^\d{4}[01]	2	0	0	1
+9687	9687	^\d{4}[01]	2	0	0	1
+9688	9688	^\d{4}[01]	2	0	0	1
+9689	9689	^\d{4}[01]	2	0	0	1
+9690	9690	^\d{4}[01]	2	0	0	1
+9691	9691	^\d{4}[01]	2	0	0	1
+9692	9692	^\d{4}[01]	2	0	0	1
+9693	9693	^\d{4}[01]	2	0	0	1
+9694	9694	^\d{4}[01]	2	0	0	1
+9695	9695	^\d{4}[01]	2	0	0	1
+9696	9696	^\d{4}[01]	2	0	0	1
+9697	9697	^\d{4}[01]	2	0	0	1
+9698	9698	^\d{4}[01]	2	0	0	1
+9699	9699	^\d{4}[01]	2	0	0	1
+9700	9700	^\d{4}[01]	2	0	0	1
+9701	9701	^\d{4}[01]	2	0	0	1
+9702	9702	^\d{4}[01]	2	0	0	1
+9703	9703	^\d{4}[01]	2	0	0	1
+9704	9704	^\d{4}[01]	2	0	0	1
+9705	9705	^\d{4}[01]	2	0	0	1
+9706	9706	^\d{4}[01]	2	0	0	1
+9707	9707	^\d{4}[01]	2	0	0	1
+9708	9708	^\d{4}[01]	2	0	0	1
+9709	9709	^\d{4}[01]	2	0	0	1
+9710	9710	^\d{4}[01]	2	0	0	1
+9711	9711	^\d{4}[01]	2	0	0	1
+9712	9712	^\d{4}[01]	2	0	0	1
+9713	9713	^\d{4}[01]	2	0	0	1
+9714	9714	^\d{4}[01]	2	0	0	1
+9715	9715	^\d{4}[01]	2	0	0	1
+9716	9716	^\d{4}[01]	2	0	0	1
+9717	9717	^\d{4}[01]	2	0	0	1
+9718	9718	^\d{4}[01]	2	0	0	1
+9719	9719	^\d{4}[01]	2	0	0	1
+9720	9720	^\d{4}[01]	2	0	0	1
+9721	9721	^\d{4}[01]	2	0	0	1
+9722	9722	^\d{4}[01]	2	0	0	1
+9723	9723	^\d{4}[01]	2	0	0	1
+9724	9724	^\d{4}[01]	2	0	0	1
+9725	9725	^\d{4}[01]	2	0	0	1
+9726	9726	^\d{4}[01]	2	0	0	1
+9727	9727	^\d{4}[01]	2	0	0	1
+9728	9728	^\d{4}[01]	2	0	0	1
+9729	9729	^\d{4}[01]	2	0	0	1
+9730	9730	^\d{4}[01]	2	0	0	1
+9731	9731	^\d{4}[01]	2	0	0	1
+9732	9732	^\d{4}[01]	2	0	0	1
+9733	9733	^\d{4}[01]	2	0	0	1
+9734	9734	^\d{4}[01]	2	0	0	1
+9735	9735	^\d{4}[01]	2	0	0	1
+9736	9736	^\d{4}[01]	2	0	0	1
+9737	9737	^\d{4}[01]	2	0	0	1
+9738	9738	^\d{4}[01]	2	0	0	1
+9739	9739	^\d{4}[01]	2	0	0	1
+9740	9740	^\d{4}[01]	2	0	0	1
+9741	9741	^\d{4}[01]	2	0	0	1
+9742	9742	^\d{4}[01]	2	0	0	1
+9743	9743	^\d{4}[01]	2	0	0	1
+9744	9744	^\d{4}[01]	2	0	0	1
+9745	9745	^\d{4}[01]	2	0	0	1
+9746	9746	^\d{4}[01]	2	0	0	1
+9747	9747	^\d{4}[01]	2	0	0	1
+9748	9748	^\d{4}[01]	2	0	0	1
+9749	9749	^\d{4}[01]	2	0	0	1
+9750	9750	^\d{4}[01]	2	0	0	1
+9751	9751	^\d{4}[01]	2	0	0	1
+9752	9752	^\d{4}[01]	2	0	0	1
+9753	9753	^\d{4}[01]	2	0	0	1
+9754	9754	^\d{4}[01]	2	0	0	1
+9755	9755	^\d{4}[01]	2	0	0	1
+9756	9756	^\d{4}[01]	2	0	0	1
+9757	9757	^\d{4}[01]	2	0	0	1
+9758	9758	^\d{4}[01]	2	0	0	1
+9759	9759	^\d{4}[01]	2	0	0	1
+9760	9760	^\d{4}[01]	2	0	0	1
+9761	9761	^\d{4}[01]	2	0	0	1
+9762	9762	^\d{4}[01]	2	0	0	1
+9763	9763	^\d{4}[01]	2	0	0	1
+9764	9764	^\d{4}[01]	2	0	0	1
+9765	9765	^\d{4}[01]	2	0	0	1
+9766	9766	^\d{4}[01]	2	0	0	1
+9767	9767	^\d{4}[01]	2	0	0	1
+9768	9768	^\d{4}[01]	2	0	0	1
+9769	9769	^\d{4}[01]	2	0	0	1
+9770	9770	^\d{4}[01]	2	0	0	1
+9771	9771	^\d{4}[01]	2	0	0	1
+9772	9772	^\d{4}[01]	2	0	0	1
+9773	9773	^\d{4}[01]	2	0	0	1
+9774	9774	^\d{4}[01]	2	0	0	1
+9775	9775	^\d{4}[01]	2	0	0	1
+9776	9776	^\d{4}[01]	2	0	0	1
+9777	9777	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9778	9778	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9779	9779	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9780	9780	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9781	9781	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9782	9782	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9783	9783	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9784	9784	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9785	9785	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9786	9786	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9787	9787	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9788	9788	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9789	9789	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9790	9790	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9791	9791	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9792	9792	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9793	9793	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9794	9794	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9795	9795	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9796	9796	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9797	9797	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9798	9798	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9799	9799	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9800	9800	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9801	9801	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9802	9802	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9803	9803	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9804	9804	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9805	9805	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9806	9806	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9807	9807	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9808	9808	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9809	9809	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9810	9810	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9811	9811	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9812	9812	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9813	9813	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9814	9814	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9815	9815	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9816	9816	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9817	9817	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9818	9818	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9819	9819	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9820	9820	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9821	9821	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9822	9822	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9823	9823	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9824	9824	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9825	9825	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9826	9826	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9827	9827	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9828	9828	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9829	9829	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9830	9830	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9831	9831	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9832	9832	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9833	9833	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9834	9834	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9835	9835	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9836	9836	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9837	9837	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9838	9838	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9839	9839	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9840	9840	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9841	9841	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9842	9842	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9843	9843	^\d{4}[01]	2	0	0	1
+9844	9844	^\d{4}[01]	2	0	0	1
+9845	9845	^\d{4}[01]	2	0	0	1
+9846	9846	^\d{4}[01]	2	0	0	1
+9847	9847	^\d{4}[01]	2	0	0	1
+9848	9848	^\d{4}[01]	2	0	0	1
+9849	9849	^\d{4}[01]	2	0	0	1
+9850	9850	^\d{4}[01]	2	0	0	1
+9851	9851	^\d{4}[01]	2	0	0	1
+9852	9852	^\d{4}[01]	2	0	0	1
+9853	9853	^\d{4}[01]	2	0	0	1
+9854	9854	^\d{4}[01]	2	0	0	1
+9855	9855	^\d{4}[01]	2	0	0	1
+9856	9856	^\d{4}[01]	2	0	0	1
+9857	9857	^\d{4}[01]	2	0	0	1
+9858	9858	^\d{4}[01]	2	0	0	1
+9859	9859	^\d{4}[01]	2	0	0	1
+9860	9860	^\d{4}[01]	2	0	0	1
+9861	9861	^\d{4}[01]	2	0	0	1
+9862	9862	^\d{4}[01]	2	0	0	1
+9863	9863	^\d{4}[01]	2	0	0	1
+9864	9864	^\d{4}[01]	2	0	0	1
+9865	9865	^\d{4}[01]	2	0	0	1
+9866	9866	^\d{4}[01]	2	0	0	1
+9867	9867	^\d{4}[01]	2	0	0	1
+9868	9868	^\d{4}[01]	2	0	0	1
+9869	9869	^\d{4}[01]	2	0	0	1
+9870	9870	^\d{4}[01]	2	0	0	1
+9871	9871	^\d{4}[01]	2	0	0	1
+9872	9872	^\d{4}[01]	2	0	0	1
+9873	9873	^\d{4}[01]	2	0	0	1
+9874	9874	^\d{4}[01]	2	0	0	1
+9875	9875	^\d{4}[01]	2	0	0	1
+9876	9876	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9877	9877	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9878	9878	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9879	9879	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9880	9880	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9881	9881	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9882	9882	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9883	9883	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9884	9884	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9885	9885	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9886	9886	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9887	9887	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9888	9888	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9889	9889	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9890	9890	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9891	9891	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9892	9892	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9893	9893	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9894	9894	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9895	9895	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9896	9896	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9897	9897	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9898	9898	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9899	9899	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9900	9900	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9901	9901	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9902	9902	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9903	9903	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9904	9904	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9905	9905	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9906	9906	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9907	9907	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9908	9908	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9909	9909	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9910	9910	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9911	9911	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9912	9912	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9913	9913	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9914	9914	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9915	9915	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9916	9916	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9917	9917	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9918	9918	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9919	9919	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9920	9920	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9921	9921	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9922	9922	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9923	9923	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9924	9924	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9925	9925	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9926	9926	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9927	9927	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9928	9928	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9929	9929	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9930	9930	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9931	9931	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9932	9932	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9933	9933	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9934	9934	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9935	9935	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9936	9936	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9937	9937	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9938	9938	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9939	9939	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9940	9940	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9941	9941	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+9942	9942	^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+9943	9943	^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+9944	9944	\x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,}	2	0	0	1
+9945	9945	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+9946	9946	appid\x3a\s+2	2	0	0	1
+9947	9947	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+9948	9948	\x22mining\x2E(subscribe|authorize)\x22	2	0	0	1
+9949	9949	^\s*(<var>[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start	2	0	0	1
+9950	9950	^\/api\/(bit|lite)coin\/balance\/	2	0	0	1
+9951	9951	miner[^a-z]	2	0	0	1
+9952	9952	(\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22)	2	0	0	1
+9953	9953	(\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22)	2	0	0	1
+9954	9954	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+9955	9955	\/tmp\/[^\/]+\.swf$	2	0	0	1
+9956	9956	name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22	2	0	0	1
+9957	9957	name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22	2	0	0	1
+9958	9958	=[0-9a-f]{8}\.jar/H	2	0	0	1
+9959	9959	^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\?	2	0	0	1
+9960	9960	^\/[a-z0-9]{32}\?s=1$	2	0	0	1
+9961	9961	^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))	2	0	0	1
+9962	9962	^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>]	2	0	0	1
+9963	9963	^(mous)?\.class	2	0	0	1
+9964	9964	\/chrome\/google_chrome_(update|installer)\.exe$	2	0	0	1
+9965	9965	^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+9966	9966	^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P	2	0	0	1
+9967	9967	findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$	2	0	0	1
+9968	9968	^[^=]+[^\x22\x27\x3b]*?(<q>[\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m	2	0	0	1
+9969	9969	\.php\?cashe=\d+$	2	0	0	1
+9970	9970	\.jar\?m=[1-2]$	2	0	0	1
+9971	9971	\.pdf\?p=1&s=[1-2]$	2	0	0	1
+9972	9972	^Host\x3a [^\r\n]+?\.bit\r\n$/Hmi	2	0	0	1
+9973	9973	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[^\/\.]+$	2	0	0	1
+9974	9974	\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$	2	0	0	1
+9975	9975	\/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+9976	9976	\/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+9977	9977	\/tds\/[a-f0-9]{32}$	2	0	0	1
+9978	9978	^[a-f0-9]{32}[\x22\x27]	2	0	0	1
+9979	9979	Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi	2	0	0	1
+9980	9980	(\.\.\/)+kboxwww\/tmp\/	2	0	0	1
+9981	9981	^(<var>.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22	2	0	0	1
+9982	9982	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+9983	9983	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+9984	9984	\/\?[0-9a-f]{60,66}[\;\d\x2c]*$	2	0	0	1
+9985	9985	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15}	2	0	0	1
+9986	9986	\/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php	2	0	0	1
+9987	9987	debugenableplugins=[a-zA-Z0-9]+?\x3b	2	0	0	1
+9988	9988	^\/[a-z0-9]+\/load\.php$	2	0	0	1
+9989	9989	^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H	2	0	0	1
+9990	9990	^\/xteas\/code$	2	0	0	1
+9991	9991	\/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash=	2	0	0	1
+9992	9992	=\w{8}\.pdf/Hi	2	0	0	1
+9993	9993	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[A-Za-z0-9]+$	2	0	0	1
+9994	9994	^User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$/H	2	0	0	1
+9995	9995	^Host\x3a\s.+\.in\r?$/Hmi	2	0	0	1
+9996	9996	name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22	2	0	0	1
+9997	9997	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+9998	9998	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+9999	9999	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+10000	10000	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+10001	10001	^Location\x3a\x20[a-f0-9]{32}\/e\.html\r$/Hm	2	0	0	1
+10002	10002	^\/(v(1\/buckets\/default\/ext-5dkJ19tFufpMZjVJbsWCiqDcclDw\/records|4\/links\/activity-stream|3\/links\/ping-centre)|gp\/(aj\/private\/reviewsGallery\/get-(application-resource|image-gallery-asset)s|cerberus\/gv)|en-us\/(p\/(onerf\/MeSilentPassport|book-2\/8MCPZJJCC98C)|store\/api\/checkproductinwishlist)|wp-(content\/themes\/am43-6\/dist\/records|includes\/js\/script\/indigo-migrate)|api2\/json\/(cluster\/(resource|task)s|access\/ticket))	2	0	0	1
+10003	10003	^(\/updates|\/license\/eula|\/docs\/office|\/software-activation)	2	0	0	1
+10004	10004	^GET\s(\/((v(i-assets\/static-asset|[12]\/preference)|idcta\/translation)s|ads\/google))	2	0	0	1
+10005	10005	^([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9_\/\+\-]{2}==|[a-zA-Z0-9_\/\+\-]{3}=|[a-zA-Z0-9_\/\+\-]{4})\x3b	2	0	0	1
+10006	10006	^(\/track|\/api\/v1\/survey\/embed|\/svc\/weather\/v2)	2	0	0	1
+10007	10007	\/api\/v1\/user\/(512|124)\/avatar	2	0	0	1
+10008	10008	^GET [^\r\n]{0,256}&parent_request_id=([A-Za-z0-9_\/\+\-%]{128,1024})={0,2}[^\r\n]{0,256} HTTP\/1\.[01]	2	0	0	1
+10009	10009	^\/v1\/(queue|profile|docs\/wsdl|pull)	2	0	0	1
+10010	10010	^GET\s(\/USAT-GUP\/user\/|\/entertainment\/|\/entertainment\/navdd-q1a2z3Z6TET4gv2PNfXpaJAniOzOajK7M\.min\.json|\/global-q1a2z3C4M2nNlQYzWhCC0oMSEFjQbW1KA\.min\.json|\/life\/|\/news\/weather\/|\/opinion\/|\/sports\/|\/sports\/navdd-q1a2z3JHa8KzCRLOQAnDoVywVWF7UwxJs\.min\.json|\/tangstatic\/js\/main-q1a2z3b37df2b1\.min\.js|\/tangstatic\/js\/pbjsandwich-q1a2z300ab4198\.min\.js|\/tangstatic\/js\/pg-q1a2z3bbc110a4\.min\.js|\/tangsvc\/pg\/3221104001\/|\/tangsvc\/pg\/5059005002\/|\/tangsvc\/pg\/5066496002\/|\/tech\/|\/travel\/)	2	0	0	1
+10011	10011	^POST\s(\/v4\/links\/check-activity\/check|\/v1\/stats|\/gql|\/api2\/json\/check\/ticket|\/1.5\/95648064\/storage\/history|\/1.5\/95648064\/storage\/tabs|\/u\/0\/_\/og\/botguard\/get|\/ev\/prd001001|\/ev\/ext001001|\/gp\/aw\/ybh\/handlers|\/v3\/links\/ping-beat\/check)	2	0	0	1
+10012	10012	^[^\n]*[\x00-\x08\x0e-\x1f]	2	0	0	1
+10013	10013	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10014	10014	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10015	10015	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10016	10016	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10017	10017	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10018	10018	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(IMCON|IMC)[\s\w,/-]*(//(X1|MR))	2	0	0	1
+10019	10019	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+10020	10020	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10021	10021	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10022	10022	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10023	10023	(TOP\s|T)(SECRET|S)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10024	10024	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+10025	10025	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10026	10026	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10027	10027	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10028	10028	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10029	10029	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10030	10030	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10031	10031	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10032	10032	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10033	10033	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10034	10034	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10035	10035	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10036	10036	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10037	10037	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10038	10038	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+10039	10039	\[\[\d{1,3}\,\[\\\"\w\\\"\,\\\"[email protected].+\\\"\,\\\"	2	0	0	1
+10040	10040	User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER	2	0	0	1
+10041	10041	\x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20)	2	0	0	1
+10042	10042	PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20)	2	0	0	1
+10043	10043	\x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\s*\x29\x3Aend\s+function\x3A	2	0	0	1
+10044	10044	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000	2	0	0	1
+10045	10045	filename\s*=\s*"WU_Details_.....\.zip	2	0	0	1
+10046	10046	filename\s*=\s*MySpace_document_[0-9]{5}\.zip	2	0	0	1
+10047	10047	filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22	2	0	0	1
+10048	10048	filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22	2	0	0	1
+10049	10049	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E	2	0	0	1
+10050	10050	MyValue=[a-f0-9]{32}	2	0	0	1
+10051	10051	\x0d\x0aUser-Agent\: 0\:0\:[^\n]{120}	2	0	0	1
+10052	10052	User-Agent\: 0\:0\:[^\x0a|\x0d]{128}	2	0	0	1
+10053	10053	01E04581-4EEE-11D0-BFE9-00AA005B4383|AF604EFE-8897-11D1-B944-00A0C90312E1|7849596A-48EA-486E-8937-A2A3009F31A9|FBEB8A05-BEEE-4442-804E-409D6C4515E9|3050F391-98B5-11CF-BB82-00AA00BDCE0B|8EE42293-C315-11D0-8D6F-00A0C9A06E1F|2A6EB050-7F1C-11CE-BE57-00AA0051FE20|510A4910-7F1C-11CE-BE57-00AA0051FE20|6D36CE10-7F1C-11CE-BE57-00AA0051FE20|860D28D0-8BF4-11CE-BE59-00AA0051FE20|9478F640-7F1C-11CE-BE57-00AA0051FE20|B0516FF0-7F1C-11CE-BE57-00AA0051FE20|D99F7670-7F1A-11CE-BE57-00AA0051FE20	2	0	0	1
+10054	10054	(\.\.\/){1,}	2	0	0	1
+10055	10055	\/cgi-bin\/pr2\.cgi\?[a-zA-Z0-9]{172}	2	0	0	1
+10056	10056	03D9F3F2-B0E3-11D2-B081-006008039BF0|860BB310-5D01-11D0-BD3B-00A0C911CE86|E0F158E1-CB04-11D0-BD4E-00A0C911CE86|33D9A761-90C8-11D0-BD43-00A0C911CE86|4EFE2452-168A-11D1-BC76-00C04FB9453B|33D9A760-90C8-11D0-BD43-00A0C911CE86|33D9A762-90C8-11D0-BD43-00A0C911CE86|083863F1-70DE-11D0-BD40-00A0C911CE86|18AB439E-FCF4-40D4-90DA-F79BAA3B0655|31087270-D348-432C-899E-2D2F38FF29A0|D2923B86-15F1-46FF-A19A-DE825F919576|FD78D554-4C6E-11D0-970D-00A0C9191601|52CA3BCF-3B9B-419E-A3D6-5D28C0B0B50C	2	0	0	1
+10057	10057	4FAAB301-CEF6-477C-9F58-F601039E9B78|6CBE0382-A879-4D2A-8EC3-1F2A43611BA8|F117831B-C052-11D1-B1C0-00C04FC2F3EF|3050F667-98B5-11CF-BB82-00AA00BDCE0B|1AA06BA1-0E88-11D1-8391-00C04FBD7C09|F28D867A-DDB1-11D3-B8E8-00A0C981AEEB|6B7F1602-D44C-11D0-A7D9-AE3D17000000|7007ACCF-3202-11D1-AAD2-00805FC1270E|992CFFA0-F557-101A-88EC-00DD010CCC48|00020420-0000-0000-C000-000000000046|0006F02A-0000-0000-C000-000000000046|ABBA001B-3075-11D6-88A4-00B0D0200F88|CE292861-FC88-11D0-9E69-00C04FD7C15B	2	0	0	1
+10058	10058	php\?r=\d+&p=	2	0	0	1
+10059	10059	\/socks\.php\?name=[^&]+&port=\d{1,5}$	2	0	0	1
+10060	10060	SELECT.+FROM	2	0	0	1
+10061	10061	UNION\s+SELECT	2	0	0	1
+10062	10062	INSERT.+INTO	2	0	0	1
+10063	10063	DELETE.+FROM	2	0	0	1
+10064	10064	ASCII\(.+SELECT	2	0	0	1
+10065	10065	UPDATE.+SET	2	0	0	1
+10066	10066	EEED4C20-7F1B-11CE-BE57-00AA0051FE20|C7B6C04A-CBB5-11D0-BB4C-00C04FC2F410|85BBD920-42A0-1069-A2E4-08002B30309D|E846F0A0-D367-11D1-8286-00A0C9231C29|B4B3AECB-DFD6-11D1-9DAA-00805F85CFE3|ECABB0BF-7F19-11D2-978E-0000F8757E2A|466D66FA-9616-11D2-9342-0000F875AE17|67DCC487-AA48-11D1-8F4F-00C04FB611C7|00022613-0000-0000-C000-000000000046|D2D588B5-D081-11D0-99E0-00C04FC2F8EC|5D08B586-343A-11D0-AD46-00C04FD8FDFF|CC7BFB42-F175-11D1-A392-00E0291F3959|CC7BFB43-F175-11D1-A392-00E0291F3959|3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5	2	0	0	1
+10067	10067	BC5F1E51-5110-11D1-AFF5-006097C9A284|F27CE930-4CA3-11D1-AFF2-006097C9A284|3BC4F3A7-652A-11D1-B4D4-00C04FC2DB8D|ECABAFC2-7F19-11D2-978E-0000F8757E2A|283807B8-2C60-11D0-A31D-00AA00B92C03|250770F3-6AF2-11CF-A915-008029E31FCD|D24D4453-1F01-11D1-8E63-006097D2DF48|03CB9467-FD9D-42A8-82F9-8615B4223E6E|598EBA02-B49A-11D2-A1C1-00609778EA66|8FE7E181-BB96-11D2-A1CB-00609778EA66|4CFB5280-800B-4367-848F-5A13EBF27F1D|B3E0E785-BD78-4366-9560-B7DABE2723BE|208DD6A3-E12B-4755-9607-2E39EF84CFC5	2	0	0	1
+10068	10068	6E227101-F799-11CF-9227-00AA00A1EB95|7057E952-BD1B-11D1-8919-00C04FC2C836|7007ACC7-3202-11D1-AAD2-00805FC1270E|4622AD11-FF23-11D0-8D34-00A0C90F2719|98CB4060-D3E7-42A1-8D65-949D34EBFE14|47C6C527-6204-4F91-849D-66E234DEE015|35CEC8A3-2BE6-11D2-8773-92E220524153|730F6CDC-2C86-11D2-8773-92E220524153|2C10A98F-D64F-43B4-BED6-DD0E1BF2074C|6F9F3481-84DD-4B14-B09C-6B4288ECCDE8|8E26BFC1-AFD6-11CF-BFFC-00AA003CFDFC|F0975AFE-5C7F-11D2-8B74-00104B2AFB41	2	0	0	1
+10069	10069	index\.php\?q=(uggc|jjj|http|www|aHR0c|d3d3)	2	0	0	1
+10070	10070	(file=\|.+\|)	2	0	0	1
+10071	10071	SELECT.+FROM	2	0	0	1
+10072	10072	UNION\s+SELECT	2	0	0	1
+10073	10073	INSERT.+INTO	2	0	0	1
+10074	10074	DELETE.+FROM	2	0	0	1
+10075	10075	ASCII\(.+SELECT	2	0	0	1
+10076	10076	UPDATE.+SET	2	0	0	1
+10077	10077	SELECT.+FROM	2	0	0	1
+10078	10078	UNION\s+SELECT	2	0	0	1
+10079	10079	INSERT.+INTO	2	0	0	1
+10080	10080	DELETE.+FROM	2	0	0	1
+10081	10081	ASCII\(.+SELECT	2	0	0	1
+10082	10082	UPDATE.+SET	2	0	0	1
+10083	10083	SELECT.+FROM	2	0	0	1
+10084	10084	UNION\s+SELECT	2	0	0	1
+10085	10085	INSERT.+INTO	2	0	0	1
+10086	10086	DELETE.+FROM	2	0	0	1
+10087	10087	ASCII\(.+SELECT	2	0	0	1
+10088	10088	UPDATE.+SET	2	0	0	1
+10089	10089	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+10090	10090	filename=\x22Facebook_(Password|Support|Document)_[A-Z0-9]{4,7}\.zip\x22	2	0	0	1
+10091	10091	\x2FU3D\x2FLength\x20172[0-5][0-9]{2}	2	0	0	1
+10092	10092	\/000[a-z][0-9]{3}\x2Eso	2	0	0	1
+10093	10093	\/000[a-z][0-9]{3}\x2Eexe	2	0	0	1
+10094	10094	UPDATE.+SET	2	0	0	1
+10095	10095	PDF-.+[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F]	2	0	0	1
+10096	10096	^FOLD\s[^\n]{256}	2	0	0	1
+10097	10097	^FOLD\s+\/	2	0	0	1
+10098	10098	^Username\:[^\n]{100}	2	0	0	1
+10099	10099	^http\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+10100	10100	^http\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+10101	10101	^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\}	2	0	0	1
+10102	10102	^file\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+10103	10103	\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JBIG2Decode](J|#4A)(B|#42)(I|#49)(G|#47)(2|#32)(D|#44)(e|#65)(c|#63)(o|#6F)(d|#64)(e|#65)	2	0	0	1
+10104	10104	OS 4_[0-3]_[1-4] like/H	2	0	0	1
+10105	10105	[a-f0-9]{16}$	2	0	0	1
+10106	10106	mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+10107	10107	(/joomla/admin|/joomla/administrator|/joomla/manage|/joomla/administration)	2	0	0	1
+10108	10108	\x3A\x02\x5B(Atk33|Exploiting|Finished|GOOGLE.*|HTTP.{0,8}|PKS-SCAN.{0,20}|Results|RSH|SCAN|TCP.{0,8}|UDP.{0,8}|v6.{0,12}|VERSION)\x5D\x02	2	0	0	1
+10109	10109	\x3A\x02(Alvo dos Pacotes|Conectando-se em|M.dia de envio|Tempo.*|Total .*)\x02	2	0	0	1
+10110	10110	NICK\x20\S+\x0AUSER\x20\S+localhost\x20localhost\x20\x3A	2	0	0	1
+10111	10111	\x3a.4\x7c.12.\x3a.4	2	0	0	1
+10112	10112	(cheguei gazelas|meh que tao|Status|Tempo|Total pacotes|Total bytes|M?dia de envio|portas? aberta)	2	0	0	1
+10113	10113	keepalive([0-9]{4}|\x7c[0-9]{4})	2	0	0	1
+10114	10114	User-Agent\x3a[^\n]+sbu-hb-	2	0	0	1
+10115	10115	User-Agent\:[^\n]+Peer Points/iH	2	0	0	1
+10116	10116	User-Agent\:[^\n]+zbu-hb-/Hi	2	0	0	1
+10117	10117	User-Agent\:[^\n]+HSN/iH	2	0	0	1
+10118	10118	User-Agent\:[^\n]+Wildtangent/iH	2	0	0	1
+10119	10119	^RMD\s+\x2f$	2	0	0	1
+10120	10120	User-Agent\x3A[^\n]+TheWorld/H	2	0	0	1
+10121	10121	^Max-dotdot[\s\r\n]*\d{3,}	2	0	0	1
+10122	10122	^Authorization\x3a Basic\s+=	2	0	0	1
+10123	10123	^Authorization\x3a Basic\s+=	2	0	0	1
+10124	10124	Host\x3a\s[a-z]{16}\.ru/H	2	0	0	1
+10125	10125	CREATE.+ENDPOINT	2	0	0	1
+10126	10126	\/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir=	2	0	0	1
+10127	10127	MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w	2	0	0	1
+10128	10128	MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w	2	0	0	1
+10129	10129	\x00[0-9]{4,7}\x02co\x00	2	0	0	1
+10130	10130	\x2fsogou(config)?\x2f	2	0	0	1
+10131	10131	\/\d{8,}\/\d{4,}\/\d{4,}\.jsp	2	0	0	1
+10132	10132	adv\d+\.php	2	0	0	1
+10133	10133	a=\%[0-9a-fA-F]{2}\&b	2	0	0	1
+10134	10134	\Wcustomer\slist(s)?\W	2	0	0	1
+10135	10135	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+10136	10136	\Wcredit\shistor(y|ies)\W	2	0	0	1
+10137	10137	\Wannual\sincome(s)?\W	2	0	0	1
+10138	10138	\Wpayment\shistory\W	2	0	0	1
+10139	10139	\Waccount\sbalance(s)?\W	2	0	0	1
+10140	10140	\Wappraisal(s)?\W	2	0	0	1
+10141	10141	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+10142	10142	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+10143	10143	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+10144	10144	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+10145	10145	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+10146	10146	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+10147	10147	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+10148	10148	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+10149	10149	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+10150	10150	\Winternal\suse\sonly\W	2	0	0	1
+10151	10151	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+10152	10152	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+10153	10153	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+10154	10154	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+10155	10155	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+10156	10156	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+10157	10157	(//)\Wconfidential[^\w/]	2	0	0	1
+10158	10158	(//)\Wrestricted[^\w/]	2	0	0	1
+10159	10159	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+10160	10160	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+10161	10161	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+10162	10162	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+10163	10163	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+10164	10164	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+10165	10165	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+10166	10166	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+10167	10167	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+10168	10168	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+10169	10169	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+10170	10170	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+10171	10171	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+10172	10172	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+10173	10173	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10174	10174	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10175	10175	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10176	10176	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10177	10177	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10178	10178	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+10179	10179	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10180	10180	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+10181	10181	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+10182	10182	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10183	10183	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10184	10184	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10185	10185	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10186	10186	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10187	10187	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10188	10188	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10189	10189	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+10190	10190	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+10191	10191	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10192	10192	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10193	10193	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10194	10194	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10195	10195	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+10196	10196	(//)\Wrestricted[^\w/]	2	0	0	1
+10197	10197	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+10198	10198	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+10199	10199	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+10200	10200	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+10201	10201	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+10202	10202	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+10203	10203	\Winternal\suse\sonly\W	2	0	0	1
+10204	10204	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+10205	10205	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+10206	10206	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+10207	10207	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+10208	10208	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+10209	10209	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+10210	10210	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+10211	10211	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+10212	10212	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+10213	10213	\Wappraisal(s)?\W	2	0	0	1
+10214	10214	\Waccount\sbalance(s)?\W	2	0	0	1
+10215	10215	\Wannual\sincome(s)?\W	2	0	0	1
+10216	10216	\Wcredit\shistor(y|ies)\W	2	0	0	1
+10217	10217	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+10218	10218	\Wcustomer\slist(s)?\W	2	0	0	1
+10219	10219	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+10220	10220	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+10221	10221	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+10222	10222	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+10223	10223	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+10224	10224	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+10225	10225	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+10226	10226	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+10227	10227	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+10228	10228	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+10229	10229	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+10230	10230	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+10231	10231	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+10232	10232	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10233	10233	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10234	10234	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10235	10235	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10236	10236	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10237	10237	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+10238	10238	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10239	10239	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+10240	10240	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+10241	10241	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10242	10242	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10243	10243	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10244	10244	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10245	10245	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10246	10246	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10247	10247	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10248	10248	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+10249	10249	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+10250	10250	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10251	10251	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10252	10252	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10253	10253	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10254	10254	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+10255	10255	(//)\Wrestricted[^\w/]	2	0	0	1
+10256	10256	(//)\Wconfidential[^\w/]	2	0	0	1
+10257	10257	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+10258	10258	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+10259	10259	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+10260	10260	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+10261	10261	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+10262	10262	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+10263	10263	\Winternal\suse\sonly\W	2	0	0	1
+10264	10264	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+10265	10265	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+10266	10266	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+10267	10267	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+10268	10268	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+10269	10269	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+10270	10270	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+10271	10271	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+10272	10272	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+10273	10273	\Wappraisal(s)?\W	2	0	0	1
+10274	10274	\Waccount\sbalance(s)?\W	2	0	0	1
+10275	10275	\Wpayment\shistory\W	2	0	0	1
+10276	10276	\Wannual\sincome(s)?\W	2	0	0	1
+10277	10277	\Wcredit\shistor(y|ies)\W	2	0	0	1
+10278	10278	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+10279	10279	\Wcustomer\slist(s)?\W	2	0	0	1
+10280	10280	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+10281	10281	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+10282	10282	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+10283	10283	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+10284	10284	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+10285	10285	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+10286	10286	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+10287	10287	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+10288	10288	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+10289	10289	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+10290	10290	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+10291	10291	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+10292	10292	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+10293	10293	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10294	10294	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10295	10295	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10296	10296	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10297	10297	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10298	10298	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+10299	10299	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10300	10300	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+10301	10301	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+10302	10302	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10303	10303	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10304	10304	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10305	10305	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10306	10306	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10307	10307	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10308	10308	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10309	10309	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+10310	10310	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+10311	10311	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10312	10312	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10313	10313	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10314	10314	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+10315	10315	User-Agent\x3a \d{6}\x0d\x0a/H	2	0	0	1
+10316	10316	(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/s\/l\/firstping	2	0	0	1
+10317	10317	\.dyndns\.((biz|info|org|tv))\x0d\x0a/iH	2	0	0	1
+10318	10318	\.dyndns-((at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work))\.com\x0d\x0a/iH	2	0	0	1
+10319	10319	\.jpg\?t\x3d\d\.\d	2	0	0	1
+10320	10320	[0-9]{1,16}[a-f]{1,16}[0-9]{1,16}$	2	0	0	1
+10321	10321	^Content-Length\x3a\s*-\d+	2	0	0	1
+10322	10322	\W[0-9]{5}\.jar	2	0	0	1
+10323	10323	machine_id={[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+}	2	0	0	1
+10324	10324	[0-9]{1,8}[a-f]{1,8}[0-9]{1,8}$	2	0	0	1
+10325	10325	^[a-z0-9]{6}..\x00\x00	2	0	0	1
+10326	10326	^[a-z0-9]{7}..\x00\x00	2	0	0	1
+10327	10327	\sLOGIN\s[^\n]*?%	2	0	0	1
+10328	10328	({(\d+}[^\n]*?\sAUTH)|AUTH\s[^\n]*?{(\d+}))	2	0	0	1
+10329	10329	^\/\?[a-f0-9]{32}$	2	0	0	1
+10330	10330	[a-z]{9}[0-9]\.exe/H	2	0	0	1
+10331	10331	\.php\?inst_result=.+&hwid=	2	0	0	1
+10332	10332	^.{1,5}[a-f0-9]{100}	2	0	0	1
+10333	10333	\/scr5\.php\?p=\d+&id=\d	2	0	0	1
+10334	10334	^User-Agent\: App\d/Hmi	2	0	0	1
+10335	10335	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$	2	0	0	1
+10336	10336	\x00\x07[a-z]{7}\x02eu\x00	2	0	0	1
+10337	10337	REGISTER.{400}	2	0	0	1
+10338	10338	\/content\/jav\d?\.jar$	2	0	0	1
+10339	10339	^\/\?[a-f0-9]{32}$	2	0	0	1
+10340	10340	\.php\?[a-z]+=[a-f0-9]{64}&[^\?]+=[a-f0-9]{20}&	2	0	0	1
+10341	10341	^HTTP\x2f1\.[01] 200	2	0	0	1
+10342	10342	\.php\?[a-z]+=(([1-2][a-z]|3[0-9])\x3a){3,}([1-2][a-z]|3[0-9])&	2	0	0	1
+10343	10343	IP\:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+10344	10344	^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$	2	0	0	1
+10345	10345	\.(jpg|png|gif|cgi)\?pr=	2	0	0	1
+10346	10346	^\/\?affid=\d+&promo_type=\d+&promo_opt=\d+$	2	0	0	1
+10347	10347	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10348	10348	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10349	10349	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10350	10350	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10351	10351	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10352	10352	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10353	10353	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10354	10354	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10355	10355	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10356	10356	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10357	10357	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10358	10358	(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/.*perl\/fr\.pl	2	0	0	1
+10359	10359	\x2F[a-z\x2D]{60,120}.+\x2D\x2Ephp$	2	0	0	1
+10360	10360	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+10361	10361	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10362	10362	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+10363	10363	^\/[a-z0-9A-Z]{25,35}\/(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+(_[e7uxMhp1Kt]+)?|a2\.\.)Z(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+|a2\.\.)\/	2	0	0	1
+10364	10364	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$	2	0	0	1
+10365	10365	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$	2	0	0	1
+10366	10366	applet\/code=[\x22\x27](<val1>[a-zA-Z0-9]+)[a-z]\.(=val1)[a-z][\x22\x27][^\x3e]+\.jar[\x22\x27]	2	0	0	1
+10367	10367	code\x3D\x22[a-z]{4}\x2E[a-z]{4}\x22	2	0	0	1
+10368	10368	\x7B\x22e(v|x22\x2B\x22)(v|x22\x2B\x22|a)(a|v|x22\x2B\x22)[^\x5D]*?l\x22\x5D	2	0	0	1
+10369	10369	\x2Fgo\x2Ephp\x3Dd\x3D[a-f0-9]{16}$	2	0	0	1
+10370	10370	^[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}=	2	0	0	1
+10371	10371	\.php\?\w{2,9}\=(0[0-9a-b]|3[0-9]){5}\&\w{3,9}\=(3[0-9a-f]|4[0-9a-f])\&\w{3,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{3,9}\=(0[0-9a-b]{1,8})00020002$	2	0	0	1
+10372	10372	^\d+?.\x00\x00\x00	2	0	0	1
+10373	10373	\/[0-9a-f]{32}\.jar$	2	0	0	1
+10374	10374	\/[a-f0-9]{5,}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+10375	10375	^[^OGHPDTCMLUVRBAS]	2	0	0	1
+10376	10376	&s=\{[A-Z0-9]{8}-([A-Z0-9]{4}-){3}[A-Z0-9]{12}\}&w=(\d{1,2}\.){2}\d{1,2}&b=(32|64)$/Pi	2	0	0	1
+10377	10377	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$	2	0	0	1
+10378	10378	AjaxHandler\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+10379	10379	DELETE.+FROM	2	0	0	1
+10380	10380	UNION.+SELECT	2	0	0	1
+10381	10381	UPDATE.+SET	2	0	0	1
+10382	10382	ASCII\(.+SELECT	2	0	0	1
+10383	10383	DELETE.+FROM	2	0	0	1
+10384	10384	INSERT.+INTO	2	0	0	1
+10385	10385	UNION\s+SELECT	2	0	0	1
+10386	10386	SELECT.+FROM	2	0	0	1
+10387	10387	UPDATE.+SET	2	0	0	1
+10388	10388	ASCII\(.+SELECT	2	0	0	1
+10389	10389	DELETE.+FROM	2	0	0	1
+10390	10390	INSERT.+INTO	2	0	0	1
+10391	10391	SELECT.+FROM	2	0	0	1
+10392	10392	\/\S+\.cab	2	0	0	1
+10393	10393	User-Agent\x3a[^\n]+AskTB/iH	2	0	0	1
+10394	10394	(<p>[0-7]{3})(<d>[0-7]{3})(=p)(=d)([0-7]{3}){10}(<q>[0-7]{3})[0-7]{3}(<dot>[0-7]{3})[0-7]{3}(=dot)[0-7]{3}(=q)	2	0	0	1
+10395	10395	(<p>[0-7]{2,4})(<sep>[^0-7])(<d>((=p))[0-7]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-7]{2,4}(=sep)){10}(<q>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(<dot>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(=dot)(=sep)[0-7]{2,4}(=sep)(=q)	2	0	0	1
+10396	10396	^\/(p(a(rs|g)e|rocess)|(securit|quer)y|(defaul|abou)t|index|login|user)\.jsp\?[a-z]{2}\x3d[a-z0-9]{9}[A-F0-9]{9}$	2	0	0	1
+10397	10397	\/gate\.php\?cmd=urls$	2	0	0	1
+10398	10398	\/gate\.php\?cmd=getexe$	2	0	0	1
+10399	10399	^User-Agent\x3a[^\r\n]*?\sMSIE\s/H	2	0	0	1
+10400	10400	^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email)	2	0	0	1
+10401	10401	[^a-z0-9\-\.][a-z0-9]{32,48}\x02ru\x00\x00	2	0	0	1
+10402	10402	[^a-z0-9\-\.][a-z0-9]{32,48}\x04info\x00\x00	2	0	0	1
+10403	10403	[^a-z0-9\-\.][a-z0-9]{32,48}\x03biz\x00\x00	2	0	0	1
+10404	10404	\x2flogo\x2egif\x3f([0-9a-z]){5}\x3d\d{6,7}	2	0	0	1
+10405	10405	\.php\?label=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+10406	10406	\.php\?id=[A-F0-9]+\-[A-F0-9]+&v1=[A-F0-9]+&v2=[A-F0-9]+&q=[A-F0-9]+$	2	0	0	1
+10407	10407	^\/[A-Za-z0-9]{7,8}\/index\.html?$	2	0	0	1
+10408	10408	^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/js\.js$	2	0	0	1
+10409	10409	^Host\x3a\x20www\d+?\.[^\.]+?\.[^\.]+?\.([^\.]+\.)*?[a-z]{2,4}(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+10410	10410	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+10411	10411	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+10412	10412	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+10413	10413	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+10414	10414	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(refresh_template_name|user_name)[\r\n\s]*=>[\r\n\s]*|(refresh_template_name|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+10415	10415	^\/b\/(eve|opt|req)\/[\-f0-9A-F]{24}$	2	0	0	1
+10416	10416	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+10417	10417	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+10418	10418	\/[a-z]{1,6}\.html\?0\.[0-9]+[a-z]?$	2	0	0	1
+10419	10419	^[^\r\n]{15}\x5f[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}	2	0	0	1
+10420	10420	^Host\x3a[^\r\n]+\.passinggas\.net(\x3a\d{1,5})?\r?$/Hmi	2	0	0	1
+10421	10421	Server\: nginx/[a-zA-Z]	2	0	0	1
+10422	10422	^\x23\d\d\d\x2f\x21	2	0	0	1
+10423	10423	XPantivirus20\d{2}_v\d{6}\.exe	2	0	0	1
+10424	10424	\d\d\d\d\d\d\x0a	2	0	0	1
+10425	10425	PASS\s.*?\x0d\x0aNICK\s.*?\x0d\x0aUSER\s.*?\s\d\s\d\s\:\S	2	0	0	1
+10426	10426	[0-9A-Z]{240,}	2	0	0	1
+10427	10427	\x26[\x00-\xff]\x09\x00	2	0	0	1
+10428	10428	\x26[\x00-\xff]\x09\x00	2	0	0	1
+10429	10429	\.php\?id=\d+_[0-9a-f]{8}-[0-9a-f]+-[0-9a-f]{8}&cnt=	2	0	0	1
+10430	10430	OS 4_[0-3]_[1-4] like/H	2	0	0	1
+10431	10431	\.php\?f=\d+$	2	0	0	1
+10432	10432	Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H	2	0	0	1
+10433	10433	User-Agent\x3a We[a-z0-9]{4}\x0d\x0a/H	2	0	0	1
+10434	10434	\.php\?t=\d{2,7}$	2	0	0	1
+10435	10435	filename=.*facebook.*\.(rar|exe|zip)	2	0	0	1
+10436	10436	filename\s*[^\n]*?(UPS|United Parcel Service)[^\n]*?\.(rar|exe|zip)	2	0	0	1
+10437	10437	flash-[A-Z0-9]+-plugin\.[A-Z0-9]+\.exe	2	0	0	1
+10438	10438	\x2Fget\x5Fdr\x2Ephp\x3F(e|ini)\x3D	2	0	0	1
+10439	10439	MalvRem_\d{3,4}\.exe	2	0	0	1
+10440	10440	avdistr_\d{3,4}\.exe	2	0	0	1
+10441	10441	RunAV_\d{3,4}\.exe	2	0	0	1
+10442	10442	installer\.\d{4}\.exe	2	0	0	1
+10443	10443	\/stetement_id\.\d+\/	2	0	0	1
+10444	10444	^\/stream\?\d$	2	0	0	1
+10445	10445	loads2\.php\?r=[0-9]{2}\.[0-9]	2	0	0	1
+10446	10446	^[\x20-\x7e]{5}.{4}\x7c\x01	2	0	0	1
+10447	10447	(\/[a-z-]+)+\.php\?[a-z]+=[0-9]+[^\r\n]+HTTP\/1\.1	2	0	0	1
+10448	10448	&cid=\d+$	2	0	0	1
+10449	10449	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+10450	10450	^Content-Disposition\x3a\x20attachment\x3b\x20filename=[^\r\n]+?\.[a-z]{2,4}\.exe\r?$/Hmi	2	0	0	1
+10451	10451	^\/[a-z0-9A-Z]{15,35}\/((\d+[A-Z]){3}\d+|null)\/	2	0	0	1
+10452	10452	^Content-Length\x3a 2\d{2}\r?$/Hmi	2	0	0	1
+10453	10453	\/[a-z]{2,9}\.php\?([a-z0-9]{2,4}|[cktw])=[a-zA-Z0-9\x2b\x2f\x5c]{43,56}=?$	2	0	0	1
+10454	10454	\.((testdlls|threads|netstatp|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|stats|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\x|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r])	2	0	0	1
+10455	10455	\x2B\x22l\x22(\x3B|\x5D)	2	0	0	1
+10456	10456	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+10457	10457	^Referer\x3a[^\r\n]+\.swf/Hmi	2	0	0	1
+10458	10458	\.jpg\?id=\d+$	2	0	0	1
+10459	10459	^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){3,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$	2	0	0	1
+10460	10460	^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$	2	0	0	1
+10461	10461	^\/[a-z]{4}\.html?(\?[h-j]=\d+)?$	2	0	0	1
+10462	10462	^\/h[a-z]{3}\.html?$	2	0	0	1
+10463	10463	^\/[0-9]{8}\.html$	2	0	0	1
+10464	10464	^\/lists\/\d{15}(\d{5})?$	2	0	0	1
+10465	10465	^\/[a-z0-9]{2}\.jar$	2	0	0	1
+10466	10466	^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$	2	0	0	1
+10467	10467	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+10468	10468	^([a-zA-Z]{0,119}[0-9])(<var>[a-zA-Z0-9]{9,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+10469	10469	^\/0[a-z0-9]{13}$	2	0	0	1
+10470	10470	^\/[-a-zA-Z0-9_]{70,75}==?$	2	0	0	1
+10471	10471	^User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)/Hmi	2	0	0	1
+10472	10472	\/[a-f0-9]{32}\.eot$	2	0	0	1
+10473	10473	^\/0[a-z0-9]{13}$	2	0	0	1
+10474	10474	^\/([a-z0-9_-]{0,47}?[A-Z][a-z0-9_-]{0,46}?[A-Z])([A-Z0-9_-]{0,47}?[a-z][A-Z0-9_-]{0,46}?[a-z])([A-Za-z_-]{0,47}?[0-9][A-Za-z_-]{0,46}?[0-9])[A-Za-z0-9_-]{48}\.[a-z]{2,25}\d?\??	2	0	0	1
+10475	10475	^[\x00-\x0c]\x00\x00\x00[a-z0-9]{6,12}\x00	2	0	0	1
+10476	10476	^(\x62|\x1b)	2	0	0	1
+10477	10477	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])3((=sep)|\d)*?$	2	0	0	1
+10478	10478	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])4((=sep)|\d)*?$	2	0	0	1
+10479	10479	^(\x8b|\xf2)	2	0	0	1
+10480	10480	^[a-z0-9\x02-\x50]{100,}\x00\x00\x01\x00\x01$	2	0	0	1
+10481	10481	^Host\x3a\x20[^\r\n]+\.pw\r?$/Hmi	2	0	0	1
+10482	10482	GRANT.{1,5}TO	2	0	0	1
+10483	10483	^\/\?[a-f0-9]{32}$	2	0	0	1
+10484	10484	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])0((=sep)|\d)*?$	2	0	0	1
+10485	10485	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])1((=sep)|\d)*?$	2	0	0	1
+10486	10486	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])2((=sep)|\d)*?$	2	0	0	1
+10487	10487	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])5((=sep)|\d)*?$	2	0	0	1
+10488	10488	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])6((=sep)|\d)*?$	2	0	0	1
+10489	10489	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])7((=sep)|\d)*?$	2	0	0	1
+10490	10490	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])8((=sep)|\d)*?$	2	0	0	1
+10491	10491	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])9((=sep)|\d)*?$	2	0	0	1
+10492	10492	\/\w{1,2}\/\w{1,2}\.class$	2	0	0	1
+10493	10493	User-Agent\:[^\n]+zb-hb-/Hi	2	0	0	1
+10494	10494	^[^\r\n]*\/[0-9a-f]{78}\sHTTP	2	0	0	1
+10495	10495	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20((=refhost))/Hsi	2	0	0	1
+10496	10496	Host\x3a\x20(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+10497	10497	^\/index\.php\?[a-z]{8,80}=(\d{10,13}|\d{15,20})$	2	0	0	1
+10498	10498	Host\x3a\x20([0-9]{0,22}[a-z])([a-z]*?[0-9][a-z]{0,22}[0-9])[a-z0-9]{23}\x2e[^\x2e\r\n]+\x2e[^\x2e\r\n]/H	2	0	0	1
+10499	10499	&id=\d+(\x3a([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{10,}\.{0,2})?&catid=\d+&itemid=\d+$	2	0	0	1
+10500	10500	\/pd\.php\?id=[a-f0-9]+$	2	0	0	1
+10501	10501	^\x2Fsearch\x2F\x3F[a-z]{2,5}\x3D	2	0	0	1
+10502	10502	^Referer\x3a\x20http\x3a\/\/[^\x2f]+\/[a-z0-9]{6}\/[a-z0-9]{5}\.html\r?$/Hm	2	0	0	1
+10503	10503	^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text\/vbscript[\x22\x27])	2	0	0	1
+10504	10504	filename=\x22\d+?\x22/P	2	0	0	1
+10505	10505	^\/log\.php\?f=[0-1](\.[a-z]+)?$	2	0	0	1
+10506	10506	(<p>[0-9a-f]{2,4})(<sep>[\x2e\x2c\x3b\x3a])(<d>((=p))[0-9a-f]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-9a-f]{2,4}(=sep)){10}(<q>(((=p)|(=d)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(<dot>(((=p)|(=d)|(=q)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(=dot)(=sep)[0-9a-f]{2,4}(=sep)(=q)	2	0	0	1
+10507	10507	^Host\x3a[^\r\n]+craigslist\.org[^\r\n]{20,}\r\n/Hmi	2	0	0	1
+10508	10508	^Host\x3a[^\r\n]+\r\nConnection\x3a\x20Keep-Alive\r\n(\r\n)?$/H	2	0	0	1
+10509	10509	^Content-Length\x3a[^\r\n]*?\{([^\r\n]*java\.)[^\r\n]*\.ognl[^\r\n]*\}	2	0	0	1
+10510	10510	\/j[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+10511	10511	\/j[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+10512	10512	\/j[a-z]+?\?f[a-z]+[a-z]+$	2	0	0	1
+10513	10513	\/f[a-z]+?\?f[a-z]+[a-z]+$	2	0	0	1
+10514	10514	\.php$	2	0	0	1
+10515	10515	\.php$	2	0	0	1
+10516	10516	GET\s[^\r\n]*?(<name>\/[^\.\/]+\.html)\?id\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(:?\d{1,5})?\r\n	2	0	0	1
+10517	10517	^\d{4}\r$	2	0	0	1
+10518	10518	^Host\x3a\x20[^\r\n]+\-login\.id\-107sbtd9cbhsbt[^\r]+$/Hmi	2	0	0	1
+10519	10519	\/form\/submit\/$	2	0	0	1
+10520	10520	pch\.php\?f=\d+$	2	0	0	1
+10521	10521	hcp_vbs\.php\?f=\d+&d=\d+$	2	0	0	1
+10522	10522	\.php\?e=\w+&f=\w+$	2	0	0	1
+10523	10523	pch2.php?c=\d+$	2	0	0	1
+10524	10524	\.jar\?t=\d+&h=[^&]+$	2	0	0	1
+10525	10525	\/adp\d\.php\[0-9a-z]{2,6}	2	0	0	1
+10526	10526	attachment\x3b[^\r\n]*?info\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+10527	10527	attachment\x3b[^\r\n]*?contacts\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+10528	10528	attachment\x3b[^\r\n]*?calc\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+10529	10529	attachment\x3b[^\r\n]*?about\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+10530	10530	hhcp.php?c=[a-f0-9]{5}$	2	0	0	1
+10531	10531	attachment\x3b[^\r\n]*?readme\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+10532	10532	\/content\/jav\d?\.jar$	2	0	0	1
+10533	10533	\.php\?[^&]{1,8}=[a-f0-9]{16}[\x22\x27\x3b\x20\x0a\x0d]	2	0	0	1
+10534	10534	=.*[a-f].*$	2	0	0	1
+10535	10535	<title>[a-f0-9]{10}<\/title>	2	0	0	1
+10536	10536	=[0-9a-f]{8}\.jar/H	2	0	0	1
+10537	10537	\x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}$	2	0	0	1
+10538	10538	\x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}\x3A\x3A[0-9]{1,5}$	2	0	0	1
+10539	10539	display\x3Anone\x3B\x22\x3E[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}[^\r\n]*\x3C\x2Fpre\x3E\x3Cscript\x3E	2	0	0	1
+10540	10540	(\x3D|\x5B\x22])e\x22\x2B\x22va	2	0	0	1
+10541	10541	(\x3D|\x5B\x22])e\x22\x2B\x22v\x22\x2B\x22a	2	0	0	1
+10542	10542	(\x3D|\x5B\x22])ev\x22\x2B\x22a	2	0	0	1
+10543	10543	\x2B\x22al\x22(\x3B|\x5D)	2	0	0	1
+10544	10544	\x2B\x22val\x22(\x3B|\x5D)	2	0	0	1
+10545	10545	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jnlp(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+10546	10546	\.php\?[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}=	2	0	0	1
+10547	10547	^.{1,5}[a-f0-9]{100}	2	0	0	1
+10548	10548	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.eot(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+10549	10549	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jar(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+10550	10550	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.exe(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+10551	10551	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.php(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+10552	10552	\.php\?\w{2,8}\=(0[0-9a-b]|3[0-9]){5,32}\&\w{2,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{1,8}\=\d{2}\&\w{1,8}\=\w{1,8}\&\w{1,8}\=\w{1,8}$	2	0	0	1
+10553	10553	\/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php$	2	0	0	1
+10554	10554	\/news\/enter\/2012-1[0-2]-([0-2][0-9]|3[0-1])\.php	2	0	0	1
+10555	10555	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.txt(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+10556	10556	\/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php	2	0	0	1
+10557	10557	^\/[0-9a-f]{16}\/q\.php$	2	0	0	1
+10558	10558	^\/[0-9a-f]{16}\/q\.php	2	0	0	1
+10559	10559	^\/[0-9a-f]{32}\/ff\.php$	2	0	0	1
+10560	10560	^\/[0-9a-f]{32}\/ff\.php	2	0	0	1
+10561	10561	^\/[0-9a-f]{16}\/ff\.php$	2	0	0	1
+10562	10562	^\/[0-9a-f]{16}\/ff\.php	2	0	0	1
+10563	10563	^\/closest\/(([a-z]{1,16}[-_]){1,4}[a-z]{1,16}|[a-z0-9]{20,})\.php	2	0	0	1
+10564	10564	&jopa=\d+$	2	0	0	1
+10565	10565	\.php\?jnlp=[a-f0-9]{10}(,|$)	2	0	0	1
+10566	10566	\/[0-9a-f]{32}\/a\.php$	2	0	0	1
+10567	10567	\/[0-9a-f]{32}\/a\.php	2	0	0	1
+10568	10568	\/[0-9a-f]{16}\/a\.php$	2	0	0	1
+10569	10569	\/[0-9a-f]{16}\/a\.php	2	0	0	1
+10570	10570	\.php\?[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){5}&[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){10}&	2	0	0	1
+10571	10571	\/([^\/]+?\/[a-z]{2,16}[_-][a-z]{2,16}([_-][a-z]{2,16})*?|[a-z]{16,20}\/[a-z]{16,20}|closest\/[a-z0-9]+)\.php\?[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+&[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+$	2	0	0	1
+10572	10572	^([0-9a-z]{8})?(<p>[0-9a-z]{2})(<d>((=p))[0-9a-z]{2})(=p)(=d)([0-9a-z]{2}){10}(<q>[0-9a-z]{2})[0-9a-z]{2}(<dot>[0-9a-z]{2})[0-9a-z]{2}(=dot)[0-9a-z]{2}(=q)	2	0	0	1
+10573	10573	\.php\?[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){5}&[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){10}&	2	0	0	1
+10574	10574	\.php\?[^=]+=([^&](5[5-9a-e]|8[9a-e])){5}[^=]+=[^&]+&[^=]+=([^&](5[5-9a-f]|8[9a-e])){10}([^&]60[^&]60([^&](5[5-9a-f]|8[9a-e])){10})*?&	2	0	0	1
+10575	10575	\.php\?[^=]+=[^&]{10}&[^=]+=[^&]+&[^=]+=[^&]{20}((<sep>[^&]{2})(=sep)[^&]{20})*?&	2	0	0	1
+10576	10576	^\/[a-z0-9]{6,10}\/\?[0-9]{1,2}$	2	0	0	1
+10577	10577	@\x00i\x00m\x00p\x00o\x00r\x00t\x00\x20.{4,20}[^\x00\w\s.]	2	0	0	1
+10578	10578	^\s*?\(\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27]	2	0	0	1
+10579	10579	^\s*?\(\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27]	2	0	0	1
+10580	10580	^Referer\x3a[^\r\n]+\x3a\d+\/([a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,3}|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3})/Hm	2	0	0	1
+10581	10581	^\s*?value\s*\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27]	2	0	0	1
+10582	10582	^\s*?value\s*\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27]	2	0	0	1
+10583	10583	^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$	2	0	0	1
+10584	10584	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+10585	10585	Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=refhost)/Hsi	2	0	0	1
+10586	10586	^Host\x3a[^\r\n]*?\x3a((80(80)|312[89]))\d+\r$/Hm	2	0	0	1
+10587	10587	^(((<\/object>).)*?<param([^>]*?name\s*\s*?\x22bgcolor\x22)[^>]*?value\s*\s*?\x22#ffffff\x22)((<\/object>).)*?<param([^>]*?name\s*\s*?\x22movie\x22)[^>]*?value\s*\s*?\x22([^\x22]+\.[Ss][Ww][Ff])[^\x22]*?\x22	2	0	0	1
+10588	10588	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+10589	10589	Host\x3a\x20(<host>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?Referer\x3a\x20http\x3a\x2f\x2f(=host)\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n/Hsi	2	0	0	1
+10590	10590	Referer\x3a\x20http\x3a\x2f\x2f(<host>[^\r\n\x3a\x2f]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=host)(\x3a\d{1,5})?\r\n/Hsi	2	0	0	1
+10591	10591	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+10592	10592	^\s*=\s*(<var1>[\x22\x27][a-z]+[\x22\x27]).+?\sid\s*=\s*(=var1)	2	0	0	1
+10593	10593	^([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$	2	0	0	1
+10594	10594	^(\s*var\s[a-z]+\s*=\s*\d+\x3b\s*\n)*\s*<\/script>\s*<object([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$	2	0	0	1
+10595	10595	^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27]	2	0	0	1
+10596	10596	^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|([a-z]*\d+[a-z]+\d)(\d*[a-z]+\d+[a-z])[a-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27]	2	0	0	1
+10597	10597	^\s*=\s*[\x22\x27][a-z]+[\x22\x27]	2	0	0	1
+10598	10598	^\s*=\s*[\x22\x27][a-z]+[\x22\x27]	2	0	0	1
+10599	10599	^\s*=\s*[\x22\x27]\/[^\x22\x27]*\.html\.swf[\x22\x27]	2	0	0	1
+10600	10600	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+10601	10601	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+10602	10602	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)	2	0	0	1
+10603	10603	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+10604	10604	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)	2	0	0	1
+10605	10605	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27]	2	0	0	1
+10606	10606	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)	2	0	0	1
+10607	10607	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)	2	0	0	1
+10608	10608	\/m[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+10609	10609	^h[a-z0-9]{0,10}\x3d[a-f0-9]{24}&p[a-z0-9]{0,10}\x3d[a-z0-9]{1,11}&i/P	2	0	0	1
+10610	10610	^p[a-z0-9]{0,20}\x3d[a-z0-9]{1,20}&i[a-z0-9]{0,20}\x3d%[0-9A-F]{2}/P	2	0	0	1
+10611	10611	\x28[\r\n\s]*?(<qa1>[\x22\x27]?)[a-f0-9]{24}(=qa1)[\r\n\s]*?,[\r\n\s]*?(<qa2>[\x22\x27]?)[a-z0-9]{1,20}(=qa2)[\r\n\s]*?	2	0	0	1
+10612	10612	=%25[0-9A-F]{2}%25[0-9A-F]{2}/P	2	0	0	1
+10613	10613	^\/a[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?q[a-z]{4,11}=\d{6,7}$	2	0	0	1
+10614	10614	^\/s[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?d[a-z]{4,11}=\d{6,7}$	2	0	0	1
+10615	10615	^\/k[a-z]{4,13}\?e[a-z]{4,11}=\d{6,7}$	2	0	0	1
+10616	10616	^\/g[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?t[a-z]{4,11}=\d{6,7}$	2	0	0	1
+10617	10617	\/r[a-z]+?\?j[a-z]+[a-z]+$	2	0	0	1
+10618	10618	\/f[a-z]+?\?j[a-z]+[a-z]+$	2	0	0	1
+10619	10619	^\/o[a-z]{4,13}\?h[a-z]{4,11}=\d{6,7}$	2	0	0	1
+10620	10620	\/b[a-z]+?\?n[a-z]+[a-z]+$	2	0	0	1
+10621	10621	\/v[a-z]+?\?n[a-z]+[a-z]+$	2	0	0	1
+10622	10622	^\/[a-z]{5,14}\?[a-z]{5,12}=\d{6,7}$	2	0	0	1
+10623	10623	^\/[a-z]{5,14}\?[a-z]{5,12}=[a-z]{6,11}$	2	0	0	1
+10624	10624	^[\r\n\s]*?\,	2	0	0	1
+10625	10625	\bdig\.dll\b	2	0	0	1
+10626	10626	^\/[a-z]+?\?[a-z]+[a-z]+$	2	0	0	1
+10627	10627	^Host\x3a\x20[^\r\n]+\.(d(yndns\.[a-z]{2,3}|esi)|c(ricket|a?fe?)|(lin|wor)k|s(u|pace)|accountant|t(k|op)|g[aq]|xyz|ml|pw)(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+10628	10628	^\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)$	2	0	0	1
+10629	10629	^(<windname>[a-z0-9]+)(<plug1>([sj]|f1))=true.+?window\.(=windname)(<plug2>(((=plug1))([sj]|f1)))=true.+?window\.(=windname)(((=plug1)|(=plug2)))([sj]|f1)=true	2	0	0	1
+10630	10630	^\/1[a-z0-9]{13}$	2	0	0	1
+10631	10631	^GET \/0(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n	2	0	0	1
+10632	10632	^\/1[a-z0-9]{13}$	2	0	0	1
+10633	10633	^GET \/4(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n	2	0	0	1
+10634	10634	^\/3[a-z0-9]{13}$	2	0	0	1
+10635	10635	\/4[a-z0-9]{13}\?&xkey=	2	0	0	1
+10636	10636	^[a-zA-Z0-9\/\+]+?ODAvM[a-zA-Z0-9\/\+]{18}(=|%3D)[\x22\x27]	2	0	0	1
+10637	10637	^[a-zA-Z0-9\/\+]+?4MC8x[a-zA-Z0-9\/\+]{18}(=|%3D){2}[\x22\x27]	2	0	0	1
+10638	10638	^[a-zA-Z0-9\/\+]+?OjgwL[a-zA-Z0-9\/\+]{19}[\x22\x27]	2	0	0	1
+10639	10639	^(\s*?|\/\*((\*\/).)*?\*\/)*?\((\s*?|\/\*((\*\/).)*?\*\/)*?(<vname>[^\s>=]+)(\s*?|\/\*((\*\/).)*?\*\/)*?<(\s*?|\/\*((\*\/).)*?\*\/)*?32\b.{0,200}(=vname)(\s*?|\/\*((\*\/).)*?\*\/)*?\x3d(\s*?|\/\*((\*\/).)*?\*\/)*?63\b.{1,200}\+=.{0,200}\((\s*?|\/\*((\*\/).)*?\*\/)*?(=vname)	2	0	0	1
+10640	10640	^[a-zA-Z0-9]+\*\/	2	0	0	1
+10641	10641	[a-z0-9]+?\*\/	2	0	0	1
+10642	10642	^\s*?<script>\s*?(<func>[A-Za-z0-9]+)\s*?\(\s*?[\x22\x27](<var>[^1\x22\x27]+)1[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)2[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)3[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>	2	0	0	1
+10643	10643	^\s*?\n\s*?(<func>[^\x28\r\n\s]+)\s*?\(\s*?(<var>[^\+\x29]+)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+	2	0	0	1
+10644	10644	^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$	2	0	0	1
+10645	10645	^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$	2	0	0	1
+10646	10646	^Referer\x3a[^\r\n]+\/([a-z0-9]+\.php|\d+)\r$/Hm	2	0	0	1
+10647	10647	Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2039/H	2	0	0	1
+10648	10648	Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2040/H	2	0	0	1
+10649	10649	^\W	2	0	0	1
+10650	10650	^\W	2	0	0	1
+10651	10651	^\/[a-z]{3}\?[A-F0-9]{8}$	2	0	0	1
+10652	10652	^Referer\x3a\x20http\x3a\x2f\x2f?[^\x2f]+\/[a-z]{3,20}((<sep>[_-]?)[a-z]{3,20}(=sep)([a-z]{3,20}(=sep))?)?[a-z]{3,20}\/\d{10,20}(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+10653	10653	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi	2	0	0	1
+10654	10654	Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+10655	10655	^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}\r$/Hmi	2	0	0	1
+10656	10656	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi	2	0	0	1
+10657	10657	Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+10658	10658	^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+10659	10659	^((<\/body).)+?Content\s*?loading.*lease wait.*?<iframe	2	0	0	1
+10660	10660	^(\x4c|\x35)	2	0	0	1
+10661	10661	^(\x76|\x0f)	2	0	0	1
+10662	10662	\/wp-(content|admin|includes)\/	2	0	0	1
+10663	10663	^\d\x00\d	2	0	0	1
+10664	10664	\.php\?$	2	0	0	1
+10665	10665	\?showforum=$	2	0	0	1
+10666	10666	^\s*5a\s*90\s*00\s*03\s*00\s*00\s*00	2	0	0	1
+10667	10667	\x2Fphp-calendar-1.1\x2Fupdate(08|10)\x2Ephp(\x3F|.*(\x26|\x3B))configfile=[^\x26\x3B]*[^a-zA-Z0-9_]	2	0	0	1
+10668	10668	(\.\.\/){1,}	2	0	0	1
+10669	10669	(\.\.\/){1,}	2	0	0	1
+10670	10670	=(https?|ftps?|php)\:\/.{0,100}cmd=	2	0	0	1
+10671	10671	MEAS\.TYPE=((link|class)&)	2	0	0	1
+10672	10672	url=.{8000}	2	0	0	1
+10673	10673	\/ssp\/files\/annonce\.pdf$	2	0	0	1
+10674	10674	\/ssp\/loadjavad\.php$	2	0	0	1
+10675	10675	\/wywg\/[a-z0-9]{2,5}\/[a-z0-9]+\.exe$	2	0	0	1
+10676	10676	\/xml\/p\.php\?id=\d{2,}	2	0	0	1
+10677	10677	ts\/in\.cgi\?pepsi\d+	2	0	0	1
+10678	10678	cs_base_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+10679	10679	\x0d\x0aHost\: (www\.)?nacha\.org\.	2	0	0	1
+10680	10680	\x26n\x3d[a-z]{5}\d{4}	2	0	0	1
+10681	10681	name=(https?|ftps?|php)	2	0	0	1
+10682	10682	\/script\.php?\d{8}	2	0	0	1
+10683	10683	Host\: \d+\.\d+\.\d+\.\d+\x0d\x0a	2	0	0	1
+10684	10684	\/[a-z]+\/[a-z0-9]{120,}\/[a-z0-9]+\/.+\.com$	2	0	0	1
+10685	10685	UPDATE.+SET	2	0	0	1
+10686	10686	ASCII\(.+SELECT	2	0	0	1
+10687	10687	DELETE.+FROM	2	0	0	1
+10688	10688	INSERT.+INTO	2	0	0	1
+10689	10689	UNION\s+SELECT	2	0	0	1
+10690	10690	SELECT.+FROM	2	0	0	1
+10691	10691	UPDATE.+SET	2	0	0	1
+10692	10692	ASCII\(.+SELECT	2	0	0	1
+10693	10693	DELETE.+FROM	2	0	0	1
+10694	10694	INSERT.+INTO	2	0	0	1
+10695	10695	UNION\s+SELECT	2	0	0	1
+10696	10696	SELECT.+FROM	2	0	0	1
+10697	10697	ver=[v\d]+	2	0	0	1
+10698	10698	\/Setup_[0-9]{3}([A-Z][0-9])?\.exe$	2	0	0	1
+10699	10699	\/\d+\/installer\/Installer(Clean)?\.exe$	2	0	0	1
+10700	10700	\/(nte|ld)\/[0-9A-Z]*trest1[0-9](\.php|\s\.asp|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$	2	0	0	1
+10701	10701	^[a-z0-9\x40\x2d\x5f]{5,12}..\x00\x00..\x00\x00\x78\x9c	2	0	0	1
+10702	10702	=sent$	2	0	0	1
+10703	10703	\.php\?get[^=]*=\d_\d{5,}$	2	0	0	1
+10704	10704	\.php\?[a-z]_info=[a-z0-9]{1,4}_\d+?$	2	0	0	1
+10705	10705	Host\x3A\x20[^\r\n]*.rr.nu/H	2	0	0	1
+10706	10706	^(.{0,63}\x00.{0,62}\x00.{0,61}\x00.{0,60}\x00)(.{0,62}\x00{2})(.{0,59}[A-Za-z0-9]{5})((<b1>.).{0,63}(=b1).{0,62}(=b1).{0,61}(=b1).{0,60}(=b1))(.(<b2>.).{0,62}(=b2).{0,61}(=b2).{0,60}(=b2).{0,59}(=b2))(..(<b3>.).{0,61}(=b3).{0,60}(=b3).{0,59}(=b3).{0,58}(=b3))(...(<b4>.).{0,60}(=b4).{0,59}(=b4).{0,58}(=b4).{0,57}(=b4))(....(<b5>.).{0,59}(=b5).{0,58}(=b5).{0,57}(=b5).{0,56}(=b5))(.....(<b6>.).{0,58}(=b6).{0,57}(=b6).{0,56}(=b6).{0,55}(=b6))(......(<b7>.).{0,57}(=b7).{0,56}(=b7).{0,55}(=b7).{0,54}(=b7))(.......(<b8>.).{0,56}(=b8).{0,55}(=b8).{0,54}(=b8).{0,53}(=b8))(........(<b9>.).{0,55}(=b9).{0,54}(=b9).{0,53}(=b9).{0,52}(=b9))(.........(<b10>.).{0,54}(=b10).{0,53}(=b10).{0,52}(=b10).{0,51}(=b10))	2	0	0	1
+10707	10707	\.tar$	2	0	0	1
+10708	10708	\x2Fjs\x2F[\r\n]*\x2Eexe$	2	0	0	1
+10709	10709	^(<mac_addr>[\x00-\xff]{6})(=mac_addr){2,}$	2	0	0	1
+10710	10710	^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED)	2	0	0	1
+10711	10711	^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED)	2	0	0	1
+10712	10712	^(\\r\\n|\x0d\x0a)C	2	0	0	1
+10713	10713	\/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+10714	10714	<iframe.*?src.*.*?<\/iframe>	2	0	0	1
+10715	10715	[a-z]{4,10}\x08velodrivve\x03biz\x00	2	0	0	1
+10716	10716	PRIVMSG.*@(portscan|nmap|back|udpflood|tcpflood|httpflood|linuxhelp|rfi|system|milw0rm|logcleaner|sendmail|join|part|help)	2	0	0	1
+10717	10717	\/[A-Z]Setup_[0-9]{4}\.exe$	2	0	0	1
+10718	10718	\.php.+?(c((onfi|f)g|alendar)|p(a(ge|th)|rog)|l(ang(uage)?|ib)|f(older|ile|ad)|d(omain|ir|f)|s(ettings|bp)|a(genda|uth)|i(con|ncl|d)|n(ame|ews)|r(oot|f)|gallery|type|ext|mod|[a-z](\[.*\])+?)\s*=\s*https?	2	0	0	1
+10719	10719	\/[a-f0-9]{16}\/.+?\.(exe|zip)$	2	0	0	1
+10720	10720	^\s?\+x=[0-9]*\;\ +y=[0-9]	2	0	0	1
+10721	10721	User-Agent\:[^\n]+\; UA\d\d\d\d\d\;/H	2	0	0	1
+10722	10722	^\/load.php\?showforum=(ato|obe|rhino|lib)$	2	0	0	1
+10723	10723	^[a-z]{5}\d=\x5f\d\x5f	2	0	0	1
+10724	10724	index.php\?[0-9a-f]{32}$	2	0	0	1
+10725	10725	o/\d{9}\/[0-9a-f]{32}\/[0-9]$	2	0	0	1
+10726	10726	\/out.php\?id=\d$	2	0	0	1
+10727	10727	\/\?[a-z0-9]{5,}=[a-zA-Z0-9\x25]{40,}\x253D$	2	0	0	1
+10728	10728	^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$	2	0	0	1
+10729	10729	\/((article|contact|new)s|read|(fo|tu)r)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.eot|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.EOT)$	2	0	0	1
+10730	10730	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})1\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}1\.PDF)$	2	0	0	1
+10731	10731	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})2\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}2\.PDF)$	2	0	0	1
+10732	10732	^(\/[a-z]{3,20})?\/([a-z]{3,20}[-_])+[a-z]{3,20}\.jar$	2	0	0	1
+10733	10733	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})3\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}3\.PDF)$	2	0	0	1
+10734	10734	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/foto\.png$	2	0	0	1
+10735	10735	\.png$	2	0	0	1
+10736	10736	^\/[a-zA-Z0-9_\x2f-]{300,}\.html?$	2	0	0	1
+10737	10737	\/\d+\.mp3\x3frnd\x3d\d+$	2	0	0	1
+10738	10738	(Is|CheckRemote)DebuggerPresent	2	0	0	1
+10739	10739	(Create|Connect|Peek)NamedPipe	2	0	0	1
+10740	10740	ftp(open|get)file	2	0	0	1
+10741	10741	^\/r\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+10742	10742	^\/t\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+10743	10743	^\/[a-f0-9]{32}\.eot$	2	0	0	1
+10744	10744	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/new\.png$	2	0	0	1
+10745	10745	\.gif$	2	0	0	1
+10746	10746	\/(w(hite|orld)|step)\/\d+$	2	0	0	1
+10747	10747	\.psd$	2	0	0	1
+10748	10748	\.jpeg$	2	0	0	1
+10749	10749	\/(w(hite|orld)|step)\/mypic\.dll$	2	0	0	1
+10750	10750	getqq\.jpg$	2	0	0	1
+10751	10751	^[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(((=q)).)+?\.txt\?e=\d+(&[fh]=\d+)?(=q)	2	0	0	1
+10752	10752	\.php\?t[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+10753	10753	([a-z+-]{0,4}[0-9.*]+[a-z$+-]{0,4},){24}	2	0	0	1
+10754	10754	[\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]+	2	0	0	1
+10755	10755	\.php\?spl=[A-Z]{3}	2	0	0	1
+10756	10756	\.php\?b[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+10757	10757	\.php\?n[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+10758	10758	^[^?#]+?\.php\?page[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+10759	10759	\.php\?v[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+10760	10760	\.php\?doit[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+10761	10761	^[^?#]+?\.php\?id[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+10762	10762	(-?\d+\x3a-?\d+\x3a){100}	2	0	0	1
+10763	10763	\x2Fsrc\x2Ephp\x3Fcase\x3D[a-f0-9]{16}$	2	0	0	1
+10764	10764	[\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]	2	0	0	1
+10765	10765	value\x3D\x22\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23	2	0	0	1
+10766	10766	\x2Fredirect\x2Ephp\x3Fd\x3D[0-9a-f]{8}$	2	0	0	1
+10767	10767	\/\d+\.js\?\d+&[a-f0-9]{16}$	2	0	0	1
+10768	10768	^\/[a-z0-9_\-]{48}$	2	0	0	1
+10769	10769	\.php\?e=[^&]+?$	2	0	0	1
+10770	10770	\/[a-z]\/[0-9]\/[0-9a-f]{32}$	2	0	0	1
+10771	10771	archive=[^\x3e]+?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+10772	10772	^\/[a-z]+\/$	2	0	0	1
+10773	10773	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/image\.gif$	2	0	0	1
+10774	10774	\/w(hite|orld|step)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.PDF)$	2	0	0	1
+10775	10775	\/(w(hite|orld)|step)\/get(a+|n+)\.jpg	2	0	0	1
+10776	10776	\.php\?usernms=[^@]+@[^\r\n]+$	2	0	0	1
+10777	10777	^(\x3a\d{1,5})?$	2	0	0	1
+10778	10778	^[^\r\n]+?\.(c(o(l(leg(e((confidential|-station|prowler)\.net|s?explained\.com)|iate(explained|info)\.com)|(o(rado-springs-jobs|nexplained)|umnexplore)\.com)|m(p(uter(explained\.com|themes\.net)|assiondefinition\.com)|m(oditylingerie|unesinfo|ercekid)\.com)|n(ce(rtparis\.net|ptsets\.com)|trolwedding\.com)|((rnell|upon)explained|peguide)\.com|7\.us)|a(((mpaign|talog|det)explained|n(cersexplained|adadaycore)|p(itali[sz]eguide|ricornhi)|b(leexplained|indynamic))\.com|r((tograph(yanalysis|erwhat)|cinomas?explained|scratch-remover|eblack)\.com|insurance-compare\.net)|ce\.us)|h((a(r(med-episodes|les-proxy|tpixel)|p(elsinfo|terball)|nnelexplained)|ristmas(gift-ideas|motion)|inesenewyearboom|eckingwatch)\.com|(orizo|urros)\.es)|(e(l(lularexplained|iac-diet)|ntigrade(explained|info))|(li(nical|ck)|ustomized)explained|r(uiseshipdating|iticsmart)|pu-benchmark|nc-cs)\.com|8\.biz|z\.cc)|a((ll(about(((collegi|gradu)at|yal)e|s(eminary|tudent)|(facul|varsi)ty|bestsellers|academic|teaching|harvard|ucla|pro)|babyours)|n((tip	2	0	0	1
+10779	10779	desbi|alyzelan)d|onymous-film)|(mericas-nexttopmode|gentsbal)l|r(chitectureice|lingtonwriter)|c(ademicexplaine|tionmo)d|ero(flotinfo|bicfund))\.com|u((toma(tedexplained|kers24)|stralia-airlines|xiliaryverb)\.com|di(t(jewellery\.com|report\.net)|o-planet\.com))|p((rilfools(hotel|spin)|ple-airport)\.com|[fh]i\.biz)|ir((bnb-coupon|waysinfo)\.com|portshuttleseattle\.net)|v(enue(domain|hello)\.com|li\.biz)|\.e\.gy)|b((a(c(helorexplained|kpackscope)|by(online-shop|revision)|(rcelonarea|ggagecoo)l|s(icexplained|escope)|ttle-field-3)|e((st-hoteldeal|er-calorie|t-award)s|nefitexplained)|u(y-invite|dgetyep)|logger-com)\.com|r((o(adbandinternet-providers|king(explained|guide))|unomarsalbum|yan-college)\.com|ea(st(cancertattoos\.net|explained\.com)|dmachine-recipes\.com))|o(((om(ing|s)|nd)explained|tany(explained|info)|dybuildingdomains|rrowings?24)\.com|stoncolleges\.net)|irthcertificatetemplate\.net|3g\.biz)|d(e((((benture|posit)explaine|alershipislan)d|n(guefevertreatment|verhowto)|ductguide|veloptea)\.com|(xterstre	2	0	0	1
+10780	10780	ming|ciduoustrees)\.net)|o((ctorate(s?explained|info)|llar-converter|gwalking-jobs|texplained|mainsknow)\.com|wnload(starcraft|-films|ubuntu)\.net)|(a(ncecentralsonglist|rtmouthexplained)|na-replication|hcp-server|vd-codec|rivewww)\.com|i((s(count|ease)explained|nnerparty-recipes|walifile)\.com|rect-golf\.net))|e((a(r(fulexplained|th-clinic)|sy(-costumes|repayment))|conomic(save|24))\.com|\.gy)|4((4qs|h5)\.com|[jp]\.org|ql\.biz)|3(vt\.info|gb\.biz|q\.org)|2(eat\.com|sf\.biz|u\.se)|8(c1\.net|x\.biz)|7(c\.org|p\.biz)|11r\.(biz|us))(\x3a\d{1,5})?$	2	0	0	1
+10781	10781	^[^\r\n]+?\.(f((a(c(ultyexplained|e-bok)|(ncy-font|ke-nail)s|ir(explained|fuse)|shion-wallpaper|lterguide)|i(nanc(i(al|ng)explained|epets)|rm(explained|s24)|lter-coffee)|o(r(umexplained|ecastbooks|ceestate)|x-drama)|udaninfo)\.com|re(e(-(((foodcoupon|angrybird)s|s(oundclips|tock)|photoeditor)\.com|music-download\.net)|(p(owerpointthem|roduct-sampl)es|dom-ofspeech)\.com|fileconverter\.net)|snoever\.com)|l(a(shplayerdownload\.net|tbelly-diet\.com)|oridaunemploymentclaim\.com|v-downloader\.net)|e(rtility-calculator\.net|stivalexplained\.com)|b(-smileys\.com|skins\.net))|l((i(n(k(explained|master)|colnsbirthdaytea)|(ability|ver)explained|(berty-saf|ftmov)e|stings(biz|red)|teraturemulti)|u(ng(explained|abscess)|ggageboom)|o(cationssecure|ndon-riots|gback))\.com|e((a(singexplained|ther-trousers)|(edsunited-new|d-candle)s|cturer(explained|info)|nd(ing|er)explained|isure-diving)\.com|u(kemiaexplained\.com|e\.biz)|tup\.org)|a(guay\.(com|es)|-gazzetta\.com)|6\.org)|i(n(s((ur(er(s(explained|24)|explained)|ancesexplain	2	0	0	1
+10782	10782	d)|ide-film)\.com|(pection-camera|taflex)\.net)|d(e(pendenceday(portal|realty)|mnityexplained)\.com|ividual-healthinsurance\.net)|t(er(estexplained\.com|trigo\.net)|ranet(explained|pm)\.com)|((vestment|centive)explained|expensivehyper)\.com|f(ections?explained\.com|o\.se))|((mmersio|sd)nexplained|ronmancom|pone-5)\.com|i(nkai|lg)\.biz)|m((e(tropolis((cruis|fac|mov)e|pixel)|(lanoma|dical)explained|r(idiantotal|cedes-cls)|ntal-healthjobs|morialdaycon|ssenger-mac|ansgift)|i(ami(-holidays|what)|di-editor)|baexplained)\.com|a(r((tial-empires|ket-hq)\.com|iogames-online\.net)|n((agejoin|ualzap)\.com|ipal-university\.net)|(lignanthypertension|gazinedownload)\.net|s(on(wave|car)|tersexplained)\.com|c2\.org))|e((s(ta(tes(mob|fx)|blishstyle)|lexplained)|mploy(e(eexplained|r24)|mentexplained))\.com|n(((gagement-photo|able-cookie)s|rollexplained)\.com|trepreneur-ideas\.net)|x(((hibition|po)explained|ecutive-decision)\.com|tremedeal\.net)|l(ect(ronicexplained|orate123)\.com|guay\.(com|es))|q(uityexplained\.com|8\.biz))|	2	0	0	1
+10783	10783	((o(a(d(minister|vertize|just)|cademic|llocate)|(thic-literatur|handl)e|(bailou|conduc)t|govern)|r(a(duate(explained|sinfo)|ndparentsdayplan)|oceryexplained|4)|ym(glas|car)s|m[69])\.com|a(((llaudet|te)explained|mevelocity|rnerguide)\.com|511\.net)|cwsa\.org)|h(o((me(made-biscuits|pageexplained)|(nours|tline|using)explained|6)\.com|stel-barcelona\.net)|a(r(dback(city|yoga)|vardexplained)|n(dlechange|ukkahbio)|lloweenorange)\.com|y(perthyroidsymptoms\.net|d\.me)|ellokittypictures\.net)|j((o(urnalism(explained|info)|hn-grisham|ker-tattoo)|query-examples)\.com|a(cksonvillepath\.com|vacollection\.net)|(vvg|6)\.org)|k(ilometersreach|udosexplained|jyg)\.com)(\x3a\d{1,5})?$	2	0	0	1
+10784	10784	^[^\r\n]+?\.(p(r(o(pert(ies(-forsale\.net|winters\.com)|y-(singapore|rental)\.net)|(fessors|state)explained\.com)|e(miums(e(xplained|ek)|guide)|(acher|cinct|late)sinfo|pexplained)\.com|i(va(te(car-sales|explained)\.com|do\.info)|nceton\.me))|e((n(sionexplained|thousepal|cetruck)|diatricsexplained)\.com|rsonal(trainer-certification\.net|-injuryclaims\.com)|tardo\.es)|o((wer(borrowings?|repayment|debts)|rt(land-holidays|alexplained)|intexplained|litical24)\.com|kertexas-holdem\.net)|a((ss(engersinfo|agepix)|ge(explained|as)|cemaker-surgery|ttinson-robert|rk-edu)\.com|loaltocollege\.net)|(u(blicationgift|pils?info)|ickups(articles|gen)|neumoniaexplained|sychologyquotes|lus-sign)\.com|h(o(toedit(orfreedownload\.net|ingsite\.com)|neexplained\.com)|pbb-themes\.com|yscology\.net)|cbp\.net|9\.org)|o(n(line(((f(o(ster|rce)|irstborn|raternal|ulltime)|b(r(idegroom|owse)|oxoffice)|e((valuat|xpress)e|fficient)|-(collegecourse|radiostation)|d(escendant|aughter|iscusse)|v(illage|acant)|re(sidence|al))s|c((r(iti(c(ize|al)|	2	0	0	1
+10785	10785	ue)|ew)|o(nsider|usin)|a(pture|meo)|elluloid)s|ha(racters|teau))|a(((vailabl|doptiv|llianc|pprais)e|ss(esse|ay)|unt)s|n((cestor|alyze)s|imated)|way)|per(sonal-trainer|manents))\.com|mediaconverter\.net)|e-lyrics\.com|amia\.biz)|(ver(seasexplained|drawnreal)|(wnership|ffline)explained|cean(ic-cable|you)|rphanagesinfo|klahomafuse)\.com|a(klandour\.com|pg\.org))|r(e((s(idenc(e(attorney|dating|cook|food)|yexplained)|erves(development|core))|(c(o(ver(ing|ed)|up)|laim)guid|laxationhyp|bateventur)e|g(i(on(private|mentor)|stercommunity)|ainguide)|t(r(ainingexplained|ieveguide)|ailexplained)|motecontrol-helicopter|viewwinters|payment24)\.com|alestate-perth\.net)|(a(cetracksinfo|veexplained|iserepair|tetask)|ising-antivirus|bnnetwork)\.com|o((o(m(sfootball|mateco)|fcute)|admodern)\.com|yallondonhospital\.net))|s((o((lventsourc|ftenguid)e|urceexplained|cietiesinfo|ng-india)|a(n(antoniosource|diegodiscover)|l(aryexplaine|euploa)d)|ta(nford(explained|info)|(bilis|v)eguide|r-treck)|p(ecialtyexplained|iralwatch|orts-tab)|	2	0	0	1
+10786	10786	h(oolexplained|eduleedu)|ites?explained)\.com|e((minar(y(explained|info)|explained)|c((urities|tor)explained|what)|aworld-coupons)\.com|rvertransfer\.net)|m(ier\.org|oz\.us)|hellgascard\.net|gba\.biz)|m(o((t(oristsinfo|iveshare)|ntre-breitling|dernexplained|squesinfo)\.com|hamed\.me)|(y(borrowings|-husband)|ultimediaexplained|inistriesinfo)\.com|mcd\.us)|n((a(ming(mac|our)|uticalfit|vigateadd)|e(tworkexplained|w-college))\.com|8\.biz))(\x3a\d{1,5})?$	2	0	0	1
+10787	10787	^[^\r\n]+?\.(t(e((l(e(phoneexplained|comsguide)|learth)|n(ured(explained|info)|nis-ranking))\.com|mp(l(ates-gratis\.com|ecollege\.net)|converter\.net)|a(ching(-certificate\.net|explained\.com)|m\.pro))|r(a(((nsferbyt|de-)e|in(eesinf|ge)o|mray)\.com|vel(insurance-comparison\.net|agentnerd\.com))|e(k-bicycles|nd-online)\.net|uckstool\.com|onco\.es)|(o(wn(housepic|study|euro|meta)|(tal-tool|memap)s|pgamebook|olboxsol)|u(mors?explained|lsatrain|rn-ons)|attoo-websites|ype-racer|wainfo)\.com|h((anksgivinggaming|riftexplained)\.com|e(sis-examples\.com|atreparis\.net))|i(mezonevendor\.com|dl\.net)|cmn\.biz)|w(e(b((b(estseller|ailout)|administer)\.com|site(downloader\.net|explained\.com)|developertoolbar\.net)|(l(lesley|fare)explained|akenguide)\.com)|or(th(voice|war)\.com|ld-records\.net)|ater(front-property\.net|-plants\.com)|(riterpics|hoiscan)\.com|pbh\.org|sse\.us)|s((t(ud(ent(financecontact|s?explained)|yexplained)|r(eetmaphub|ongat)|patricksweightloss|onewhat)|wissairinfo)\.com|u((mmertimelyrics|nset-wallpape	2	0	0	1
+10788	10788	|per-committee|itegraphic)\.com|b\.(name|cat|es)))|v((i(llage((in|na)no|crystal)|deo(-mediaset|explained)|ta(minssms|lwow)|rtualexplained)|o(lumesynergy|ucheragent|ters24)|a(rsityexplained|lentinesproxy)|entureexplained)\.com|qtel\.net|f1\.us)|u(n(i(versityexplained\.com|nstalltool\.net|\.me)|((secured|am)explained|ravelguide)\.com|limited-web-hosting\.net)|(cla(explained|info)|s-inflation|alinfo|zdom)\.com|[04]\.org)|y((o(u(ngstersinfo|rbroking)|mkippursocial)|(eshiva|ale)explained|vxs)\.com|nna\.biz)|zwr\.org)(\x3a\d{1,5})?$	2	0	0	1
+10789	10789	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+10790	10790	[a-z]{8}.(:?tif|gif)	2	0	0	1
+10791	10791	^.{2}[a-zA-Z0-9]+\x2e[01]	2	0	0	1
+10792	10792	(\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(	2	0	0	1
+10793	10793	^\w+?\[[^\]]+?\]\.src[\r\n\s]*=	2	0	0	1
+10794	10794	(\/(php)?|\.php)\?[\s\+]*\-[A-Za-z]	2	0	0	1
+10795	10795	^[A-Z]=[A-Za-z/+0-9=]{200,400}$	2	0	0	1
+10796	10796	^\{?[a-fA-F0-9]{4}\}?(\x5cu\{?[a-fA-F0-9]{4}\}?){20}	2	0	0	1
+10797	10797	^\{?[a-fA-F0-9]{4}\}?(\x25u\{?[a-fA-F0-9]{4}\}?){20}	2	0	0	1
+10798	10798	[^a-zA-Z0-9_\-\.][a-zA-Z]{7}\.class	2	0	0	1
+10799	10799	^[\r\n\s]*?\\?\(.+?\\?\)\.keep\.previous[\r\n\s]*[\r\n\s]*?[\x22\x27]contentArea	2	0	0	1
+10800	10800	\/vw\.php\?i=[a-fA-F0-9]+?\-[a-fA-F0-9]+?$	2	0	0	1
+10801	10801	^[\x11\x21-\x26\x41\x45\x70-\x79]	2	0	0	1
+10802	10802	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+10803	10803	^.{0,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.jsp\x22	2	0	0	1
+10804	10804	^..[\x81\x82\x83\x84\x85\x86\x87]\x81	2	0	0	1
+10805	10805	^..[\x81\x82\x83\x84\x85\x86\x87]\x83	2	0	0	1
+10806	10806	^..[\x81\x82\x83\x84\x85\x86\x87]\x84	2	0	0	1
+10807	10807	^..[\x81\x82\x83\x84\x85\x86\x87]\x85	2	0	0	1
+10808	10808	REGISTER.{400}	2	0	0	1
+10809	10809	SELECT.+geometrycollectionfromwkb	2	0	0	1
+10810	10810	SELECT.+WHERE.+SELECT.+\x60	2	0	0	1
+10811	10811	ALTER.+DATABASE.+\x22\x2E(\x22|\x2E\x22|\x2E\x2E\x2F\x22).+UPGRADE.+DATA	2	0	0	1
+10812	10812	^Authorization\x3A Basic.{120}/Hmi	2	0	0	1
+10813	10813	^Host\x3a[^\x3a\r\n]+?\x3a[^\r\n]{6}/Hmi	2	0	0	1
+10814	10814	^[^\x00]+?\x00	2	0	0	1
+10815	10815	^[^\x00]+?\x00	2	0	0	1
+10816	10816	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*22C83263-E4B8-4233-82CD-FB047C6BF13E	2	0	0	1
+10817	10817	^Cache-Control\x3a\x20(max-age=0|no-cache)\r?$	2	0	0	1
+10818	10818	^\/\?id=[0-9]{13}&msg=	2	0	0	1
+10819	10819	^13\d{11}	2	0	0	1
+10820	10820	^Callback\x3a\x20<http[^>]+><http	2	0	0	1
+10821	10821	^[^\r\n]*uuid\x3a[^\r\n\x3a]{181}	2	0	0	1
+10822	10822	^[^\r\n]+#[^\x22\r\n]{2049}	2	0	0	1
+10823	10823	^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{181}	2	0	0	1
+10824	10824	^[^\r\n]*urn\x3aservice\x3a[^\r\n\x3a]{181}	2	0	0	1
+10825	10825	^[^\r\n]*urn\x3adevice\x3a[^\r\n\x3a]{181}	2	0	0	1
+10826	10826	^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{1,180}\x3a[^\r\n\x3a]{181}	2	0	0	1
+10827	10827	M-SEARCH\s+[^\n]{500}	2	0	0	1
+10828	10828	(\/\.){70,}	2	0	0	1
+10829	10829	[\w]{70,}	2	0	0	1
+10830	10830	\xB6\x29\x8C\x23\xFF\xFF\xFF[\xF8-\xFF]	2	0	0	1
+10831	10831	^.{27}	2	0	0	1
+10832	10832	[0-9a-zA-Z]{200,}	2	0	0	1
+10833	10833	(GET).\/%.{1586,}	2	0	0	1
+10834	10834	ctxsys\x2Edrvxtabc\x2Ecreate\x5Ftables.+(SELECT|DELETE|CREATE|INSERT|UPDATE|OUTFILE)	2	0	0	1
+10835	10835	[^a-zA-Z0-9]+\.message	2	0	0	1
+10836	10836	\x3d[^\x26]{720}	2	0	0	1
+10837	10837	ENTER\x20LANGUAGE\x20\x3D.{55}	2	0	0	1
+10838	10838	[a-zA-Z0-9]{1000,}	2	0	0	1
+10839	10839	\xbc[\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4]	2	0	0	1
+10840	10840	\xae[\xef\xcf][\xf0\xd0][\xe5\xc5][\xee\xce]\xa0\xa2[\xe7\xc7][\xe5\xc5][\xf4\xd4]\xa2	2	0	0	1
+10841	10841	[\xf3\xd3][\xe8\xc8][\xe5\xc5][\xec\xcc][\xec\xcc][\xe5\xc5][\xf8\xd8][\xe5\xc5][\xe3\xc3][\xf5\xd5][\xf4\xd4][\xe5\xc5]	2	0	0	1
+10842	10842	[\xf6\xd6][\xe2\xc2][\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4]	2	0	0	1
+10843	10843	Cookie\:\ +REMOTE_ADDR=	2	0	0	1
+10844	10844	Authorization\x3a\s*Basic\s*[a-zA-Z0-9]{255,}==	2	0	0	1
+10845	10845	\x2findex\x2etmpl(\x3a\x3a\x24DATA|\x2f|\x2e)\x0d\x0a	2	0	0	1
+10846	10846	\/[a-z0-9]{30,}\.php\?height=\d+&sid=\d+&width=[a-z0-9]+&	2	0	0	1
+10847	10847	\.php\?sex=\d+&children=\d+&userid=	2	0	0	1
+10848	10848	^SSH-\s[^\n]{200}	2	0	0	1
+10849	10849	value\x22[^\x22]*\x2Eswf\x3finfo\x3D	2	0	0	1
+10850	10850	^(CLIENT|MACHINE)_INFO	2	0	0	1
+10851	10851	Host\x3a \d{8,10}(\x0d\x0a|\x3a\d{1,5}\x0d\x0a)/H	2	0	0	1
+10852	10852	\/tmp\/[^\/]+\.pdf$	2	0	0	1
+10853	10853	\/tmp\/[^\/]+\.jar$	2	0	0	1
+10854	10854	^Directory	2	0	0	1
+10855	10855	^HEAD[^s]{432}	2	0	0	1
+10856	10856	^PUT[^s]{432}	2	0	0	1
+10857	10857	^POST[^s]{432}	2	0	0	1
+10858	10858	^TRACE[^s]{432}	2	0	0	1
+10859	10859	^DELETE[^s]{432}	2	0	0	1
+10860	10860	^LOCK[^s]{432}	2	0	0	1
+10861	10861	^MKCOL[^s]{432}	2	0	0	1
+10862	10862	^COPY[^s]{432}	2	0	0	1
+10863	10863	^MOVE[^s]{432}	2	0	0	1
+10864	10864	\x2Frequests\x2Fstatus\x2Exml\x3F[^\x0A\x0D]*input\x3D[^\x0A\x0D\x26\x3B]{1000}	2	0	0	1
+10865	10865	^\/[0-9]{5}\.jar$	2	0	0	1
+10866	10866	Host\x3a \d{4,}[^A-Za-z\.]	2	0	0	1
+10867	10867	^\/[0-9]$	2	0	0	1
+10868	10868	^\/[a-z]{13,14}\.jar$	2	0	0	1
+10869	10869	^\s*?STOR\s+[^\r\n]*?nsswitch\.conf\r$	2	0	0	1
+10870	10870	^\s*?STOR\s+[^\r\n]*?\x2f(tgt|trace|rbp(c|p))\.conf\r$	2	0	0	1
+10871	10871	T.*?T.*?Y.*.*?R.*?O.*?M.*.*?T	2	0	0	1
+10872	10872	[0-9a-zA-Z]{10}	2	0	0	1
+10873	10873	[0-9a-zA-Z]{10}	2	0	0	1
+10874	10874	Host\x3a \d{4,}[^A-Za-z\.]	2	0	0	1
+10875	10875	^\/m[a-zA-Z0-9-_]{3,14}\/[a-zA-Z0-9-_]{3,17}$	2	0	0	1
+10876	10876	SELECT data FROM [^\x20]+?\x20INTO DUMPFILE [\x27\x22]c\x3a\/windows\/system32\/[a-z0-9_-]+?\.exe[\x27\x22]	2	0	0	1
+10877	10877	[a-zA-Z0-9]{5}	2	0	0	1
+10878	10878	[0-9a-zA-Z]{50}	2	0	0	1
+10879	10879	\x90{200}	2	0	0	1
+10880	10880	^\s+A{500}	2	0	0	1
+10881	10881	^[\r\n\s]*?\x28[^\x29]*?shellcode	2	0	0	1
+10882	10882	^[\r\n\s]*?\x28[^\x29]*?shellcode	2	0	0	1
+10883	10883	\.(php|asp|py|exe|htm|html)\/[joewxy](U[0-9a-f]{8})?H[0-9a-f]{8}V[0-9a-f]{8}\d{3}R[0-9a-f]{8}\d{3}T[0-9a-f]{8,}	2	0	0	1
+10884	10884	[\r\n\s]+(<var1>([a-z]([a-z0-9_])*|_+([a-z0-9])([a-z0-9_])*))[\r\n\s]*\x3d[\r\n\s]*CreateObject\(\s*[\x22\x27]Wscript\.Shell[\x27\x22]\s*\).+?(=var1)\.run	2	0	0	1
+10885	10885	^((>>).)+?#([46][1-9a-fA-F]|[57][\daA])	2	0	0	1
+10886	10886	^\s*?fun\s*?\(	2	0	0	1
+10887	10887	[\?&]mail=[^&]+?[\x3b\x2c\x7c\x27]	2	0	0	1
+10888	10888	WSH\.run\x28\x5c+?[\x22\x27][a-z0-9_-]+?\.exe	2	0	0	1
+10889	10889	^(90|0x5a|0+?132)\s*?,\s*?(71|0x47|0+?107)\s*?,\s*?(70|0x46|0+?106)\s*?,\s*?(48|0x30|0+?60)\s*?,\s*?(89|0x59|0+?131)\s*?,\s*?(84|0x54|0+?124)\s*?,\s*?(112|0x70|0+?160)	2	0	0	1
+10890	10890	\/\??[a-f0-9]{60,}(\x3b\d+){1,4}$	2	0	0	1
+10891	10891	\/\??[a-f0-9]{60,}\x3b4[0-1]\d{5}$	2	0	0	1
+10892	10892	^\/([a-z0-9]{3,7}\/)?[a-z]{3,7}\.swf$	2	0	0	1
+10893	10893	^(25)?282176\x25(25)?29\x25(25)?26chrw\x25(25)?2801	2	0	0	1
+10894	10894	^Referer\x3a[^\r\n]+\/gate.php\r$/Hm	2	0	0	1
+10895	10895	Host\x3a\x20(\.*[a-f0-9]\.*){32}\./Hm	2	0	0	1
+10896	10896	^( Systems|\.com\/techsupport)	2	0	0	1
+10897	10897	^\s*?(<v1>[^\x29\s]+)\s*?\x29\s*?To Ubound\x28(=v1)\s*?\x29\s*?(dim\s*?)?(<v2>[^\s\x3d]+)\s*?\x3d\s*?(=v2)\+Cstr\x28\s*?Chr\x28(=v1)\x28i\x29[\+\-]\d+\x29\x29.+?Execute\s*?(=v2)	2	0	0	1
+10898	10898	^[0-9][^=]	2	0	0	1
+10899	10899	^\s*?\d[\d\x2e]{255}	2	0	0	1
+10900	10900	^\s*?\d[\d\x2e]{255}	2	0	0	1
+10901	10901	\s+?trigger\s+?[^\x20]+?\s+?after\s+?insert\s+?on\s+?	2	0	0	1
+10902	10902	^..[^\x00]+\x00	2	0	0	1
+10903	10903	^..[^\x00]+\x00	2	0	0	1
+10904	10904	^..[^\x00]+\x00	2	0	0	1
+10905	10905	^..[^\x00]+\x00	2	0	0	1
+10906	10906	^([^>]*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]*?\.swf[\x22\x27])([^>]*?\swidth\s*\s*?[\x22\x27]0[\x22\x27])[^>]*?\sheight\s*\s*?[\x22\x27]0[\x22\x27]	2	0	0	1
+10907	10907	^(<addr1>.{4})(<addr2>.{4})(=addr2)(=addr1)	2	0	0	1
+10908	10908	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+10909	10909	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+10910	10910	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+10911	10911	Type\x2FAction.+Launch.+\x28\x2F[a-z]\x2F[a-z].+NewWindow\x20true	2	0	0	1
+10912	10912	^=\s*\x22\s*[^\s\x22\x28]{1000}	2	0	0	1
+10913	10913	^(USE|PASS|SELECT|UPDATE|INSERT|ASCII|SHOW|CREATE|DESCRIBE|DROP|ALTER)\s+?(.{1}){300}	2	0	0	1
+10914	10914	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d+?&){3,}[a-z\_\-]{4,10}=-?[a-z0-9]+$	2	0	0	1
+10915	10915	^\s*\[\s*[\x22\x27]\\u[a-f0-9]{4}\\u[a-f0-9]{4}	2	0	0	1
+10916	10916	^[^\x00]+\x00\x00\x01	2	0	0	1
+10917	10917	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+10918	10918	^.{6}[^\x00]+	2	0	0	1
+10919	10919	^.{6}[^\x00]+	2	0	0	1
+10920	10920	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+10921	10921	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+10922	10922	^\x20+\x3a\x20([0-9A-F]{2}\x3a){5}[0-9A-F]{2}\x0d\x00\x0a	2	0	0	1
+10923	10923	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+10924	10924	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+10925	10925	^(\x01((\x01((\x04((\x03(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x04(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?|\x02(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?))?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|\x02([\x01\x02\x03\x04])?|\x03([\x01\x02])?))?|\x03((\x03(\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e])?)?)?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13])?|\x02([\x01\x02])?))?|\x05((\x02(\x01([\x01\x02\x03\x04\x05\x06\x07])?)?|\x01([\x01\x02\x03])?))?|\x02(([\x01\x02]|\x03(\x01([\x01\x02\x03])?)?))?|\x06(\x01([\x01\x02\x03\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x07([\x01\x02])?|\x04))?|\x02((\x02([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|(\x01)?\x01))?)	2	0	0	1
+10926	10926	^(\x41\xd8\x41\xd8\x41\xdc){2,}\x41\x00	2	0	0	1
+10927	10927	^\s*\x28\s*retPtrAddr\.add\s*\x28\s*i\s*\*\s*8\s*\x29\s*,\s*rop\s*\x5b	2	0	0	1
+10928	10928	^\S+?drivestoredirect	2	0	0	1
+10929	10929	^\s*(f0VMR|9FTE|\/RUxG)	2	0	0	1
+10930	10930	^\s*=\s*[\x27\x22]\s*POST	2	0	0	1
+10931	10931	^.*?[\x24\x60]	2	0	0	1
+10932	10932	^\s*=\s*[^>]*file\x3a[^>]*\/\x24MFT\/	2	0	0	1
+10933	10933	^\s*(\x28|\%28)s	2	0	0	1
+10934	10934	^\s*\d*[^\x20-\x7e\r\n\t]	2	0	0	1
+10935	10935	^[\x30-\x3f\x7D]	2	0	0	1
+10936	10936	^[\x30-\x3f\x7D]	2	0	0	1
+10937	10937	AUTH\s+\S+\s+([a-zA-Z0-9\+\/=]{4})*[a-zA-Z0-9\+\/=]{3}\s	2	0	0	1
+10938	10938	^\s*((>).)+?\s*src\s*=\s*[\x22\x27]\s*[^\x27\x28]+?[\x22\x27]\s*onError\s*=\s*prompt\s*\x28\s*[^)]*?(document|s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+10939	10939	legal[^x7B]*\x7B[^\x7D]*restore	2	0	0	1
+10940	10940	legal[^x7B]*\x7B[^\x7D]*restore	2	0	0	1
+10941	10941	errordict\s+\x2Finvalidfileaccess	2	0	0	1
+10942	10942	errordict\s+\x2Finvalidfileaccess	2	0	0	1
+10943	10943	\x2Ebindnow[^\x7D]*\x7D\s*stopped	2	0	0	1
+10944	10944	\x2Ebindnow[^\x7D]+\x7D\s*stopped	2	0	0	1
+10945	10945	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+10946	10946	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+10947	10947	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+10948	10948	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+10949	10949	^\s*	2	0	0	1
+10950	10950	^\s*	2	0	0	1
+10951	10951	^\s*	2	0	0	1
+10952	10952	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){5}	2	0	0	1
+10953	10953	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7}	2	0	0	1
+10954	10954	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7}	2	0	0	1
+10955	10955	Template=.*\.\.	2	0	0	1
+10956	10956	act\x3D[^\x26\s\r\n]{257}	2	0	0	1
+10957	10957	app\x3D[^\x26\s\r\n]{257}	2	0	0	1
+10958	10958	[\x20-\x7e]{5,}\x5c\x00[\x20-\x7e]{5,}	2	0	0	1
+10959	10959	^[\x50-\x59]	2	0	0	1
+10960	10960	^[^\r\n]*?\x60[^\x60]*?\$\{IFS\}	2	0	0	1
+10961	10961	\bsolusvmc-node\b	2	0	0	1
+10962	10962	^\s*?\(\s*?[^,\s]*?\s*?,\s*?[\x22\x27][a-f0-9]{100}	2	0	0	1
+10963	10963	^mail\s*?from\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b	2	0	0	1
+10964	10964	^(\x25(25)*?20|\s)*?runmumaa\W	2	0	0	1
+10965	10965	^\s*?(<var>[^=\s\x3b]+)\s*\s*?getBits\(\s*?\)\x3b.+?flashvars\s*\s*?\x5c\x22(=var)\s*\s*?\x22\s*?\+\s*?(=var)\s*?\+\s*?\x22\x5c\x22	2	0	0	1
+10966	10966	^[a-z-]+\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b.*\x3b.*\x7d\s*\x3b(=[\r\n])	2	0	0	1
+10967	10967	^\s*\x28\s*[\x22\x27]\s*message	2	0	0	1
+10968	10968	^(\.|\[\s*?[\x22\x27])defineProperties\s*?\x28	2	0	0	1
+10969	10969	^[^\r\n]+\.hta\r?\n	2	0	0	1
+10970	10970	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+10971	10971	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+10972	10972	^(<num_value>\d+)\x7d,\x22id\x22\x3a(=num_value)	2	0	0	1
+10973	10973	^[(\x60|%60)(\x27|%27)]	2	0	0	1
+10974	10974	^\/(home\/a3user|root)\/agile3\/patches\/	2	0	0	1
+10975	10975	^.*?\x26	2	0	0	1
+10976	10976	(\x0a|\\n)\/s1Caa6	2	0	0	1
+10977	10977	^(\\r\\n|\x0d\x0a)C	2	0	0	1
+10978	10978	^\d{3}	2	0	0	1
+10979	10979	^(https\/\/|(\d{1,3}\.){3}\d{1,3}|([a-z0-9-]+\.)+[a-z]{1,8})	2	0	0	1
+10980	10980	^(==[A-Z0-9+/]{2}|=[A-Z0-9+/]{3}|[A-Z0-9+/]{4})([A-Z0-9+/]{4})*$	2	0	0	1
+10981	10981	^[A-Za-z0-9+/]{2}([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+10982	10982	[\?\&]cmd_param=[^\&\r\n]{500}	2	0	0	1
+10983	10983	(%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))	2	0	0	1
+10984	10984	^.{11}([\xC0-\xC1]|[\xF5-\xFF]|\xE0[\x80-\x9F]|\xF0[\x80-\x8F]|[\xC2-\xDF]([\x80-\xBF])|[\xE0-\xEF]([\x80-\xBF]{2})|[\xF0-\xF4]([\x80-\xBF]{3})|([\x00-\x7F\xF5-\xFF])[\x80-\xBF]|([\xC2-\xDF]|[\xE0-\xEF]|[\xE0-\xEF][\x80-\xBF]|[\xF0-\xF4]|[\xF0-\xF4][\x80-\xBF]|[\xF0-\xF4][\x80-\xBF]{2})[\x80-\xBF]|([\xE0-\xEF])[\x80-\xBF]([\x80-\xBF])|([\xF0-\xF4])[\x80-\xBF]([\x80-\xBF]{2})|([\xF0-\xF4][\x80-\xBF])[\x80-\xBF]([\x80-\xBF]))	2	0	0	1
+10985	10985	^[^\x22]*[\x24\x60]+	2	0	0	1
+10986	10986	^[^\x22]*[\x24\x60]+	2	0	0	1
+10987	10987	^[a-z0-9\-_\.\/]+\x00	2	0	0	1
+10988	10988	^SOAPAction\x3a\s+?[^\r\n]*?http\x3a\/\/purenetworks\.com\/HNAP1\/([^\x2f]+?[\x2f])?[^\x2f]	2	0	0	1
+10989	10989	\/dev-report-overview\.html[^\"]*?\x3b	2	0	0	1
+10990	10990	^\s*\x22{2}	2	0	0	1
+10991	10991	^[\x22\x27]t(eamviewer(\d+|api)|v(c(hat|ontrol)|filetransfer|joinv|present|s(endfile|q(customer|support))|v(ideocall|pn))\d)	2	0	0	1
+10992	10992	^Host\x3a[^\n]{0,50}?\x3b	2	0	0	1
+10993	10993	^[\s>]	2	0	0	1
+10994	10994	^[\s>]	2	0	0	1
+10995	10995	^((\x0d\x0a).)+\x22(https?|file):\x2f\x2f	2	0	0	1
+10996	10996	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+10997	10997	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+10998	10998	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+10999	10999	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+11000	11000	^\s*?\x29	2	0	0	1
+11001	11001	^\s*?\(x\s*,\s*1,\s*24000\s*\x29	2	0	0	1
+11002	11002	^\s*[\x22\x27][^\x22\x27]{0,128}\x2e\x2e	2	0	0	1
+11003	11003	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+11004	11004	=\s*\x25\s*\{\s*.+?\bProcessBuilder\b	2	0	0	1
+11005	11005	^[ a-zA-Z0-9+_]*[\x27\x3b]	2	0	0	1
+11006	11006	destination=[^&]*\x24\x28	2	0	0	1
+11007	11007	name=[^&]*\x24\x28	2	0	0	1
+11008	11008	^[^&]+\x2527(UNION|SELECT)	2	0	0	1
+11009	11009	[^&]*(\x60|\x24)	2	0	0	1
+11010	11010	(\x60|\x24)	2	0	0	1
+11011	11011	(\/GponForm\/diag_FORM\?images\/|\.html\?images\/)	2	0	0	1
+11012	11012	^((\S\:\\){2,}|\S\:\\\S\:\S\:|S\:\\\\\\([0-9]{1,3}\.){3}[0-9]{1,3}|\S\:\\\\\\([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+11013	11013	^(www\.)?(cisco|linksys)\.com\/jnap\/	2	0	0	1
+11014	11014	^.{1,10}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)	2	0	0	1
+11015	11015	(\%3C){1000}	2	0	0	1
+11016	11016	A{1000}	2	0	0	1
+11017	11017	id\=[^\r\n]*?(select|delete|union|update|insert)	2	0	0	1
+11018	11018	^\d{2,5}(\&|\d)	2	0	0	1
+11019	11019	^(8=|9BQQ==)\r?\n?	2	0	0	1
+11020	11020	=\s*\x25\s*\{\s*(.+?\bgetRunTime\b).+?\bexec\b	2	0	0	1
+11021	11021	^[0-9]+	2	0	0	1
+11022	11022	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\[[^\x5d]*?\W	2	0	0	1
+11023	11023	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\%5b[^\x5d]*?\W	2	0	0	1
+11024	11024	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\[[^\x5d]*?\W	2	0	0	1
+11025	11025	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\%5b[^\x5d]*?\W	2	0	0	1
+11026	11026	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\[[^\x5d]*?\W	2	0	0	1
+11027	11027	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\%5b[^\x5d]*?\W	2	0	0	1
+11028	11028	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+11029	11029	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+11030	11030	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\[[^\x5d]*?\W	2	0	0	1
+11031	11031	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\%5b[^\x5d]*?\W	2	0	0	1
+11032	11032	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\[[^\x5d]*?\W	2	0	0	1
+11033	11033	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\%5b[^\x5d]*?\W	2	0	0	1
+11034	11034	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\[[^\x5d]*?\W	2	0	0	1
+11035	11035	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\%5b[^\x5d]*?\W	2	0	0	1
+11036	11036	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+11037	11037	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+11038	11038	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\[[^\x5d]*?\W	2	0	0	1
+11039	11039	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\%5b[^\x5d]*?\W	2	0	0	1
+11040	11040	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\[[^\x5d]*?\W	2	0	0	1
+11041	11041	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\%5b[^\x5d]*?\W	2	0	0	1
+11042	11042	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\[[^\x5d]*?\W	2	0	0	1
+11043	11043	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\%5b[^\x5d]*?\W	2	0	0	1
+11044	11044	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+11045	11045	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+11046	11046	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\[[^\x5d]*?\W	2	0	0	1
+11047	11047	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\%5b[^\x5d]*?\W	2	0	0	1
+11048	11048	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\[[^\x5d]*?\W	2	0	0	1
+11049	11049	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\%5b[^\x5d]*?\W	2	0	0	1
+11050	11050	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\[[^\x5d]*?\W	2	0	0	1
+11051	11051	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\%5b[^\x5d]*?\W	2	0	0	1
+11052	11052	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+11053	11053	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+11054	11054	ping_addr=[\d.]*[^\d.]	2	0	0	1
+11055	11055	\?write_(m(ac|sn)|hdv|pid|tan)&[^&]*\x3b	2	0	0	1
+11056	11056	^User-Agent\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}	2	0	0	1
+11057	11057	^X-Forwarded-For\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}	2	0	0	1
+11058	11058	pjl\x5Fready\x5Fmessage\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+11059	11059	^[^=]{1,}$	2	0	0	1
+11060	11060	^\x22[^\x22]*\x3b[^\x22]*\x22/P	2	0	0	1
+11061	11061	^\s*[\x22\x27]	2	0	0	1
+11062	11062	\.hta([?&]|$)	2	0	0	1
+11063	11063	^[A-Za-z0-9+/]{0,4}?[^\x20-\x7e]	2	0	0	1
+11064	11064	\%(25)?temp\%	2	0	0	1
+11065	11065	^[a-zA-Z0-9]+$	2	0	0	1
+11066	11066	[^&]*(\x60|\x24)	2	0	0	1
+11067	11067	^User-Agent\x3a[^\r\n]*JDatabaseDriverMysqli/Hmi	2	0	0	1
+11068	11068	(localhost|127\.0\.0\.1)/W	2	0	0	1
+11069	11069	^[^\r\n]{128,}\r\n	2	0	0	1
+11070	11070	^[^\+]+\+0A	2	0	0	1
+11071	11071	^[^\+]+(\+[A-F0-9]{2}){4,}	2	0	0	1
+11072	11072	^.{0,100}\+0A.{0,100}\x40	2	0	0	1
+11073	11073	^[^\r\n]{50,}	2	0	0	1
+11074	11074	^\S{0,7}\/(meeting|fb\/smb|namedusers|metric)	2	0	0	1
+11075	11075	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+11076	11076	^(((:?0x[a-f0-9]{2}|0+?\d{1,3})\s*?,\s*?)*?\d{1,3})(((:?0x[a-f0-9]{2}|\d{1,3})\s*?,\s*?)*?0+?\d{1,3})(((:?0+?\d{1,3}|\d{1,3})\s*?,\s*?)*?0x[a-f0-9]{2})((:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?,\s*?)+(:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?\)	2	0	0	1
+11077	11077	^form(Ping|Tracert)$	2	0	0	1
+11078	11078	^form(Ping|Tracert)$	2	0	0	1
+11079	11079	^.{1,50}\/uapi-cgi\/	2	0	0	1
+11080	11080	^.{1,50}\/uapi-cgi\/	2	0	0	1
+11081	11081	^[^&]{150,}	2	0	0	1
+11082	11082	^[^&]{150,}	2	0	0	1
+11083	11083	\bexec\b	2	0	0	1
+11084	11084	parent=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+11085	11085	oId=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+11086	11086	[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+11087	11087	^\s+?[^\s\>]+?\s+?SYSTEM\s	2	0	0	1
+11088	11088	^[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+11089	11089	^[A-Z]{8}\x3a	2	0	0	1
+11090	11090	^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5bnull\x5d	2	0	0	1
+11091	11091	^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5b\x5d	2	0	0	1
+11092	11092	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+11093	11093	^.{0,5}(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+11094	11094	^\s*(<worker>[A-Za-z0-9_-]{1,20})\s*=\s*null\x3b.{1,300}(=worker)\s*=\s*document\.getElementById\([\x22\x27](=worker)[\x22\x27]\)\x3b.{1,300}\.addEventListener\([\x22\x27]DOMNodeInserted[\x22\x27]\s*,\s*(<callback0>[A-Za-z0-9_-]{1,20}).{0,300}(=worker)(<worker_ext>(\.\w{1,20})+)\s*=\s*\d+\x3b.{1,300}function\s*(=callback0)\([^\)]+\)\s*\{\s*.{1,300}\.requestAnimationFrame\((<callback>[A-Za-z0-9_-]{1,20})\)\x3b.{1,300}function\s*(<garbagecollector>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*.{0,100}for\s*\(let\s*(<gc_counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=gc_counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=gc_counter)(\+{2}|-{2})\s*\)\s*.{1,300}function\s*(=callback)\([^\)]+\)\s*\{\s*.{1,300}(=garbagecollector)\(\)\s*\x3b\s*.{1,300}\((=worker)(=worker_ext)\)	2	0	0	1
+11095	11095	^\s*(<opt>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*let\s*(<o_var>[A-Za-z0-9_-]{1,20})\s*=\s*\{\}\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=o_var)\.(<x_prop>[A-Za-z0-9_-]{1,20}).{1,300}for\s*\(\s*let\s*(<counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)(\+{2}|-{2})\).{1,100}(=opt)\(\).{1,300}let\s*(<leaked_stack_obj>[A-Za-z0-9_-]{1,20})\s*=\s*null.{1,100}let\s*(<obj_proto>[A-Za-z0-9_-]{1,20})\s*=\s*\(\{\}\)\.__proto__\x3b.{1,300}(=obj_proto)\.__defineGetter__\([\x22\x27](=x_prop)[\x22\x27],\s*Error\.prototype\.toString\)\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=obj_proto)\.__defineGetter__\([\x22\x27](<message_proto>[A-Za-z0-9_-]{1,20})[\x22\x27].{1,300}delete\s*(=obj_proto)\.(=message_proto)\x3b.{1,300}(=obj_proto)\.\w+\s*=\s*Array\.prototype.{1,300}(=opt)	2	0	0	1
+11096	11096	^\s*(<func_opt>[\w-]{1,20})\((<var_a>[\w-]{1,20})\s*,\s*(<var_b>[\w-]{1,20}).{1,300}((=var_a)\.(=var_b)|(=var_b)\.(=var_a))\s*=\s*\d+\x3b\s*((=var_a)|(=var_b))\.push\(\d+\)\x3b\s*((=var_a)\.(=var_a)|(=var_b)\.(=var_b))\s*=\s*0x.{1,300}Object\.prototype\.push\s*=\s*Array\.prototype\.push\x3b\s*for\s*\(\s*let\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\).{1,300}let\s*((=var_a)|(=var_b))\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}\x3b.{1,300}(=func_opt)\(((=var_a)|(=var_b)),\s*\{\}.{1,300}let\s*(<var_o>[\w-]{1,20})\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}.{1,300}(=func_opt)\((=var_o)	2	0	0	1
+11097	11097	^\s*(<func_a>[\w-]{1,20})\((<obj1>[\w-]{1,20})\s*,\s*(<tmp_obj>[\w-]{1,20})\s*,\s*(<value>[\w-]{1,20})\).{1,300}(=obj1)\.\w+\s*=\s*\d+\.\d+\x3b\s*var\s*\w+\s*=\s*\{__proto__:\s*(=tmp_obj)\}\x3b\s*(=obj1)\.\w+\s*=\s*(=value)\x3b.{1,300}var\s*(=obj1)\s*=\s*\{\w+:\s*\d+\.\d+\s*,\s*\w+:\s*\d+\.\d+\}\x3b\s*for\s*\(\s*var\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\)\s*\{\s*(=func_a)\((=obj1)\s*,\s*(\x22{2}|\x27{2})\s*,\s*(\x22{2}|\x27{2})\)\x3b.{1,300}(=func_a)\((=obj1)\s*,\s*(=obj1)\s*,\s*\d+\.\d{8,}.{1,300}eval\((=obj1)\.	2	0	0	1
+11098	11098	^form(RebootCheck|Wsc)$	2	0	0	1
+11099	11099	^[^&]{42,}	2	0	0	1
+11100	11100	^[^&]{512,}	2	0	0	1
+11101	11101	^Callback\x3a\x20\x3chttp[^\x3a]+\x3a\d{1,5}[^\/]/Hmi	2	0	0	1
+11102	11102	^[^&]{90,}	2	0	0	1
+11103	11103	^\d[012345]	2	0	0	1
+11104	11104	^\d[012345]	2	0	0	1
+11105	11105	^\d[012345]	2	0	0	1
+11106	11106	^\d[012345]	2	0	0	1
+11107	11107	^\d[012345]	2	0	0	1
+11108	11108	^\d[012345]	2	0	0	1
+11109	11109	^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e)	2	0	0	1
+11110	11110	^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e)	2	0	0	1
+11111	11111	^[^&\x0d\r]+[\n\x0a]	2	0	0	1
+11112	11112	^\s*(<func_a>[\w\-]{1,20})\((<obj_1>[\w\-]{1,20})\s*,\s*(<obj_2>[\w\-]{1,20}).{1,300}(=obj_1)\.(<prop_2>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,300}?(=obj_2)\.pop\(\).{1,300}?(=obj_1)\.(<prop_1>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,500}Object\.prototype\.p(op|ush)\s*=\s*Array\.prototype\.p(op|ush)\x3b.{1,500}var\s*(<obj_3>[\w\-]{1,20})\s*=\s*\{\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)?\s*,\s*((=prop_2)\s*\x3a\s*\d+(\.\d+)?|(=prop_2)\s*\x3a\s*\d+(\.\d+)?\s*,\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)).{1,500}(=func_a)\(\s*((=obj_3)\s*,\s*new\s*Object\(\)|\s*new\s*Object\(\)\s*,\s*(=obj_3)\s*).{1,500}?(=func_a)\((=obj_3)	2	0	0	1
+11113	11113	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+11114	11114	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+11115	11115	^[^&\r\n]+(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+11116	11116	^(%[a-f0-9]{2}){5,}	2	0	0	1
+11117	11117	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+11118	11118	^%(3b|0a|26|60|7C|24)	2	0	0	1
+11119	11119	^\/(icons|cgi-bin)	2	0	0	1
+11120	11120	^\/(icons|cgi-bin)	2	0	0	1
+11121	11121	^\/(icons|cgi-bin)	2	0	0	1
+11122	11122	[^\r\n]*true	2	0	0	1
+11123	11123	\x2f(FURUKAWA|APROS)\x2f	2	0	0	1
+11124	11124	[^\r\n]*(\x60|\x24|\x7c|\bsh\b)	2	0	0	1
+11125	11125	^[^\r\n=]*(union|select)	2	0	0	1
+11126	11126	^[^&=]*(union|select)	2	0	0	1
+11127	11127	^(<class>[A-Z0-9_-]{1,20})\s*.*?(<var>[A-Z0-9_-]{1,15})\s*=\s*(&amp\x3b|0x|\\x|&?h)*\d{8}\s*.*?(ReDim|Dim)\s*(=var)\(\d{4,20}\).*?set\s*(=var)\(\d+\)\s*=\s*new\s*(=class).*?Erase\s*(=var).*?Erase\s*(=var)	2	0	0	1
+11128	11128	^[^\x22]+\.jsp\x22	2	0	0	1
+11129	11129	([\x60\x3b\x7c]|%60|%3b|%7c|%26|(\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+11130	11130	^[\s\x22\x27]*check_ping\b	2	0	0	1
+11131	11131	^\s*(<obj>[\w\-]{1,20})\s*=\s*document\.getElementById\(.{1,500}Class\s*(<class>[\w\-]{1,20}).{1,500}End\s*Class.{1,500}set\s*(=obj)\.scroll((Left|Top)(Max)?|Height|Width)\s*=\s*New\s*(=class)	2	0	0	1
+11132	11132	[^\r\n]*\x5c(n|c)[^\r\n]{0,100}[\x60\x24]	2	0	0	1
+11133	11133	([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+11134	11134	^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+11135	11135	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+11136	11136	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+11137	11137	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+11138	11138	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+11139	11139	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+11140	11140	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+11141	11141	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+11142	11142	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+11143	11143	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+11144	11144	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+11145	11145	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+11146	11146	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+11147	11147	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+11148	11148	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+11149	11149	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+11150	11150	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+11151	11151	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+11152	11152	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+11153	11153	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+11154	11154	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+11155	11155	\.((php\d{0,}|phps|pht|phtm|phtml|shtml|htaccess|phar|inc))	2	0	0	1
+11156	11156	^[^&]{100,}	2	0	0	1
+11157	11157	^[a-zA-Z0-9]+\.(zip|7z|gz)	2	0	0	1
+11158	11158	^(\x28|\x29|\x3c|\x3e|\x26|\x2a|\xe2|\x80|\x98|\x7c|\x3f|\x3b|\x5b|\x5d|\x5e|\x7e|\x21|\x2e|\xe2|\x80|\x9d|\x25|\x40|\x2f|\x5c|\x3a|\x2b|\x2c|\x60)	2	0	0	1
+11159	11159	^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr)	2	0	0	1
+11160	11160	^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr)	2	0	0	1
+11161	11161	^[0-9]{1,10}\x3b	2	0	0	1
+11162	11162	^(%2e|\.)exec	2	0	0	1
+11163	11163	^[a-zA-Z0-9]{5,40}	2	0	0	1
+11164	11164	^[a-zA-Z0-9]{7,200}	2	0	0	1
+11165	11165	^\d+..([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))-XX:OnOutOfMemoryError=	2	0	0	1
+11166	11166	^[^&=]*(union|select|update|insert|delete)	2	0	0	1
+11167	11167	^[^&=]*(union|select|update|insert|delete)	2	0	0	1
+11168	11168	((%2F|\/)(\.|%2E){2}(%2F|\/))	2	0	0	1
+11169	11169	((%2F|\/)(\.|%2E){2}(%2F|\/))	2	0	0	1
+11170	11170	^(%2E%2E%2F|\.\.\/)	2	0	0	1
+11171	11171	^[a-zA-Z0-9]{5,45}	2	0	0	1
+11172	11172	^([A-Z]\x00){20}\x00\x00	2	0	0	1
+11173	11173	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+11174	11174	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+11175	11175	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+11176	11176	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+11177	11177	^SOAPAction\x3a\x20\x22?urn\x3aNETGEAR-ROUTER\x3aservice\x3a.{128,}(:\d#)/Hm	2	0	0	1
+11178	11178	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+11179	11179	^[a-zA-Z0-9+/]{1000,}	2	0	0	1
+11180	11180	\We[\s\x22\x27,+]*?v[\s\x22\x27,+]*?a[\s\x22\x27,+]*?l\W	2	0	0	1
+11181	11181	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+11182	11182	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+11183	11183	^[^<]{30,}<\/NewMACAddress>	2	0	0	1
+11184	11184	^0+(&|$)	2	0	0	1
+11185	11185	^0+(&|$)	2	0	0	1
+11186	11186	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+11187	11187	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+11188	11188	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+11189	11189	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+11190	11190	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+11191	11191	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+11192	11192	^\/(icons|cgi-bin)	2	0	0	1
+11193	11193	^\/(icons|cgi-bin)	2	0	0	1
+11194	11194	^\/(icons|cgi-bin)	2	0	0	1
+11195	11195	^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+11196	11196	(yJ0eXAiOiJKV1Qi|InR5cCI6IkpXVCJ)/H	2	0	0	1
+11197	11197	^(CREATE|SELECT|INSERT|UPDATE|EXEC)	2	0	0	1
+11198	11198	^["']\s*:\s*["']\s*[^0-9]+	2	0	0	1
+11199	11199	^\s?([\x3b\x0a\x26\x60\x7c\x24]|%(3b|0a|26|60|7c|24))	2	0	0	1
+11200	11200	^\s*=\s*[\x22\x27]\s*ms-msdt\x3a	2	0	0	1
+11201	11201	(\x2e|%2e)(\x2e|%2e)(\x2f|%2f)	2	0	0	1
+11202	11202	myname=[^&]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+11203	11203	^\x2fdefault\x2fen_US\x2fframe(\x2eA100)?\x2ehtml\?(content|sidebar)=.*\x2e\x2e\x2f	2	0	0	1
+11204	11204	^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+11205	11205	^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+11206	11206	[^a-zA-Z0-9_\-\.][a-zA-Z]{8}\.jar	2	0	0	1
+11207	11207	^\s?(file|https?)\x3a	2	0	0	1
+11208	11208	^(\/?\.\.?\/){2}	2	0	0	1
+11209	11209	\b(<xps>[a-zA-Z]{7})\.classPK.+?\b(=xps)\[a-zA-Z]{12}\.classPK.+?\b(=xps)\$[a-zA-Z]{12}\.classPK	2	0	0	1
+11210	11210	^[\r\n\s\+]*.+?\}[\r\n\s]*?catch	2	0	0	1
+11211	11211	^(application\/(x-)?|text\/)xml	2	0	0	1
+11212	11212	^(application\/(x-)?|text\/)xml	2	0	0	1
+11213	11213	\/((index|toc)\.html?)?\?\/\/	2	0	0	1
+11214	11214	^.{0,10}[\x3b\x0a\x26\x60\x7c\x24]	2	0	0	1
+11215	11215	[?&]ap=	2	0	0	1
+11216	11216	^\d+\s*[^\r\n]{50,}	2	0	0	1
+11217	11217	(web|decorators|seraph-config)\x2exml$	2	0	0	1
+11218	11218	com.atlassian.jira\x2f(jira\x2dwebapp\x2ddist|atlassian\x2djira\x2dwebapp)\x2fpom\x2e(properties|xml)$	2	0	0	1
+11219	11219	^[^\x3c]{,100}\x27	2	0	0	1
+11220	11220	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+11221	11221	^(Begin|End)\=/P	2	0	0	1
+11222	11222	\/\?[a-f0-9]{64}\;\d\;\d	2	0	0	1
+11223	11223	\x7b?(visibility\x3ahidden|display\x3anone)\x3b?\x7d?\x22><div>\d{16}	2	0	0	1
+11224	11224	\/[a-z]\/[0-9a-f]{32}$	2	0	0	1
+11225	11225	\/dl\/\w{1,4}\.php\?[0-9]$	2	0	0	1
+11226	11226	\/[a-f0-9]{60,}_js\?	2	0	0	1
+11227	11227	\/[a-f0-9]{60,}_jar$	2	0	0	1
+11228	11228	\/[a-f0-9]{60,}_exe$	2	0	0	1
+11229	11229	,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,	2	0	0	1
+11230	11230	^\/showthread\.php\?t=\d+$	2	0	0	1
+11231	11231	function\x20booom[1-3]{1}\x28\x29	2	0	0	1
+11232	11232	var\x20Cute(Money|Power|Shine)	2	0	0	1
+11233	11233	iframe[^\r\n]*\x2FCUTE-IE\x2Ehtml	2	0	0	1
+11234	11234	^\/[a-z][0-9a-z_+=-]{10,30}\?\w=[0-9.]+\&\w=1.6.0_\d\d$	2	0	0	1
+11235	11235	\.php\?(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+$	2	0	0	1
+11236	11236	\/[a-z0-9]+\.[a-z0-9]{2,4}\/eH[a-z0-9]{60,}$	2	0	0	1
+11237	11237	\/[a-z0-9]+\.[a-z0-9]{2,4}\/oH[a-z0-9]{60,}$	2	0	0	1
+11238	11238	\/indigo\?\d+	2	0	0	1
+11239	11239	^\/\?[a-f0-9]{32}$	2	0	0	1
+11240	11240	=[.\"]\w{8}\.jar/Hi	2	0	0	1
+11241	11241	\.php\?showtopic=[0-9]{6}$	2	0	0	1
+11242	11242	\/[0-9]\.html$	2	0	0	1
+11243	11243	^\?[a-f0-9]{32}\" 	2	0	0	1
+11244	11244	^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$	2	0	0	1
+11245	11245	^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$	2	0	0	1
+11246	11246	^\/t\/[a-f0-9]{32}	2	0	0	1
+11247	11247	\/[A-Z]{20,}\?[A-Z]=\d$	2	0	0	1
+11248	11248	^\/q[a-zA-Z0-9+-]{3,14}\/[a-zA-Z0-9+-]{3,16}\?[a-z]{1,6}=[a-zA-Z0-9+-\._]{7,18}$	2	0	0	1
+11249	11249	^\/Applet\.jar$	2	0	0	1
+11250	11250	\/beacon\/[a-f0-9]{8}\.htm$	2	0	0	1
+11251	11251	\/t\/[a-f0-9]{32}$	2	0	0	1
+11252	11252	^\/[0-9]{3}\.jar$	2	0	0	1
+11253	11253	^[\r\n\s]*[\d\x5b]	2	0	0	1
+11254	11254	^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.jar$	2	0	0	1
+11255	11255	^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.pdf$	2	0	0	1
+11256	11256	\/[0-9]{3}\.pdf	2	0	0	1
+11257	11257	\(\x22[0-9\x3a\x3b\x3c\x3d\x3e\x3fa-k]{50,100}\x22\).{0,200}\)\x3b<\/script><\/body>	2	0	0	1
+11258	11258	^[a-f0-9]{32}	2	0	0	1
+11259	11259	^((<\/applet>).)+?\/.{1,12}\/.{1,12}\x3a.{1,12}p.{1,12}t.{1,12}t.{1,12}h	2	0	0	1
+11260	11260	^(\s*=\s*|[\x22\x27]\s*,\s*)[\x22\x27]	2	0	0	1
+11261	11261	^[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])(((=q)).)+?\.(gif|jpe?g|p(ng|sd))(=q)	2	0	0	1
+11262	11262	^((<\/applet>).)+[\r\n\s]value[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])[a-f0-9]{32}(=q1)	2	0	0	1
+11263	11263	^\/[a-z0-9A-Z]{25,35}\/(([tZFBeDauxR]+q){3}[tZFBeDauxR]+(_[tZFBeDauxR]+)?|O7dd)k(([tZFBeDauxR]+q){3}[tZFBeDauxR]+|O7dd)\/	2	0	0	1
+11264	11264	EGYPACK_CRYPT\d	2	0	0	1
+11265	11265	\/\?[0-9a-f]{60,66}\x3b(1(0[0-3]|1\d)|90)\d{1,3}\x3b\d{1,3}$	2	0	0	1
+11266	11266	^(ckwm)*?(Exp|cc)\.class	2	0	0	1
+11267	11267	^\/command\/[a-zA-Z]{6}$	2	0	0	1
+11268	11268	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+11269	11269	^(a(ttack|dEx[xp])|([a-z]))\.class	2	0	0	1
+11270	11270	^(a(ttack|dEx[xp])|([a-z]))\.class	2	0	0	1
+11271	11271	^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27]((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){10}|(=ascii){10})	2	0	0	1
+11272	11272	^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27][^\x22\x27]+?[\x22\x27][^>]*((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){9,20}|(=ascii){9,20})%3C	2	0	0	1
+11273	11273	^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$	2	0	0	1
+11274	11274	^\/[0-9]{1,2}\/red[0-9]{1,4}\.php[0-9]{0,1}$	2	0	0	1
+11275	11275	\.php\?(b=[a-fA-F0-9]{6}&)?v=1\.((4\.[0-2]\.[0-3]|5\.0\.[0-2]|6.0\.[0-4])\d?|[7-8]\.0\.\d{1,2})$	2	0	0	1
+11276	11276	&k=\d{16}(&|$)	2	0	0	1
+11277	11277	^(((?i:<\/applet>)).)+?[\r\n\s]value[\r\n\s]*[\r\n\s]*?[\x22\x27]?(\d{2,3})?(<sep>([^a-zA-Z0-9]{1,100}|[a-zA-Z0-9]{1,100}))\d{2,3}((=sep)\d{2,3}){20}	2	0	0	1
+11278	11278	^(((?i:<\/applet>)).)+?[\r\n\s]archive[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27]	2	0	0	1
+11279	11279	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+11280	11280	if.{1,10}[<>]=?\s*(<quot>[\x22\x27])1(<sep>[^0-9a-zA-Z])7((=sep)\d+)?(=quot).{1,10}[<>]=?\s*(=quot)1(=sep)7((=sep)\d+)?(=quot)	2	0	0	1
+11281	11281	^[\r\n\s]*[\r\n\s]*?[\x22\x27]http\x3a\/\/[^\/]+?\/\?[A-Za-z0-9]+=[A-Za-z0-9%]{60,}[\x22\x27]	2	0	0	1
+11282	11282	^[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\x22\x27]\.replace\([\r\n\s]*?(<q1>[\x22\x27]?)\/.+?\/g[\r\n\s]*?,[\r\n\s]*?(<q2>[\x22\x27]?)%(=q2)[\r\n\s]*?\)	2	0	0	1
+11283	11283	(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{12,16}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a)	2	0	0	1
+11284	11284	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27]	2	0	0	1
+11285	11285	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(<dot>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<p>((=dot))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<h>(((=p)|(=dot)))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=p).+?value[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(=dot)([^a-f0-9]{2}){1,20}(<e>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<x>((=e))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=e)(([^a-f0-9]{2}){1,20})?[\x22\x27]	2	0	0	1
+11286	11286	\/[a-f0-9]{32}\/[a-z]+?\-[a-z]+?\.php	2	0	0	1
+11287	11287	\.php\?e=\d+(&|$)	2	0	0	1
+11288	11288	^[\r\n\s]*?[\x22\x27][a-f0-9]{2}(<sep>[^a-f0-9]{1,10})(<a>[a-f0-9]{2})(=sep)(<p>[a-f0-9]{2})(=sep)(=p)(=sep)(<l>[a-f0-9]{2})(=sep)(<e>[a-f0-9]{2})[^\x22\x27]+?(=sep)(=p)(=sep)(=a)(=sep)[a-f0-9]{2}(=sep)(=a)(=sep)[^\x22\x27]+?(=sep)(=a)(=sep)(=l)(=sep)[a-f0-9]{2}(=sep)(=e)	2	0	0	1
+11289	11289	\/cod\/[^\x2f]+\.vbs$	2	0	0	1
+11290	11290	[a-f0-9]{32}\.jar	2	0	0	1
+11291	11291	^[^a-z0-9]	2	0	0	1
+11292	11292	\.php\?dwl=[a-z]+$	2	0	0	1
+11293	11293	^[\r\n\s]*[\r\n\s]*?[\x22\x27]h(<sep>\d{2})t(=sep)t(=sep)p(=sep)\x3a	2	0	0	1
+11294	11294	^[\r\n\s]*?[\x22\x27]<([\x27\x22]\s*?\+\s*?[\x22\x27])?a([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?l([\x27\x22]\s*?\+\s*?[\x22\x27])?e([\x27\x22]\s*?\+\s*?[\x27\x22])?t	2	0	0	1
+11295	11295	^\/ep\/cl\.php$	2	0	0	1
+11296	11296	^[\r\n\s]*?[\x22\x27]<applet	2	0	0	1
+11297	11297	=\d+&e=\d+$	2	0	0	1
+11298	11298	\/\d+\/\d\.zip$	2	0	0	1
+11299	11299	(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{10,20}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a)	2	0	0	1
+11300	11300	(<a>[0-9a-z]{2})(<s>((=a))[0-9a-z]{2})[0-9a-z]{2}(=s)[0-9a-z]{2}(<y>[0-9a-z]{2})[0-9a-z]{4}(<dot>[0-9a-z]{2})(=a)(<r>[0-9a-z]{2})(=r)(=a)(=y)(=dot)	2	0	0	1
+11301	11301	^[\r\n\s]*?\(	2	0	0	1
+11302	11302	\/[a-z0-9]{32}\.jar$	2	0	0	1
+11303	11303	^[^\s]*?\s*?\/[^\r\n\s]*?\?src=	2	0	0	1
+11304	11304	^\/([\/_]*?[a-f0-9][\/_]*?){32}\/\d+?$	2	0	0	1
+11305	11305	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?\/([\/_]*?[a-f0-9][\/_]*?){64}[\x22\x27]	2	0	0	1
+11306	11306	^\/([\/_]*?[a-f0-9][\/_]*?){32}$	2	0	0	1
+11307	11307	^\/[a-zA-Z0-9_\x2f-]{300,}\.jar$	2	0	0	1
+11308	11308	^\/[a-zA-Z0-9_\x2f-]{300,}\.eot$	2	0	0	1
+11309	11309	^((<\/applet>).)+?[\x22\x27]687474703a2f2f	2	0	0	1
+11310	11310	\.html\?sv=[1-5](\,\d+?){1,3}$	2	0	0	1
+11311	11311	\/(d|xie|fla)\.php\?[a-z]+687474703a2f2f	2	0	0	1
+11312	11312	\.html\?jar$	2	0	0	1
+11313	11313	^\/\d{4,5}\/\d{7}$	2	0	0	1
+11314	11314	\/\{0,2}[A-Za-z0-9\+\/]+?LvoDc0RHa8NnZ$	2	0	0	1
+11315	11315	^[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*?\.charCodeAt[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*[\r\n\s]*?\)[\r\n\s]*?\^[\r\n\s]*?[a-zA-Z_$][^\r\n\s]*\.charCodeAt[\r\n\s]*?\(	2	0	0	1
+11316	11316	^(<sep>[^\x22\x27]{1,10})100(=sep)97(=sep)115(=sep)104(=sep)115(=sep)116(=sep)121(=sep)108(=sep)101(=sep)46(=sep)97(=sep)114(=sep)114(=sep)97(=sep)121(=sep)	2	0	0	1
+11317	11317	^[a-z0-9]{1,500}?(<s>[a-z0-9]{2})(<t>((=s))[a-z0-9]{2})(<r>(((=s)|(=t)))[a-z0-9]{2})(=t)(<o>(((=s)|(=t)|(=r)))[a-z0-9]{2})(<b>(((=s)|(=t)|(=r)|(=o)))[a-z0-9]{2})(<y>(((=s)|(=t)|(=r)|(=o)|(=b)))[a-z0-9]{2})(=t)((((=s)|(=t)|(=r)))[a-z0-9]{4})(=s)(=t)(=r)	2	0	0	1
+11318	11318	^\/[a-z0-9]+?\?thread=\d+?&x?key=[A-F0-9]{32}$	2	0	0	1
+11319	11319	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+11320	11320	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+11321	11321	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+11322	11322	\/[A-Z]\.xml$	2	0	0	1
+11323	11323	^(<sep>((100).){1,20})100(=sep)101(=sep)102(=sep)97(=sep)117(=sep)108(=sep)116(=sep)35(=sep)86(=sep)77(=sep)76(=sep)	2	0	0	1
+11324	11324	\.php\?a=[^&]+&f=[a-f0-9]{32}&u=[^&]+$	2	0	0	1
+11325	11325	\.php\?a=(dw[a-z0-9]|[hr][2-7])$	2	0	0	1
+11326	11326	(PK\x01\x02.{24}\x0a\x00.{16}[a-z]{4}.class){4}	2	0	0	1
+11327	11327	^(((?i:<\/applet>)).)+?(?i:value)[\r\n\s]*=[\r\n\s]*\x5c?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]+(=slash)	2	0	0	1
+11328	11328	^\d+u\d+s\d+h\d	2	0	0	1
+11329	11329	^((<\/applet>).)+?&#(0*?(1([0-1]\d|2[0-2])|[78][0-9]|9[07-9]|4[8-9]|5[0-7]|6[5-9])|x0*?([46][1-9A-F]|[57][0-9A]|3[0-9]))(\x3b|&#)	2	0	0	1
+11330	11330	^\s*?\d	2	0	0	1
+11331	11331	^\s*\s*?[\x22\x27][^\x22\x27\x3d]{1,20}=[a-f0-9]{20}	2	0	0	1
+11332	11332	^[^\d]{1,20}100[^\d]{1,20}101[^\d]{1,20}102[^\d]{1,20}97[^\d]{1,20}117[^\d]{1,20}108[^\d]{1,20}116[^\d]{1,20}35[^\d]{1,20}86[^\d]{1,20}77[^\d]{1,20}76	2	0	0	1
+11333	11333	^\s*?<<\s*?\/[A-Z0-9a-z]+\([A-Z0-9a-z]+\)\s*?	2	0	0	1
+11334	11334	^\/[a-f0-9]{32}\.php\?q=[a-f0-9]{32}$	2	0	0	1
+11335	11335	\.php\?req=(swf(IE)?|x(ap|ml)|jar|mp3)&	2	0	0	1
+11336	11336	(\0[a-z]{3}\.classPK.{43}){4}	2	0	0	1
+11337	11337	^[\x22\x27]	2	0	0	1
+11338	11338	^\s*\s*?window\.document\.createElement	2	0	0	1
+11339	11339	^(<sep>[^\x22\x27]{0,10})6f(=sep)6c(=sep)6c(=sep)65(=sep)63(=sep)74(=sep)47(=sep)61(=sep)72(=sep)62(=sep)61(=sep)67(=sep)65(=sep)	2	0	0	1
+11340	11340	\/3\/[a-f0-9]{32}\/http\x3a\x2f	2	0	0	1
+11341	11341	\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+)?$	2	0	0	1
+11342	11342	^\x2Fload\x5Fmodule\x2Ephp\x3Fuser\x3D(n1|11?|2)$	2	0	0	1
+11343	11343	^\x2Fmodules\x2F(n[u3]|1|2)\x2Eswf$	2	0	0	1
+11344	11344	^\x2Fmodules\x2F(1|2)\x2Ejar$	2	0	0	1
+11345	11345	^\s*?\(\s*?[\x22\x27]Flash[\x22\x27]	2	0	0	1
+11346	11346	^\s*?[\x22\x27][A-Za-z0-9\s]{500}	2	0	0	1
+11347	11347	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}<script>var	2	0	0	1
+11348	11348	^[\r\n\s]*?<script>[\r\n\s]*?[A-Za-z]+[\r\n\s]*[\r\n\s]*?[\x22\x27][A-Za-z]{9}\x20[A-Za-z\x20]{300}	2	0	0	1
+11349	11349	^\/[a-z]\?[a-z]=[0-9]{5,}$	2	0	0	1
+11350	11350	[^0-9a-f]{1,3}68[^0-9a-f]{1,3}74[^0-9a-f]{1,3}74[^0-9a-f]{1,3}70[0-9a-f]{1,3}3a	2	0	0	1
+11351	11351	^[\x22\x27]	2	0	0	1
+11352	11352	^(e(vtmgr|ext)|actmon|nciesc|EBC32|comm|tdi)\.sys[\x22\x27]	2	0	0	1
+11353	11353	^([\x22\x27]\s*?\])?\(\s*?(\[[\x22\x27])?rc4([\x22\x27]\s*?\])?\(\s*?[\x22\x27][^\x22\x27]+?[\x22\x27]\s*?,\s*?(\[[\x22\x27])?hex2bin([\x22\x27]\s*?\])?\(	2	0	0	1
+11354	11354	^[\x22\x27]	2	0	0	1
+11355	11355	^[\x22\x27]	2	0	0	1
+11356	11356	^[\x22\x27]	2	0	0	1
+11357	11357	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\?\&]e=\d+[\x22\x27]	2	0	0	1
+11358	11358	^[\r\n\s]*?\,[\r\n\s]*?[\x22\x27][\%\\]u"	2	0	0	1
+11359	11359	^(((<\/object>).)+?codebase\s*\s*?[\x22\x27]spl[\x22\x27])(((<\/object>).)+?\/x-java-applet)	2	0	0	1
+11360	11360	^[\w.]*?\.class	2	0	0	1
+11361	11361	^\s*\s*?[\x22\x27]\-	2	0	0	1
+11362	11362	^\s*\s*?[\x22\x27]\-	2	0	0	1
+11363	11363	\/Fqxzdh\.jar$	2	0	0	1
+11364	11364	^\s*?\(\s*?[\x22\x27](AgControl\.AgControl)[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?\.[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?[\x22\x27]\s*?\.\s*?replace\s*?\(	2	0	0	1
+11365	11365	^id=[^&]+&dom=687474703a2f2f[a-f0-9]+2e706870\s*?$/Ps	2	0	0	1
+11366	11366	[^=]+(([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+?2e)+([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+\s*?/P	2	0	0	1
+11367	11367	\.php\?spl=[\w_]+$	2	0	0	1
+11368	11368	^Content-Disposition\x3a[^\r\n]+\.swf/Hm	2	0	0	1
+11369	11369	Referer\x3a[^\r\n]+\.php\/\[\[DYNAMIC\]\]\/\d/Hm	2	0	0	1
+11370	11370	^\s*?[\x3a\x3d]\s*?[\x22\x27]?\-	2	0	0	1
+11371	11371	^\/f(\/[^\x2f]+)?\/14\d{8}(\/\d{9,10})?(\/\d)+(\/x[a-f0-9]+(\x3b\d)+?)?$	2	0	0	1
+11372	11372	^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{14,}\.html(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+11373	11373	^(<sep>.{1,50})u(=sep)n(=sep)c(=sep)t(=sep)i(=sep)o(=sep)n(=sep)\s	2	0	0	1
+11374	11374	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}(\r\n)*?<script>[^\r\n]+?\We[\x22\x27\+]*?v[\x22\x27\+]*?a[\x22\x27\+]*?l\W	2	0	0	1
+11375	11375	^(<sep>.{1,20})\.___\+(=sep)\._\\\+(=sep)\._\\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+(=sep)\.\\\_\+(=sep)\.\\__\+(=sep)\.__\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.___\+(=sep)\.\\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\\_\+(=sep)\._\_\+(=sep)\.\_\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\__\+(=sep)\.\\\\+(=sep)\.\\\$_\+	2	0	0	1
+11376	11376	^\/(pruncd)?flashhigh\.swf$	2	0	0	1
+11377	11377	^\/(pruncd)?flashlow\.swf$	2	0	0	1
+11378	11378	^\/(pruncd)?silverapp1\.xap$	2	0	0	1
+11379	11379	\?action=lnd$	2	0	0	1
+11380	11380	\?action=(pld|exp)&exp=	2	0	0	1
+11381	11381	^Referer\x3a[^\r\n]+\x3a\d{1,5}\/[^\r\n]*?[a-z]+?\.php\?[a-z]+\d/Hm	2	0	0	1
+11382	11382	\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Z-a-z]{18}\.jnlp$	2	0	0	1
+11383	11383	\/k\?t[a-z]*=\d{5,}$	2	0	0	1
+11384	11384	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+11385	11385	^\/[^\x2f]*?flashhigh\.swf$	2	0	0	1
+11386	11386	^\/[^\x2f]*?flashlow\.swf$	2	0	0	1
+11387	11387	^\/[^\x2f]*?iebasic\.html$	2	0	0	1
+11388	11388	^\/[^\x2f]*?silverapp1\.xap$	2	0	0	1
+11389	11389	\/[a-z]{3,7}\.php$	2	0	0	1
+11390	11390	\/([a-z0-9]{1,7}\.php)?\?zho=	2	0	0	1
+11391	11391	^\/[a-f0-9]{32}\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Za-z]+\.(html|jar|swf)$	2	0	0	1
+11392	11392	^\/Drop2(-\d+)\.swf$	2	0	0	1
+11393	11393	^[^\r\n]*?(<name>\/[^\.\/]+\.html)\?[a-z]+?\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(\d{1,5})?\r\n	2	0	0	1
+11394	11394	^Content-Disposition\x3a[^\r\n]+\.swf/Hm	2	0	0	1
+11395	11395	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi	2	0	0	1
+11396	11396	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi	2	0	0	1
+11397	11397	^\s*?\x28\s*?[a-z0-9]{4,6}\s*?\x28\s*?[a-z0-9]{1,3}\s*?,\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x29\s*?\x3b\s*?(<var>[a-z0-9]{1,3})\s*?\x3d\s*?\x28\s*?(=var)\s*?\x2b\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x25\s*?[a-z0-9]{1,3}\.length\x3b	2	0	0	1
+11398	11398	^[A-Za-z0-9]+\x27\s*?src=\x27http\x3a[^\x27]+[\x27]\s*width=1\d\s+height=1\d\s+	2	0	0	1
+11399	11399	^Last-Modified\x3a\x20[^A-Za-z]{2}/Hm	2	0	0	1
+11400	11400	^\/ABs[A-Za-z0-9_]+(\/x?[a-f0-9]+(\x3b\d+)+)?$	2	0	0	1
+11401	11401	^\/AwoVG[A-Za-z0-9_]+$	2	0	0	1
+11402	11402	^[a-z0-9]+\x2A\x2F\x22\x6F\x66\x74\x2E	2	0	0	1
+11403	11403	^Referer\x3a[^\r\n]+?rowedmedia\.com\/search\.php\r?$/Hmi	2	0	0	1
+11404	11404	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r\n)/Hmi	2	0	0	1
+11405	11405	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+11406	11406	^[a-zA-Z0-9]{9}<\/[^>]+>\s+?<[^\s]+\sid=\x22[a-zA-Z]{3,5}\x22\sstyle=\x22display\x3anone\x22>[A-Za-z0-9]{500}	2	0	0	1
+11407	11407	^[a-z]{7}(\s*?[a-z]+\s*?)*?[a-z]{7,}\x2a\x2f	2	0	0	1
+11408	11408	nb[\d+]=Yes	2	0	0	1
+11409	11409	^(<vname>[A-Za-z0-9]+)\s*\s*?navigator.userAgent.toLowerCase\x28\x29\x3b.+?if\(document.cookie[^\r\n]+\([^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]b[\x22\x27+\s]*o[\x22\x27+\s]*t[\x22\x27+\s]*[\x22\x27][^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]s[\x22\x27+\s]*p[\x22\x27+\s]*i[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*r[\x22\x27+\s]*[\x22\x27]	2	0	0	1
+11410	11410	^Referer\x3a[^\r\n]+?\x3a\d+[^\r\n]*?\/[a-z0-9]+\.php\?[a-z0-9]+=\d+(\r\n|&)/Hm	2	0	0	1
+11411	11411	^GET \/(<name>a[a-z]{9,})\/.+?\r\nHost\x3a\x20(=name)\.	2	0	0	1
+11412	11412	^\s*?[\x22\x27][^\x22\x27]+\.php\?id=\d+[\x22\x27]	2	0	0	1
+11413	11413	^\W	2	0	0	1
+11414	11414	^[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(<arg>[a-z0-9]{3,})(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28[^\x29]+\x29\x3b\x2f\x2a[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(=arg)(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28	2	0	0	1
+11415	11415	^\s*?\d+,\s*?\d	2	0	0	1
+11416	11416	^\s*?\d+,\s*?\d	2	0	0	1
+11417	11417	\/14\d{8}(\.jar)?$	2	0	0	1
+11418	11418	^[a-z0-9]*\r\n/H	2	0	0	1
+11419	11419	^[a-z0-9]*\r\n/H	2	0	0	1
+11420	11420	filename=[a-z0-9]*\r\n/H	2	0	0	1
+11421	11421	\/\??4c2H($|[&?]utm_source=)	2	0	0	1
+11422	11422	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+11423	11423	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+11424	11424	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+11425	11425	\/([A-Za-z]{0,3}\d)(\d{0,3}[A-Za-z])[A-Za-z0-9]{4,5}\.swf$	2	0	0	1
+11426	11426	^\s*[^>]*?[a-zA-Z]+\s*\s*?[\x22\x27]([a-z]{0,20}[A-Z])([A-Z]{0,20}[a-z])[A-Za-z]{15,21}[\x22\x27][^>]*([A-Za-z_]{0,200}[0-9])([0-9a-z_]{0,200}[A-Z])([0-9A-Z_]{0,200}[a-z])[A-Za-z0-9_]{200}	2	0	0	1
+11427	11427	\/5\/[a-f0-9]{32}\/\x20*http\x3a\x2f	2	0	0	1
+11428	11428	^\x2f+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x2f\??[a-f0-9]+\x7chttp\x3a\x2f	2	0	0	1
+11429	11429	^Refresh\x3a\x20\d+\x3b\x20url[^\r\n]+\/999\/00000\/\r?$/Hm	2	0	0	1
+11430	11430	^\s*?[\x22\x27][^\x22\x27a-f0-9]68[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]70[^\x22\x27a-f0-9]3a[^\x22\x27a-f0-9]2f[^\x22\x27a-f0-9]2f[^\x22\x27]+?[^\x22\x27a-f0-9]00[\x22\x27]	2	0	0	1
+11431	11431	^\/[a-f0-9]{32}\/e\.html$	2	0	0	1
+11432	11432	Host\x3a\x20a[a-z]{10}\.[a-z]{5}\./H	2	0	0	1
+11433	11433	\.js\?ver=[0-9]\.[0-9]{2}\.[0-9]{4}$	2	0	0	1
+11434	11434	\/\d\/?[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.html&[a-z]+=[^&]+&[a-z]+=\d{3}\.\d{3}\.\d{3,}(\.\d{3,})?$	2	0	0	1
+11435	11435	\/\d\/?[A-Z]+\/[a-f0-9]{40}\/$	2	0	0	1
+11436	11436	\/([a-z0-9]{0,10}[A-Z])([A-Z0-9]{0,10}[a-z])[A-Z-a-z0-9]{5,20}\.jar$	2	0	0	1
+11437	11437	\?([a-z\d\x3d&\x2e]*?[A-Z])([A-Z\d=&\x2e]*?[a-z])([A-Za-z=&\x2e]*?\d)[A-Za-z\d=&\x2e]{50,}$	2	0	0	1
+11438	11438	^\/([a-z0-9]+\/)?[^\x2f]+\?[a-z]{1,40}_id=\d{2,5}?&[a-z]{1,40}_id=\d{2,5}&[^&\x3d]+(_id)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$	2	0	0	1
+11439	11439	&cat_no=\d{2,5}?&no=\d{2,5}&[^&\x3d]+(_no)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$	2	0	0	1
+11440	11440	\x3capplet[^\x3e]+visibility[^\x3e]+hidden[^\x3e]	2	0	0	1
+11441	11441	^\s*?[a-z]+\s*\s*?\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b]	2	0	0	1
+11442	11442	^\s*?	2	0	0	1
+11443	11443	^\/[0-9a-f]{32}\.html$	2	0	0	1
+11444	11444	^\/[a-z\_\-]{4,20}\.php\?([a-z\_\-]{4,20}=\d+?&){3,}[a-z\_\-]{4,20}=-?\d+$	2	0	0	1
+11445	11445	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{4,10}=\d{1,3}&){7,}[a-z\_\-]{4,10}=-?\d+$	2	0	0	1
+11446	11446	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d{1,3}&){3,}[a-z\_\-]{4,10}=-?\d+$	2	0	0	1
+11447	11447	\.jpg$	2	0	0	1
+11448	11448	^\s+\d+\x3b\s*\}	2	0	0	1
+11449	11449	^\/([a-z][a-z\x2f]*\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d)[a-z0-9\x2f]+\/$	2	0	0	1
+11450	11450	^\/([a-z][a-z\x2f]*-[a-z\x2f]+-)[a-z\x2f-]+\/$	2	0	0	1
+11451	11451	^http\x3a\/\/[^\x2f]+\/[A-Z]([a-z0-9]+[A-Z])([A-Z0-9]+[a-z])[A-Za-z0-9]{9,}\.html?\r?$/Hmi	2	0	0	1
+11452	11452	\.js\?chebstr=0\.\d+$	2	0	0	1
+11453	11453	\.js\?chbstr=0\.\d+$	2	0	0	1
+11454	11454	^[^\r\n\x22\?]+[&?][^=\r\n\x22]+=[a-f0-9]+[^\r\n\x22\?]*[&?][^=\r\n\x22]+=[a-f0-9]+\x22\s*\x3b\s*head\.appendChild\(\s*script\s*\)\x3b	2	0	0	1
+11455	11455	^\/([a-z\d]+[+-][a-z\d]+[+-][a-z\d]+[+-])[a-z\d+-]*\/$	2	0	0	1
+11456	11456	^\s*\(\s*[\x22\x27][\x00-\x09\x80-\xff][\x22\x27]\s*\)\s*\x3b\s*[A-Za-z0-9]+\s*=\s*[\x22\x27]	2	0	0	1
+11457	11457	^\s*\x27[^\x27]+\x27width=\x27250\x27\sheight=\x27250\x27>\s*<\/iframe>\s*<\/div>	2	0	0	1
+11458	11458	^[\x3b\x2c]postRequest\x28cfg\.urlSoftDetectorCallback	2	0	0	1
+11459	11459	^[\r\n\s]*?Base64\.decode[\r\n\s]*?\x28[\r\n\s]*?[\x22\x27]	2	0	0	1
+11460	11460	Referer\x3a\x20http\x3a\x2f\x2f[^\r\n\x2f]+\/index\.php\?[^\x3d&]+=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=)?\r\n/H	2	0	0	1
+11461	11461	^[^\n]*\x29\x3b$	2	0	0	1
+11462	11462	^\s*(<var>[^\r\n\s\x3d\x2c\x3b]+)\s*=[^\n]*<iframe([^\n>]*top\x3a-\d+px\x3b)[^\n>]+src\s*=\s*\x5c?[\x22\x27]http[^\n>]+>\s*<\/iframe>\x22\x3bdocument\.write\((=var)\)\x3b\s*$	2	0	0	1
+11463	11463	^[^\x2f\x22\x27]+\/\?[^=&\x22\x27]+=l3S	2	0	0	1
+11464	11464	^.{16}[a-z]{3}\.dll	2	0	0	1
+11465	11465	^.{16}[a-z]{4}\.dll	2	0	0	1
+11466	11466	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{7,8}\d{2,3}\.pdf\r\n/Hm	2	0	0	1
+11467	11467	\.php\?setup=d&s=\d+&r=\d+$	2	0	0	1
+11468	11468	\/\?[a-z0-9]{65,}\x3b \d\x3b \d	2	0	0	1
+11469	11469	^\/wordpress\/\?[A-Za-z0-9]{4}(&utm_source=le)?$	2	0	0	1
+11470	11470	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+11471	11471	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+11472	11472	\/\?nbVykj$	2	0	0	1
+11473	11473	^s?\x3a\x2f\x2f[^\x22\x27]+\/\?[A-Za-z0-9]{5,6}(=[^&\x22\x27]+)?[\x22\x27]\x29\x3bsetCookie\(\x22popundr\x22,1,864e5\)\}	2	0	0	1
+11474	11474	^(<var>[A-Z0-9a-z]{1,20})\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29	2	0	0	1
+11475	11475	^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.[a-z]+\?time=[^&]+&stamp=[a-z]*\d+(\.[a-z]*\d+)+$	2	0	0	1
+11476	11476	^[^\r\n]+\/%(3A|20)http%3A%2F%2F/Hmi	2	0	0	1
+11477	11477	^\/\?3b[A-Z0-9a-z]{2}(&subid=[^&]*)?$	2	0	0	1
+11478	11478	^\/[a-z]+\/$	2	0	0	1
+11479	11479	^\s*\([\x22\x27][A-F0-9a-f]{32}[\x22\x27]\s*\)\s*\x3b\s*}\s*catch\s*\(e\)\s*\{\s*\}\s*\}\s*<\/script>\s*<\/body>	2	0	0	1
+11480	11480	^([^>]*? name\s*=\s*[\x22\x27]flashvars)[^>]*? value\s*=\s*[\x22\x27]url=https?\x3a[^\x22\x27]*?\.wasm	2	0	0	1
+11481	11481	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22(\!(\x22\s*?\+\s*?\x22)?)?Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+11482	11482	^(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{2}(<J>[0-9a-z]{2})[0-9a-z]{4}(=v)[0-9a-z]{6}(=space)[0-9a-z]{2}(=space)[0-9a-z]{64}(=J)(=a)(=v)(=a)	2	0	0	1
+11483	11483	^\d{3}px\x3b\swidth\x3a3\d{2}px\x3b\sheight\x3a3\d{2}px\x3b\x22>[^<>]*?<iframe src=[\x22\x27][^\x22\x27]+[\x22\x27]\swidth=[\x22\x27]2\d{2}[\x22\x27]\sheight=[\x22\x27]2\d{2}[\x22\x27]><\/iframe>[^<>]*?\n[^<>]*?<\/span>	2	0	0	1
+11484	11484	\/[a-z]{4,20}-a\.[a-z]{4,20}\.jar$	2	0	0	1
+11485	11485	\/view.php\?i=\d&key=[0-9a-f]{32}$	2	0	0	1
+11486	11486	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.jar$	2	0	0	1
+11487	11487	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$	2	0	0	1
+11488	11488	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$	2	0	0	1
+11489	11489	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$	2	0	0	1
+11490	11490	^\/[a-z]\/f\.php\?k=\d(&e=\d&f=\d)?$	2	0	0	1
+11491	11491	^\/[a-z]+\/$	2	0	0	1
+11492	11492	\.php\?j=1&k=[0-9](i=[0-9])?$	2	0	0	1
+11493	11493	^\/[a-zA-Z]{7}\.jar$	2	0	0	1
+11494	11494	\/lpdf\.php\?i=[a-zA-Z0-9]+&?$	2	0	0	1
+11495	11495	[a-z0-9]{32}\.jar	2	0	0	1
+11496	11496	\/inf\.php\?id=[a-f0-9]{32}$	2	0	0	1
+11497	11497	^\s*=\s*[\x22\x27]	2	0	0	1
+11498	11498	\/vd\/\d+\x3b[a-f0-9]{32}	2	0	0	1
+11499	11499	\.php\?pprec$	2	0	0	1
+11500	11500	\.php\?c002$	2	0	0	1
+11501	11501	[a-f0-9]{32}\.jar	2	0	0	1
+11502	11502	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1)	2	0	0	1
+11503	11503	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1)	2	0	0	1
+11504	11504	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1)	2	0	0	1
+11505	11505	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1)	2	0	0	1
+11506	11506	[a-f0-9]{32,64}\/[a-f0-9]{32,64}/\w$	2	0	0	1
+11507	11507	\?(s|page|id)=\d+$	2	0	0	1
+11508	11508	^[\r\n\s\+]*[\r\n\s\+]*?(<func>[_a-zA-Z][a-zA-Z0-9_-]+)\([\r\n\s]*?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]*?[\x22\x27][\r\n\s]*?,[\r\n\s]*?[\x22\x27][^\x22\x27]+[\x22\x27][\r\n\s]*?\)\+(=func)	2	0	0	1
+11509	11509	\/FlashPlayer\.cpl$	2	0	0	1
+11510	11510	^((<\/applet>).)+?[\x22\x27]1337\.exe	2	0	0	1
+11511	11511	filename=[a-z]{4}\.txt\x0D\x0A/H	2	0	0	1
+11512	11512	&p=\d+\.\d+\.\d+\.\d+&j=\d+\.\d+\.\d+\.\d+&f=\d+\.\d+\.\d+\.\d+$	2	0	0	1
+11513	11513	^[\r\n\s]*[\r\n\s]*?(<q>[\x22\x27])[a-f0-9]{9,16}\.(jar|zip)(=q)	2	0	0	1
+11514	11514	^\x2Fclicker\x2Ephp$	2	0	0	1
+11515	11515	^(<var>.{1,10})\.\\_\\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\(\!\[\]\+\x22\x22\)\[(=var)\.\_\\_\]\+(=var)\.\\\$\_\+(=var)\.\_\_\+	2	0	0	1
+11516	11516	\?(s|page|id)=\d+&text=\d+$	2	0	0	1
+11517	11517	^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)j51[a-f0-9]{21}\.jar(=q)\r?$/Hm	2	0	0	1
+11518	11518	^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)e51[a-f0-9]{21}\.exe(=q)\r?$/Hm	2	0	0	1
+11519	11519	\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$	2	0	0	1
+11520	11520	\/\{0,2}[A-Za-z0-9\+\/]+?voDc0RHa8NnZ$	2	0	0	1
+11521	11521	^[^\x3b\r\n\x22\x27]+?[A-Za-z0-9\/\_\-]{60,}\.exe\?	2	0	0	1
+11522	11522	^[^\x3b\r\n\x22\x27]+?\.txt\?e=\d+(&[fh]=\d)?	2	0	0	1
+11523	11523	^[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)	2	0	0	1
+11524	11524	[a-z]	2	0	0	1
+11525	11525	\.exe\?(e=)?\d+$	2	0	0	1
+11526	11526	\/j\d{2}\.php\?i=	2	0	0	1
+11527	11527	\/\?whole=\d+$	2	0	0	1
+11528	11528	^\/search\/[0-9]{64}	2	0	0	1
+11529	11529	\/m1[1-6]\.jar$	2	0	0	1
+11530	11530	\/[0-9]{4}\.html$	2	0	0	1
+11531	11531	\/\d+\.pkg$	2	0	0	1
+11532	11532	\/j_[a-z0-9]+_(0422|1723|3544|5076)\.jar$	2	0	0	1
+11533	11533	\/[a-z0-9]{3}\.php\?[a-z]=[a-zA-Z0-9]{10}$	2	0	0	1
+11534	11534	amor\d{0,2}\.jar	2	0	0	1
+11535	11535	[a-f]	2	0	0	1
+11536	11536	=(3[0-9a]|2e)+3a313[3-9](3[0-9]){8}$	2	0	0	1
+11537	11537	(<m>[0-9a-f]{2})(<sep>[^0-9a-f])(<e>((=m))[0-9a-f]{2})(=sep)([0-9a-f]{2}(=sep)){7}(=e)(=sep)(=m)(=sep)[0-9a-f]{2}(=sep)(=e)(=sep)(<d>((=e))[0-9a-f]{2})(=sep)(=d)(=sep)(=e)(=sep)(=d)	2	0	0	1
+11538	11538	^[\r\n\s]*?\([\r\n\s]*?(<q>[\x22\x27])(<m>(((=q)).)+)(=q).+?<(=m)?a(=m)?p(=m)?p(=m)l(=m)?e(=m)?t	2	0	0	1
+11539	11539	\/[a-f0-9]{32}\/[a-f0-9]{32}\.jar$	2	0	0	1
+11540	11540	^\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$	2	0	0	1
+11541	11541	\.jar\?java=\d+$	2	0	0	1
+11542	11542	^((<\/applet>).)+?\.jar\?java=\d+	2	0	0	1
+11543	11543	^((<\/applet>).)+?[\x22\x27]aHR0cDov	2	0	0	1
+11544	11544	^[a-f0-9]{32}=\d{1,10}\r\n/H	2	0	0	1
+11545	11545	\/1[34]\d{8}\.tpl$	2	0	0	1
+11546	11546	^[\r\n\s]*?\([\r\n\s]*?[\x22\x27]f([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?m([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?C([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?h([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?a([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?c([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?d([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?e[\x22\x27]	2	0	0	1
+11547	11547	^\/\d{1,2}(<l>[A-Z])\d{1,2}(=l)\d{1,2}(=l)\d{1,2}\.pdf$	2	0	0	1
+11548	11548	\/java\.php\?eid=[a-f0-9]{32}&	2	0	0	1
+11549	11549	\/pdf\.php\?pdf=[a-f0-9]{32}&	2	0	0	1
+11550	11550	[&?]type=\d+($|&)	2	0	0	1
+11551	11551	^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{32,}\.html(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+11552	11552	^\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?m\d+([\x22\x27]\s*?,\s*[\x22\x27])?C\d+([\x22\x27]\s*?,\s*[\x22\x27])?h\d+([\x22\x27]\s*?,\s*[\x22\x27])?a\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?c\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?d\d+([\x22\x27]\s*?,\s*[\x22\x27])?e\d+[\x22\x27]	2	0	0	1
+11553	11553	\/13[89]\d{7}.swf$	2	0	0	1
+11554	11554	\/[a-z]+\.php\?[a-z]+\d{7}&[a-z]+\d{7,8}$	2	0	0	1
+11555	11555	^(<sep>[^\x22\x27]{0,10})75(=sep)6e(=sep)63(=sep)74(=sep)69(=sep)6f(=sep)6e(=sep)20	2	0	0	1
+11556	11556	^\d+?\*\/\s*?(<vname>[^\s\(\x3b]{1,20})\s*?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)\s*?(\/\*\d+?\*\/\s*?)?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)	2	0	0	1
+11557	11557	[&?]v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=	2	0	0	1
+11558	11558	\/1(3[89]\d{7}|4\d{8})\.xap$	2	0	0	1
+11559	11559	&dr=\d+$	2	0	0	1
+11560	11560	&nrk=\d+$	2	0	0	1
+11561	11561	^Content-Disposition\x3a[^\r\n]+(\W14\d{8})\.pdf\r?$/Hm	2	0	0	1
+11562	11562	^(((<\/iframe>).)+?src\s*\s*?\x22http\x3a[^\x22]+16\.html\x22)(((<\/iframe>).)+?left\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)(((<\/iframe>).)+?top\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)((<\/iframe>).)+?<\/iframe>\x27\x29	2	0	0	1
+11563	11563	^\s*?[A-Z0-9a-z\+]+?\s*?\x7d	2	0	0	1
+11564	11564	^((\/[a-z]+?)*?\/\d+\/)((\/\d+?)*?\/[a-z]+?\/)(\/([a-z]+|\d+)){4,}\/[a-z]+\.pack\.gz$	2	0	0	1
+11565	11565	^\s*?\x28\s*?(<q>[\x22\x27])(((=q)).)+?(=q)\s*?\,\s*?[\x22\x27]container[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27],\s*?[\x22\x27]9\.0\.0[\x22\x27]\s*?,\s*?false\s*?,\s*?flashvars,\s*?params\s*?,\s*?attributes\s*?\x29\s*?\x3b\s*?<\/script>\s*?<\/head>	2	0	0	1
+11566	11566	\/14\d{8}(\.swf)?$	2	0	0	1
+11567	11567	\/14\d{8}(\.pdf)?$	2	0	0	1
+11568	11568	^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.exe/Hm	2	0	0	1
+11569	11569	^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.dll/Hm	2	0	0	1
+11570	11570	\/14\d{8}(\/\d+)*?(\/x[a-f0-9]+[\x3b0-9]*)?$	2	0	0	1
+11571	11571	^\s[^\r\n]*?[\x28\x5b]\s*?[\x22\x27][^\x22\x27]?s[^\x22\x27]?u[^\x22\x27]?b[^\x22\x27]?s[^\x22\x27]?t[^\x22\x27]?r[^\x22\x27]?[\x22\x27]\s*?[\x29\x5d]\s*?(\x5d\s*?)?\x28	2	0	0	1
+11572	11572	\/video.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+11573	11573	\/player.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+11574	11574	\/search.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+11575	11575	^\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28(=var1)\s*\!\s*=\s*[\x27\x22][\x22\x27]\s*?\x29\s*?\{\s*?(<var2>[^\s\x3d]+)\s*\s*?(=var1)\s*?\[	2	0	0	1
+11576	11576	\/1\.php\?r$	2	0	0	1
+11577	11577	^[^a-z]?\x65[^a-z]?\x6e[^a-z]?\x67[^a-z]?\x74[^a-z]?\x68	2	0	0	1
+11578	11578	^\s*?[\x22\x27](<char>[^\x22\x27]+)[\x22\x27]\.replace\x28\s*?[\x22\x27](=char)[\x22\x27]\s*?,	2	0	0	1
+11579	11579	\/banner.php\?sid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+11580	11580	\/blog.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+11581	11581	\/main\.html$	2	0	0	1
+11582	11582	\.php\?id=[0-9A-F]{44,54}&rnd=[0-9]{3,7}$	2	0	0	1
+11583	11583	^\/tdstest\/[a-f0-9]{32,}\/?$	2	0	0	1
+11584	11584	\/content\/dl\.php\?sl=vbs[a-z0-9]{32}$	2	0	0	1
+11585	11585	\/content\/getvbslink\.php\?d=[a-z0-9]{32}$	2	0	0	1
+11586	11586	Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H	2	0	0	1
+11587	11587	^[a-z0-9]*\r\n/H	2	0	0	1
+11588	11588	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+11589	11589	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+11590	11590	\/street[1-5]\.php$	2	0	0	1
+11591	11591	\/XV-\d+\.exe$	2	0	0	1
+11592	11592	\/bad\/[A-Z0-9]+\.swf$	2	0	0	1
+11593	11593	\/\d\/[A-Z]+\/[a-f0-9]{32}\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?$	2	0	0	1
+11594	11594	^\s*?[^\x28\s]*?\x28\s*?(<a1>[^\s,\x29]+)\s*?,\s*?(<a2>[^\s,\x29]+)\s*?\x29\{[^\r\n]*?[\+=]String.fromCharCode\((=a2)\)[^\r\n]*?\}	2	0	0	1
+11595	11595	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.jar\r\n/Hm	2	0	0	1
+11596	11596	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+11597	11597	\b[a-z]{2}\d+\s*\s*?Yes	2	0	0	1
+11598	11598	^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x20http\x3a\x2f	2	0	0	1
+11599	11599	^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?(\.[a-z]+)?$	2	0	0	1
+11600	11600	^[^\r\n]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?/H	2	0	0	1
+11601	11601	^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x3ahttp\x3a\x2f	2	0	0	1
+11602	11602	^Referer\x3a[^\r\n]+\/4\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?$/Hm	2	0	0	1
+11603	11603	^\s*\s*?[\x22\x27]8\.8\.8\.8[\x22\x27]	2	0	0	1
+11604	11604	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+11605	11605	Host\x3a\x20([\x2eg-z]*[a-f0-9][\x2eg-z]*){32}\./H	2	0	0	1
+11606	11606	\/e\.html$	2	0	0	1
+11607	11607	^(<var>[a-f0-9]{6})-->\s*?<script\s*?type=[\x22\x27]text\/javascript[\x22\x27]\s*?src=[\x22\x27]http\x3a\x2f[^\x22\x27]*?\/[a-z\d]{8}\.php\?id=\d+[\x22\x27]\s*<\/script><!--\/(=var)-->	2	0	0	1
+11608	11608	[&?]t=[a-f0-9]{32}(&|$)	2	0	0	1
+11609	11609	\/5\/[A-Z]{3,}\/[a-f0-9]{32}(\.[^\x2f]+|\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?|\/\d+\/?)?$	2	0	0	1
+11610	11610	^\s*?[_$]+\x28\x29	2	0	0	1
+11611	11611	^\s*?[_$]+\x28\x29	2	0	0	1
+11612	11612	Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)[^\r\n]*?\/search\?q=([A-Z&=\d]*?[a-z])([a-zA-Z\d&=]*?[A-Za-z=&]\d[A-Za-z])([a-zA-Z\d&=]*?[a-z\d][A-Z][A-Za-z\d])[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+[&=A-Za-z0-9]*?\r\n.*?Host\x3a\x20(=refhost)/Hsi	2	0	0	1
+11613	11613	^\s*?\w+\s*?\.\s*?charCodeAt	2	0	0	1
+11614	11614	^\/\?[a-f0-9]{32,64}$	2	0	0	1
+11615	11615	^[^>]*?id\s*[\x22\x27][a-z0-9]+[\x22\x27][^>]*\s*?[\x2a\d]{100}	2	0	0	1
+11616	11616	Referer\x3a\x20http\x3a\x2f+(<dl1>[^\x2e\r\n]+)\x2e[^\x2f\r\n]*?(<dl2>\x2e[^\x2e\r\n\x2f]+\x2e[^\x2e\x2f\r\n]+)\x2f(\??[a-f0-9]{32,64}\/?)?\r\n.*?Host\x3a\x20((=dl1))[^\r\n]*?(=dl2)\r\n/Hsm	2	0	0	1
+11617	11617	Referer\x3a\x20[^\r\n]*?\/[a-f0-9]{32,64}\.swf/H	2	0	0	1
+11618	11618	\.php\?id=[0-9A-F]{32,}&rnd=\d+$	2	0	0	1
+11619	11619	^((<\/div).)+?top\x3a\s*?\x2d[0-9]+px\x3b.+left\x3a\s*?\x2d[0-9]+px\x3b.+<iframe\x20.+?stack=\d+	2	0	0	1
+11620	11620	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)str2long(=sep)).+?(=sep)long2str(=sep)	2	0	0	1
+11621	11621	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)str2long(=sep)	2	0	0	1
+11622	11622	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)long2str(=sep)	2	0	0	1
+11623	11623	^([^>]*?\sname\s*?\x3d\s*?[\x22\x27]?movie[\x22\x27]?)[^>]*?\svalue\s*?\x3d\s*?[\x22\x27][^\x22\x27]+\/(\??[a-f0-9]+)?[\x22\x27]	2	0	0	1
+11624	11624	^Host\x3a[^\r\n]*?\.pw\r$/Hmi	2	0	0	1
+11625	11625	^Host\x3a\x20[a-z0-9]+\.(g[aq]|cf|ml|tk|xyz|info|space)(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+11626	11626	^\s*[a-z]+\s*\s*?(<q1>[\x22\x27])(((=q1)).)+?(=q1)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr\(\s*?\d+\s*?,\s*?\d+\s*?\)\s*?\x3b\s*?[a-z]+\s*\s*?(<q2>[\x22\x27])(((=q2)).)+?(=q2)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr	2	0	0	1
+11627	11627	^(<ccode>[a-f0-9]{6})-->.*?<script.+?<\/script>.*--/(=ccode)-->	2	0	0	1
+11628	11628	^\/[a-z]{2,20}\/[a-z]{2,20}\/(((featur|quot)e|ip)s|d(ropdown|etect)|co(mpiled|re)|header|jquery|lang|min|ga)\.js$	2	0	0	1
+11629	11629	^\s*?<script>\s*?([A-Za-z][A-Za-z\d+]+\s*?\+\s*([A-Za-z][A-Za-z\d]+|[\x22\x27]\\x[2-7][0-9a-fA-F](\\x[2-7][0-9a-fA-F]){0,4}[\x22\x27])\s*?\x3b){20}	2	0	0	1
+11630	11630	^\/js\/analytic\.php\?id=\d+&tz=\-?\d+&rs=\d+x\d+$	2	0	0	1
+11631	11631	^[\x22\x27](<script)[\x22\x27+\s]*<[\x22\x27+\s]*s[\x22\x27+\s]*c[\x22\x27+\s]*r[\x22\x27+\s]*i[\x22\x27+\s]*p[\x22\x27+\s]*t[^\r\n]+\.php\?id=\d+&tz=\x27\+tzSignature\x28\x29\+\x27&rs=	2	0	0	1
+11632	11632	^\/promo\d+(x\d+)?\/promo\.swf\?t=\d+$	2	0	0	1
+11633	11633	Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H	2	0	0	1
+11634	11634	^\s*\x28\s*[\x22\x27]<div\s*style\s*=\s*[\x22\x27]([^\x22\x27\r\n]*position\x3aabsolute\x3b)([^\x22\x27\r\n]*top\x3a\s\-\d+px\x3b)([^\x22\x27\r\n]*left\x3a\s0px\x3b)[^\r\n]*?<iframe[^\r\n>]*\s><\/i[\x22\x27]\+[\x22\x27]frame>[^\r\n]*<\/div>[\x22\x27]\s*\x29\x3b$	2	0	0	1
+11635	11635	^#?\d+	2	0	0	1
+11636	11636	^#?\d+	2	0	0	1
+11637	11637	^\s*var\s*(<var>[^\s=]+)\s*=\s*document.createElement\(\s*[\x22\x27]iframe[\x22\x27](.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b	2	0	0	1
+11638	11638	^\s*\([^\x29]*(\%2F|\/)(\%5B|\[)(\%5E)([^\x29]*(%3C|\<))([^\x29]*(%3E|\>))([^\x29]*(\%5C|\\)(\%6E|n))	2	0	0	1
+11639	11639	^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27]	2	0	0	1
+11640	11640	^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Chrome_Font\.exe/Hmi	2	0	0	1
+11641	11641	^[^\x2f\x22\x27]+\/([^\x22\x27]*?[?&]oq=[A-Za-z0-9+\x2f_-]+([\x22\x27]|&))([^\x22\x27]*?[&?][a-z]+_[a-z]+=\d+)([^\x22\x27]*?[&?]q=)	2	0	0	1
+11642	11642	^\s*=\s*[\x27\x22](sh(ell(32)?)?|exec)=6wLrBej5\x2f\x2f	2	0	0	1
+11643	11643	(value=[\x22\x27](sh(ell(32)?)?|exec)=|unescape\(EscapeHexString\(.)EB02EB05E8F9FFFFFF	2	0	0	1
+11644	11644	^\s*=\s*[\x22\x27][Hh][Tt][Tt][Pp][Ss]?\x3a\x2f\x2f[^\x2f]+\x2f([^\x2f\x22\x27]+=[^\x2f\x22\x27&]{0,5}QMvXcJ)[^\x2f\x22\x27]{90}	2	0	0	1
+11645	11645	^(rocket|java)script\x22>\s*var\s*(<ifr>[^\s=]+)\s*=\s*[\x22\x27]iframe[\x22\x27].*?\s*var\s*(<var>[^\s=]+)\s*=\s*document\.createElement\(\s*(=ifr)(.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b	2	0	0	1
+11646	11646	^[a-z]\d{3}\(new Array\(	2	0	0	1
+11647	11647	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27]iddqd?\s*=	2	0	0	1
+11648	11648	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=]*\s*=EB02EB05E8F9FFFFFF	2	0	0	1
+11649	11649	^[a-zA-Z0-9]{4}NzgzNDI[a-zA-Z0-9]{8}=\x22	2	0	0	1
+11650	11650	^\d{1,2}\.php$	2	0	0	1
+11651	11651	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+11652	11652	^\/[a-z]+\/$	2	0	0	1
+11653	11653	^\/[a-z]+\/$	2	0	0	1
+11654	11654	^GET\s*?\/stat\/load((?-i)[a-z0-9]*?[A-Z])((?-i)[A-Z0-9]*?[a-z])(<hname>[a-z0-9]+)\.php\s.+?Host\x3a\x20(=hname)\.	2	0	0	1
+11655	11655	^[0-9a-fA-F]{25}$	2	0	0	1
+11656	11656	^[-_\w]+$	2	0	0	1
+11657	11657	\/[a-z]{2}[0-9]{3}[a-z]{2}\/LoginFacebook\.php$	2	0	0	1
+11658	11658	^\d+$	2	0	0	1
+11659	11659	\x2Fgetfile\x2Ephp\x3Fi\x3D[0-9]\x26key\x3D[a-f0-9]{32}$	2	0	0	1
+11660	11660	^\/[a-z]{15}[0-9]\.php$	2	0	0	1
+11661	11661	^\d$	2	0	0	1
+11662	11662	\/\?[a-f0-9]{32}=[^&]+&[a-f0-9]{32}=[^&]+$	2	0	0	1
+11663	11663	^\/\d{5}$	2	0	0	1
+11664	11664	\/[0-9]{2}\.html$	2	0	0	1
+11665	11665	\.php\?[a-z]=.{2}KAhFXlx9.{2}Oj[^&]+$	2	0	0	1
+11666	11666	\x2F[0-9]{3}\.pdf$	2	0	0	1
+11667	11667	^\d{1,2}=[a-zA-Z0-9+=]{100}	2	0	0	1
+11668	11668	^\/[a-z]\.jar$	2	0	0	1
+11669	11669	\/[a-f0-9]+\.zip$	2	0	0	1
+11670	11670	^\/\d{2,}\.[a-z0-9]+$	2	0	0	1
+11671	11671	^\/\?[a-f0-9]{32}$	2	0	0	1
+11672	11672	\/(java(db|im|rh)|silver|flash|msie)\.php\?id=	2	0	0	1
+11673	11673	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}\r\n<script>(var [a-zA-Z0-9]{1,20}\x3b){1,20}[a-zA-Z0-9]{1,20}\s*	2	0	0	1
+11674	11674	^Host\x3a\x20[^\.\r\n]+?\.[a-z]{2,4}\r\n	2	0	0	1
+11675	11675	\/\??[a-f0-9]{60,}\x3b1\d{5}\x3b\d{1,3}$	2	0	0	1
+11676	11676	\/\??[a-f0-9]{60,}\x3b5[0-1]\d{5}$	2	0	0	1
+11677	11677	^\/[^\x2f]+?\/\??[a-f0-9]{60,66}(\x3b\d+){1,4}$	2	0	0	1
+11678	11678	(\/[A-Z][a-z][A-Z][a-z][A-Z][a-z]|(b(m(nw|wn)|n(mw|wm)|w(mn|nm))|m(b(nw|wn)|n(bw|wb)|w(bn|nb))|n(b(mw|wm)|m(bw|wb)|w(bm|mb))|w(b(mn|nm)|m(bn|nb)|n(bm|mb))))\.jar$	2	0	0	1
+11679	11679	^\/index\.php\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+11680	11680	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.swf\r\n	2	0	0	1
+11681	11681	^\/\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+11682	11682	\x20filename=\r\n(\r\n)?$	2	0	0	1
+11683	11683	PK\x01\x02.{42}(<dir>[a-z]{7,}\/)([a-z]+\.class)?(\xfe\xca\x00\x00)?(PK\x01\x02.{42}(=dir)[a-z]+\.class){6,}(PK\x01\x02.{42}[0-9a-z]{5,}(\.[a-z]{3})?)K\x05\x06.{18}$	2	0	0	1
+11684	11684	^\/index\.php\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+11685	11685	\w_\.jar\?[a-f0-9]{8}$	2	0	0	1
+11686	11686	^\d+[\r\n\x2f]	2	0	0	1
+11687	11687	^\d+[\r\n\x2f]	2	0	0	1
+11688	11688	^\d+[\r\n\x2f]	2	0	0	1
+11689	11689	^\d+[\r\n\x2f]	2	0	0	1
+11690	11690	^\d+[\r\n\x2f]	2	0	0	1
+11691	11691	^\d+[\r\n\x2f]	2	0	0	1
+11692	11692	^\d+[\r\n\x2f]	2	0	0	1
+11693	11693	^\d+[\r\n\x2f]	2	0	0	1
+11694	11694	^\d+[\r\n\x2f]	2	0	0	1
+11695	11695	^\d+[\r\n\x2f]	2	0	0	1
+11696	11696	Content-Disposition\x3a[^\r\n]+\.exe-rc4\.exe\r\n	2	0	0	1
+11697	11697	^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/[a-zA-Z0-9]{12}\.php(\?[^&=]+=([a-zA-Z0-9]{8}|0(189|037)|flash|2(551|419)|6332))?$	2	0	0	1
+11698	11698	^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/test\.mp3$	2	0	0	1
+11699	11699	^\/\d{9,10}\/\d{4,5}$	2	0	0	1
+11700	11700	\/index\.html\?p=\d+$	2	0	0	1
+11701	11701	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?[a-f0-9]	2	0	0	1
+11702	11702	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a/Hmi	2	0	0	1
+11703	11703	^(<split>.{1,10})2f(=split)64(=split)69(=split)76(=split)3e(=split)?[^\x22\x27]*[\x22\x27]\.replace\s*\(\s*[\x22\x27]?\/(=split)\/g[\x22\x27]?\s*,\s*[\x22\x27]\x25[\x22\x27]\s*\x29\s*\x3b	2	0	0	1
+11704	11704	^\s*=\s*[\x22\x27]?(10|127|172\.(1[6-9]|2[0-9]|3[01])|192\.168)\.	2	0	0	1
+11705	11705	\.php\?hash=I3QxW[A-Za-z0-9\+\/]+={0,2}$	2	0	0	1
+11706	11706	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\/[a-zA-Z0-9\/\-\_]{60,}\/[a-zA-Z0-9]+\.exe\?[a-zA-Z0-9]+=[a-zA-Z0-9]+(&h=\d+)?[\x22\x27]	2	0	0	1
+11707	11707	^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27]	2	0	0	1
+11708	11708	^\s*type\s*=\s*[\x22\x27]\s*text\/javascript\s*[\x22\x27]\s*>\s+var\s*(<timestamp>[A-Za-z0-9]{1,25})\s*=\s*\(new\sDate\(\)\)\.getTime\(\)\;\s+(<url>[A-Za-z0-9]{1,25})\s*=\s*[\x22\x27]\s*[^\r\n]+\.php\?JBOSSESSION=\s*[\x22\x27]\s+(<urlvar2>[A-Za-z0-9]{1,25})\s*=\s*(=url)\s*\+\s*(=timestamp)\s+window\.location\.href\s*=\s*(=urlvar2)\s+	2	0	0	1
+11709	11709	^\s*[\x22\x27][^\r\n]+\/[a-z0-9]{20,40}\.js[\x22\x27]\s*>\s*<\/script>\s*<\/body>	2	0	0	1
+11710	11710	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+11711	11711	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+11712	11712	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+11713	11713	^http\:\/\/[^\r\n\x2f]+\/\?s=[a-f0-9]{32}[a-z]{2}$	2	0	0	1
+11714	11714	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+11715	11715	^(<vars>[a-z0-9]{1,20})\s*=\s*new\s*Array\x3b\r\n((=vars)\[\d{1,3}\]\s*=\s*\d{4,12}\x3b\r\n){5,40}	2	0	0	1
+11716	11716	^\/([\/_]*?[a-f0-9][\/_]*?){64}$	2	0	0	1
+11717	11717	src\s*=\s*https?\x3A\x2f+[^\x2f]*?((((static)?flick|blogge)r|p(hotobucket|icasa)|wordpress|tinypic)\.com|im(g(\.youtube|ur)\.com|ageshack\.us)|upload\.wikimedia\.org)[^\x2f]	2	0	0	1
+11718	11718	^[a-f0-9]{32}$	2	0	0	1
+11719	11719	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/	2	0	0	1
+11720	11720	[=\"]\w{8}\.jar	2	0	0	1
+11721	11721	^[a-z]{2}\.	2	0	0	1
+11722	11722	\/jdb\/[^\/]+\.class$	2	0	0	1
+11723	11723	\/lib\/adobe\.php\?id=[a-f0-9]{32}$	2	0	0	1
+11724	11724	\/i.php?token=[a-z0-9]+$	2	0	0	1
+11725	11725	\x2Fjerk\x2Ecgi\x3F[0-9]$	2	0	0	1
+11726	11726	^(\?[^=]{1,10}=[^&\r\n]{100,})?$	2	0	0	1
+11727	11727	\.php\?e=[^&]+?$	2	0	0	1
+11728	11728	\.txt\?e=\d+(&[fh]=\d+)?$	2	0	0	1
+11729	11729	^\x2F\x3Fwps\x3D[0-9]$	2	0	0	1
+11730	11730	^[^\r\n]+\/[A-Fa-f0-9]+\.js\?cp=	2	0	0	1
+11731	11731	^\/[a-z0-9]{1,4}\.jnlp$	2	0	0	1
+11732	11732	\.php\?id=[a-f0-9]{32}$	2	0	0	1
+11733	11733	^\/[a-f0-9]{32}\/[a-f0-9]{32}\.swf$	2	0	0	1
+11734	11734	\.php\?[^=]+=([^&]?[a-z0-9]{2}){5}&[^=]+=([^&]?[a-z0-9]{2}){10}&	2	0	0	1
+11735	11735	\/[A-F0-9]{8}\.js\?cp=	2	0	0	1
+11736	11736	^\/[a-z0-9]+[0-9][a-z0-9]+\/\?\d$	2	0	0	1
+11737	11737	\.exe(\?[a-zA-Z0-9]+=[a-zA-Z0-9]+)?&h=\d+$	2	0	0	1
+11738	11738	^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$	2	0	0	1
+11739	11739	^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$	2	0	0	1
+11740	11740	\/\d{6}\.mp3$	2	0	0	1
+11741	11741	\/14\d{8}(\.xap)?$	2	0	0	1
+11742	11742	\.swf\?myid=[a-zA-Z0-9]+$	2	0	0	1
+11743	11743	\.php\?rnd=[0-9]{3,7}&id=[0-9A-F]{44,54}$	2	0	0	1
+11744	11744	\/(Flash[23]?|Ink|New|One|HQ).exe$	2	0	0	1
+11745	11745	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.xap\r\n	2	0	0	1
+11746	11746	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?[^\r\n]*?\/(index.html)?\r\n.*?\r\nHost\x3a\x20(=refhost)[\x3a\r]	2	0	0	1
+11747	11747	\/\d{2,}\.xap$	2	0	0	1
+11748	11748	\.php\?rnd=\d+&id=[0-9A-F]{32,}$	2	0	0	1
+11749	11749	\/\?keyword=(([a-f]{0,31}[0-9])([0-9]{0,31}[a-f])[a-f0-9]{32}|\d{5})$	2	0	0	1
+11750	11750	^\/(.*?[&?][a-z]{2}_[a-z]{2}=\d+(&|))(.*?[&?]q=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&|))(.*?[&?]oq=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&|)).*?[&?][a-z]{3}=[A-Za-z_]{3,20}([a-z\d]*\x2e)([a-z\x2e]*\d)[a-z\d\x2e]+(&|$)	2	0	0	1
+11751	11751	^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Font_Update\.exe	2	0	0	1
+11752	11752	^\s*[\x22\x27]\s*http[^\x22\x27]+\.php\s*[\x22\x27]\s*\x2c\s*[\x22\x27]\s*uylzJB3mWrFjellI9iDFGQjO	2	0	0	1
+11753	11753	=[a-f0-9]{32,}(&|$)	2	0	0	1
+11754	11754	\&e=(cve|flash)	2	0	0	1
+11755	11755	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.htm$	2	0	0	1
+11756	11756	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.swf$	2	0	0	1
+11757	11757	^(0x[a-f0-9]{1,2}, ){500}	2	0	0	1
+11758	11758	^[0-9_,{AbZwP&-]{2000}	2	0	0	1
+11759	11759	^[A-F0-9]+	2	0	0	1
+11760	11760	^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_	2	0	0	1
+11761	11761	^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_	2	0	0	1
+11762	11762	^[a-z0-9]{13}\.[a-z]{3}$	2	0	0	1
+11763	11763	^\d+$	2	0	0	1
+11764	11764	Host\x3a\x20(<refhost>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f(=refhost)(\x3a\d{1,5})?\/?	2	0	0	1
+11765	11765	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\r$|\x3a)	2	0	0	1
+11766	11766	^\/[a-z]{3,20}\.php\?sid=[A-F0-9]{40,200}$	2	0	0	1
+11767	11767	^\/[a-z]{3,20}\.php\?id=4[A-F0-9]{39,200}$	2	0	0	1
+11768	11768	^\/\?o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+$	2	0	0	1
+11769	11769	(.*?[?&]oq=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|)).*?[?&]q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$)	2	0	0	1
+11770	11770	(.*[^&]{3,4}QMvXcJ).*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&.*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$)	2	0	0	1
+11771	11771	^[HX3][^&]Q[cdM][^&]{3}[ab]R	2	0	0	1
+11772	11772	^\/\?[a-f0-9]{114}$	2	0	0	1
+11773	11773	Date\x3a\x20(<dstring>[^\r\n]+)\r\n.*?Last-Modified\x3a\x20(=dstring)\r\n	2	0	0	1
+11774	11774	^\/[a-f0-9]{16}$	2	0	0	1
+11775	11775	^GET (<uri>(\/[A-Za-z0-9]+)?\/\d+\/\d+)\sHTTP\/1\.1\r\nUser-Agent\x3a\x20http\x3a\/\/(<host>[^\r\n]+)(=uri)\r\nHost\x3a\x20(=host)\r\n(\r\n)?$	2	0	0	1
+11776	11776	^Referer\x3a[^\r\n]+?\/[a-z0-9A-Z\_\-]{26,}\.html(\x3a\d{1,5})?\r$	2	0	0	1
+11777	11777	\/3\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+|\/\d+\.\d+\.\d+\.\d+\/?)?$	2	0	0	1
+11778	11778	^\/([A-Za-z_-]*?\d)([a-z0-9_-]*?[A-Z])([A-Za-z0-9_-]{4}){15,}([[A-Za-z0-9_-]{2}\x2e?\x2e|[A-Za-z0-9_-]{3}\x2e)$	2	0	0	1
+11779	11779	^\d$	2	0	0	1
+11780	11780	^[A-F0-9]{16}\x22>	2	0	0	1
+11781	11781	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-zA-Z0-9]{16}\/[a-f0-9]{40}\/[a-zA-Z0-9]+\.jpg$	2	0	0	1
+11782	11782	^[A-F0-9]{16}(&|&amp\x3b)id=\d+(&|&amp\x3b)gid=[A-F0-9\-]+\x22>	2	0	0	1
+11783	11783	^[^>]*?\>	2	0	0	1
+11784	11784	^-?\d+=([a-zA-Z0-9]|%[A-F0-9]{2}){2}(<var1>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){6}(<var2>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){2}(=var2)([a-zA-Z0-9]|%[A-F0-9]{2}){4}(=var1)/P	2	0	0	1
+11785	11785	^\s*?[\x22\x27]([A-Z]{0,19}[a-z]{1,19}[A-Z])[a-zA-Z]{14,20}[\x22\x27][^<>]*([A-Za-z]{0,99}\d)[A-Za-z0-9\x20]{100}	2	0	0	1
+11786	11786	^\s*?(<var1>[^\x29]+)\x29[^\n]*\s*?(=var1)\s*?\x7c{2}\s*?\d+?\s*?\x2c	2	0	0	1
+11787	11787	^\s+\d{1,2}\x3b\s+else\s+(<var>[a-z]+)\s+\-=\s+\d{1,2}\x3b\s+return\s+[a-z]+\.charAt\x28(=var)\/\d{1,2}\x29\x7d	2	0	0	1
+11788	11788	^[a-z0-9_-]+\.([0-9_-]*[A-Z])[A-Z0-9_-]+\.[^\x22]+\x22\s	2	0	0	1
+11789	11789	^[a-z]{10}\.[a-z]{3}\r?$/Hm	2	0	0	1
+11790	11790	Last-Modified\x3a Mon, ((0[29]|16|23|30))\d{2} Jul 2001/H	2	0	0	1
+11791	11791	^\d+\x3b	2	0	0	1
+11792	11792	^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500}	2	0	0	1
+11793	11793	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+11794	11794	^[^\x27]+[\x27]\s*	2	0	0	1
+11795	11795	^\d+\x3b	2	0	0	1
+11796	11796	^([A-Z0-9]*?[a-z])([a-z0-9]*?[A-Z])[A-Za-z0-9]+\x2a\x2f[^\n]*?Function\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28\s*?(=var1)\s*[=!]{2}\s*?[\x27\x22][\x22\x27]\s*?\x29\s*?\{	2	0	0	1
+11797	11797	^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500}	2	0	0	1
+11798	11798	^\s*\x27[^\x27\x3b\r\n]+\x27width=\x27250\x27\sheight=\x27250\x27\>	2	0	0	1
+11799	11799	^[^A-Za-z0-9]	2	0	0	1
+11800	11800	^http\x3a\x2f[^\x27]+[\x27](\swidth=\d{1,2}\sheight=\d{1,2}\s|\sheight=\d{1,2}\swidth=\d{1,2}\s)	2	0	0	1
+11801	11801	^\s*\(\s*[\x22\x27]id[\x22\x27]\s*,\s*?(<var>[^,\x29\s\x3b]+)\s*\x29.*?\.appendChild\s*\(\s*(=var)	2	0	0	1
+11802	11802	^[^<]+\x0d\x0a<\/script>	2	0	0	1
+11803	11803	\?src=[a-z]+snet$	2	0	0	1
+11804	11804	^[0-9a-f]{6}	2	0	0	1
+11805	11805	^(\x20id=\x22\d+\x22)?\x20style=\x22([^\x22\r\n]*top\x3a\x20-\d{3}px\x3b)([^\x22\r\n]*left\x3a-\d{3}px\x3b)([^\x22\r\n]*position\x3a\x20absolute\x3b)[^\x22\r\n]*\x22>\x20<iframe[^\r\n>]*><\x2f	2	0	0	1
+11806	11806	^(\s+style=\x27hidden\x27)?\s+src=\x27https?\x3a[^>\x22\x27]+[\x22\x27]\s*width=\x270\x27\s+	2	0	0	1
+11807	11807	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+11808	11808	^[^\d](.{0,20}[^\d])?100[^\d](.{0,20}[^\d])?101[^\d](.{0,20}[^\d])?102[^\d](.{0,20}[^\d])?97[^\d](.{0,20}[^\d])?117[^\d](.{1,20}[^\d])?108[^\d](.{0,20}[^\d])?116[^\d](.{0,20}[^\d])?35[^\d]([^\d].{0,20}[^\d])?86[^\d](.{0,20}[^\d])?77[^\d](.{0,20}[^\d])?76[^\d]	2	0	0	1
+11809	11809	^(<sep>((\.\\_\\+).){1,10})\.\\_\\+(=sep)\.___\+(=sep)\.\\\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\_\\_\+(=sep)\.\_\\\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\\+(=sep)\.\_\_\$	2	0	0	1
+11810	11810	^[\r\n\s]*[\r\n\s]*?(-[\r\n\s]*?\d|0[\r\n\s]*?-)	2	0	0	1
+11811	11811	SELECT.+FROM	2	0	0	1
+11812	11812	DELETE.+FROM	2	0	0	1
+11813	11813	INSERT.+INTO	2	0	0	1
+11814	11814	UPDATE.+SET	2	0	0	1
+11815	11815	UNION.+SELECT	2	0	0	1
+11816	11816	INTO.+OUTFILE	2	0	0	1
+11817	11817	^SITE\s+EXEC\s[^\n]*?%[^\n]*?%	2	0	0	1
+11818	11818	^PASS\s[^\n]{100}	2	0	0	1
+11819	11819	^MKD\s[^\n]{100}	2	0	0	1
+11820	11820	^REST\s[^\n]{100}	2	0	0	1
+11821	11821	^DELE\s[^\n]{100}	2	0	0	1
+11822	11822	^RMD\s[^\n]{100}	2	0	0	1
+11823	11823	^RMDIR\s[^\n]{100}	2	0	0	1
+11824	11824	^SITE\s+NEWER\s[^\n]{100}	2	0	0	1
+11825	11825	^SITE\s+ZIPCHK\s[^\n]{100}	2	0	0	1
+11826	11826	^USER\s+w0rm	2	0	0	1
+11827	11827	^ALLO\s[^\n]{100}	2	0	0	1
+11828	11828	^CEL\s[^\n]{100}	2	0	0	1
+11829	11829	^CMD\s[^\n]{100}	2	0	0	1
+11830	11830	^CWD\s[^\n]{100}	2	0	0	1
+11831	11831	^SITE\s+CPWD\s[^\n]{100}	2	0	0	1
+11832	11832	^SITE\s+NEWER	2	0	0	1
+11833	11833	^STAT\s+[^\n]*\x3f	2	0	0	1
+11834	11834	^APPE\s[^\n]{100}	2	0	0	1
+11835	11835	^CWD\s+~	2	0	0	1
+11836	11836	^MODE\s+[^ABSC]{1}	2	0	0	1
+11837	11837	^SITE\s[^\n]{100}	2	0	0	1
+11838	11838	^SITE\s+CHOWN\s[^\n]{100}	2	0	0	1
+11839	11839	^SITE\s+EXEC	2	0	0	1
+11840	11840	^XCWD\s[^\n]{100}	2	0	0	1
+11841	11841	^STOR\s[^\n]{100}	2	0	0	1
+11842	11842	^SITE\s+CHMOD\s[^\n]{100}	2	0	0	1
+11843	11843	^LIST\s[^\n]{100,}	2	0	0	1
+11844	11844	^RENAME\s[^\n]*?%[^\n]*?%	2	0	0	1
+11845	11845	^MKDIR\s[^\n]*?%[^\n]*?%	2	0	0	1
+11846	11846	^PASS\s[^\n]*?%[^\n]*?%	2	0	0	1
+11847	11847	^USER\s[^\n]*?%[^\n]*?%	2	0	0	1
+11848	11848	^MDTM\s[^\n]{100}	2	0	0	1
+11849	11849	^RETR\s[^\n]*?%[^\n]*?%	2	0	0	1
+11850	11850	^CWD\s[^\n]*?\.\.\.	2	0	0	1
+11851	11851	^CWD\s+~root	2	0	0	1
+11852	11852	^NLST\s[^\n]{100}	2	0	0	1
+11853	11853	^PORT	2	0	0	1
+11854	11854	REST\s+[0-9]+\n	2	0	0	1
+11855	11855	^RETR\s[^\n]{100}	2	0	0	1
+11856	11856	^RNFR\s[^\n]{100}	2	0	0	1
+11857	11857	^RNTO\s[^\n]{100}	2	0	0	1
+11858	11858	^STAT\s[^\n]{100}	2	0	0	1
+11859	11859	^STOU\s[^\n]{100}	2	0	0	1
+11860	11860	^XMKD\s[^\n]{100}	2	0	0	1
+11861	11861	\s+.*?%.*?%	2	0	0	1
+11862	11862	^530\s+(Login|User)	2	0	0	1
+11863	11863	^PASS\s*\n	2	0	0	1
+11864	11864	^LIST\s+\x22-W\s+\d	2	0	0	1
+11865	11865	^USER\x20[^\x00\x20\x0a\x0d]{100}	2	0	0	1
+11866	11866	^STAT\s+[^\n]*\x2a	2	0	0	1
+11867	11867	^MDTM \d+[-+]\D	2	0	0	1
+11868	11868	^[^\r\n]+\.jar	2	0	0	1
+11869	11869	^\d\.\d(_\d+)?\@\r\n	2	0	0	1
+11870	11870	\x5csecure\x5c[^\x00]{50}	2	0	0	1
+11871	11871	\x5C[^\x5C\x00]{257}	2	0	0	1
+11872	11872	^\s*=\s*.*?\.([abcdehijlmnoprsvwx])(a(d[ep]|s[x])|c(rt|[ho]m|li|pl|md|pp)|d(iz|ll)|e(m[fl]|xe|bs)|h(lp|sq|ta)|jse?|m(d[abzew]|s[tcgip]|htm|ht)|p(cd|if|l[xsc]|[lm]|ot)|r(eg|ar)|s(cr|ct|[hy]s|wf)|v(b[es]?|xd)|w(m[dfsz]|p[msz]|s[cfh])|xl[tw]|folder|fol|ba[st]|i(sp|n[sif])|lnk|nws|ocx|zip|url)[\x27\x22\n\r\s]	2	0	0	1
+11873	11873	(a|#61)(p|#70)(p|#70)(l|#6C)(i|#69)(c|#63)(a|#61)(t|#74)(i|#69)(o|#6F)(n|#6E)(\x2F|#2F)x-shockwave-flash	2	0	0	1
+11874	11874	^[^\r\n]*[\[\|\{][A-Z]{3}[\]\|\}]	2	0	0	1
+11875	11875	^[^\r\n]*win	2	0	0	1
+11876	11876	^[^\r\n]*-PC	2	0	0	1
+11877	11877	^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl)	2	0	0	1
+11878	11878	^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl)	2	0	0	1
+11879	11879	^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb)	2	0	0	1
+11880	11880	^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb)	2	0	0	1
+11881	11881	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3)	2	0	0	1
+11882	11882	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3)	2	0	0	1
+11883	11883	User-Agent\x3a.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi	2	0	0	1
+11884	11884	User-Agent\:.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi	2	0	0	1
+11885	11885	^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}B[\x0d\x0a]{0,2}0[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}t[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}u[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}3[\x0d\x0a]{0,2}M[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}x[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}T[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}q[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}N[\x0d\x0a]{0,2}0	2	0	0	1
+11886	11886	^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}Q[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}1[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}5[\x0d\x0a]{0,2}n[\x0d\x0a]{0,2}c[\x0d\x0a]{0,2}y[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}P[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}3	2	0	0	1
+11887	11887	^[A-Za-z0-9\/\+\x0D\x0A]+?B[\x0d\x0a]{0,2}w[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}C[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}z[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}s[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}U[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}j[\x0d\x0a]{0,2}d	2	0	0	1
+11888	11888	\d*?\.bin	2	0	0	1
+11889	11889	^[^\r\n]*(W(in(dows)?)?[^a-z0-9]?(XP|[7-8])|Vista)	2	0	0	1
+11890	11890	^\d+/V	2	0	0	1
+11891	11891	^\s*,\s*[a-zA-Z]\x3a[\x2f\x5c]	2	0	0	1
+11892	11892	^((PK).)*?\x50\x4b\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00	2	0	0	1
+11893	11893	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+11894	11894	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+11895	11895	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+11896	11896	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+11897	11897	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+11898	11898	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+11899	11899	\bshell\b	2	0	0	1
+11900	11900	\benable\b	2	0	0	1
+11901	11901	^[^\r\n]+\.(t(ar|gz)|exe|zip)	2	0	0	1
+11902	11902	^([\x7f-\xff]){100}/Hi	2	0	0	1
+11903	11903	^((<\/script>).)*?src\s*=\s*\x5c?[\x22\x27]https?\x3a\/\/(www\.)?pastebin\.com\/raw(\/|\.php\?i=)[A-Z-a-z0-9]{8}[\x22\x27]	2	0	0	1
+11904	11904	^.{42}[\x20-\x7f]{1,500}\.jsPK\x05\x06.{4}\x01\x00\x01\x00	2	0	0	1
+11905	11905	\/[0-9]{1,2}\.dat$	2	0	0	1
+11906	11906	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+11907	11907	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+11908	11908	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+11909	11909	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+11910	11910	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+11911	11911	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+11912	11912	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+11913	11913	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+11914	11914	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+11915	11915	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+11916	11916	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+11917	11917	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+11918	11918	Content-Disposition\x3a[^\r\n]*?\.xla[\s\x22\x27]	2	0	0	1
+11919	11919	\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)(\x3a\d{1,5})?$	2	0	0	1
+11920	11920	^[\d\s]	2	0	0	1
+11921	11921	^USER [^\r\n]*?\x22	2	0	0	1
+11922	11922	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+11923	11923	^(\x3a\d{1,5})?$	2	0	0	1
+11924	11924	\.(gif|jpe?g|png)$	2	0	0	1
+11925	11925	^((jp|pn)g|bmp)	2	0	0	1
+11926	11926	^(logins|c(cdata|ookie))	2	0	0	1
+11927	11927	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+11928	11928	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+11929	11929	\/winhost(32|64)\.(exe|pack)$	2	0	0	1
+11930	11930	\/pony\.(exe|pack)$	2	0	0	1
+11931	11931	^[^>]+url=sms\x3a	2	0	0	1
+11932	11932	\/[^\x2f]+\.[^\x2f]+\.wsf$	2	0	0	1
+11933	11933	^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4})	2	0	0	1
+11934	11934	^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4})	2	0	0	1
+11935	11935	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+11936	11936	^[^\r\n]+\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)	2	0	0	1
+11937	11937	^((jp|pn)g|bmp)	2	0	0	1
+11938	11938	^(logins|c(cdata|ookie))	2	0	0	1
+11939	11939	^(m(ultipart|essage|odel)|a(pplication|udio|ccept)|(exampl|imag)e|video|text|\*)	2	0	0	1
+11940	11940	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+11941	11941	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+11942	11942	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+11943	11943	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+11944	11944	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+11945	11945	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+11946	11946	^[a-f0-9]{8,}\.duckdns\.org$	2	0	0	1
+11947	11947	^[^\x3b\x2f\x28]+$	2	0	0	1
+11948	11948	^[^\r\n]{100,}	2	0	0	1
+11949	11949	^[^\r\n]{100,}	2	0	0	1
+11950	11950	^[^\r\n]{100,}	2	0	0	1
+11951	11951	^[^\r\n]{100,}	2	0	0	1
+11952	11952	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+11953	11953	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+11954	11954	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+11955	11955	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+11956	11956	[a-z]{8}.[a-z]{3}	2	0	0	1
+11957	11957	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.zip$	2	0	0	1
+11958	11958	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.vbs$	2	0	0	1
+11959	11959	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.pif$	2	0	0	1
+11960	11960	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.exe$	2	0	0	1
+11961	11961	CN=ssl\d{1,2}.ovh.net($|,)	2	0	0	1
+11962	11962	(\.[a-z]{2}|$)	2	0	0	1
+11963	11963	[a-f0-9]{32}$	2	0	0	1
+11964	11964	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P	2	0	0	1
+11965	11965	^(\x3b|\r\n)	2	0	0	1
+11966	11966	CN=([^\r\n]+?\.)?\.gov\.procurement\.(\.)	2	0	0	1
+11967	11967	^[a-f0-9]+	2	0	0	1
+11968	11968	^[a-f0-9]+	2	0	0	1
+11969	11969	^[a-f0-9]+	2	0	0	1
+11970	11970	^Agent\d{5,6}$	2	0	0	1
+11971	11971	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+11972	11972	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+11973	11973	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+11974	11974	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11975	11975	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11976	11976	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11977	11977	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11978	11978	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11979	11979	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11980	11980	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11981	11981	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11982	11982	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11983	11983	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11984	11984	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11985	11985	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11986	11986	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11987	11987	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11988	11988	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11989	11989	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11990	11990	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11991	11991	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+11992	11992	.*[^A-Za-z0-9]edu\.rf\.gd$	2	0	0	1
+11993	11993	\x2edoc[xm]?$	2	0	0	1
+11994	11994	\x2exls[xm]?$	2	0	0	1
+11995	11995	\/\d+$	2	0	0	1
+11996	11996	function(\s_0x[0-9a-f]{4})?\(_0x[0-9a-f]{6},_0x[0-9a-f]{6}\){var _0x[0-9a-f]{6}=/Qi	2	0	0	1
+11997	11997	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+11998	11998	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+11999	11999	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+12000	12000	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+12001	12001	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+12002	12002	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+12003	12003	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+12004	12004	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+12005	12005	\sLOGIN\s[^\n]*?\s\{	2	0	0	1
+12006	12006	\sLSUB\s[^\n]*?\s\{	2	0	0	1
+12007	12007	\sRENAME\s[^\n]{100}	2	0	0	1
+12008	12008	\sFIND\s[^\n]{100}	2	0	0	1
+12009	12009	\sFETCH\s[^\n]{500}	2	0	0	1
+12010	12010	\sLOGIN\s[^\n]{100}	2	0	0	1
+12011	12011	\sAUTHENTICATE\s[^\n]{100}	2	0	0	1
+12012	12012	\sLIST\s[^\n]*?\s\{	2	0	0	1
+12013	12013	\sPARTIAL.*BODY\[[^\]]{1024}	2	0	0	1
+12014	12014	AUTH\s[^\n]{100}	2	0	0	1
+12015	12015	\sCREATE\s*\{	2	0	0	1
+12016	12016	\sRENAME\s[^\n]*?\s\{	2	0	0	1
+12017	12017	\sLIST\s[^\n]{100}	2	0	0	1
+12018	12018	\sCREATE\s[^\n]{1024}	2	0	0	1
+12019	12019	\sLSUB\s[^\n]{100}	2	0	0	1
+12020	12020	\sAUTHENTICATE\s[^\n]*?\{	2	0	0	1
+12021	12021	\sPARTIAL.*BODY\.PEEK\[[^\]]{1024}	2	0	0	1
+12022	12022	\sUNSUBSCRIBE\s[^\n]{100}	2	0	0	1
+12023	12023	\sUNSUBSCRIBE\s[^\n]*?\s\{	2	0	0	1
+12024	12024	\sSUBSCRIBE\s[^\n]{100}	2	0	0	1
+12025	12025	\sSUBSCRIBE\s[^\n]*?\s\{	2	0	0	1
+12026	12026	\sSTATUS\s[^\n]{100}	2	0	0	1
+12027	12027	\sSTATUS\s[^\n]*?\s\{	2	0	0	1
+12028	12028	\sFETCH\s[^\n]*?\s\{	2	0	0	1
+12029	12029	\sEXAMINE\s[^\n]{100}	2	0	0	1
+12030	12030	\sEXAMINE\s[^\n]*?\s\{	2	0	0	1
+12031	12031	\sAPPEND\s[^\n]{256}	2	0	0	1
+12032	12032	\sCOPY\s[^\n]*?\{	2	0	0	1
+12033	12033	\sDELETE\s[^\n]*?\{	2	0	0	1
+12034	12034	\sDELETE\s[^\n]{100}	2	0	0	1
+12035	12035	\sLOGIN\s\w+\s\{\d+\}[\r]?\n[^\n]*?%	2	0	0	1
+12036	12036	 (FREE XXX|dildo|masturbat|oral sex|ejaculat|up skirt|tits|bondage|lolita|clitoris|cock suck|hardcore (teen|anal|sex|porn)|raw sex|((fuck|sex|porn|xxx) (movies|dvd))|((naked|nude) (celeb|lesbian)))\b	2	0	0	1
+12037	12037	^RETR\s+[^\r\n]+?\x2eexe\r?$	2	0	0	1
+12038	12038	\<xdp\x3axdp(\s+[^\>]*)?\>((\<\/xdp[^\>]*\>).)*?\<pdf	2	0	0	1
+12039	12039	SELECT @@version_compile_os\s*?\x3b	2	0	0	1
+12040	12040	^Server\x3a[^\r\n]*Portable SDK for UPnP devices(\/?\s*$|\/1\.([0-5]\..|8\.0.|(6\.[0-9]|6\.1[0-7])))	2	0	0	1
+12041	12041	^Server\x3a[^\r\n]*Intel SDK for UPnP devices	2	0	0	1
+12042	12042	^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27]	2	0	0	1
+12043	12043	^[8-9]\.0	2	0	0	1
+12044	12044	^(<global_var>(((\]\,__\\x3a\+\+)).)+)]\,__\$\x3a\+\+(=global_var)	2	0	0	1
+12045	12045	^Host\x3a\x20[^\r\n]+\.((b(bsindex|0ne)|chatnook|gotgeeks|3d-game|4irc)\.com|s((cieron|uroot)\.com|lyip\.(com|net))|d(arktech\.org|eaftone\.com|tdns\.net)|e(towns\.(net|org)|ffers\.com)|flnet\.org)(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+12046	12046	^Host\x3a\x20[^\r\n]+\.cd\.am(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+12047	12047	^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}[^\r\n]*\x3C\x2Fiframe\x3E	2	0	0	1
+12048	12048	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+12049	12049	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+12050	12050	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+12051	12051	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+12052	12052	^(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?m(\x22\s*?\+\s*?\x22)?C(\x22\s*?\+\s*?\x22)?h(\x22\s*?\+\s*?\x22)?a(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?c(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?d(\x22\s*?\+\s*?\x22)?e	2	0	0	1
+12053	12053	^(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?m(\x27\s*?\+\s*?\x27)?C(\x27\s*?\+\s*?\x27)?h(\x27\s*?\+\s*?\x27)?a(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?c(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?d(\x27\s*?\+\s*?\x27)?e	2	0	0	1
+12054	12054	for\x28[^\x3D\r\n]*[0-9]{1,6}\x2D[0-9]{1,5}\x3B[^\x3D\r\n]\x3E\x3D0\x3B[^\x29\r\n]\x2D\x2D\x29	2	0	0	1
+12055	12055	^User-Agent\x3a[^\r\n]*?Googlebot/Hmi	2	0	0	1
+12056	12056	^\s*?\([^\)]*?(<var>[^\.]+)\s*?\.\s*?length\s*<\s*(0?[0-9]{5,}|0x[a-z0-9]{3,})[^)]+\)\s*?\{\s*?(=var)\s*\s*?(=var)\s*?\+\s*?(=var)\s*?\}	2	0	0	1
+12057	12057	^(nc)?\s*([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=)	2	0	0	1
+12058	12058	\x00[0-9]{4,7}\x02in\x00	2	0	0	1
+12059	12059	^Server\x3a[^\r\n]*miniupnpd\/1\.[0-3]	2	0	0	1
+12060	12060	^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27]	2	0	0	1
+12061	12061	^\s+?(<vname>[^\s\x3d]+)\s*\s*?(0x((6[4-9a-f]|[7-9a-f])|\d{3,})|\d{3,}).+?[\s\x3b]for\s*?\([^\x3b\)]*?\x3b[^\x3b\)]+?\s*?(=vname)[^\)]+?\)\s*?(\{[^}]*?|[^\r\n]*?)document\s*\.\s*createElement	2	0	0	1
+12062	12062	^((<\/title).)*\x26\x23x1F512	2	0	0	1
+12063	12063	^\/tmp\/.+\.exe$	2	0	0	1
+12064	12064	^(&).	2	0	0	1
+12065	12065	((\?|&))pasa=(&).	2	0	0	1
+12066	12066	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp)\.com|m(inecraft\.net|p3\.com)|b(eer\.com|log\.net))|curity(exploit|tactic)s\.com)|tufftoread\.com|ytes\.net)|m(y(((dissen|effec)t|mediapc|psx)\.net|securitycamera\.(com|net|org)|(activedirectory|vnc)\.com|ftp\.(biz|org))|lbfan\.org|mafan\.biz)|d((itchyourip|amnserver|ynns)\.com|dns(\.(net|me)|king\.com)|ns(iskinky\.com|for\.me)|vrcam\.info)|n(o(-ip\.(c(o\.uk|a)|info|biz|net|org)|ip\.(me|us))|et-freaks\.com|flfan\.org|hlfan\.net)|h(o(mesecurity(ma|p)c\.com|pto\.(org|me))|ealth-carereform\.com)|p((rivatizehealthinsurance|gafan)\.net|oint(2this\.com|to\.us))|c((o(uchpotatofries|llegefan)|able-modem)\.org|iscofreak\.com)|g(o(lffan\.us|tdns\.ch)|eekgalaxy\.com)|b(logsyte\.com|ounceme\.net|rasilia\.me)|re(ad-books\.org|directme\.net)|u(nusualperson\.com|fcfan\.org)|w(orkisboring\.com|ebhop\.me)|(3utiliti|quicksyt)es\.com|eating-organic\.net|ilovecollege\.info|fantasyleague\.cc|loginto\.me|zapto\.org)(\x3a\d{1,5})?$	2	0	0	1
+12067	12067	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+12068	12068	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+12069	12069	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+12070	12070	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+12071	12071	^(\d{1,3}\.){3}\d{1,3}(\x3a\d+)?$	2	0	0	1
+12072	12072	\.jpg(\?\d+)?$	2	0	0	1
+12073	12073	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+12074	12074	^[^0-9]	2	0	0	1
+12075	12075	^(\x3a\d{1,5})?$	2	0	0	1
+12076	12076	\.(arm(5n|7)?|m(ips|psl))$	2	0	0	1
+12077	12077	\.dyndns\.(biz|info|org|tv)$	2	0	0	1
+12078	12078	(at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work)\.com	2	0	0	1
+12079	12079	^[^&=?]*\/wp-content\/themes\/	2	0	0	1
+12080	12080	^(\x3a\d{1,5})?$	2	0	0	1
+12081	12081	^\x22(v(mware|irtual|irtualbox|m\x20ware|box))	2	0	0	1
+12082	12082	^\x22(v(mware|irtual|irtualbox|m\x20ware|box))	2	0	0	1
+12083	12083	^\x22(v(mware|irtual|irtualbox|m\x20ware|box))	2	0	0	1
+12084	12084	^[a-z0-9.]+\.kali\.org	2	0	0	1
+12085	12085	\.(d(ns(d(ynamic\.(com|net)|\.(info|me))|api\.info|get\.org|53\.biz)|dns01\.com)|(f(lashserv|e100|tp21)|adultdns|mysq1|wow64)\.net|((ima|voi)p01|(user|ole)32|kadm5)\.com|t(tl60\.(com|org)|empors\.com|ftpd\.net)|s(sh(01\.com|22\.net)|ql01\.com)|http((s443|01)\.com|80\.info)|n(s360\.info|tdll\.net)|x(ns01\.com|64\.me)|craftx\.biz)(\x3a\d{1,5})?$	2	0	0	1
+12086	12086	\.(i(s(-(a(-(((h(ard-work|unt)e|financialadviso)r|d(e(mocrat|signer)|octor)|t(e(acher|chie)|herapist)|r(epublican|ockstar)|n(ascarfan|urse)|anarchist|musician)\.com|c(((ubicle-sla|onservati)ve|pa)\.com|a(ndidate\.org|terer\.com)|hef\.(com|net|org)|elticsfan\.org)|l(i(ber(tarian|al)\.com|nux-user\.org)|(a(ndscap|wy)er|lama)\.com)|p((ersonaltrain|hotograph|lay)er\.com|a(inter\.com|tsfan\.org))|b(((ookkeep|logg)er|ulls-fan)\.com|ruinsfan\.org)|s(o(cialist\.com|xfan\.org)|tudent\.com)|g(eek\.(com|net|org)|(reen|uru)\.com)|knight\.org)|n-(a(c(t(ress|or)|countant)|(narch|rt)ist)|en(tertain|gine)er)\.com)|(into-((car(toon)?|game)s|anime)|((not-)?certifie|with-theban)d|uberleet|gone)\.com|(very-((goo|ba)d|sweet|evil|nice)|found)\.org|s(aved\.org|lick\.com)|l(eet\.com|ost\.org)|by\.us)|a-(geek\.(com|net|org)|hockeynut\.com)|t(eingeek|mein)\.de|smarterthanyou\.com)|n-the-band\.net|amallama\.com)|f(rom-((i[adln]|w[aivy]|o[hkr]|[hr]i|d[ce]|k[sy]|p[ar]|s[cd]|t[nx]|v[at]|fl|ga|ut)\.com|m([adinost]\.com|e\.org)|n([cdehjmv	2	0	0	1
+12087	12087	\.com|y\.net)|a([klr]\.com|z\.net)|c([at]\.com|o\.net)|la\.net)|or(-(((mor|som|th)e|better)\.biz|our\.info)|got\.h(er|is)\.name)|uettertdasnetz\.de|tpaccess\.cc)|s(e(l(ls(-(for-(less|u)\.com|it\.net)|yourhome\.org)|fip\.(info|biz|com|net|org))|rve(bbs\.(com|net|org)|ftp\.(net|org)|game\.org))|(aves-the-whales|pace-to-rent|imple-url)\.com|crapp(er-site\.net|ing\.cc)|tuff-4-sale\.(org|us)|hacknet\.nu)|d(o(es(ntexist\.(com|org)|-it\.net)|ntexist\.(com|net|org)|omdns\.(com|org))|yn(a(lias\.(com|net|org)|thome\.net)|-o-saur\.com|dns\.ws)|ns(alias\.(com|net|org)|dojo\.(com|net|org))|vrdns\.org)|h(o(me(linux\.(com|net|org)|unix\.(com|net|org)|(\.dyn)?dns\.org|ftp\.(net|org)|ip\.net)|bby-site\.(com|org))|ere-for-more\.info|am-radio-op\.net)|b(log(dns\.(com|net|org)|site\.org)|(uyshouses|roke-it)\.net|arrel?l-of-knowledge\.info|oldlygoingnowhere\.org|etter-than\.tv)|g(o(tdns\.(com|org)|\.dyndns\.org)|ame-(server\.cc|host\.org)|et(myip\.com|s-it\.net)|roks-th(is|e)\.info)|e(st-((a-la-ma(is|si)|le-patr)on|mon-blogueur	2	0	0	1
+12088	12088	\.com|ndof(internet\.(net|org)|theinternet\.org))|l(e(btimnetz|itungsen)\.de|ikes(candy|-pie)\.com|and-4-sale\.us)|m(i(sconfused\.org|ne\.nu)|yp(hotos\.cc|ets\.ws)|erseine\.nu)|w(ebhop\.(info|biz|net|org)|ritesthisblog\.com|orse-than\.tv)|t(eaches-yoga\.com|raeumtgerade\.de|hruhere\.net)|k(icks-ass\.(net|org)|nowsitall\.info)|o(ffice-on-the\.net|n-the-web\.tv)|(neat-url|cechire)\.com|podzone\.(net|org)|at-band-camp\.net|readmyblog\.org)(\x3a\d{1,5})?$	2	0	0	1
+12089	12089	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+12090	12090	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12091	12091	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12092	12092	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12093	12093	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12094	12094	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12095	12095	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12096	12096	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12097	12097	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12098	12098	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12099	12099	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12100	12100	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12101	12101	^1\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12102	12102	^2\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12103	12103	^3\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12104	12104	^4\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12105	12105	^5\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12106	12106	^6\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12107	12107	^7\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12108	12108	^8\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12109	12109	^9\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12110	12110	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12111	12111	^\d	2	0	0	1
+12112	12112	^User-Agent\x3a\x20iTunes\/10\.6\.[0-1]	2	0	0	1
+12113	12113	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12114	12114	(/d{6})	2	0	0	1
+12115	12115	CN=([^\r\n]+?\.)?hizliresim\.com(\.)	2	0	0	1
+12116	12116	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12117	12117	^ip[23]?\.bablosoft\.com$	2	0	0	1
+12118	12118	^[A-Z]=[A-Za-z/+0-9=]{200,400}$	2	0	0	1
+12119	12119	CN=([^\r\n]+?\.)?sharepointin\.com(\.)	2	0	0	1
+12120	12120	CN=([^\r\n]+?\.)?templatern\.com(\.)	2	0	0	1
+12121	12121	CN=([^\r\n]+?\.)?prizegives\.com(\.)	2	0	0	1
+12122	12122	CN=([^\r\n]+?\.)?shareholds\.com(\.)	2	0	0	1
+12123	12123	CN=([^\r\n]+?\.)?mesharepoint\.com(\.)	2	0	0	1
+12124	12124	CN=([^\r\n]+?\.)?prizewings\.com(\.)	2	0	0	1
+12125	12125	CN=([^\r\n]+?\.)?doctricant\.com(\.)	2	0	0	1
+12126	12126	CN=([^\r\n]+?\.)?sharession\.com(\.)	2	0	0	1
+12127	12127	CN=([^\r\n]+?\.)?sharepointle\.com(\.)	2	0	0	1
+12128	12128	CN=([^\r\n]+?\.)?mcsharepoint\.com(\.)	2	0	0	1
+12129	12129	CN=([^\r\n]+?\.)?officenced\.com(\.)	2	0	0	1
+12130	12130	CN=([^\r\n]+?\.)?templatent\.com(\.)	2	0	0	1
+12131	12131	CN=([^\r\n]+?\.)?sharepointen\.com(\.)	2	0	0	1
+12132	12132	CN=([^\r\n]+?\.)?officence\.com(\.)	2	0	0	1
+12133	12133	CN=([^\r\n]+?\.)?templateau\.com(\.)	2	0	0	1
+12134	12134	CN=([^\r\n]+?\.)?sharesbyte\.com(\.)	2	0	0	1
+12135	12135	CN=([^\r\n]+?\.)?officences\.com(\.)	2	0	0	1
+12136	12136	CN=([^\r\n]+?\.)?officentry\.com(\.)	2	0	0	1
+12137	12137	CN=([^\r\n]+?\.)?officested\.com(\.)	2	0	0	1
+12138	12138	CN=([^\r\n]+?\.)?prizemons\.com(\.)	2	0	0	1
+12139	12139	CN=([^\r\n]+?\.)?prizewel\.com(\.)	2	0	0	1
+12140	12140	CN=([^\r\n]+?\.)?sharestion\.com(\.)	2	0	0	1
+12141	12141	CN=([^\r\n]+?\.)?attemplate\.com(\.)	2	0	0	1
+12142	12142	CN=([^\r\n]+?\.)?windocyte\.com(\.)	2	0	0	1
+12143	12143	CN=([^\r\n]+?\.)?logodownload\.org(\.)	2	0	0	1
+12144	12144	^[0-9a-f]{32}	2	0	0	1
+12145	12145	# \d+d \d+dh \d+m # 	2	0	0	1
+12146	12146	\x0D\x0A\x0D\x0ASLP\x3A\d+\x3BMOD\x3A[\S\x3B]+\x3BURL\x3Ahttp\x3A\x2F{2}[^\x3B]+\x3BSRV\x3Aupd\x3B	2	0	0	1
+12147	12147	^\x23\d\d\d\x2f\x21	2	0	0	1
+12148	12148	\x06\x00?$	2	0	0	1
+12149	12149	\.php\?i=\w+_[0-9A-F]{8}&k=\d+$	2	0	0	1
+12150	12150	.asp\?username=.+&serverMac=([0-9A-F]{2}-){5}[0-9A-F]{2}&edition=	2	0	0	1
+12151	12151	\/smain\?scout=acxc[a-z]{3}$	2	0	0	1
+12152	12152	\?sid=[0-9A-F]{180}	2	0	0	1
+12153	12153	.asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2})	2	0	0	1
+12154	12154	\/chr\/\d+\/e\/t\d+\?lid=	2	0	0	1
+12155	12155	mac=([0-9A-F]{2}:){5}([0-9A-F]{2})	2	0	0	1
+12156	12156	mac=([0-9A-F]{2}:){5}([0-9A-F]{2})	2	0	0	1
+12157	12157	cmd=give&pcname=.+&status=\d+$	2	0	0	1
+12158	12158	\?uid=[0-9a-f]{40}&action=\w+&v=[\w.]+&b=\d+$	2	0	0	1
+12159	12159	Host\x3a [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}	2	0	0	1
+12160	12160	\/[0-9A-Z]+\/[0-9A-Z]+\.bin$	2	0	0	1
+12161	12161	\x2fpeca\d+\x2eexe	2	0	0	1
+12162	12162	\.php\?v=[A-Za-z0-9.]+&id=-?\d+&wv=[0-9.]{1,14}$	2	0	0	1
+12163	12163	si\x5F[a-z]{5}[0-9]{5}\x2Ecb	2	0	0	1
+12164	12164	seclog\x5F[a-z]{5}[0-9]{5}\x5F.+\x2Ekcb	2	0	0	1
+12165	12165	&si=\d+&si=\d+&rd=20\d{11}	2	0	0	1
+12166	12166	\x2f\x3fdata\x3d[a-fA-F0-9]{60}	2	0	0	1
+12167	12167	\S{20,40}\'\>	2	0	0	1
+12168	12168	\.php\?e=\d+&o=\w+&b=\w+&id=[0-9a-f]{32}$	2	0	0	1
+12169	12169	c\x3d[0-9a-f]{100}	2	0	0	1
+12170	12170	^\x23BOT\x23(VisitUrl|OpenUrl|Ping|RunPrompt|CloseServer|SvrUninstall|URLUpate|URLDownload)	2	0	0	1
+12171	12171	^\x23botCommand\x25(close\x20command|Error|Finish|Http\x20Flood|Mass\x20Download|Respond\x20\x5bOK|Syn\x20Flood|UDP\x20Flood|uninstall|Update|)	2	0	0	1
+12172	12172	hash=\{[a-f0-9]+-	2	0	0	1
+12173	12173	\/server_privileges\.php\?[0-9a-f]{32}=\d+(&\w+)?$	2	0	0	1
+12174	12174	\.php\?w=\d+&fail=\d+&i=[0-9a-f]{32}$	2	0	0	1
+12175	12175	(\.php|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$	2	0	0	1
+12176	12176	ddos\.(phat(icmp|syn|wonk)|stop|(syn|udp|http)flood|targa3|(syn|ack|random) ([0-9]{1,3}\.){3}[0-9]{1,3})	2	0	0	1
+12177	12177	floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+12178	12178	\.(upda|getfile|dl\dx|dl|download|execute)\w*\s+http\x3a\x2f\x2f	2	0	0	1
+12179	12179	(ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]|mydoom|netdevil|DameWare|kuang2|sub7|iis5ssl|wkssvc|wks1|mysql|wkssvcOth|wkssvcENG|arkeia|arcserve|wins|veritas|netbackup|asn))	2	0	0	1
+12180	12180	\x3A\x02\x034\x5B(BackConnect|help|HTTP.*|SCAN|TCP.*|UDP.*|VERSION)\x5D\x03\x02	2	0	0	1
+12181	12181	(ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|exploited|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]|mydoom|netdevil|DameWare|kuang2|sub7|iis5ssl|wkssvc|wks1|mysql|wkssvcOth|wkssvcENG|arkeia|arcserve|wins|veritas|netbackup|asn))	2	0	0	1
+12182	12182	((\.aim\w*|ascanall|\x3agetshit200)\s+\w+)|((@kill|@get_os_version|@get_computer_name|@get_bot_version|@update|@restart|@reboot|@shutdown)\s)	2	0	0	1
+12183	12183	\.((testdlls|threads|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\dx|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r])	2	0	0	1
+12184	12184	((cvar\.set)|(http\.(execute|update))|((aol)spam\.(setlist|settemplate|start|stop|setuser|setpass))|sniffer\.(addstring|delstring)|pingstop|udpstop|scan(all|stats|del|stop)|clone(stop|start)|c_(raw|mode|nick|join|part|privmsg|action))	2	0	0	1
+12185	12185	((T?FTP)\x3a File transfer|(random|sequential) Port Scan|Random (Spreading|Scanner)|Exploiting IP|Exploiting\.\.|flooding\x3a|flood stopped|sending packets)|Random Method started|FINDFILE|Scan stopped|No scan thread found|thread\(s\) stopped|\x3aExec 	2	0	0	1
+12186	12186	PRIVMSG\s+\S+\s+\x3a\s*(\.user |\.logout|\.die|\.restart|\.mail |\.dns |\.download |\.exec |\.find |\.cmd |\.php |\.tcpflood |\.udpflood |\.raw |\.rndnick|\.pscan |\.ud\.server )	2	0	0	1
+12187	12187	\x7Cddos\x7C(syn|http)\x7C	2	0	0	1
+12188	12188	\?rnd=\d{5,7}\x20HTTP1\/1\.[01]\x0d\x0aHost\x3a\x20	2	0	0	1
+12189	12189	\?aid=\d{9}&url=[\w\.\-]{23}$	2	0	0	1
+12190	12190	\?subid=\d{9}&u=[\w\.\-]{23}$	2	0	0	1
+12191	12191	FileName\x3D[^\r\n]*\x2E(dll|exe)	2	0	0	1
+12192	12192	Subject\x3A\x20[^\r\n]*C\x3A\x5C[^\r\n]*\x2Eexe	2	0	0	1
+12193	12193	download\x2FAntivirus_\d+\x2Eexe	2	0	0	1
+12194	12194	\/installer\.\d+\.exe	2	0	0	1
+12195	12195	\/installer_\d+\.exe	2	0	0	1
+12196	12196	\x0d\x0aHost\: [a-z\x2e]+(security|virus|pro|anti|scan|mypc|total|protect|check|guard|defend)	2	0	0	1
+12197	12197	Setup_20\d+\x2Eexe	2	0	0	1
+12198	12198	\/dl\/AcroIEHelpe(r)?(\d)?\.dll	2	0	0	1
+12199	12199	mac=[0-9A-Fa-f]{12}&	2	0	0	1
+12200	12200	\?type=slg&id=[0-9A-Z]{18}	2	0	0	1
+12201	12201	phid=[A-F0-9]{64}	2	0	0	1
+12202	12202	mode=\d+D[0-9A-F]{150}	2	0	0	1
+12203	12203	^x=[0-9a-zA-Z]{50}/P	2	0	0	1
+12204	12204	\/x\/\?0\w{35}$	2	0	0	1
+12205	12205	\/down\d+\/down\/\?s=[A-F0-9]+\&t=\d+\/\d+\/20	2	0	0	1
+12206	12206	\?spl=\d+&br=[A-Za-z]+&vers=\d\.\d&s=[a-z0-9]+[^&]$	2	0	0	1
+12207	12207	\?spl=MS[0-9]{2}-[0-9]{3}$	2	0	0	1
+12208	12208	\.php\?(land=\d+|affid=\d{5})&(land=\d+|affid=\d{5})$	2	0	0	1
+12209	12209	[1-3]\x2Finstaller\x2FInstaller\x2Eexe	2	0	0	1
+12210	12210	\x2FLayouts\x2FLandings\x2FCentralLandings\x2F\d+\x2Fimages\x2F	2	0	0	1
+12211	12211	MyValue=[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:	2	0	0	1
+12212	12212	\/(ucleaner|udefender|ufixer)\.com\/demo\.php\?	2	0	0	1
+12213	12213	\.php\?1=[a-z0-9]+_[a-z0-9_]+&i=	2	0	0	1
+12214	12214	^User-Agent\:[^\n]+PassSickle/Hmi	2	0	0	1
+12215	12215	\/cd\/un\.php.id=[A-F0-9\-]+&ver=	2	0	0	1
+12216	12216	&os=[a-f0-9]{50}	2	0	0	1
+12217	12217	^GET\x20[^\x0D\x0A]+\x3Fmod\x3Dcmd\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+	2	0	0	1
+12218	12218	^POST\x20[^\x0D\x0A]+\x3Fmod\x3Dlog\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+.*\x0D\x0A\x0D\x0Acurr\x3D.*\x26next\x3D	2	0	0	1
+12219	12219	Content-Length\x3a [1-9]	2	0	0	1
+12220	12220	Host\x3a\s[a-z]{15,19}\.ru(\x3a8080)?/Hm	2	0	0	1
+12221	12221	gameover(\d+)?\.php	2	0	0	1
+12222	12222	\x2F[a-z]{5}\x2Ephp\x3Fid\x3D	2	0	0	1
+12223	12223	\.php\?m=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&[vs]=	2	0	0	1
+12224	12224	\.php\?s=\d&m=[A-F0-9]{16}$	2	0	0	1
+12225	12225	\?id=[A-Za-z]+_[A-Za-z0-9]+&	2	0	0	1
+12226	12226	\/index.dat\?\d{5,9}$	2	0	0	1
+12227	12227	\x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+[a-f0-9]{12}&ext\x3D	2	0	0	1
+12228	12228	^User-Agent\x3a [a-z0-9]{92}/Hmi	2	0	0	1
+12229	12229	\/crack\.\d+\.exe$	2	0	0	1
+12230	12230	^\d+\x7cddos\x7c([^\x7c]+\x7c){5}[^\x7c]+$	2	0	0	1
+12231	12231	^\d+\x7cdlexec\x7c([^\x7c]+\x7c){3}[^\x7c]+$	2	0	0	1
+12232	12232	\.txt$	2	0	0	1
+12233	12233	^\d+\x3a\d\x7c\d+\x7c[0-9a-z]+\x7c\d	2	0	0	1
+12234	12234	\.php\?cmd=getFile&counter=\d	2	0	0	1
+12235	12235	codec=\d+D\d+D\d	2	0	0	1
+12236	12236	(\.aim\w*|ascanall)\s+\w	2	0	0	1
+12237	12237	report=\d+&pid=\d+&wv=[A-Za-z0-9]/P	2	0	0	1
+12238	12238	User\x2DAgent\x3A\x20[a-f0-9]{5,14}\x0D\x0A/H	2	0	0	1
+12239	12239	.php\?gd=\d+_\d+_\d+$	2	0	0	1
+12240	12240	\x2f\d+?\x2erar$	2	0	0	1
+12241	12241	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$	2	0	0	1
+12242	12242	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/	2	0	0	1
+12243	12243	^KEEPALIVE\x7c?\d	2	0	0	1
+12244	12244	kill\-\d+.\d+.\d+.\d+\:\d+%\d	2	0	0	1
+12245	12245	\x0d\x0aMagic-Number\x3a\s+\d+\|\d	2	0	0	1
+12246	12246	\/ping\/[0-9a-fA-F]{64}\/[0-9a-fA-F]+\/[0-9a-fA-F]	2	0	0	1
+12247	12247	\x3Fmod\x3D\w*?\x26id\x3D[^\x26\s]+?\x5F\w+?\x26up\x3D[^\x26]+?\x26mid\x3D[^\x26\s]	2	0	0	1
+12248	12248	Host\: \d+\.\d+\.\d+\.\d	2	0	0	1
+12249	12249	\?n=\d+&id=.+&t=.+&i=\d	2	0	0	1
+12250	12250	id=[a-f0-9-]+&	2	0	0	1
+12251	12251	ID=.{40}&.{6}	2	0	0	1
+12252	12252	(web(\.(velocitycache\.com|autoflash\.info)|update\.(dyndns\.info|hopto\.org)|app\.serveftp\.com)|flash(center\.info|rider\.org)|cache\.dyndns\.info)\r?$/Hmi	2	0	0	1
+12253	12253	((nvidia(s(tream|oft)|drivers)|(rendercode|videosyn)c|flashupdates|syncstream)\.info|194\.192\.14\.125|202\.75\.58\.179)\r?$/Hmi	2	0	0	1
+12254	12254	\/search\?q\=\d+&aq=\d	2	0	0	1
+12255	12255	\x7C(NEW|Awaiting commands)	2	0	0	1
+12256	12256	\x7C(NEW|Awaiting commands)	2	0	0	1
+12257	12257	\x7C(NEW|Awaiting commands)	2	0	0	1
+12258	12258	^\x3c\x21\x2d\x2d\x0d\x0a\x3cimg\x20border=\d+\x20src=\x22\S+\x2f\x23KX8\x2e	2	0	0	1
+12259	12259	^\d+\s*-->	2	0	0	1
+12260	12260	^[0-4]\s*src=\x22[^\x22]+\x22\swidth=\d+\sheight=\d+>\r\n-->	2	0	0	1
+12261	12261	\&p=[0-9A-Za-z]{5}\-[0-9A-Za-z]{5}\-	2	0	0	1
+12262	12262	^Accept-Encoding\x3a\s+([a-z]){3}/Hmi	2	0	0	1
+12263	12263	user=[a-f0-9]{32}&	2	0	0	1
+12264	12264	\/tlog\.php\?logn=[^\s]+&pss=[^\s]	2	0	0	1
+12265	12265	ntarg\.php\?[^\s]*(notdoing|howme|uname)=	2	0	0	1
+12266	12266	\/tnewu\.php\?nlogin=[^\s]+&npss=[^\s]+&invitedby=[^\s]	2	0	0	1
+12267	12267	updatea\.php\?p=\d	2	0	0	1
+12268	12268	&d=.{44}$	2	0	0	1
+12269	12269	filename=j[a-f0-9]{23}\.jar/H	2	0	0	1
+12270	12270	^hello\/[0-9]\.[0-9]\/[0-9]{3}	2	0	0	1
+12271	12271	^[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+12272	12272	^[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+12273	12273	NICK {[a-z]{2,3}\x2D.+?x86[a-z]}[a-z]	2	0	0	1
+12274	12274	^\d+\w+\/\d+\w+ free \(\d+% used\)	2	0	0	1
+12275	12275	^[A-Z]\x3a\x5f	2	0	0	1
+12276	12276	filename=e[a-f0-9]{23}\.exe/H	2	0	0	1
+12277	12277	^Host\x3a\x20[a-z0-9]+\.[a-z0-9]+\.[a-z0-9]+\.pl\x3a\d{2,5}\r$/Hm	2	0	0	1
+12278	12278	^[A-Z]{3}\|[UA]\|[DL]\|W([78]|_XP|VIS)\|x(86|64)\|	2	0	0	1
+12279	12279	^([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4})	2	0	0	1
+12280	12280	^[a-z0-9\+\/]+={0,2}$	2	0	0	1
+12281	12281	^(\r\n|$)	2	0	0	1
+12282	12282	^\d+?\x5d	2	0	0	1
+12283	12283	^[\r\n\s]*?<<((>>).)+?\/[a-zA-Z\d]*?#([46][1-9a-fA-F]|[57][\daA])([a-zA-Z\d])*?#([46][1-9a-fA-F]|[57][\daA])	2	0	0	1
+12284	12284	^(4\x00[1-9a-f]|5\x00[\da])	2	0	0	1
+12285	12285	^Referer\x3a[^\r\n]+\/[a-f0-9]{8}\/1(0\/[0-2]|1\/\d)\/\r$/Hm	2	0	0	1
+12286	12286	data_\d{4}_\d{1,2}_\d{1,2}_\d{1,2}_\d{1,2}\.txt	2	0	0	1
+12287	12287	^\d+?\x7cOnConnect\x7c	2	0	0	1
+12288	12288	^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01	2	0	0	1
+12289	12289	^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01	2	0	0	1
+12290	12290	^[0-9a-f]{22,46}	2	0	0	1
+12291	12291	^((PCACTIV|ONLIN)ETIME|WEBSITE[DS]|CHATROOM|KEYLOGS)	2	0	0	1
+12292	12292	^\S{2,3}\x7c\S+?[au]\x7D\w{2,11}\x0d?\x0a	2	0	0	1
+12293	12293	^\/[A-Z]{1}[0-9]{1,3}\/[A-X]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/[A-Z]{1}[0-9]{4,5}[A-M]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/$	2	0	0	1
+12294	12294	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+12295	12295	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+12296	12296	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+12297	12297	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+12298	12298	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+12299	12299	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+12300	12300	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+12301	12301	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+12302	12302	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+12303	12303	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+12304	12304	^(x(86|64)@)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+12305	12305	^[^\x00]+?\x00	2	0	0	1
+12306	12306	Host\x3a\x20([^\r\n]+\.)?bitcrypt\.cc(\x3a\d{1,5})?\r\n/Hmi	2	0	0	1
+12307	12307	ID=\d{24}($|&)	2	0	0	1
+12308	12308	^[a-z0-9_-]*?\.class	2	0	0	1
+12309	12309	name=\x22[a-z0-9\-_\.\s]{0,25}\.gadget\x22	2	0	0	1
+12310	12310	^..[\x0d-\x20](\d{0,27}[a-z])([a-z]{0,27}\d)[a-z0-9]{21,28}(\x03(biz|com|net|org))\x00\x00\x01\x00\x01	2	0	0	1
+12311	12311	^\d\.\d\.\d{4}\]\r\n\(C\)\x20Copyright\x20\d{4}(\x2d\d{4})?\x20Microsoft Corp(:?\.|oration)	2	0	0	1
+12312	12312	^\d+?\.\d+?\sstarted	2	0	0	1
+12313	12313	^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$	2	0	0	1
+12314	12314	MyValue=[a-f0-9]{32}	2	0	0	1
+12315	12315	^([a-zA-Z0-9\x2d\x5f]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]*?9\.9\.9\.9\s+?([a-zA-Z0-9\_\-]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]	2	0	0	1
+12316	12316	^PRIVMSG.*@(portscan|back|(tcp|udp|http)flood|tsunami|(de)?voice|reset|die|say|join|part|(de)?op)	2	0	0	1
+12317	12317	name=\x22DHL(\s|_|\-)?[a-z0-9\-_\.\s]{0,63}\.zip\x22	2	0	0	1
+12318	12318	\/.+(www\.)?[a-z0-9]+\.[a-z]{2,3}\.exe$	2	0	0	1
+12319	12319	adobe-flash\.v\.\d{5}\.exe	2	0	0	1
+12320	12320	\x2Finvoice\x2Escr$	2	0	0	1
+12321	12321	forum\/\?[0-9a-f]{8}$	2	0	0	1
+12322	12322	ups(_parcel_delivery-tracking-notice-|-Delivery-Notification-Message_)\S*\.zip	2	0	0	1
+12323	12323	Host\x3A\x20[^a-z]*[0-9]{4,30}\x2Ecn\x0D\x0A/Hi	2	0	0	1
+12324	12324	User-Agent\x3a\x20[a-z]{3,4}\x0d\x0a/H	2	0	0	1
+12325	12325	\/xxxx_\d+\/	2	0	0	1
+12326	12326	^Host\x3a\s[^\r\n]+?\.[abedgfihkmlonqpsruwvyxz]{16}\.waw\.pl\r$/Hmi	2	0	0	1
+12327	12327	\x10[abedgfihkmlonqpsruwvyxz]{16}\x03waw\x02pl\x00	2	0	0	1
+12328	12328	^[^\x3b]+\\x([57][0-9a]|4[0-9a-f]|6[1-9a-f]|3[0-9])	2	0	0	1
+12329	12329	^(<q>[\x22\x27])(((=q))[^\r\n\x2c])+?(=q)\s*?\+\s*?[\x22\x27][^\r\n\x2c]*?[cg][\x22\x27\+\s]*?[o][\x22\x27\+\s]*?[vm][\x22\x27\+\s]*?\.[\x22\x27\+\s]*?b[\x22\x27\+\s]*?r[\x22\x27\+\s]*?\x2c	2	0	0	1
+12330	12330	^..[\x0d-\x20][a-z]{13,32}(\x03(biz|com|net|org)|\x04info|\x02ru)\x00\x00\x01\x00\x01	2	0	0	1
+12331	12331	^\d	2	0	0	1
+12332	12332	[^\x33][^\x6f\x19\x18\x0e\x4f\x09\x08\x11\x0c\x0f\x0d\x1f\x10\x39][\x00-\x07\x0b\x0a\x1e\x1d\x12\x13\x15\x10\x1b\x1a\x54-\x5f\x50-\x52\x40-\x4b\x4d\x4e\x70-\x7f\x60-\x67\x69-\x6d]{1,14}\x33	2	0	0	1
+12333	12333	^\x2d?\d	2	0	0	1
+12334	12334	My\x20IP\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x0A	2	0	0	1
+12335	12335	^[^\r\n]{0,7}\b(M[ACDEFGHKLMNOPQRSTUVWXYZ]|B[ABDEFGHIJLMNOQRSTVWYZ]|S[ABCDEGHIJKLMNORSTVXYZ]|C[ACDFGHIKLMNORUVWXYZ]|G[ABDEFGHILMNPQRSTUWY]|A[DEFGILMOQRSTUWXZ]|T[CDFGHJKLMNORTVWZ]|P[AEFGHKLMNRSTWY]|N[ACEFGILOPRUZ]|K[EGHIMNPRWYZ]|L[ABCIKRSTUVY]|I[DELMNOQRST]|E[CEGHRST]|V[ACEGINU]|D[EJKMOZ]|F[IJKMOR]|H[KMNRTU]|U[AGMSYZ]|R[EOSUW]|J[EMOP]|Z[AMW]|W[FS]|Y[ET]|OM|QA)\b	2	0	0	1
+12336	12336	^[^\r\n]{0,7}\b(M(A[CFR]|D[AGV]|N[EGP]|L[IT]|Y[ST]|[MS]R|CO|EX|HL|KD|OZ|RT|TQ|US|WI)|S(L[BEV]|[DEH]N|[JOP]M|G[PS]|V[KN]|W[EZ]|Y[CR]|[MU]R|AU|RB|SD|TP)|B(L[MRZ]|R[ABN]|E[LN]|G[DR]|H[RS]|[FW]A|DI|IH|MU|OL|TN|VT)|C(O[DGKLM]|H[ELN]|A[FN]|Y[MP]|[IP]V|[MX]R|CK|RI|UB|ZE)|A(R[EGM]|T[AFG]|L[AB]|N[DT]|U[ST]|BW|FG|GO|IA|SM|ZE)|G(R[CDL]|U[FMY]|I[BN]|N[BQ]|[AM]B|BR|EO|GY|HA|LP|TM)|T(U[NRV]|C[AD]|K[LM]|[GT]O|[HZ]A|[OW]N|JK|LS)|P(R[IKTY]|A[KN]|[HO]L|CN|ER|LW|NG|SE|YF)|N([CPZ]L|I[CU]|[EO]R|AM|FK|GA|LD|RU)|L(B[NRY]|[CKV]A|[AS]O|IE|TU|UX)|I(R[LNQ]|S[LR]|[DM]N|ND|OT|TA)|K([AG]Z|[IO]R|EN|HM|NA|WT)|E(S[HPT]|CU|GY|RI|TH)|V([ACU]T|EN|GB|IR|NM)|D([MZ]A|EU|JI|NK|OM)|F(R[AO]|IN|JI|LK|SM)|H([MN]D|KG|RV|TI|UN)|U([GS]A|KR|MI|RY|ZB)|J(AM|EY|OR|PN)|R([EO]U|US|WA)|Z(AF|MB|WE)|W(LF|SM)|OMN|QAT|YEM)\b	2	0	0	1
+12337	12337	^[a-z0-9_-]*?\.class	2	0	0	1
+12338	12338	^.\x00\x00\x00[a-z0-9]+?\x00	2	0	0	1
+12339	12339	^\d+[\r\n]*?$	2	0	0	1
+12340	12340	^[^\r\n]*?\x3a[^\r\n]*?(port(scan)?|udp[1-3]|tcp|http|download)[^\r\n]+?(\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}|https?\x3A\x2F\x2F)	2	0	0	1
+12341	12341	^[^\r\n]*?(p[ao]rt|udp|c?tcp|http|d(ie|ownload)|mail|c?back|(msg|notice)?flood)	2	0	0	1
+12342	12342	^[a-z]{12}	2	0	0	1
+12343	12343	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x40\x24\x40$	2	0	0	1
+12344	12344	^[a-z]{16}	2	0	0	1
+12345	12345	\/get\/get\.php$	2	0	0	1
+12346	12346	^[A-Za-z0-9\s/+]{100}	2	0	0	1
+12347	12347	^Host\x3a\x20ns1\.help(update(d\.(com?|net?|org?)|k\.(at?|eu?|tw)|r\.net|s\.com)|checks\.net)	2	0	0	1
+12348	12348	^<(<var1>[a-z])>[a-z0-9/]+<\/(=var1)><(<var2>[a-z])>[a-z0-9/]+<\/(=var2)>	2	0	0	1
+12349	12349	^[^\r\n]+?\n$	2	0	0	1
+12350	12350	\x21\x20UDP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+12351	12351	\x21\x20TCP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+12352	12352	\x21\x20HOLD\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+12353	12353	\x21\x20SCANNER\x20(ON|OFF)\x0A	2	0	0	1
+12354	12354	\x21\x20JUNK\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+12355	12355	^[a-z][a-f0-9]{33}	2	0	0	1
+12356	12356	^[a-z][a-f0-9]{33}	2	0	0	1
+12357	12357	^[a-z][a-f0-9]{33}	2	0	0	1
+12358	12358	^[a-z][a-f0-9]{33}	2	0	0	1
+12359	12359	^[a-z][a-f0-9]{33}	2	0	0	1
+12360	12360	^[a-z][a-f0-9]{33}	2	0	0	1
+12361	12361	^[a-z][a-f0-9]{33}	2	0	0	1
+12362	12362	^[a-z][a-f0-9]{33}	2	0	0	1
+12363	12363	^Host\x3A[^\r\n]+?\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(\x3a\d{1,5})?\r?$/Hmi	2	0	0	1
+12364	12364	^[a-f0-9]+$	2	0	0	1
+12365	12365	^[0-9A-F]{12}$	2	0	0	1
+12366	12366	^\S{2,3}\x2d(XP|2K3|VIS|2K8|W7|ERR)\w?\x2d\w+?\x7D\w+?\r\n?	2	0	0	1
+12367	12367	^(MIPS(EL)?|POWERPC|ARM|X86)\x0a$	2	0	0	1
+12368	12368	^(ON|OFF)	2	0	0	1
+12369	12369	^\d+MHz\x00	2	0	0	1
+12370	12370	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})system$	2	0	0	1
+12371	12371	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}D\x3a\x00+?$	2	0	0	1
+12372	12372	^.{2}(<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x08.{2}(=var)	2	0	0	1
+12373	12373	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12374	12374	^[\x53\x54]	2	0	0	1
+12375	12375	^[a-z0-9]{50}	2	0	0	1
+12376	12376	^[a-z0-9]{50}	2	0	0	1
+12377	12377	^\x3c\x2a\x60[\x20-\x7e]+\x60\x2a\x3e$	2	0	0	1
+12378	12378	^\d+\]\r\n$	2	0	0	1
+12379	12379	^((menelao|ho[mr]u)s|adair|johan|kweku)\r\n	2	0	0	1
+12380	12380	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d	2	0	0	1
+12381	12381	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d	2	0	0	1
+12382	12382	^[A-F0-9]{8,12}	2	0	0	1
+12383	12383	^(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?$	2	0	0	1
+12384	12384	^[\x01\x03\x08\x09\x0b]\x00	2	0	0	1
+12385	12385	^\d{1,3}[0-2]	2	0	0	1
+12386	12386	\.tar$	2	0	0	1
+12387	12387	^[a-zA-Z0-9]{8}	2	0	0	1
+12388	12388	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+12389	12389	\x7c[a-f0-9]{16}\x7c\d+\x7c$	2	0	0	1
+12390	12390	[^\x28][^\x76\x74\x02\x03\x15\x54\x12\x13\x0a\x17\x14\x16\x04\x0b\x22][\x05\x09\x0b\x0e\x08\x06\x1a-\x1f\x10\x11\x18\x19\x40-\x47\x48-\x4f\x50-\x53\x55\x56\x58-\x5e\x60-\x68\x6a-\x6f\x70\x72\x76-\x7e]{1,14}\x28	2	0	0	1
+12391	12391	\x00\x05value$	2	0	0	1
+12392	12392	^[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+12393	12393	^\d{1,5}	2	0	0	1
+12394	12394	^.{2}[a-z]{5,}\.[a-z]{2}\x30	2	0	0	1
+12395	12395	^(#+[A-Z]+)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?\${10}	2	0	0	1
+12396	12396	^(in|out)	2	0	0	1
+12397	12397	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+12398	12398	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+12399	12399	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+12400	12400	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+12401	12401	^[0-9A-F]{12}	2	0	0	1
+12402	12402	^\d{1,6}\x00pl\x7c	2	0	0	1
+12403	12403	^\d{1,6}\x00sc\x7e\x7c	2	0	0	1
+12404	12404	^\d{1,6}\x00scPK\x7c	2	0	0	1
+12405	12405	^\d{1,6}\x00rn\x7c	2	0	0	1
+12406	12406	^\d{1,6}\x00ret\x7c	2	0	0	1
+12407	12407	^\d{1,6}\x00cap\x7c	2	0	0	1
+12408	12408	^\d{1,6}\x00kl\x7c	2	0	0	1
+12409	12409	^\d{1,6}\x00fm\x7c	2	0	0	1
+12410	12410	^\d{1,6}\x00proc\x7c	2	0	0	1
+12411	12411	^\d{1,6}\x00rg\x7c	2	0	0	1
+12412	12412	^\d{1,6}\x00srv\x7c	2	0	0	1
+12413	12413	^\d{1,6}\x00rs\x7c	2	0	0	1
+12414	12414	^\d{1,6}\x00mic\x7c	2	0	0	1
+12415	12415	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+12416	12416	^NOTICE [^\r\n]+? \x3aREWRITING\x0a[^\r\n]+?\x0ato\x0a[^\r\n]+?\x0a	2	0	0	1
+12417	12417	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+12418	12418	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+12419	12419	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+12420	12420	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+12421	12421	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+12422	12422	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+12423	12423	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+12424	12424	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+12425	12425	^([A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(64)?$	2	0	0	1
+12426	12426	^([A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(64)?$	2	0	0	1
+12427	12427	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+12428	12428	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+12429	12429	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+12430	12430	^\d+	2	0	0	1
+12431	12431	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+12432	12432	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+12433	12433	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+12434	12434	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+12435	12435	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+12436	12436	^.{2}[a-z]{25}\.[a-z]{2,3}[01]	2	0	0	1
+12437	12437	^(([0-9]{1,3}\.){3}[0-9]{1,3})(={2})	2	0	0	1
+12438	12438	\/\?[A-Z]{10,}$	2	0	0	1
+12439	12439	^User-Agent\x3a[^\r\n]+?(MSIE|rv\x3a11)/Hm	2	0	0	1
+12440	12440	\/\d{10}\?w=\d{3}&i=\d{6,10}&v=\d\.\d$	2	0	0	1
+12441	12441	\.php$	2	0	0	1
+12442	12442	^KEEPALIVE\d+$	2	0	0	1
+12443	12443	\x24RECYCLE\.BIN\.\x7B[0-9A-F]{8}\x2D([0-9A-F]{4}\x2D){3}[0-9A-F]{12}\x7D\x5C\x7B[0-9A-F]{8}\x2D([0-9A-F]{4}\x2D){3}[0-9A-F]{12}\x7D\.(scr|pif|cmd)	2	0	0	1
+12444	12444	^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][A-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}	2	0	0	1
+12445	12445	^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][A-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}	2	0	0	1
+12446	12446	\.php\?e=\d{4}\-\d{4}&h=[a-f0-9]{32}$	2	0	0	1
+12447	12447	^[a-f0-9]{7,}$	2	0	0	1
+12448	12448	^.{2}(www)\d?[A-Z]?([a-z]{3,20}\.)?[a-z]{5,}(\d[a-z]{5,})?\.[a-z]{2,5}[01]	2	0	0	1
+12449	12449	^[^\x00]+(\xff\xd9)?$	2	0	0	1
+12450	12450	^0103F\x00[^\x00]+(\xff\xd9)?$	2	0	0	1
+12451	12451	^0103F\x00[^\x00]+(\xff\xd9)?$	2	0	0	1
+12452	12452	^.{2}((\d[A-Z]?|[A-Z]\d?)[a-z]{6,20}|[A-Z]?[a-z]{3,7}\d[a-z]{3,7})\.((\d[A-Z]?|[A-Z]\d?)[a-z]{6,20}|[A-Z]?[a-z]{3,7}\d[a-z]{3,7})\.((com|net|org)[01])[a-z]{2,}[01]	2	0	0	1
+12453	12453	^(<v1>\S{1,100})\s+(<v2>\S{1,100})\s+=\s+\x22\x22\x3b\s+(=v2)\s+\+\=\s+\x27(=v1).+?(=v1)\x27\x3b.+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27]	2	0	0	1
+12454	12454	^[a-z]{12}	2	0	0	1
+12455	12455	^[a-f0-9]{14}$	2	0	0	1
+12456	12456	^\d	2	0	0	1
+12457	12457	\.php\?id=\d+&magic=(-)?\d+$	2	0	0	1
+12458	12458	^.{2}(<CN>((\d?[A-Z]?|[A-Z]?\d?)([a-z]{3,20}|[a-z]{3,6}[0-9_][a-z]{3,6})\.){0,2}?(\d?[A-Z]?|[A-Z]?\d?)[a-z]{3,}([0-9_-][a-z]{3,})?\.(com|org|net|tv)[a-z]{2,9})[01].*?(=CN)[01]	2	0	0	1
+12459	12459	^.[\x0e\x0f]((www|ns))[a-z0-9]{2,3}	2	0	0	1
+12460	12460	^.[\x0a\x0b]((www|ns))[a-z0-9]{1,2}	2	0	0	1
+12461	12461	^KEEPALIVE\x7c?\d	2	0	0	1
+12462	12462	^[a-f0-9]{13,30}$	2	0	0	1
+12463	12463	^[a-f0-9]{13,30}$	2	0	0	1
+12464	12464	^[a-f0-9]{13,30}$	2	0	0	1
+12465	12465	^[a-f0-9]{13,30}$	2	0	0	1
+12466	12466	^[a-f0-9]{13,30}$	2	0	0	1
+12467	12467	^[a-f0-9]{13,30}$	2	0	0	1
+12468	12468	^[a-f0-9]{13,30}$	2	0	0	1
+12469	12469	^[a-f0-9]{13,30}$	2	0	0	1
+12470	12470	^[a-f0-9]{13,30}$	2	0	0	1
+12471	12471	^[a-f0-9]{13,30}$	2	0	0	1
+12472	12472	^[a-f0-9]{13,30}$	2	0	0	1
+12473	12473	^[a-f0-9]{13,30}$	2	0	0	1
+12474	12474	^[a-f0-9]{13,30}$	2	0	0	1
+12475	12475	^[a-f0-9]{13,30}$	2	0	0	1
+12476	12476	^[a-f0-9]{13,30}$	2	0	0	1
+12477	12477	^[a-f0-9]{13,30}$	2	0	0	1
+12478	12478	^[A-F0-9]+\x00	2	0	0	1
+12479	12479	Cookie\x3a mstshash=[a-zA-Z]\r\n	2	0	0	1
+12480	12480	^[^A-Za-z0-9]	2	0	0	1
+12481	12481	^(FM|SM|CP|CM|MC|NF|CH|PS|PT)	2	0	0	1
+12482	12482	^(Lg|Execute|FLD|Sc)\x7c\x2d\x7c	2	0	0	1
+12483	12483	^(\x40|\x21|\x23|\x7e|\x24)	2	0	0	1
+12484	12484	\bnethelper\b/Vi	2	0	0	1
+12485	12485	^\d	2	0	0	1
+12486	12486	[\x04\x06]\x88\x4d\x76$	2	0	0	1
+12487	12487	[\xb0\xb2]\x63\x70\x7b$	2	0	0	1
+12488	12488	^(.{0,56}\x00.{0,55}\x00.{0,54}\x00.{0,53}\x00)(.{0,54}\x00{2})(.{0,50}[A-Za-z0-9]{5})((<b1>.).{0,53}(=b1).{0,52}(=b1).{0,51}(=b1).{0,50}(=b1))(.(<b2>.).{0,52}(=b2).{0,51}(=b2).{0,50}(=b2).{0,49}(=b2))(..(<b3>.).{0,51}(=b3).{0,50}(=b3).{0,49}(=b3).{0,48}(=b3))(...(<b4>.).{0,50}(=b4).{0,49}(=b4).{0,48}(=b4).{0,47}(=b4))(....(<b5>.).{0,49}(=b5).{0,48}(=b5).{0,47}(=b5).{0,46}(=b5))(.....(<b6>.).{0,48}(=b6).{0,47}(=b6).{0,46}(=b6).{0,45}(=b6))(......(<b7>.).{0,47}(=b7).{0,46}(=b7).{0,45}(=b7).{0,44}(=b7))(.......(<b8>.).{0,46}(=b8).{0,45}(=b8).{0,44}(=b8).{0,43}(=b8))(........(<b9>.).{0,45}(=b9).{0,44}(=b9).{0,43}(=b9).{0,42}(=b9))(.........(<b10>.).{0,44}(=b10).{0,43}(=b10).{0,42}(=b10).{0,41}(=b10))	2	0	0	1
+12489	12489	\r\nHost\x3a[^\r\n]+\r\n(Pragma|Cache-Control)\x3a\x20no-cache\r\n(Connection\x3a Keep-Alive\r\n)?(\r\n)?$/H	2	0	0	1
+12490	12490	^Accept\x3a\x20\*\/\*\r\nConnection\x3a\x20close\r\nHost\x3a\x20[^\r\n\x2e]+\x2e[^\r\n\x2e]+(\x3a\d{1,5})?\r\n(\r\n)?$/H	2	0	0	1
+12491	12491	name\x3d\x22(message|letter|.*lebanon\x2donline\x2ecom\x2elb)?\x2ezip\x22\x0d\x0a	2	0	0	1
+12492	12492	^[A-Za-z0-9+/=]+\x24\x3a\d+\x3a\x24$	2	0	0	1
+12493	12493	^[acdefghijlmopqrtwz]{16}\.mynumber\.org$	2	0	0	1
+12494	12494	^Host\x3a (\d+\.){3}\d+$	2	0	0	1
+12495	12495	^[0-9A-Z]{8}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9]{12}-0[0-9]{1}	2	0	0	1
+12496	12496	^(_|Keylogger)	2	0	0	1
+12497	12497	[^\x12][^\x4e\x38\x39\x2f\x6e\x28\x29\x30\x2d\x2e\x2c\x3e\x31\x18][\x40-\x48\x4a-\x4d\x31-\x34\x3a-\x3c\x3f\x50-\x5f\x60-\x6c\x6f\x73-\x7f\x70\x71\x20-\x27\x2a\x2b]{1,14}\x12	2	0	0	1
+12498	12498	^[0-9]{2,3}\x00\x6c\x6c(<var>[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(=var)[^\r\n]+(=var)$	2	0	0	1
+12499	12499	^(GET|POST)\/(watch|search|find|results|open|search|close)\/\?(text=|from=|aq=|ai=|ags=|oe=|btnG=|oprnd=|utm=|channel=|itwm=)	2	0	0	1
+12500	12500	itwm=[A-Za-z0-9\-\_]{29,35}	2	0	0	1
+12501	12501	&itwm=[A-Za-z0-9\-\_]{29,35}	2	0	0	1
+12502	12502	[A-Z0-9\-]{16}-FILE-[^\r\n]+.tmp	2	0	0	1
+12503	12503	Mozilla\/[0-9]{1,2}.[0-9]{1,2}\(compatible\; MSIE [0-9]{1,2}.[0-9]{1,2}\;\)\x0d\x0a	2	0	0	1
+12504	12504	^.{2}[A-Za-z][a-z]*?@[a-z]+\.com0	2	0	0	1
+12505	12505	^User-Agent\x3a\x20[^\r\n]+?(MSIE|rv\x3a11\.0)/Hmi	2	0	0	1
+12506	12506	^\x00+?[\x20-\x7f]+?\x00+?$	2	0	0	1
+12507	12507	^\x00+?[\x20-\x7f]+?\x00+?$	2	0	0	1
+12508	12508	^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi	2	0	0	1
+12509	12509	^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi	2	0	0	1
+12510	12510	^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi	2	0	0	1
+12511	12511	^[\x22\x27][a-z][\x27\x22]	2	0	0	1
+12512	12512	^.(.[a-z]{4,12}\.(us|org|net|biz|info|mobi|com)[01]).*?\x55\x04\x03.	2	0	0	1
+12513	12513	^[0-9]{3}\x7cx	2	0	0	1
+12514	12514	^[0-9]{2}\x7cx	2	0	0	1
+12515	12515	^[a-f0-9]{40,}$	2	0	0	1
+12516	12516	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12517	12517	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps	2	0	0	1
+12518	12518	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps	2	0	0	1
+12519	12519	([0-9A-F]{8}\-){5}\-SH	2	0	0	1
+12520	12520	^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+12521	12521	^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+12522	12522	^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+12523	12523	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+12524	12524	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+12525	12525	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+12526	12526	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+12527	12527	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+12528	12528	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+12529	12529	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+12530	12530	^d([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?e([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?f([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?a([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?u([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?l([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?t([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?#([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?V([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?M([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?L[\x22\x27]	2	0	0	1
+12531	12531	^.{4}[\x0a-\x7f]{0,100}[\x00-x09\x80-\xff]	2	0	0	1
+12532	12532	^\/([a-z]*[0-9][a-z-0-9]*)([0-9]*[a-z][a-z-0-9]*)[a-z0-9]{5,8}$	2	0	0	1
+12533	12533	Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(\x3a\d{1,5})?\r\n/H	2	0	0	1
+12534	12534	\/js\/bin\.exe\\d+$	2	0	0	1
+12535	12535	^.{1}([\x20-\x7e]{0,8}?[^\x20-\x7e])(<var>.{10,120}?[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+12536	12536	^.{2}[a-z]+@[a-z]+\.com[01]	2	0	0	1
+12537	12537	^.{2}[a-z]+@[a-z]+\.com[01]	2	0	0	1
+12538	12538	^.{2}[A-Za-z][a-z]*?@[a-z]+\.com[01]	2	0	0	1
+12539	12539	\x00[0-9]{4,7}\x02in\x00	2	0	0	1
+12540	12540	^[\x0e-\x1e]([a-f0-9]{2}){1,3}(dc([a-f0-9]{2}){1,3}){3}.[a-f0-9]{2}	2	0	0	1
+12541	12541	^[\x08-\xFF]([a-f0-9]{2})*?dc978a97	2	0	0	1
+12542	12542	^(gdqg|hdqh|idqi|jdqj|kdqk|ldql|mdqm|ndqn|odqo|pdqp|qdqq|rdqr|sdqs|tdqt|udqu|vdqv|wdqw|xdqx|ydqy|zdqz)[a-j](\x02ch|\x03biz)	2	0	0	1
+12543	12543	^(adra|bdrb|cdrc|ddrd|edre|fdrf|gdrg|hdrh|idri|jdrj|kdrk|ldrl|mdrm|ndrn|odro|pdrp|qdrq|rdrr|sdrs|tdrt|udru|vdrv|wdrw|xdrx|ydry|zdrz)[a-j](\x02ch|\x03biz)	2	0	0	1
+12544	12544	^(0+30)[0-9A-Z]+30[^0-9]	2	0	0	1
+12545	12545	[a-z]{4,10}\.velodrivve\.biz$	2	0	0	1
+12546	12546	[a-z]{4,10}\.bedrifg\.org$	2	0	0	1
+12547	12547	[a-z]{4,10}\.fedbook\.org$	2	0	0	1
+12548	12548	[a-z]{4,10}\.goodbird\.biz$	2	0	0	1
+12549	12549	[a-z]{4,10}\.verekt\.biz$	2	0	0	1
+12550	12550	[a-z]{4,10}\.barrout\.org$	2	0	0	1
+12551	12551	[a-z]{4,10}\.biojart\.biz$	2	0	0	1
+12552	12552	[a-z]{4,10}\.benefin\.org$	2	0	0	1
+12553	12553	\.(upda|getfile|dl\dx|dl|download|execute)\w*\s+ftp\x3a\x2f\x2f	2	0	0	1
+12554	12554	\/operator\/login\.php$	2	0	0	1
+12555	12555	^.{8}[\x20-\x7e]+?\x7b\x9e	2	0	0	1
+12556	12556	^Subject\x3a [^\r\n]+?Foi Instalado	2	0	0	1
+12557	12557	^\/[56]\d{4}\x2c.*?\x2c[A-Z]\x3a[\x2f\x5c].+?\.exe	2	0	0	1
+12558	12558	\x00\x07[a-z0-9]{7}\x02eu\x00	2	0	0	1
+12559	12559	[^a-z0-9\-\.][a-z]{32,48}\x02ru\x00\x00	2	0	0	1
+12560	12560	^ETag\x3a\x20\x22\d+75BCD15\d+\x3a[a-f0-9]{1,6}	2	0	0	1
+12561	12561	^<(<var1>[a-z])>[a-z0-9/]+<\/(=var1)><(<var2>[a-z])>[a-z0-9/]+<\/(=var2)>$	2	0	0	1
+12562	12562	^Host\x3a[^\r\n]+?cvredirect.no-ip.net/Hmi	2	0	0	1
+12563	12563	^Host\x3a[^\r\n]+?cvredirect.ddns.net/Hmi	2	0	0	1
+12564	12564	^Keylogger\r$	2	0	0	1
+12565	12565	^[\x22\x27]NEGOCIO_ONLINE(\.(zip|exe))[\x27\x22]\x0d\x0a	2	0	0	1
+12566	12566	^[A-F0-9]{48}\.bin\r\n	2	0	0	1
+12567	12567	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d+\/stat\x03\x08\x0c$	2	0	0	1
+12568	12568	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d+\/control\x03\x08\x0c$	2	0	0	1
+12569	12569	^Host\x3a[^\r\n]+?\r\n(\r\n)?$/Hi	2	0	0	1
+12570	12570	^Host\x3a[^\r\n]+\.asia\r\n/Hmi	2	0	0	1
+12571	12571	^Host\x3a[^\r\n]+\.ru\r\n/Hmi	2	0	0	1
+12572	12572	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title><\/html>$	2	0	0	1
+12573	12573	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+12574	12574	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+12575	12575	^[a-z0-9]{1,10}[A-F0-9]+\.bin\r\n$	2	0	0	1
+12576	12576	^\s*\s*?[\x22\x27]javax.naming.InitialContext	2	0	0	1
+12577	12577	\x7c([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})$	2	0	0	1
+12578	12578	^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/n\d+\.png$	2	0	0	1
+12579	12579	(JUNK|HOLD) Flooding (\d{1,3}\.){3}\d{1,3} for \d+ seconds.\r?\n	2	0	0	1
+12580	12580	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})Wrod--\\\$	2	0	0	1
+12581	12581	^(:?[78]|XP)	2	0	0	1
+12582	12582	\.php\?\d{1,4}$	2	0	0	1
+12583	12583	\.php\?\d{1,4}$	2	0	0	1
+12584	12584	\/config\.php\?id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+	2	0	0	1
+12585	12585	^AuthToken=[A-Za-z0-9+/]{43}=$	2	0	0	1
+12586	12586	\.[^\x3F]+\?id=\d+&act=\d+$	2	0	0	1
+12587	12587	^.{2}[A-Z]?[a-z]+\.[A-Z]?[a-z]+@gmail\.com[01]	2	0	0	1
+12588	12588	^[0-9A-Z]+232A	2	0	0	1
+12589	12589	^\d{1,3}$	2	0	0	1
+12590	12590	^(Cek\x20This|miss\x20[A-Za-z0-9]{2,20}|[A-Za-z0-9]{2,20}Porn)\r\n	2	0	0	1
+12591	12591	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+12592	12592	^(likes|check|login_status)\.json\?	2	0	0	1
+12593	12593	^[0-9A-F]{16}$	2	0	0	1
+12594	12594	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+12595	12595	^[A-F0-9]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\/	2	0	0	1
+12596	12596	^[a-z0-9/%=]{100,}$	2	0	0	1
+12597	12597	^(-[0-9]+|[A-F0-9]{32})=1$	2	0	0	1
+12598	12598	^(-[0-9]+|[A-F0-9]{32})=1&type=zip$	2	0	0	1
+12599	12599	^(-[0-9]+|[A-F0-9]{32})=1&type=filter$	2	0	0	1
+12600	12600	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}&u=	2	0	0	1
+12601	12601	^[A-Za-z0-9\/\.=]{250,}$	2	0	0	1
+12602	12602	^\d+\x0a$	2	0	0	1
+12603	12603	^[A-Za-z0-9]{25,}$	2	0	0	1
+12604	12604	^\d{2,4}$	2	0	0	1
+12605	12605	^[a-z0-9]{6}$	2	0	0	1
+12606	12606	^=?[a-z0-9]{6}$	2	0	0	1
+12607	12607	^(pe|pp|s)$	2	0	0	1
+12608	12608	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12609	12609	^(mfa\.[\w-]{84}|[\w-]{24}\.[\w-]{6}\.[\w-]{27})\x0d\x0a	2	0	0	1
+12610	12610	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})\d(\r\n)?$/Hmi	2	0	0	1
+12611	12611	&p=[a-z0-9]{12}(&v=[a-z0-9\.-]{1,24})?$	2	0	0	1
+12612	12612	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12613	12613	^[A-F0-9]{8}$	2	0	0	1
+12614	12614	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x00$	2	0	0	1
+12615	12615	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12616	12616	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+12617	12617	^[a-z]{200,}$	2	0	0	1
+12618	12618	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12619	12619	^(The White House|And increasing numbers|Drivers for a parcel|The Italian region worst hit|Although Interpol issued|President Donald Trump|Restaurants are still allowed|A paper released on Friday)	2	0	0	1
+12620	12620	^[a-f0-9]{32}$	2	0	0	1
+12621	12621	^[A-Za-z0-9\-_\.]{20,80}\.[a-z]{2}\d{2}\.com$	2	0	0	1
+12622	12622	^[a-fA-F0-9]{61}\.[a-fA-F0-9]{63}\.[a-fA-F0-9]{63}\.	2	0	0	1
+12623	12623	^88[a-fA-F0-9]{38}b9\.	2	0	0	1
+12624	12624	^8b[a-fA-F0-9]{46}b9\.	2	0	0	1
+12625	12625	&uuid=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+12626	12626	^[a-z]{256}$	2	0	0	1
+12627	12627	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12628	12628	\x2Fu\x2Fupd\x5F(cb|.+\x2Ecb)	2	0	0	1
+12629	12629	^(\d+|(\w+)?grabbers?|uploader)(&luck=\d)?$	2	0	0	1
+12630	12630	\x2F(data|main|patch)\x2Ecfg	2	0	0	1
+12631	12631	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+12632	12632	c\x3d[0-9a-f]{100}	2	0	0	1
+12633	12633	\.php\?U=\d+@\d+@\d+@\d+@\d+@[a-f0-9]+$	2	0	0	1
+12634	12634	^(0-9]{1,3}\.){3}\d{1,3}$	2	0	0	1
+12635	12635	^[^?#]+?\.php\?f=\w+&e=\d+$	2	0	0	1
+12636	12636	id=[A-F0-9]{20}	2	0	0	1
+12637	12637	^(x\d{1,2}){5,}	2	0	0	1
+12638	12638	\?ca[sc]hingDeny=[0-9A-Za-z]{16}&	2	0	0	1
+12639	12639	^[a-f0-9]-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+12640	12640	^[a-f0-9]-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+12641	12641	^\d+$	2	0	0	1
+12642	12642	^\d+$	2	0	0	1
+12643	12643	^\d+$	2	0	0	1
+12644	12644	^[a-z0-9]{60}	2	0	0	1
+12645	12645	^[A-F0-9\-]+&ver=	2	0	0	1
+12646	12646	^[A-F0-9\-]+&ver=	2	0	0	1
+12647	12647	\/task.php\?id=[^&]{32,64}&task=\d	2	0	0	1
+12648	12648	^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}&a=	2	0	0	1
+12649	12649	c\x3d[0-9A-F]{100}	2	0	0	1
+12650	12650	^[a-f0-9]{100,200}\/[a-f0-9]{6,9}\/[A-Z0-9_]{4,200}\.com	2	0	0	1
+12651	12651	\.php\?m=\w&n=\w+_\w+(@|@.c|@.t)$	2	0	0	1
+12652	12652	^\d{5,9}$	2	0	0	1
+12653	12653	\x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+121212121212	2	0	0	1
+12654	12654	^[a-z]{3,6}\x3d[A-F0-9]{50}	2	0	0	1
+12655	12655	^([0-9A-F][0-9A-F]-){5}([0-9A-F][0-9A-F])	2	0	0	1
+12656	12656	verint=\d+&uid=\d+&wv=[A-Za-z0-9]+&report=\d+&abbr=[A-Za-z0-9]+&pid=\d	2	0	0	1
+12657	12657	^\d+$	2	0	0	1
+12658	12658	^(\d+|x.+)	2	0	0	1
+12659	12659	^[a-z0-9]{12,14}(&p2=([a-z0-9]([\._-])?){1,24}(_DROPPER)?)$	2	0	0	1
+12660	12660	id=x.+_[0-9A-F]{8}&build_id=.	2	0	0	1
+12661	12661	^[A-Za-z0-9+\/=]+?$	2	0	0	1
+12662	12662	v=\d+&rnd=\d	2	0	0	1
+12663	12663	\?mac=[0-9]*?&os=[a-z]*?&ver=[0-9]{8}&id=	2	0	0	1
+12664	12664	p4=\d+&p5=\d+&hs=\d	2	0	0	1
+12665	12665	^[a-f0-9]	2	0	0	1
+12666	12666	^\d	2	0	0	1
+12667	12667	\x2Ephp\x3Fid\x3D\d*\x26v\x3D\d*\x26tm\x3D\d*\x26b\x3D	2	0	0	1
+12668	12668	\.asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2})+&ver=\d	2	0	0	1
+12669	12669	id=\d+&bid=[^&]+&query=\w+&data=\w	2	0	0	1
+12670	12670	^[a-z]{1,4}\x3d[a-z0-9]+?$	2	0	0	1
+12671	12671	^\d{5}\x2eddns[a-z0-9]\x2eeu$	2	0	0	1
+12672	12672	^\/[A-Z]+\.php\?php=receipt$	2	0	0	1
+12673	12673	^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x3A[0-9]{1,5}	2	0	0	1
+12674	12674	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+12675	12675	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+12676	12676	^[a-f0-9]{8}\x2D[a-f0-9]{8}\x2D[a-f0-9]{8}\x2D[a-f0-9]{8}$	2	0	0	1
+12677	12677	^(id|key)=	2	0	0	1
+12678	12678	User-Agent\x3a[^\r\n]+[^\x20]\x3bTrident\/4\.0\x29\s\d{2}\x3a\d{2}\s\r$	2	0	0	1
+12679	12679	&userid=\d{4}&other=[MF]	2	0	0	1
+12680	12680	^[A-Z]{10}$	2	0	0	1
+12681	12681	^\x2F[a-f0-9]{40,60}$	2	0	0	1
+12682	12682	\/[a-z0-9]+$	2	0	0	1
+12683	12683	^[a-z0-9]{196}	2	0	0	1
+12684	12684	^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+12685	12685	^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+12686	12686	^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+12687	12687	\/[a-z]\/$	2	0	0	1
+12688	12688	^\/ad[^\x2f]*?\/\?[a-z]{1,5}\x3d\x2e?[a-z0-9]+?$	2	0	0	1
+12689	12689	^[a-z]{15}$	2	0	0	1
+12690	12690	^[a-z]{3,4}\/\d{1,4}$	2	0	0	1
+12691	12691	^subject=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})_((list|que)_done|ini(_done)?)&data	2	0	0	1
+12692	12692	^\d+?\x22	2	0	0	1
+12693	12693	^\/[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{5}\/\d+\/\d{2}[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{3}\/$	2	0	0	1
+12694	12694	^[^\r\n]+?\$	2	0	0	1
+12695	12695	^[A-Za-z0-9]{15}([A-Za-z0-9]{19})?$	2	0	0	1
+12696	12696	=[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+12697	12697	^[a-f0-9]{32}\/[0-9]$	2	0	0	1
+12698	12698	\/get\d*\.php\?c=[A-Z]{8}&d=[0-9A-F]{250,}$	2	0	0	1
+12699	12699	\/crypt_[^\/]*?sell[^\/]*?\d\.exe$	2	0	0	1
+12700	12700	\/[A-F0-9]+$	2	0	0	1
+12701	12701	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+12702	12702	^[^\x22\x2f\r\n]+?\x22\r\n	2	0	0	1
+12703	12703	^[^&]+?&\d+$	2	0	0	1
+12704	12704	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12705	12705	^id=[A-Z0-9]+?&info=[A-Z0-9]+?$	2	0	0	1
+12706	12706	^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}	2	0	0	1
+12707	12707	^\x2F(policy|cache)$	2	0	0	1
+12708	12708	^(ode)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&h(wid)	2	0	0	1
+12709	12709	(\?|&)guid=[^!&]+?\!	2	0	0	1
+12710	12710	^\d+\d+?(&ver=\d+?)?&req=\d+?(&r=)?$	2	0	0	1
+12711	12711	^mac=([A-F0-9]{2}-){5}[A-F0-9]{2}&t1=	2	0	0	1
+12712	12712	\.((jp|pn)g|cgi|gif)\?tq=	2	0	0	1
+12713	12713	^\/[b-u][A-Za-z0-9]{6,25}\.php$	2	0	0	1
+12714	12714	^Last-Modified\x3a(\s[^\r\n]{2}|[^\r\n\s]{3}),	2	0	0	1
+12715	12715	^\d{5,}$	2	0	0	1
+12716	12716	\?[0-9a-f]{6}$	2	0	0	1
+12717	12717	\?ID=[A-Z]{10}$	2	0	0	1
+12718	12718	^[0-9A-F]{12,24}	2	0	0	1
+12719	12719	^\x2F[a-f0-9]{40,60}$	2	0	0	1
+12720	12720	\.cgi\?s(id)\d{1,12}&r=	2	0	0	1
+12721	12721	\/([^\x2f]+?\/)?[a-z-_]+?\.(php|html)$	2	0	0	1
+12722	12722	^\x2fimage\x2f[A-Za-z0-9\+_-]+\.jpg$	2	0	0	1
+12723	12723	\/\/?$	2	0	0	1
+12724	12724	^(\x3a\d{1,5})?$	2	0	0	1
+12725	12725	^(\x3a\d{1,5})?$	2	0	0	1
+12726	12726	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})$	2	0	0	1
+12727	12727	^[A-Za-z0-9]{48}\x3a([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})$	2	0	0	1
+12728	12728	\/0\/$	2	0	0	1
+12729	12729	^[^\x2f]+\/[a-z0-9]+$	2	0	0	1
+12730	12730	\/([a-z]{4,9}\/[a-z]{3,10}\?[a-z_]{2,9}=[0-9]{2,8}|[a-z]{10})&[a-z]{5,9}=[a-zA-Z0-9_*]{30,}$	2	0	0	1
+12731	12731	^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}_	2	0	0	1
+12732	12732	^\/lolo\/[0-9]+\/[0-9]+\/[0-9]+\/[0-9]+\.html$	2	0	0	1
+12733	12733	^\/log\/[0-9]+\/[0-9]+\/\?id=[0-9]+$	2	0	0	1
+12734	12734	^\/[\/a-z0-9]+$	2	0	0	1
+12735	12735	^\/\?\d([A-Za-z0-9~_]{4})*([A-Za-z0-9~_]{2}--|[A-Za-z0-9~_]{3}-|[A-Za-z0-9~_]{4})$	2	0	0	1
+12736	12736	^\/UID\d+\.jsp\?	2	0	0	1
+12737	12737	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+12738	12738	\.php\?id=[a-zA-Z]{15,}&?x=\d+&?os=[0-9.]+&?n=\d	2	0	0	1
+12739	12739	^[0-9A-F]{550,}\.html	2	0	0	1
+12740	12740	\/Setup_\d+\.exe$	2	0	0	1
+12741	12741	\?0=.*\&1=.*\&2=.*\&3=.*\&4=.*\&5=.*\&6=.*\&7=.*\&8=	2	0	0	1
+12742	12742	&ver=\d\.\d$	2	0	0	1
+12743	12743	^\/([A-Fa-f0-9]+|index\.php)$	2	0	0	1
+12744	12744	^(c(omment|_id)|m(jdu)?)=	2	0	0	1
+12745	12745	^\/1+$	2	0	0	1
+12746	12746	(MSIE|rv\x3a11)	2	0	0	1
+12747	12747	\/\d+\.png\?uid=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+12748	12748	&data=([a-z]\d){7,}$	2	0	0	1
+12749	12749	^([a-z]\d){7,}\.zip\x22	2	0	0	1
+12750	12750	(MSIE|rv\x3a11\.0)	2	0	0	1
+12751	12751	^\x2f[a-zA-Z]{4,}\x2ephp\x3f[a-zA-Z]{2,10}\x3d([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+	2	0	0	1
+12752	12752	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+12753	12753	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})$	2	0	0	1
+12754	12754	=0[0-2](&\w+=[a-fA-F0-9]{8}){2}&\w+=[a-fA-F0-9]+$	2	0	0	1
+12755	12755	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+12756	12756	0[0-2]0000[a-fA-F0-9]{16,}$	2	0	0	1
+12757	12757	^\d+$	2	0	0	1
+12758	12758	^([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})+	2	0	0	1
+12759	12759	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+?$	2	0	0	1
+12760	12760	^\x5b[^\r\n]+\(64\s=\s\d\)\sEXE\s=	2	0	0	1
+12761	12761	^[a-zA-Z0-9+/]{43}	2	0	0	1
+12762	12762	^winver=\d+&ver=\d+$	2	0	0	1
+12763	12763	^\/\?0=([^&]+?&\d+)+?[^=&]+?$	2	0	0	1
+12764	12764	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+12765	12765	^[a-z]{2,}=(%[A-F0-9]{2})+&	2	0	0	1
+12766	12766	^[a-z]{2,}=(%[A-F0-9]{2})+&	2	0	0	1
+12767	12767	^\/[^\x2f]+\/0000[A-F0-9]{4}\/0[0-2]\/[A-F0-9]{8}$	2	0	0	1
+12768	12768	^\/0[0-2]\/[^\x2f]+\/0000[A-F0-9]{4}\/[^\x2f]+\/[A-F0-9]{8}$	2	0	0	1
+12769	12769	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]svchost\.exe[\x22\x27]\r\n	2	0	0	1
+12770	12770	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]explorer\.exe[\x22\x27]\r\n	2	0	0	1
+12771	12771	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]hkcmd\.exe[\x22\x27]\r\n	2	0	0	1
+12772	12772	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]server\.exe[\x22\x27]\r\n	2	0	0	1
+12773	12773	^\d+?\/(\d+?\/-?\d+?\.(php|jsp))?$	2	0	0	1
+12774	12774	\?uid=\d+&context=\w+&mode=text&data=\w+$	2	0	0	1
+12775	12775	^\/\d+$	2	0	0	1
+12776	12776	^\/sys\/(who|genid|data|upload|update)	2	0	0	1
+12777	12777	^a=(%[0-9A-Fa-f]{2})+\x26b=[0-9A-Za-z]+(%3[dD]){0,2}\x26c=(%[0-9A-Fa-f]{2})+$	2	0	0	1
+12778	12778	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+12779	12779	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+12780	12780	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12781	12781	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12782	12782	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+12783	12783	^\/[a-z]+\/[a-z]+\.exe$	2	0	0	1
+12784	12784	\.php\?uid=\d{5,6}&ver=[^&]+(&traff=\d+)?$	2	0	0	1
+12785	12785	^Host\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+12786	12786	^[a-z]{4,12}=([A-Za-z0-9+/]{4})*[A-Za-z0-9+/]{3}=&[a-z]{4,12}=[A-Za-z0-9+/]{4}	2	0	0	1
+12787	12787	\/0[0-2](\/[^\/]*?)?\/0000[a-fA-F0-9]{4}(\/[^\/]*?)?\/[a-fA-F0-9]{8}(\?\w+=[a-fA-F0-9]+)?$	2	0	0	1
+12788	12788	^http\x3a\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/[a-z_-]+\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r?$	2	0	0	1
+12789	12789	^[C-J]\r\n	2	0	0	1
+12790	12790	^[A-Z]+$	2	0	0	1
+12791	12791	^(32|64)$	2	0	0	1
+12792	12792	\/$	2	0	0	1
+12793	12793	^[a-f0-9]+(\x20[a-f0-9]+)+$	2	0	0	1
+12794	12794	^\/-?[a-f0-9]{8,9}\/-?\d+(\.php|\/)$	2	0	0	1
+12795	12795	&_=\d+$	2	0	0	1
+12796	12796	&_=\d+$	2	0	0	1
+12797	12797	&_=\d+$	2	0	0	1
+12798	12798	^User-Agent\x3a[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x30442e9d036a40c8cbd41f8f4c9afab1ba\x20no-cache\r\n(\r\n)?$	2	0	0	1
+12799	12799	^\d+$	2	0	0	1
+12800	12800	^[a-z]=[a-f0-9]{80,}$	2	0	0	1
+12801	12801	\/[a-f0-9]{32}\.png$	2	0	0	1
+12802	12802	&(un)?key=[A-Z]+$	2	0	0	1
+12803	12803	\.php\?pn=[^&]+&s=[0-9]+&x=0\.[0-9]{7}$	2	0	0	1
+12804	12804	^\/([a-z]{4,9}\/[a-z]{4,12}\?[a-z]{4,7}\=[0-9]{5,7})$	2	0	0	1
+12805	12805	^\/p\?\d+(\x3b\d+){4}$	2	0	0	1
+12806	12806	^\/s\?\d+\x3b\d+\x3b\d{1,2}\.\d_(32|64)_\d+(\x3b\d+){4}$	2	0	0	1
+12807	12807	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+12808	12808	\/[a-f0-9]{8}\/archive\/\d{8,10}\.html$	2	0	0	1
+12809	12809	\?[0-9a-f]{5,}=\d+&id=\d+&v=\d+$	2	0	0	1
+12810	12810	iid=[a-fA-F0-9]{32}&kernel=	2	0	0	1
+12811	12811	iid=[a-fA-F0-9]{32}&username=	2	0	0	1
+12812	12812	^[a-z]{2}\x3d[a-z0-9]+?[A-F0-9]+?$	2	0	0	1
+12813	12813	^\x2F[a-z]\x2Ephp\x3Fp\x3D[a-z0-9]{30,}$	2	0	0	1
+12814	12814	^\x2Ftrack\x2F\x3Fip\x3D\d&data\x3D	2	0	0	1
+12815	12815	\/\d{5}\/(<s1>[a-z]{3})[a-z]\.php\?(=s1)_id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12816	12816	^filename=[a-z]+?\.[a-z]+?&data=	2	0	0	1
+12817	12817	^Host\x3a[^\r\n]+\r\n(Connection\x3a\x20Keep-Alive\r\n)?(\r\n)?	2	0	0	1
+12818	12818	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+12819	12819	^\x0a([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})\x0a	2	0	0	1
+12820	12820	_W\d+\.[A-F0-9]+\/\d+\/[^\x2f]+\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/$	2	0	0	1
+12821	12821	x20InfoPath\x2e\d[^\x29]+$	2	0	0	1
+12822	12822	\/\d{4,}\.txt$	2	0	0	1
+12823	12823	\/([a-z]+|\d+)\.jpg	2	0	0	1
+12824	12824	\?[a-z0-9]{32}$	2	0	0	1
+12825	12825	[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+12826	12826	\.[a-z]{3,4}$	2	0	0	1
+12827	12827	\/[A-Za-z]{4,9}\.dot$	2	0	0	1
+12828	12828	\/get(_new)?\.php\?[a-zA-Z]{4,}=0\.[0-9]{10,}&key=[a-zA-Z0-9]{4,}$	2	0	0	1
+12829	12829	\/get(_new)?\.php\?[a-zA-Z]{4,}=0\.[0-9]{10,}&key=[a-zA-Z0-9]{4,}&pdf=[a-zA-Z]{4,}$	2	0	0	1
+12830	12830	^\/document\.php\?rnd=[0-9]{4}&id=[A-F0-9]{100,}$	2	0	0	1
+12831	12831	\/0[0-2](\/[^\/]*?)?\/0000[a-fA-F0-9]{4}(\/[^\/]*?)?\/[a-fA-F0-9]{8}(\?\w+=[a-fA-F0-9]+)?$	2	0	0	1
+12832	12832	^[a-zA-Z]{4,}=0\.[0-9]{10,}&jndj=[a-zA-Z0-9]{4,}$	2	0	0	1
+12833	12833	^[a-zA-Z]{4,}=0\.[0-9]{10,}&jndj=[a-zA-Z0-9]{4,}&ncm=[a-zA-Z]{4,}$	2	0	0	1
+12834	12834	^\/[a-f0-9]+000[a-f0-9]{37}$	2	0	0	1
+12835	12835	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+12836	12836	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P	2	0	0	1
+12837	12837	\.php\?check=\d$	2	0	0	1
+12838	12838	^tekst=\w+$	2	0	0	1
+12839	12839	^User-Agent\x3a MSIE \d+\.\d+\r\n	2	0	0	1
+12840	12840	\/libso\d{1,4}\.php\?id=[a-zA-Z0-9]+$	2	0	0	1
+12841	12841	\/[0-9]{2}\.exe\?[0-9]$	2	0	0	1
+12842	12842	^\/0[a-f0-9]{48}$	2	0	0	1
+12843	12843	path=[A-Z]\x3a\x5c[A-F0-9]+\r\nlog=	2	0	0	1
+12844	12844	^(Connection\x0d\x0a)?\x0d\x0a$	2	0	0	1
+12845	12845	^[a-z0-9]{10,}$	2	0	0	1
+12846	12846	\?sid=[a-f0-9]{40}&cid=[0-9]$	2	0	0	1
+12847	12847	[A-F0-9]{8}(-[A-F0-9]{4}){2}-[A-F0-9]{8}	2	0	0	1
+12848	12848	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+12849	12849	\/[A-Za-z]+\.php\?((id|token1|token2|C)=[A-Za-z0-9\/=+%]*={0,2}&?){4}$	2	0	0	1
+12850	12850	^([a-zA-Z]*?\d)([a-z0-9]*?[A-Z])[a-zA-Z0-9+/]{30}	2	0	0	1
+12851	12851	^[a-z]{256}$	2	0	0	1
+12852	12852	^[abcdefghiklmnopqrstvxyz123456789]{62}\.aaaaaaaaaaaa	2	0	0	1
+12853	12853	^(Connection\x3a[^\r\n]+\r\n)?Accept\x3a[^\r\n]+\r\n(Accept-Encoding\x3a[^\r\n]+\r\n)?Accept-Language\x3a[^\r\n]+\r\n(Referer\x3a[^\r\n]+[^\r\n]*?\r\n)?User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)	2	0	0	1
+12854	12854	\.php\?lid=[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$	2	0	0	1
+12855	12855	^[A-F0-9]{2}F4[A-F0-9]{2}0(1|2|3)[A-F0-9]{8}	2	0	0	1
+12856	12856	&m=\d$	2	0	0	1
+12857	12857	^[a-f0-9]{31}\x3B([a-zA-Z0-9+/=]+)?\r?$	2	0	0	1
+12858	12858	\?q=[a-f0-9]{32}$	2	0	0	1
+12859	12859	^(<id>[a-z])\x22\sname=\x22(=id)\x22>TVqQAA	2	0	0	1
+12860	12860	^version=\d{4}-\d{1,2}-\d{1,2}$	2	0	0	1
+12861	12861	[\x80-\xff]	2	0	0	1
+12862	12862	(xyz|pw)$	2	0	0	1
+12863	12863	^[A-Z0-9_-]+\.analytics-akadns\.com$	2	0	0	1
+12864	12864	^[A-Z0-9_-]+\.akamai-analytics\.com$	2	0	0	1
+12865	12865	^[A-Z0-9_-]+\.akamai-information\.com$	2	0	0	1
+12866	12866	^[A-Z0-9_-]+\.akamai-technologies\.com$	2	0	0	1
+12867	12867	^[A-Z0-9_-]+\.sync-akamai\.com$	2	0	0	1
+12868	12868	^\/[^\r\n]+\.php\?[a-f0-9]{32}(=(%3D|\x3d)*[A-Za-z0-9%\/]+&[a-f0-9]{32}){4,}=(%3D|\x3d)*[A-Za-z0-9%\/]+$	2	0	0	1
+12869	12869	^.{0,15}[^\x20-\x7e\r\n]	2	0	0	1
+12870	12870	\?---[A-Z]$	2	0	0	1
+12871	12871	^\/help(me)?\.bmp$	2	0	0	1
+12872	12872	\/[a-z0-9]{16}\.php\?ufw=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12873	12873	(BrowsingHistoryView|WebBrowserPassView)\.exe$	2	0	0	1
+12874	12874	[\x80-\xff]	2	0	0	1
+12875	12875	\.php\?a=\d{5,10}.+\x3a\d\x3a\d\x3a\d\.\d\x3a\d$	2	0	0	1
+12876	12876	=8ACEFC[0-9A-F]{150,}$	2	0	0	1
+12877	12877	\?[a-f0-9]{32}$	2	0	0	1
+12878	12878	^ps0=[A-F0-9]+\&ps1=[A-F0-9]+($|\&[a-z]s\d=)	2	0	0	1
+12879	12879	\.php\?computerid=[a-fA-F0-9]{32}&(public|private)=\d$	2	0	0	1
+12880	12880	^[^_]+_[^\_]+_[A-F0-9]{10}_[0-9]{2}-[0-9]{2}-20[0-9]{2}\s[0-9]{1,2}\.[0-9]{1,2}\.[0-9]{1,2}\.	2	0	0	1
+12881	12881	\/(tr(_w)?|ft)\.so$	2	0	0	1
+12882	12882	^([a-zA-Z0-9+/\x20]{4})*([a-zA-Z0-9+/\x20]{2}==|[a-zA-Z0-9+/\x20]{3}=|[a-zA-Z0-9+/\x20]{4})$	2	0	0	1
+12883	12883	^\/v\d+\/lady_[ix]	2	0	0	1
+12884	12884	\/(IUpdate|fbclient|IETask|Mixeds|Ubuntu10)\.dll$	2	0	0	1
+12885	12885	\?action=\d(&botId=[A-F0-9]{32})?$	2	0	0	1
+12886	12886	^[^&]+?\.html\?s=[^&]+?&d=$	2	0	0	1
+12887	12887	\/victim\.php\?info=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&ip=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12888	12888	\/savekey\.php\?file=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12889	12889	\/images\/.*_2[FB].*\.(avi|gif|bmp|jpeg|png)$	2	0	0	1
+12890	12890	^[A-F0-9]{8}$	2	0	0	1
+12891	12891	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a)?	2	0	0	1
+12892	12892	^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$	2	0	0	1
+12893	12893	^\/kb\/\d{4,8}$	2	0	0	1
+12894	12894	\.[a-z]{3}\?[a-z]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12895	12895	^[a-zA-Z]{7}=([A-Za-z0-9+/]|%2[FB]){2}AAAA[a-z]A[^\s=]+=?$	2	0	0	1
+12896	12896	END\x20CERTIFICATE-----$	2	0	0	1
+12897	12897	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+12898	12898	^get=\d+($|&)	2	0	0	1
+12899	12899	^(Mozilla\/|Shockwave)	2	0	0	1
+12900	12900	=11&[^&]{1,7}2[^&]{6,12}&[^&]{1,7}410&[^&]{1,7}650&[^&]{1,7}51$	2	0	0	1
+12901	12901	(\x20MSIE\x20|rv\x3a11)	2	0	0	1
+12902	12902	^id=[0-9A-Z]+&count=	2	0	0	1
+12903	12903	^guid=[^&]+?&ver=[^&]+?(&fc=[^\r\n]+)?$	2	0	0	1
+12904	12904	\.php\?rid=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12905	12905	^machine=[^&]+$/Pi	2	0	0	1
+12906	12906	\.(arm(5n|7)?|m(ips|psl))$	2	0	0	1
+12907	12907	[a-z]+\.php\?aid=\d+&sid=[a-z0-9]+$	2	0	0	1
+12908	12908	^\/oscp\/[a-z]+$	2	0	0	1
+12909	12909	\/(countdown|check)\/[a-f0-9]{30,45}\/([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})?$	2	0	0	1
+12910	12910	\.php\?key=[^\r\n]+&string=[^\r\n]+?(\x3a\x3a[^\x3a]+?){5,}$	2	0	0	1
+12911	12911	\.php\?key=[^\r\n]+&string=[^\r\n]+?((\x3a\x3a|3A3A)[^\x3a]+?){5,}$	2	0	0	1
+12912	12912	^((Passwords|PCinformation)\.txt|(Data|GrabbedTxtFiles)\.zip)\x22\r\n	2	0	0	1
+12913	12913	\/[a-z]+2\.php\?jpg=[^&]+$	2	0	0	1
+12914	12914	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$	2	0	0	1
+12915	12915	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$	2	0	0	1
+12916	12916	\.php\?Hwid=[^&]+[0-9](&(Pc|Etat)=[^&]+)?(&user=[^&]+&Ip=[^&]+&Ping=[^&]+&v=[^&]+&Ville=[^&]+&Pays=[^&]+&Region=[^&]+)?$	2	0	0	1
+12917	12917	\.php\?[a-z]{3,8}=[a-f0-9]{16}[01][a-z]+$	2	0	0	1
+12918	12918	^((a((lbu|d)m|ccount|uthor)|c(ont(ac|en)|lien)t|p(artners|hoto)|(memb|us)er|session|video|hash|key|id)=[a-z0-9]{6,12}&){4}	2	0	0	1
+12919	12919	\.(aspx|txt)\?[a-z0-9]{3}=[a-f0-9]{32}&[a-z0-9]{3}=[^&]+&[a-z0-9]{3}=[a-f0-9]{32}$	2	0	0	1
+12920	12920	\.php\?string=[a-zA-Z0-9+=]+$	2	0	0	1
+12921	12921	^([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})$	2	0	0	1
+12922	12922	^c=[A-F0-9]{10,}&v=[^&]+&h=[^&]+&t=[0-9]$	2	0	0	1
+12923	12923	^([a-f0-9]{30,60})$	2	0	0	1
+12924	12924	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+12925	12925	\x26affid\x3D[0-9]{4,7}$	2	0	0	1
+12926	12926	[\x80-\xff]{16}	2	0	0	1
+12927	12927	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+12928	12928	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}	2	0	0	1
+12929	12929	^[0-9a-f]{4,8}\x3d\x2d?\d+(&id\x3d\d+)?$	2	0	0	1
+12930	12930	^[A-Z0-9]{18}$	2	0	0	1
+12931	12931	^[a-z]{3,4}\x2F[a-f0-9]{24}$	2	0	0	1
+12932	12932	^\/[a-z0-9]{1,10}\/?\?.+?$	2	0	0	1
+12933	12933	\/[a-z0-9A-Z]\.exe$	2	0	0	1
+12934	12934	^\d+$	2	0	0	1
+12935	12935	^\d+$	2	0	0	1
+12936	12936	^\/[a-z0-9+\/=]{16,400}$	2	0	0	1
+12937	12937	&s=\{?[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}\}?(&|$)	2	0	0	1
+12938	12938	^(cache|logs)\/[^\x2f]+\.(exe|dll|doc|bin)$	2	0	0	1
+12939	12939	^\/[a-z0-9.&-]+([a-z0-9]{4}-){3}[a-z0-9.&+-]+$	2	0	0	1
+12940	12940	=\d+$	2	0	0	1
+12941	12941	\/[A-Z0-9]+\.[aj]sp\?[a-zA-Z0-9+/\x20=]+$	2	0	0	1
+12942	12942	\.php\?w=\d+&i=[0-9a-f]{32}&a=\d+$	2	0	0	1
+12943	12943	\?action=\w+gen&v=\d	2	0	0	1
+12944	12944	\/counter\/(\?[a-z]?\d{1,2}|[^\x2f]*\d\.exe|.*?[]([A-Za-z_-]{0,200}[0-9][A-Za-z_-]{0,200}[0-9])([A-Z0-9_-]{0,200}[a-z][A-Z0-9_-]{0,200}[a-z])([a-z0-9_-]{0,200}[A-Z][a-z0-9_-]{0,200}[A-Z])[A-Za-z0-9_-]{50,}(&|$)	2	0	0	1
+12945	12945	^[^\r\n]+\.(jpe?g|gif|png)\r\n	2	0	0	1
+12946	12946	^\/report[0-9]?_(v[0-9])?[A-Z]?[A-F0-9_-]+_[0-9]{1,3}_(st(arted|ep)|already|mark|p(rocess|a(ge|yload))|watch2|http|image|gdiplus|crc|DIRRR|finished|(ex(cept|ecuted)))	2	0	0	1
+12947	12947	\/[a-z]+\.php\?[A-F0-9]{250,}$	2	0	0	1
+12948	12948	^Accept\x3a\x20text\/\*,\x20application\/\*\r\nUser-Agent\x3a\x20[^\r\n]+\r\n(Pragma|Cache-Control)\x3a\x20no-cache\r\nConnection\x3a Keep-Alive\r\nHost\x3a[^\r\n]+?\r\n(\r\n)?$	2	0	0	1
+12949	12949	^[A-F0-9]{250,}$	2	0	0	1
+12950	12950	^\d+?$	2	0	0	1
+12951	12951	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12952	12952	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}	2	0	0	1
+12953	12953	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+12954	12954	^\/debug\/trace\/(Fw(Downloaded|Check)|N(oFw|sis))$	2	0	0	1
+12955	12955	^\/[a-z]+\.php\?num=\d+&rev=	2	0	0	1
+12956	12956	^[A-Za-z0-9]{14,15}$	2	0	0	1
+12957	12957	^\d{2}$	2	0	0	1
+12958	12958	\.php\?v\x3d\d+?\x26rs\x3d((\d+?\x2d){3})?\d+?\x26n\x3d\d	2	0	0	1
+12959	12959	^(<vname>[^\r\n\x3a]+)(<n1>[0-4])\x3a\x20\d+\r\n(=vname)(<n2>(((=n1))[0-4]))\x3a\x20\d+\r\n(=vname)(<n3>((((=n1)|(=n2)))[0-4]))\x3a\x20\d+\r\n(=vname)((((=n1)|(=n2)))[0-4])\x3a\x20\d+\r\n	2	0	0	1
+12960	12960	\/counter\/\?id=[A-Z0-9_-]{60,}&rnd=\d{1,}$	2	0	0	1
+12961	12961	^[0-9a-f]{32}\.php	2	0	0	1
+12962	12962	^[A-F0-9]{30}	2	0	0	1
+12963	12963	^[a-f0-9]{24}$	2	0	0	1
+12964	12964	^\x00\x00\x00[\x72-\x74]	2	0	0	1
+12965	12965	(\d{1,3}\.){3}\d{1,3} (\d{1,3}\.){3}\d{1,3} \x3a(Linux|FreeBSD|SunOS)	2	0	0	1
+12966	12966	^\d+[\x22\x27]	2	0	0	1
+12967	12967	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+12968	12968	^[0-9]{2,3}\x00\x6c\x6c(<var>[\x20-\x2f\x30-\x39\x3a-\x40\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x5b-\x60\x7b-\x7e])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(=var)[^\r\n]+(=var)$	2	0	0	1
+12969	12969	^(-[0-9]+|[A-F0-9]{32})=1&type=txt$	2	0	0	1
+12970	12970	^([a-f0-9]{2}-){5}[a-f0-9]{2}	2	0	0	1
+12971	12971	^[a-f0-9]{18}\x22	2	0	0	1
+12972	12972	^(<id>[a-z])\x22\sname=\x22(=id)\x22>[a-zA-Z0-9+/=]{28}	2	0	0	1
+12973	12973	^[A-Za-z0-9]{10,}[\-\)\(]{1,2}	2	0	0	1
+12974	12974	data=[a-zA-Z0-9\+\/]{64}/P	2	0	0	1
+12975	12975	<root><clnt>\d{8}-\d{4}-\d{4}-\d{4}-[0-9A-F]{12}</clnt><code>CheckUpdate</code>/P	2	0	0	1
+12976	12976	\d{2}\x7C\d{1,3}\x7C\d{1,3}http\x3A\x2F\x2F	2	0	0	1
+12977	12977	^X-ID\x3a\x20\d+\r?$/Hm	2	0	0	1
+12978	12978	\/ff\.ie\?rnd=\x2d?\d	2	0	0	1
+12979	12979	c=[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}	2	0	0	1
+12980	12980	^.{2}(<fake_org>([asdfgh]+|[qwerty]+|[zxcvbn]+|[23werf]+)[01]).+?\x06\x03\x55\x04\x0a.{2}(=fake_org)	2	0	0	1
+12981	12981	^\d{1,6}\x00msg\x7c	2	0	0	1
+12982	12982	^\/counter\/\?([a-z]=(0\.\d{8}|1[A-Z0-9a-z]+))+&r=\d+$	2	0	0	1
+12983	12983	[^A-Za-z0-9+/]TVqQA	2	0	0	1
+12984	12984	\/im(age|g)\.php\?id=\d+$	2	0	0	1
+12985	12985	^.{1,1000}p([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?o([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?w([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?r([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?s([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?h([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?e([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?l	2	0	0	1
+12986	12986	^(-[0-9]+|[A-F0-9]{32})=1$	2	0	0	1
+12987	12987	^([a-z0-9]{0,19}[A-Z])(([A-Z0-9]{0,19}[a-z])|([A-Za-z]{0,19}\d)|([A-Z]+\.))[a-zA-Z0-9]{3,20}[\x2e\x20][a-z]{2,3}$	2	0	0	1
+12988	12988	^.{0,15}[^\x20-\x7e\r\n]	2	0	0	1
+12989	12989	^\d{30}\w{6}-\d{2}-\d{3}-\d{9}$	2	0	0	1
+12990	12990	(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+12991	12991	^[a-zA-Z0-9/+]{171}=	2	0	0	1
+12992	12992	ms-?office	2	0	0	1
+12993	12993	^(Connection\r\n)?\r\n$	2	0	0	1
+12994	12994	^(Connection\r\n)?\r\n$	2	0	0	1
+12995	12995	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+12996	12996	^[0-9]+lu[0-9]+d[0-9]+$	2	0	0	1
+12997	12997	^[a-f0-9]{16}$	2	0	0	1
+12998	12998	^[a-z0-9_\/+-]{1000}	2	0	0	1
+12999	12999	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13000	13000	^\d{4,8}$	2	0	0	1
+13001	13001	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13002	13002	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+13003	13003	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+13004	13004	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+13005	13005	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+13006	13006	^[\x00-\x01]\x00.\x00[\x00-\x01]\x00.\x00.{4}\x01\x00.\x00{3}.{48}\x05\x00{3}	2	0	0	1
+13007	13007	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+13008	13008	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+13009	13009	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+13010	13010	^[\x00-\x01]\x00.\x00[\x00-\x01]\x00.\x00.{4}\x01\x00.\x00{3}.{48}\x05\x00{3}	2	0	0	1
+13011	13011	^Host\x3a\x20[^\r\n]+\r\n(Connection\x3a\x20Keep-Alive\r\n)?(\r\n)?$	2	0	0	1
+13012	13012	^(WOW64\x3b\s)?Trident\/[457]\.0\x3b\s*SLCC2\x3b\s\.NET\sCLR\s2\.0\.50727\x3b\s\.NET\sCLR\s3\.5\.30729\x3b\s(\x20\.NET\x20CLR\x203\.5\.30729\x3b\s)?\.NET\sCLR\s3\.0\.30729\x3b\sMedia\sCenter\sPC\s6\.0\x3b\s\.NET4\.0C\x3b\s\.NET4\.0E(\.NET4\.0E(\x3b\s)?)?(\x3b\sInfoPath\.3)?\)$	2	0	0	1
+13013	13013	^[a-z0-9]+\.(biz|com|net|org)	2	0	0	1
+13014	13014	\/wp-(content|admin|includes)\/	2	0	0	1
+13015	13015	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+13016	13016	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13017	13017	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13018	13018	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13019	13019	^[A-Za-z0-9\/\-\+]{40,}\.=auth\.	2	0	0	1
+13020	13020	^[A-Za-z0-9\/\-\+]{10,}\.=connect\.	2	0	0	1
+13021	13021	^[A-Za-z0-9\/\-\+]{10,}AAAA--\.	2	0	0	1
+13022	13022	^[A-Z]{2}-[0-9]{1,5}\x3aEnd(\x3a[0-9]{1,5})?$	2	0	0	1
+13023	13023	^[a-z0-9]{8}	2	0	0	1
+13024	13024	^(\d{1,3}\.)\d{1,3}$	2	0	0	1
+13025	13025	^\/[a-z]\.php\?query=[a-f0-9]{32}$	2	0	0	1
+13026	13026	^[A-F0-9]{50,}$	2	0	0	1
+13027	13027	^([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=|[A-Z0-9+\/]{4})$	2	0	0	1
+13028	13028	^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$	2	0	0	1
+13029	13029	^data=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13030	13030	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+13031	13031	^(<js>\$[a-z0-9]{1,15})\s*=\s*\[System\.Text\.Encoding\]::ASCII\.GetString\(\[System\.Convert\]::FromBase64String\((=js)\)\)\s*Set-Content\s*(-Path\s*C:\\Windows\\Temp\\[a-z0-9]{1,15}\.[a-z0-9]{2,4}\s*|-Value\s*(=js)\s*|-Encoding\s*ASCII){3}	2	0	0	1
+13032	13032	^(<content>\[a-z0-9]{1,15})\s*=\s*\[System\.Convert\]::FromBase64String\(\$[a-z0-9]{1,15}\)\s*Set-Content\s*(-Path\s*C:\\Windows\\Temp\\[a-z0-9]{1,15}\.vbe\s*|-Value\s*(=content)\s*|-Encoding\s*Byte){3}	2	0	0	1
+13033	13033	^[a-zA-Z0-9\x21\x2a\x2f\x2e\x3b\x3a\x5b\x5d\x7b\x7d]+$	2	0	0	1
+13034	13034	^[0-9]{3,5}\s*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+13035	13035	^[a-z0-9]{3,10}$	2	0	0	1
+13036	13036	^[a-z0-9]{5,30}$	2	0	0	1
+13037	13037	^\d{3,15}$	2	0	0	1
+13038	13038	^\/([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+13039	13039	^[a-z]{3,10}=[a-z0-9]+$	2	0	0	1
+13040	13040	^[a-z]{3,10}=[a-z0-9]+$	2	0	0	1
+13041	13041	^[a-z]{3,10}=[a-z0-9]+$	2	0	0	1
+13042	13042	^\.(space|press|website)$	2	0	0	1
+13043	13043	^\/hyllkjit\/[a-f0-9]{8}\/\?n=\d{4,10}$	2	0	0	1
+13044	13044	^9([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+13045	13045	^(\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?<pushvar>\.push\x28\x22)(\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)([\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)([\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)	2	0	0	1
+13046	13046	^lessie(\/[0-9]\.0)?$	2	0	0	1
+13047	13047	^Cakle(\/[0-9]\.0)?$	2	0	0	1
+13048	13048	^Damien(\/[0-9]\.0)?$	2	0	0	1
+13049	13049	^Solar(\/[0-9]\.0)?$	2	0	0	1
+13050	13050	^muhstik(-scan)?(\/[0-9]\.0)?$	2	0	0	1
+13051	13051	^Shaolin(\/[0-9]\.0)?$	2	0	0	1
+13052	13052	^Rift(\/[0-9]\.0)?$	2	0	0	1
+13053	13053	^Tsunami(\/[0-9]\.0)?$	2	0	0	1
+13054	13054	^Yowai(\/[0-9]\.0)?$	2	0	0	1
+13055	13055	^Yakuza(\/[0-9]\.0)?$	2	0	0	1
+13056	13056	^Hentai(\/[0-9]\.0)?$	2	0	0	1
+13057	13057	\/[A-Za-z0-9]{2,8}[-_][a-zA-Z0-9-_]+\/\?InvoiceType=Regular&date=[0-9-_]+$	2	0	0	1
+13058	13058	^[A-F0-9]+\x2d\x2d\x3e(\r\n)?$	2	0	0	1
+13059	13059	^CN=(help|g(ui(de|ld)|round))\.domainoutlet\.site$	2	0	0	1
+13060	13060	^CN=((jasper|qwe|alter|car|param|bike|genwar)\.)?drivethrough\.top$	2	0	0	1
+13061	13061	^CN=((justin|digest)\.)?drinkeatgood\.space$	2	0	0	1
+13062	13062	^\d	2	0	0	1
+13063	13063	^\/[a-zA-Z0-9]{1,19}\/?\?[abdefijhgv\x22](\x7C\x2d?\d+?[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\%^&\(\)\x20_{}\.~]{1,14})?$	2	0	0	1
+13064	13064	^\/(<n>\d)(=n){1,2}$	2	0	0	1
+13065	13065	\/\d+$	2	0	0	1
+13066	13066	^\/[a-f0-9]{7,8}\/[a-f0-9]{7,8}\/$	2	0	0	1
+13067	13067	^GET\x20\/[A-F0-9]{32}\x20HTTP\/1\.1\r\nHost\x3a\x20[^\r\n]+\r\n\r\n$	2	0	0	1
+13068	13068	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13069	13069	_[A-F0-9]{12}\.jpg$	2	0	0	1
+13070	13070	_[A-F0-9]{12}&filename=\w{1,20}\.jpg$	2	0	0	1
+13071	13071	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+13072	13072	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+13073	13073	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+13074	13074	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13075	13075	^[0-9]{3}$	2	0	0	1
+13076	13076	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13077	13077	^.+(IlR5cGUiO|JUeXBlIj|iVHlwZSI6)	2	0	0	1
+13078	13078	\.jpg\?v=\d+&d=(\d{8}T\d{6}Z)([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+13079	13079	^\/[^\x2f]+\/pops[a-z]?\.php$	2	0	0	1
+13080	13080	\.php\?s=\d+&cn=	2	0	0	1
+13081	13081	^[a-z]{4,10}\.freemooon\.org$	2	0	0	1
+13082	13082	[a-z]{4,10}\.olimpian\.org$	2	0	0	1
+13083	13083	[a-z]{4,10}\.sunsay\.biz$	2	0	0	1
+13084	13084	[a-z]{4,11}\.feellgood\.org$	2	0	0	1
+13085	13085	[a-z]{4,11}\.kinomix\.org$	2	0	0	1
+13086	13086	[a-z]{4,10}\.beneton\.biz$	2	0	0	1
+13087	13087	[a-z]{4,10}\.bigdoggi\.biz$	2	0	0	1
+13088	13088	[a-z]{4,10}\.bjksfohseaguu\.org$	2	0	0	1
+13089	13089	[a-z]{4,10}\.closedoors\.net$	2	0	0	1
+13090	13090	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+13091	13091	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+13092	13092	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+13093	13093	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+13094	13094	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$	2	0	0	1
+13095	13095	^(www|bbs|cms|down|up|file|ftp)	2	0	0	1
+13096	13096	\/log\/proc\.php.key=[a-z0-9]{11}	2	0	0	1
+13097	13097	code=[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}	2	0	0	1
+13098	13098	x=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+13099	13099	mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+13100	13100	^RAV\d\.\d\d	2	0	0	1
+13101	13101	^([a-z0-9:.,]{3,10}\s){50,}[a-z0-9:.,]{3,10}\s*$	2	0	0	1
+13102	13102	^[a-zA-Z0-9]{20}	2	0	0	1
+13103	13103	\x2E(p(hp|ng)|jpe?g|cgi|gif)\x3F(v\d{1,2}|pr)\x3D	2	0	0	1
+13104	13104	\/\?rnd=\d+&id=\d+$	2	0	0	1
+13105	13105	port=[1-9]{1,5}	2	0	0	1
+13106	13106	\/getfile\.php\?r=-?\d+&p=	2	0	0	1
+13107	13107	\/manda\.php\?id=(-)?\d{8,10}&v=\w	2	0	0	1
+13108	13108	\/\?id(\d+)?&rnd=\d+$	2	0	0	1
+13109	13109	\.php\?hdr_ctx=[0-9]{1,5}_[0-9]{1,5}$	2	0	0	1
+13110	13110	^\/\d+\.functions$	2	0	0	1
+13111	13111	\/\d{10}$	2	0	0	1
+13112	13112	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+13113	13113	^[A-F0-9]{100,}$	2	0	0	1
+13114	13114	^\d	2	0	0	1
+13115	13115	^\/[a-z-_]+?\.(php|html)$	2	0	0	1
+13116	13116	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13117	13117	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+13118	13118	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13119	13119	^data=[a-zA-Z0-9+\/]{64}	2	0	0	1
+13120	13120	^\d{4}$	2	0	0	1
+13121	13121	\.(jpg|png|gif)\?v[0-9]{1,2}=[0-9]+&tq=	2	0	0	1
+13122	13122	^\/[mp]od[12]\/[^\/]+?\.exe$	2	0	0	1
+13123	13123	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+13124	13124	\/[0-9]{2}\.exe$	2	0	0	1
+13125	13125	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+13126	13126	[\x80-\xff]	2	0	0	1
+13127	13127	\.(me|net)$/W	2	0	0	1
+13128	13128	\/[A-Z]?[a-z]{1,3}[0-9]?\.exe$	2	0	0	1
+13129	13129	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13130	13130	^[a-z]\.	2	0	0	1
+13131	13131	^((malwarehuntertea|nomoreranso)m|politiaromana|ransomware|carder)\.(bit|coin)$	2	0	0	1
+13132	13132	^((malwarehuntertea|nomoreranso)m|politiaromana|ransomware|carder)\.(bit|coin)$	2	0	0	1
+13133	13133	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13134	13134	^m=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+13135	13135	^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$	2	0	0	1
+13136	13136	\/[0-9]{10}.php1$	2	0	0	1
+13137	13137	^[A-F0-9]{10,}(BBZ|BBY)[A-F0-9]{,1000}$	2	0	0	1
+13138	13138	^[A-F0-9]{10,}$	2	0	0	1
+13139	13139	^[A-F0-9]{10,}$	2	0	0	1
+13140	13140	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+13141	13141	^\/d[0-9]?\.php\?check$	2	0	0	1
+13142	13142	^\/d[0-9]?\.php\?servers$	2	0	0	1
+13143	13143	^\/[a-z]\.php\?check=[a-f0-9]{32}$	2	0	0	1
+13144	13144	^[a-f0-9]{8}$	2	0	0	1
+13145	13145	\.aspx\?m=[A-F0-9]{3,40}&i=[A-F0-9]{3,40}&p=[A-F0-9]{3,40}$	2	0	0	1
+13146	13146	^([\x3a\x2c\x2e]?[A-Za-z0-9]{1,8}[\x3a\x2c\x2e]?[\x3a\x2c\x2e]?\s*){50,}$	2	0	0	1
+13147	13147	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13148	13148	^[a-z]{1,10}=[A-Z]+(&[a-z]{1,10}=[A-Z]+){2,}$	2	0	0	1
+13149	13149	^[A-F0-9]{16}$	2	0	0	1
+13150	13150	\/rpt\d	2	0	0	1
+13151	13151	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+13152	13152	^\/fbot\.arm\d{1}\.u$	2	0	0	1
+13153	13153	^\/[A-F0-9]{30,60}\/1\/0\/0$	2	0	0	1
+13154	13154	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13155	13155	^[A-F0-9]+$	2	0	0	1
+13156	13156	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+13157	13157	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+13158	13158	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+13159	13159	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+13160	13160	^[a-z0-9\-\.]{1,60}\.ssmailer\.com$	2	0	0	1
+13161	13161	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13162	13162	^[a-z]=[a-f0-9]{80,}$	2	0	0	1
+13163	13163	^Mozilla\/\d+\.\d+\x20\x28compatible\x3b\x20MSIE\x20\d+\.\d+\x3b\x20Windows\x20NT\x20\d+\.\d+\x3b\x20SV1\x29$	2	0	0	1
+13164	13164	^php.{0,500}[\x80-\xff]	2	0	0	1
+13165	13165	^[a-zA-Z0-9_-]{2,6}=[a-zA-Z0-9_-]+(\x3b\x20[a-zA-Z0-9_-]{2,6}=[a-zA-Z0-9_-]+){1,6}={0,2}?$	2	0	0	1
+13166	13166	^[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(&[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$	2	0	0	1
+13167	13167	^[A-F0-9]{8}_[A-F0-9]{8}\.sql	2	0	0	1
+13168	13168	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+13169	13169	\/[a-z-_]{75,}\.php$	2	0	0	1
+13170	13170	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+13171	13171	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+13172	13172	^[^\x20-\x7e\r\n]{2}$	2	0	0	1
+13173	13173	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+13174	13174	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13175	13175	^\/\?([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13176	13176	^[a-zA-Z0-9=/&?\x2e-]+$	2	0	0	1
+13177	13177	^\d{5,10}$	2	0	0	1
+13178	13178	^[a-z0-9/%=]{100,}$	2	0	0	1
+13179	13179	\/[a-z0-9]+\/[a-z0-9]+\.exe$	2	0	0	1
+13180	13180	^[a-zA-Z0-9]+$	2	0	0	1
+13181	13181	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[A-Za-z]+?	2	0	0	1
+13182	13182	^.([a-z0-9+/]*?[A-Z])([A-Z0-9+/]*?[a-z])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\.29a\.de$	2	0	0	1
+13183	13183	(^|\.)en-content\.com$	2	0	0	1
+13184	13184	ch=1$	2	0	0	1
+13185	13185	^\/\?ptrxcz_[a-z0-9A-Z]{30}$	2	0	0	1
+13186	13186	[a-z]{2}\.CAB.bin	2	0	0	1
+13187	13187	\.php\?(print_)?receipt=(s00|\d{3})_\d+$	2	0	0	1
+13188	13188	^sleep \d+[\r\x2c]	2	0	0	1
+13189	13189	\.php\?id=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}&os=\d\.\d[^&]*&bot_id=	2	0	0	1
+13190	13190	\.php\?id=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}-(\d{1,3}\.){3}\d{1,3}&gr	2	0	0	1
+13191	13191	\(b\x3a\d+?\x3bc\x3aAMD-	2	0	0	1
+13192	13192	\(b\x3a\d+?\x3bc\x3aINT-	2	0	0	1
+13193	13193	^\/uploading\/id=\d{2,20}&u=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13194	13194	user=[a-f0-9]{31,32}&	2	0	0	1
+13195	13195	^$	2	0	0	1
+13196	13196	\/gate\.php\?reg=([a-z]{10}|[A-Za-z]{15})$	2	0	0	1
+13197	13197	\(b\x3a\d+?\x3bc\x3a[^\x3b]+AuthenticAMD\x3b	2	0	0	1
+13198	13198	\(b\x3a\d+?\x3bc\x3a[^\x3b]+GenuineIntel\x3b	2	0	0	1
+13199	13199	\?hostid=[0-9A-F]+?&	2	0	0	1
+13200	13200	^\/[a-z0-9]{3,}\/upload\/img\.jpg$	2	0	0	1
+13201	13201	\.php\?[a-zA-Z0-9]+[a-zA-Z0-9]+?&[a-zA-Z0-9]+([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4})(&[a-zA-Z0-9]+[a-f0-9]{32}){2}$	2	0	0	1
+13202	13202	\.php\?ver=\d\&cver=\d\&id=\d{5}$	2	0	0	1
+13203	13203	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13204	13204	^\x2Flts\x2Etxt$	2	0	0	1
+13205	13205	\/\d\d[A-F0-9]{4}0000\/log$	2	0	0	1
+13206	13206	\/[a-z]{2,3}\/(\d{3,4}x\d{3,4}|default)\.bmp\.gz$	2	0	0	1
+13207	13207	\/cp\/\?(logo\.jpg|adm)	2	0	0	1
+13208	13208	\x2Fping\x2Ehtml\x3Fr\x3D[0-9]{5,14}$	2	0	0	1
+13209	13209	^g=[A-Z0-9]+&cmd=	2	0	0	1
+13210	13210	&arg2=(([a-f0-9]{32})|([A-Za-z0-9\x2b\x2f]{4})*([A-Za-z0-9\x2b\x2f]{2}==|[A-Za-z0-9\x2b\x2f]{3}=|[A-Za-z0-9\x2b\x2f]{4}))(&|$)	2	0	0	1
+13211	13211	filename=[a-f0-9]{13}\.file\r\n	2	0	0	1
+13212	13212	\/monitor\.php\?resp=ID\x3a[A-Za-z]{15}	2	0	0	1
+13213	13213	\/gate\.php\?cmd=(get(installconfig|exe)|urls)$	2	0	0	1
+13214	13214	\.php\?(q|name)=	2	0	0	1
+13215	13215	^\x2F(acheb|bajree|cyacrin|dauber|eaves)\x2Easpx\x3FRandom\x3D[a-z]{16}$	2	0	0	1
+13216	13216	^\/201\d{5,8}\/\d{6,11}\/\d{5,10}\.jsp$	2	0	0	1
+13217	13217	\.php\?a1=\d+&a2=([0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}|([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4}))(&a\d+=[^&]+)+$	2	0	0	1
+13218	13218	&HD=[A-F0-9]{32}&	2	0	0	1
+13219	13219	&id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&os=	2	0	0	1
+13220	13220	\.asp\?MAC=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&VER=[^&]+$	2	0	0	1
+13221	13221	\/log\?(start|install)\x7caid=	2	0	0	1
+13222	13222	\.php\?user=[a-f0-9]{32}&id=\d+&type=\d+($|&)	2	0	0	1
+13223	13223	^\/post\.aspx\?[^&]+=[0-9]{9,10}$	2	0	0	1
+13224	13224	^\/j\/[a-f0-9]{8}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{12}\/0001\/?$	2	0	0	1
+13225	13225	^\x2Fel\x2Fsregister\x2Ephp\x3Fname\x3D[a-f0-9]{32}$	2	0	0	1
+13226	13226	^\x2Fel\x2Fslogin\x2Ephp\x3Fuid\x3D[a-f0-9]{32}$	2	0	0	1
+13227	13227	\.php\?m=[A-F0-9]{12}	2	0	0	1
+13228	13228	&rvz1=\d+&rvz2=\d+?$	2	0	0	1
+13229	13229	^\/getc(loud|onf)\/\?c=	2	0	0	1
+13230	13230	^\/home\/index\.asp\?typeid=(1[13]?|[3579])$	2	0	0	1
+13231	13231	\/tasksz\.php\?(dc|load)	2	0	0	1
+13232	13232	^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3Ffile(index\x3D[A-Z]|n\x3Dnoexist|wh\x3Dfalse)	2	0	0	1
+13233	13233	^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3FRe\x3D	2	0	0	1
+13234	13234	^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3Fverify\x3D	2	0	0	1
+13235	13235	\.asp\?IDPC=[^\x26]*?\x26(Status=|Msg=)[^\x26]*?$	2	0	0	1
+13236	13236	^OPC=\d	2	0	0	1
+13237	13237	^\/[^\x2f]+?\.hlp$	2	0	0	1
+13238	13238	^\/(components|wp-content|tmp)/api/[a-zA-Z0-9\/\x20]{43}=\/(toll|inv|notice|get_label)$	2	0	0	1
+13239	13239	&build_id=[A-F0-9]+$	2	0	0	1
+13240	13240	^&op=\d{1,2}&id=\w+?&ui=.+?&bv=\d{1,2}\.\d{1,2}($|&)	2	0	0	1
+13241	13241	\/vtris\d?\.php\?srs=\d{1,10}$	2	0	0	1
+13242	13242	\/soft(32|64)\.dll$	2	0	0	1
+13243	13243	\/ord\/[^\x2f]+?\.exe$	2	0	0	1
+13244	13244	\/zConfig\/\d+$	2	0	0	1
+13245	13245	\/zImprimer\/\d+-	2	0	0	1
+13246	13246	\/enc\/1$	2	0	0	1
+13247	13247	^\/p\/(p(hphphphphphphp|thon)|(dropytho|admmmom)n|u(pdata-server|dom)|eyewheye|joompler|rubbay|tempzz)	2	0	0	1
+13248	13248	[a-z]\d{2}$	2	0	0	1
+13249	13249	\/images2\/[0-9a-fA-F]{500}	2	0	0	1
+13250	13250	^(u(wf(ekfyj|ubpeb)|d(xowub|zycaf)|h(duxic|zubvo)|x(fokur|osgik)|celgos|ggifym|mpefan|qlahaf)|s(u(t(fasof|imjy)|kbewli)|i(ttanyg|webheb|hemuj)|e(suhror|xjereh)|o(haxim|qvaqo)|axyjuw)|r(i(zsebym|firac|sytfa|trios)|e(bfelqi|kvyfo)|u(xymqic|jfeag)|y(buhoq|kafeh)|acadpuh)|j(y(meegom|vvozoz|kyvca|torqu)|a(mwazer|ibzup)|e(btelyx|dytlu)|o(dkymy|kenqi))|o(t(geguuz|xolpow|pipug)|q(lapjim|jogxi)|cgaextu|gdowkys|jpaxlam|vquqaip|smuryf)|i(r(ojvuqu|hegre)|v(kikcop|nuvuk)|hmytog|kevzaq|mgohut|pdehas|wvahin|zxirfy)|b(y((cmolh|vbym)y|gotbys|jlegta)|i(pulte|wuvba)|o(pwyeb|wbaiv))|p(e(dugtap|gyrgun|vhyvys)|y(nxomoj|ykxug)|a(gube|waha)v|ogwytfy)|d(e(afesqy|hjujuq)|o(hwapih|xilik)|a(lwoza|rabub)|inymak)|t(a(hfifak|ixcih)|i(wciwu|koqo)x|ecviqir|ozfyma|uriwil)|g(i(jevsog|nnyjyb)|olhysux|ywilhof|azuzoz|edopan|ubahvi)|y((n(japru|kicy)|kocna)r|bsahov|dabxag|xyqwiz|zsabuq)|h(a(hsekju|poneg)|e(ztymut|dybih)|uquqxov|itakat)|w(a(pifnu|rkafo)c|e(tifjam|fecfo)|ibveces|yjenqo)|a(d(nedat|tesok)|qzepylu|baxhad|smukuf|wewsip)|l(u((fseki|pylz	2	0	0	1
+13251	13251	)m|ditla)|eqgugom|opoqyv)|z(u(pivzed|qijcel)|aefofin|idamuk|ylhomu)|v(u(njuet|ohsub)|ijsixem|otqygiq|euwhyz)|m(u(zupdyg|hipew|wosiv)|osjinme|abuhos)|x(o(fsimi|gitaj|moqol)|ikmonej|enacoz)|f(e(vnotow|tucxo)|i(dedhah|xavpu))|k(u(btyhuz|irfufo)|ejejib|ycufvy)|n((iliqri|obzeky)x|eluzjiv)|c(ylqiduh|aqxaro|itsibe)|q(aijroke|iquzcy|uohdit)|e(gnisje|stesgo|vdyvaz))\.ru$	2	0	0	1
+13252	13252	\/[a-z]\.htm\?[A-Za-z0-9]+$	2	0	0	1
+13253	13253	Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+13254	13254	Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+13255	13255	\/p?2p\/[a-z]{3}$	2	0	0	1
+13256	13256	\/\d\.php\?sid=[0-9A-F]{32}$	2	0	0	1
+13257	13257	^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?\r?$	2	0	0	1
+13258	13258	^\/mod_jshoppi(-|ng|\/)	2	0	0	1
+13259	13259	( MSIE |rv\x3a11)	2	0	0	1
+13260	13260	( MSIE |rv\x3a11)	2	0	0	1
+13261	13261	( MSIE |rv\x3a11)	2	0	0	1
+13262	13262	( MSIE |rv\x3a11)	2	0	0	1
+13263	13263	\/[a-z]+\.k(ey)?btc$	2	0	0	1
+13264	13264	&id=[A-F0-9]+$	2	0	0	1
+13265	13265	\/images\/view\.php$	2	0	0	1
+13266	13266	\/txt\/read\.php$	2	0	0	1
+13267	13267	^hwid=[A-F0-9]{4}(-[A-F0-9]{4}){7}&func=	2	0	0	1
+13268	13268	\/[A-Za-z0-9-_]{75,}\.html$	2	0	0	1
+13269	13269	filename=\x22[A-Z]\x3a\\.+?\\[a-f0-9]{32}\.zip\x22\r\n	2	0	0	1
+13270	13270	^\/me\/(get(ref|ua)\.php|videos\.txt)$	2	0	0	1
+13271	13271	\/infect(-\d)?\.php$	2	0	0	1
+13272	13272	&hash=[^&]+$	2	0	0	1
+13273	13273	^Host\x3a[^\r\n]+?webdav\.cloudme\.com[^\r\n]*?\r?$	2	0	0	1
+13274	13274	\.exe\?dummy=\d+$	2	0	0	1
+13275	13275	^(<v1>.).{33}(=v1).{9}(<v2>.)(.{4}(=v2)){3}	2	0	0	1
+13276	13276	\.png$	2	0	0	1
+13277	13277	\x26enckey\x3D[A-F0-9]+$	2	0	0	1
+13278	13278	^\/action\.php\?action=get_(mails|red)$	2	0	0	1
+13279	13279	^Host\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+13280	13280	\/data\.cfg$	2	0	0	1
+13281	13281	\/bn_versions\/\d+?\.exe$	2	0	0	1
+13282	13282	^(Accept\x3a\x20text\/\*, application\/\*\r\n)?User-Agent\x3a[^\r\n\x3b\x28\x29]+\r\nHost\x3a[^\r\n]+checkip\.dyndns\.org\r\nCache-Control\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+13283	13283	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+13284	13284	&user=\d+$	2	0	0	1
+13285	13285	^Host\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+13286	13286	\/web_[0-9A-F]{12}\.jpg$	2	0	0	1
+13287	13287	^Mozilla(\/4\.0)?$	2	0	0	1
+13288	13288	Host\x3a\x20[a-z0-9]{16}\.[^\r\n]*?(tor|onion)	2	0	0	1
+13289	13289	^\/([^\x2f]+\/)?rp\?[a-z]=	2	0	0	1
+13290	13290	^User-Agent\x3a\x20(\d*[a-z])[a-z0-9]+\r\nHost\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+13291	13291	^Host\x3a[^\r\n]+bagacaoutra\.ru\r\n	2	0	0	1
+13292	13292	^Host\x3a[^\r\n]+bagacavoltou\.ru	2	0	0	1
+13293	13293	^Host\x3a[^\r\n]+bagacaveia\.ru	2	0	0	1
+13294	13294	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13295	13295	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13296	13296	\/state[^\x2f]*\.php\?[A-Za-z0-9+/]*={0,2}$	2	0	0	1
+13297	13297	^Accept\x3a\x20\*\/\*,[^\r\n]+, MZ	2	0	0	1
+13298	13298	^\/[^\x2f]+?\.exe$	2	0	0	1
+13299	13299	^[A-F0-9]+$	2	0	0	1
+13300	13300	\/redirect\.php\?loc=mail$	2	0	0	1
+13301	13301	&(uid|name|file)=[a-f0-9]+$	2	0	0	1
+13302	13302	\?HostID=([A-F0-9]{2}(-|<>)){5}[A-F0-9]{2}$	2	0	0	1
+13303	13303	\/\?bit=(32|64)&version=\d{4}-\d{1,2}-\d{1,2}$	2	0	0	1
+13304	13304	\/\?check$	2	0	0	1
+13305	13305	^Host\x3a[^\r\n]+\r\nAccept-Language\x3a[^\r\n]+\r\nAccept\x3a[^\r\n]+\r\nAccept-Encoding\x3a[^\r\n]+\r\nConnection\x3a\x20close\r\nUser-Agent\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+13306	13306	[A-Z]{100}(&\w+=[a-zA-Z0-9/+=]+){0,2}$	2	0	0	1
+13307	13307	^\w+=([a-zA-Z0-9/+=]{1,30}&\w+=)?[a-zA-Z0-9+/]{0,13}[A-Z]{200}	2	0	0	1
+13308	13308	(&(boardid|bbsNo|strBoardID|userid|bbs|filename|code|pid|seqNo|ReportID|v|PageNumber|num|view|read|action|page|mode|idx|cateId|bbsId|pType|pcode|index|tbl|idx_num|act|bbs_id|bbs_form|bid|bbscate|menu|tcode|b_code|bname|tb|borad01|borad02|borad03|mid|newsid|table|Board_seq|bc_idx|seq|ArticleID|B_Notice|nowPage|webid|boardDiv|sub_idxa)=[^&]+){3}$	2	0	0	1
+13309	13309	\/setup\/[a-zA-Z0-9!-]{100,}$	2	0	0	1
+13310	13310	\/app\.exe$	2	0	0	1
+13311	13311	^Host\x3a[^\r\n]+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+13312	13312	=c3NoOi8v[A-Za-z0-9+/]+={0,2}$	2	0	0	1
+13313	13313	\.asp\?([A-Za-z0-9+*]{4})*([A-Za-z0-9+*]{2}==|[A-Za-z0-9+*]{3}=|[A-Za-z0-9+*]{4})$	2	0	0	1
+13314	13314	\?wd=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})$	2	0	0	1
+13315	13315	&version=\d+$	2	0	0	1
+13316	13316	^[A-Za-z0-9/_]+={0,2}$	2	0	0	1
+13317	13317	\/[a-z]\/infects\/[a-z]\?[a-z]=[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}	2	0	0	1
+13318	13318	^\d{4}	2	0	0	1
+13319	13319	^\d{4}	2	0	0	1
+13320	13320	^Host\x3a\x20(\d{1,3}\.){3}\d{1,3}\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+13321	13321	\/lns.txt$	2	0	0	1
+13322	13322	^\/[a-z]+?\.*?ini\?\d+$	2	0	0	1
+13323	13323	\/[a-f0-9]{8}\/page_\d{8,10}\.html$	2	0	0	1
+13324	13324	^[a-z]{1,7}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13325	13325	SSID=[0-9]{5}[0-8][01][a-f0-9]{36}	2	0	0	1
+13326	13326	SSID=[0-9]{5}[0-8][01][a-f0-9]{36}	2	0	0	1
+13327	13327	^[\x20-\x7e\s]{0,20}[^\x20-\x7e\s]	2	0	0	1
+13328	13328	^s?\x3a\x2f+[^\r\n\s]+\.exe	2	0	0	1
+13329	13329	\.jpg\?vid=\d+$	2	0	0	1
+13330	13330	^[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\nUser-Agent\x3a	2	0	0	1
+13331	13331	\.php\?[a-z]+=0000[a-fA-F0-9]{4}&[a-z]+=\?[A-F0-9]+&[a-z]=\d{4}&[a-z]=\d{4}$	2	0	0	1
+13332	13332	^[0-9a-f]+$	2	0	0	1
+13333	13333	\/r\.php\?[A-F0-9]+=?$	2	0	0	1
+13334	13334	^m=([A-Za-z0-9+/]{4}){11}(([A-Za-z0-9+/]{4}){6})?AA==	2	0	0	1
+13335	13335	\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/\x20]{2}==|[A-Za-z0-9+/\x20]{3}=|[A-Za-z0-9+/\x20]{4})$	2	0	0	1
+13336	13336	^\d+\x20	2	0	0	1
+13337	13337	^\d+\x20	2	0	0	1
+13338	13338	^\d+\x20	2	0	0	1
+13339	13339	^\d+\x20	2	0	0	1
+13340	13340	^\d+\x20	2	0	0	1
+13341	13341	^\d+\x20	2	0	0	1
+13342	13342	^\d+\x20	2	0	0	1
+13343	13343	^\d+\x20	2	0	0	1
+13344	13344	\.php\?a1=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&a2=[a-f0-9]{32}&a3=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13345	13345	\/(im(age|g)|pict)\.(jpg|php)\?id=\d+&act=[12]$	2	0	0	1
+13346	13346	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13347	13347	\.php\?hwid=[A-F0-9]{16}$	2	0	0	1
+13348	13348	^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/general\.png$	2	0	0	1
+13349	13349	^\/\d+$	2	0	0	1
+13350	13350	^[\x2fa-z\d]+\.exe$	2	0	0	1
+13351	13351	\.php\?command=(g(hl|et(ip|id|backconnect))|update2?|dl|log)($|&)	2	0	0	1
+13352	13352	\.(gif|jpe?g)\.zip$	2	0	0	1
+13353	13353	^(zh-CN|en-US)\x3b rv\x3a1\.7\.6\)\r\n	2	0	0	1
+13354	13354	(,0x[0-9a-f]{2}){10}$	2	0	0	1
+13355	13355	\/default\.aspx?\?tmp=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13356	13356	^[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(&[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$	2	0	0	1
+13357	13357	\/\d{8,10}\.html$	2	0	0	1
+13358	13358	^\x40\x24[^\x20-\x7e\r\n]+$	2	0	0	1
+13359	13359	^\/[A-F0-9]+$	2	0	0	1
+13360	13360	^\/[a-z0-9]+\.jpg\?([a-z0-9]*[A-Z]+[a-z0-9])[A-Za-z0-9]+=\d{1,4}$	2	0	0	1
+13361	13361	\.png\x3f[0-9a-f]{4,8}\x3d\d+?$	2	0	0	1
+13362	13362	^Host\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+13363	13363	(\/((p(lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|osts?\/[a-z0-9]+|rogcicicic)|s(ystem\/(logs|engine)\/[^\x2f]+?|e(rv(au|er)|ct)|gau\/.*?|alam|ucks|can|ke)|([a-z]*[0-9])([0-9]*[a-z])(setup\d+\.exe)[a-z0-9]{5,10}|a(d(min\/images\/\w+|obe)|salam|live|us)|m(edia\/files\/\w+|a(cros?|rch)|soffice)|d(o(c(\/[a-z0-9]+)?|ne)|bust)|(~.+?\/\.[^\x2f]+|\.css)\/.+?|in(voice\/[^\x2f]+|fos?)|c(onfig|hris|alc)|u(swinz\w+|pdate)|xml\/load\/[^\x2f]+|([Dd]ocumen|ve)t|Ozonecrytedserver|w(or[dk]|insys)|t(mp\/.+?|est)|fa(cture|soo)|n(otepad|ach)|k(be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe|(([a-z0-9]*?[3456789][a-z0-9]*?[3456789])([a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(^\/(image\/.+?\/[^\x2f]+|x\/setup)|keem)\.exe$)	2	0	0	1
+13364	13364	\.pdf\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13365	13365	\.zip\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13366	13366	\.htm\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13367	13367	\.xml\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13368	13368	^\/[a-z0-9_-]+\.jpg\?[A-Za-z0-9]{2,10}=\d{1,4}$	2	0	0	1
+13369	13369	^(www\.)?google(\.[a-z]{2,3})+$	2	0	0	1
+13370	13370	\.log$	2	0	0	1
+13371	13371	\/([a-z0-9]+_){4,}[a-z0-9]+(\/[a-f0-9]+)*?\/[a-f0-9]+\.([Ee][Xx][Ee])[a-z0-9]+$	2	0	0	1
+13372	13372	^\/pm\.sh\?\d+$	2	0	0	1
+13373	13373	\.asp\?m=(INS|UAC)(&p=&a=)?&i=201\d{11}&	2	0	0	1
+13374	13374	\?ver=\d+$	2	0	0	1
+13375	13375	^\/(i686|arm|mips(el)?)\?ver=\d+$	2	0	0	1
+13376	13376	&u=[a-f0-9]{16}&p=	2	0	0	1
+13377	13377	\/[a-f0-9]{16}\.down$	2	0	0	1
+13378	13378	\.php\/data$	2	0	0	1
+13379	13379	\/catalog\/\d{3,}$	2	0	0	1
+13380	13380	\.php\?cookie=1$	2	0	0	1
+13381	13381	^\/[A-Za-z0-9]+?\/file\.php$	2	0	0	1
+13382	13382	\/tor\/[^\x2f\x2e]+(32|64)\.dll$	2	0	0	1
+13383	13383	\.php\?shinu=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13384	13384	^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$	2	0	0	1
+13385	13385	^\/link\.txt\?[0-9]{1,2}\x3a[0-9]{1,2}\x3a[0-9]{1,2}	2	0	0	1
+13386	13386	\.php\?uuid=[a-z0-9]{32}$	2	0	0	1
+13387	13387	^(Referer\x3a[^\r\n]+\r\n)?Host\x3a[^\r\n]+[\r\n]+$	2	0	0	1
+13388	13388	\.exe\?$	2	0	0	1
+13389	13389	^\/\w+\.php\?f=[a-z]?\d{1,3}(\.(dat|gif))?$	2	0	0	1
+13390	13390	\/\?[a-zA-Z0-9]{1,3}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13391	13391	\.php\?cn(ame)	2	0	0	1
+13392	13392	^(Host\x3a [^\r\n]+?\r\nConnection\x3a Keep-Alive|Connection\x3a Keep-Alive\r\nHost\x3a [^\r\n]+?)\r\n(\r\n)?$	2	0	0	1
+13393	13393	\.php\?file=(64|86)$	2	0	0	1
+13394	13394	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13395	13395	meta=(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?(&?id=[a-z]+)?$	2	0	0	1
+13396	13396	^\/[a-z]+?\/\?([a-z]+[A-Za-z0-9\x5f\x2d]+&){1,}ai=[^&]{5}([A-Za-z0-9\x5f\x2d]{4})*([A-Za-z0-9\x5f\x2d]{2}==|[A-Za-z0-9\x5f\x2d]{3}=|[A-Za-z0-9\x5f\x2d]{4})(&|$)	2	0	0	1
+13397	13397	(^|=)[A-F0-9]{70,}($|&)	2	0	0	1
+13398	13398	^[A-Za-z0-9+/]{64}\x0a	2	0	0	1
+13399	13399	\/viewforum\.php\?f=\d+&sid=[A-F0-9]{32}$	2	0	0	1
+13400	13400	\?uid=\d{8}&ver=\d\.\d{2}&mk=[0-9a-zA-Z]{6}&os=[A-Za-z0-9]+&rs=[a-z]+&c=\d+&rq=\d	2	0	0	1
+13401	13401	^Content-Disposition\x3a[^\r\n]*\.sct[\x22\x27\s\r\n]	2	0	0	1
+13402	13402	\.php\?cmd=p&id=\w+.*?&rnd=[\x2e\d]+$	2	0	0	1
+13403	13403	myguy\.(xls(\.hta)?|exe)$	2	0	0	1
+13404	13404	\/invoice[^a-z\/]*?\.(exe|zip|7z|rar|com|vbs|ps1)$	2	0	0	1
+13405	13405	\/[\x2f\x2bA-Za-z0-9]{59}AAA==$	2	0	0	1
+13406	13406	^\/[^\x2f]+?\/create\.php\?[a-z0-9]+\x3d[a-z0-9\x5f\x2d]+?$	2	0	0	1
+13407	13407	\.php\?id=\d+&stat=[a-z0-9]{32}(&cidl=\d+|&sidl=[\d%:\x20-]+)?$	2	0	0	1
+13408	13408	\/[A-Z0-9]{4,8}\/[A-Z0-9]{8}\.DAT$	2	0	0	1
+13409	13409	\.exe\?\.\d+$	2	0	0	1
+13410	13410	^Host\x3a[^\r\n]+\r\n((Cache-Control|Pragma)\x3a[^\r\n]+\r\n)?(\r\n)?$	2	0	0	1
+13411	13411	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13412	13412	^\/Search\/en-US\?query=[a-z]{200,400}&pgArea=header$	2	0	0	1
+13413	13413	\/stat\d+\.php	2	0	0	1
+13414	13414	\?url=[0-9]&affid=[0-9]{5}	2	0	0	1
+13415	13415	\.php\?id=[0-9a-f]{8}$	2	0	0	1
+13416	13416	^6\.[0-2]\x20\d\d\x3a\d\d\x20	2	0	0	1
+13417	13417	^IPHONE\d+\x2e\d+\x28(host\x3a|[^\r\n\x2c]+\x2c(\d{1,3}\.){3}\d{1,3})	2	0	0	1
+13418	13418	(1|2)\.(p(hp|ng)|jpe?g|cgi|gif)\?sv=\d{2,3}&tq=	2	0	0	1
+13419	13419	[\?&]p=\d&t=\d(&|$)	2	0	0	1
+13420	13420	^\x2fhistory\x2f[A-Za-z0-9+_-]+\x2easp$	2	0	0	1
+13421	13421	^\x2fdocs\x2fname\x3d\x2f[A-Za-z0-9+_-]+$	2	0	0	1
+13422	13422	^\x2ftech\x2fs\x2easp\x3fm\x3d[A-Za-z0-9+_-]+$	2	0	0	1
+13423	13423	^\x2fmanage\x2fasp\x2fitem\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26mux\x3d[A-Za-z0-9+_-]+$	2	0	0	1
+13424	13424	^\x2farticle\x2f30441\x2fReview\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26data\x3d[A-Za-z0-9+_-]+$	2	0	0	1
+13425	13425	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13426	13426	^\/[A-Za-z0-9-_]{30,}\/$	2	0	0	1
+13427	13427	^build\d	2	0	0	1
+13428	13428	^[a-zA-Z0-9]{5}6164(3[0-9]){4}31303[0-9]([a-f0-9][a-f0-9]){5,}\.	2	0	0	1
+13429	13429	^[a-zA-Z0-9]{5}6364(3[0-9]){4}\d{1,3}\.	2	0	0	1
+13430	13430	^[a-zA-Z0-9]{5}6464(3[0-9]){4}\.	2	0	0	1
+13431	13431	^[a-zA-Z0-9]{5}6664(3[0-9]){4}\.	2	0	0	1
+13432	13432	^[a-zA-Z0-9]{5}6864(3[0-9]){4}31303[0-9]\.	2	0	0	1
+13433	13433	^[a-zA-Z0-9]{5}7264(3[0-9]){4}31303[0-9]([a-f0-9][a-f0-9]){10,}\.	2	0	0	1
+13434	13434	^[a-zA-Z0-9]{5}7164(3[0-9]){4}\.	2	0	0	1
+13435	13435	^[a-f0-9]{8}$	2	0	0	1
+13436	13436	^\d{1,3}$	2	0	0	1
+13437	13437	^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+13438	13438	^[A-Za-z0-9\/\+\=]{100,}$	2	0	0	1
+13439	13439	\.(txt|gif|exe|bmp)$	2	0	0	1
+13440	13440	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+13441	13441	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+13442	13442	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13443	13443	^[A-F0-9]{128}$	2	0	0	1
+13444	13444	^DEMONS((\/|\s)[0-9]\.0)?$	2	0	0	1
+13445	13445	^Hakai((\/|\s)[0-9]\.0)?$	2	0	0	1
+13446	13446	^Messiah((\/|\s)[0-9]\.0)?$	2	0	0	1
+13447	13447	^Liquor((\/|\s)[0-9]\.0)?$	2	0	0	1
+13448	13448	^Nija((\/|\s)[0-9]\.0)?$	2	0	0	1
+13449	13449	^Gemini((\/|\s)[0-9]\.0)?$	2	0	0	1
+13450	13450	^Kayla((\/|\s)[0-9]\.0)?$	2	0	0	1
+13451	13451	^Sector((\/|\s)[0-9]\.0)?$	2	0	0	1
+13452	13452	^OSIRIS((\/|\s)[0-9]\.0)?$	2	0	0	1
+13453	13453	^lessie(\/[0-9]\.0)?$	2	0	0	1
+13454	13454	^Cakle(\/[0-9]\.0)?$	2	0	0	1
+13455	13455	^Damien(\/[0-9]\.0)?$	2	0	0	1
+13456	13456	^Solar(\/[0-9]\.0)?$	2	0	0	1
+13457	13457	^muhstik(-scan)?(\/[0-9]\.0)?$	2	0	0	1
+13458	13458	^Shaolin(\/[0-9]\.0)?$	2	0	0	1
+13459	13459	^Rift(\/[0-9]\.0)?$	2	0	0	1
+13460	13460	^Tsunami(\/[0-9]\.0)?$	2	0	0	1
+13461	13461	^Yowai(\/[0-9]\.0)?$	2	0	0	1
+13462	13462	^Yakuza(\/[0-9]\.0)?$	2	0	0	1
+13463	13463	^Hentai(\/[0-9]\.0)?$	2	0	0	1
+13464	13464	^[a-zA-Z/+=]$	2	0	0	1
+13465	13465	\?uid=[A-F0-9]{15,}&pid=\d+$	2	0	0	1
+13466	13466	\.php\?[A-F0-9]{15,25}$	2	0	0	1
+13467	13467	^(Sucessful|Failed|Missing\x20CBA8|Missing\x20LANDesk\x20Agent)$	2	0	0	1
+13468	13468	^POST\shttp\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.0\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+13469	13469	^name=v[0-9]{1,2}_kt[0-9]{1,2}p[0-9]{1}_[0-9]{8,10}$	2	0	0	1
+13470	13470	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+13471	13471	^\/[a-z]\.php	2	0	0	1
+13472	13472	^\d{1,6}$	2	0	0	1
+13473	13473	^[A-Z0-9]{8}	2	0	0	1
+13474	13474	^\d{15}	2	0	0	1
+13475	13475	^(winload(32)?|cmms)\x0d\x0a	2	0	0	1
+13476	13476	^\d$	2	0	0	1
+13477	13477	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13478	13478	^\/[a-z]+\/\?ip=	2	0	0	1
+13479	13479	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+13480	13480	^\d{1,5}\.[2-5]0[0-5]\.\d+? Firefox\/7\.0\.1	2	0	0	1
+13481	13481	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13482	13482	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13483	13483	^(update_hash|js|key|arsiv_(hash|link))$	2	0	0	1
+13484	13484	\/([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})\.jpg$	2	0	0	1
+13485	13485	^[a-z0-9]{11}=\d{16}$	2	0	0	1
+13486	13486	^[A-Za-z0-9]{3,25}=[a-f0-9]{28,}$	2	0	0	1
+13487	13487	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13488	13488	^Hello, World((\/|\s)[0-9]\.0)?$	2	0	0	1
+13489	13489	\/cgi\/[a-z0-9]{1,31}\.bin$	2	0	0	1
+13490	13490	^[0-9a-zA-Z=%-]{0,48}(%[A-F0-9]{2}){4}	2	0	0	1
+13491	13491	\?id=\d+&act=[12]$	2	0	0	1
+13492	13492	\?id=\d+&act=\d$	2	0	0	1
+13493	13493	^([A-F0-9]{2}%3A){5}[A-F0-9]{2}&	2	0	0	1
+13494	13494	\/([a-z]{0,7}[0-9])([0-9]{0,7}[a-z])[a-z0-9]{7,8}\/([a-z]{0,7}[0-9])([0-9]{0,7}[a-z])[a-z0-9]{7,8}$	2	0	0	1
+13495	13495	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&isAdvpp=(true|false)$	2	0	0	1
+13496	13496	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+13497	13497	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+13498	13498	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+13499	13499	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+13500	13500	^\d\.\d_(64|32)_\d\x3a	2	0	0	1
+13501	13501	(^|\.)15438\.xyz$	2	0	0	1
+13502	13502	(^|\.)12724\.xyz$	2	0	0	1
+13503	13503	(^|\.)21736\.xyz$	2	0	0	1
+13504	13504	^[a-f0-9]+\x08\x00$	2	0	0	1
+13505	13505	^([A-Za-z0-9%2b%2f]{4})*([A-Za-z0-9%2b%2f]{2}%3d%3d|[A-Za-z0-9%2b%2f]{3}%3d|[A-Za-z0-9%2b%2f]{4})$	2	0	0	1
+13506	13506	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+13507	13507	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+13508	13508	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+13509	13509	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+13510	13510	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+13511	13511	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+13512	13512	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+13513	13513	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+13514	13514	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+13515	13515	^Host\x3a\x20(\d{1,3}\.){3}\d{1,3}\r\nConnection\x3a\x20close(\r\n)+$	2	0	0	1
+13516	13516	^[A-Z]+$	2	0	0	1
+13517	13517	^\d+$	2	0	0	1
+13518	13518	^(64|86)$	2	0	0	1
+13519	13519	\/counter\/(\?[a-z]?\d{1,2}|[^\x2f]*\d\.exe|.*?[]([A-Za-z_-]{0,200}[0-9][A-Za-z_-]{0,200}[0-9])([A-Z0-9_-]{0,200}[a-z][A-Z0-9_-]{0,200}[a-z])([a-z0-9_-]{0,200}[A-Z][a-z0-9_-]{0,200}[A-Z])[A-Za-z0-9_-]{50,}(&|$)	2	0	0	1
+13520	13520	^\/(\w+\/){1,5}\?[a-z]{1,6}=[a-z0-9]{2,40}(&[a-z]{1,6}=([a-z0-9]){1,40}(%3D){0,2}){1,4}$	2	0	0	1
+13521	13521	^\d{5,10}\x7d	2	0	0	1
+13522	13522	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+13523	13523	\/\d{8,10}\.html$	2	0	0	1
+13524	13524	^\d{1,3}=	2	0	0	1
+13525	13525	(Proxy-)?Connection\x3a[^\r\n]+?\r\n(Pragma|Cache-Control)\x3a[^\r\n]+?\r\n(\r\n)?$	2	0	0	1
+13526	13526	\/?[a-zA-Z0-9]{1,3}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13527	13527	^\d+$	2	0	0	1
+13528	13528	^\/\?m=[abcde]&p1=[a-f0-9]{8,12}(&p2=[^&]+)?(&p3=[^&]+)?$	2	0	0	1
+13529	13529	[&?]a=([a-zA-Z0-9_-]{25,}|(0\.)?\d+)(&|$)	2	0	0	1
+13530	13530	^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$	2	0	0	1
+13531	13531	\.(aspx?|php)\?q=(KT)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$	2	0	0	1
+13532	13532	^[A-Za-z]{1,10}=[^&]+(&[A-Za-z]{1,10}=[^&]+){10,}$	2	0	0	1
+13533	13533	^[a-f0-9]{32}\x3b$	2	0	0	1
+13534	13534	^\/(kas|ser|mac)[0-9]+\.png$	2	0	0	1
+13535	13535	^\/s\.php\?id=[a-z0-9]{2,6}$	2	0	0	1
+13536	13536	\.php\?d=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13537	13537	^[a-z0-9!\x22#%&'()*,.\/\x3a\x3b<=>?@\[\] ^_`{|}~\s-]+?downloading\.?\s*Please wait\x2e*<\/div\>\s*<iframe src\s*=\s*[\x22\x27]http\:\/\/[^\x22\x27]+\.php[\x22\x27]\s*style\s*=\s*[\x22\x27]display\x3a\s*none\x3b\s*[\x22\x27]>\s*<\/iframe\>\s*$	2	0	0	1
+13538	13538	^[a-f0-9]{16}$	2	0	0	1
+13539	13539	^[A-Za-z0-9]{3,4}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})	2	0	0	1
+13540	13540	^[A-Za-z0-9]{3,4}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+13541	13541	[a-z0-9]{3,4}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+13542	13542	^Mozilla\/4\.0\x20\(compatible\x3b\x20MSIE\x20\d{1,2}\.0\.\d+\.\d+\.0\x3b\x20Windows\x20NT\x20	2	0	0	1
+13543	13543	^[\x20-\x7e\r\n]{0,28}[^\x20-\x7e\r\n]	2	0	0	1
+13544	13544	^\/([a-z]{0,9}?\d)(\d{0,9}?[a-z])[a-z0-9]{4,10}$	2	0	0	1
+13545	13545	(^|&)id=\d+($|&)	2	0	0	1
+13546	13546	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+13547	13547	^\d?\.dll$	2	0	0	1
+13548	13548	^(32|64)$	2	0	0	1
+13549	13549	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)$	2	0	0	1
+13550	13550	\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d{1,5}$	2	0	0	1
+13551	13551	^env=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+13552	13552	\/pict\.(jpg|php|xsp)\?id=\d+((&data=|&bid=)[^&]*?)?$	2	0	0	1
+13553	13553	^SESSIONID=[A-Z0-9]{16}	2	0	0	1
+13554	13554	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+13555	13555	^(\/\w{3,12}){2,4}\?[a-z]{3,12}=([A-Za-z0-9+/\x20]{4})*([A-Za-z0-9+/\x20]{2}==|[A-Za-z0-9+/\x20]{3}=|[A-Za-z0-9+/\x20]{4})$	2	0	0	1
+13556	13556	^\d+$	2	0	0	1
+13557	13557	^POST \/(<filep>[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(=filep)[a-z]+?\.net\r\n	2	0	0	1
+13558	13558	[=\"]\w{8}\.jar	2	0	0	1
+13559	13559	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13560	13560	filename\x3D\x22[^\r\n]*security[^\n]+\.exe	2	0	0	1
+13561	13561	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13562	13562	^[A-F0-9]{30}$	2	0	0	1
+13563	13563	\.php\?cx=[A-F0-9]+&b=[A-F0-9]+&gt=[A-F0-9]+&tx=[A-F0-9]+$	2	0	0	1
+13564	13564	^\/ucD[A-Za-z0-9_\/\-+]{171}$	2	0	0	1
+13565	13565	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+13566	13566	^<CHECK>([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/CHECK>$	2	0	0	1
+13567	13567	^[a-zA-Z0-9\/+_-]{171}$	2	0	0	1
+13568	13568	\/\d+\/\d+\.exe$	2	0	0	1
+13569	13569	^[A-Za-z0-9]{20,22}&usg=[A-Za-z0-9_]{34}&bvm=bv\.81[1-7]{6}\,d\.[A-Za-z0-9_]{3}\r\n	2	0	0	1
+13570	13570	^fn=[^&]*\.gif&code=\d+$	2	0	0	1
+13571	13571	^[A-F0-9]+$	2	0	0	1
+13572	13572	^log=save&session_id=[^&]+&value=[^&]+$	2	0	0	1
+13573	13573	%comSpec%\s\/c\s((\\x50)|(\\x70)|[Pp])\^?((\\x4f)|(\\x5f)|[Oo])\^?((\\x57)|(\\x77)|[Ww])\^?((\\x45)|(\\x65)|[Ee])\^?((\\x52)|(\\x72)|[Rr])\^?((\\x53)|(\\x73)|[Ss])\^?((\\x48)|(\\x68)|[Hh])\^?((\\x45)|(\\x65)|[Ee])\^?((\\x4c)|(\\x6c)|[Ll])\^?((\\x4c)|(\\x6c)|[Ll])\^?((\\x2e)|\.)\^?((\\x45)|(\\x65)|[Ee])\^?((\\x58)|(\\x78)|[Xx])\^?((\\x45)|(\\x65)|[Ee])\^?\s	2	0	0	1
+13574	13574	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13575	13575	^([a-f0-9]{2}){23,60}$	2	0	0	1
+13576	13576	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13577	13577	^[0-9]*?[a-z]/P	2	0	0	1
+13578	13578	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a8080$	2	0	0	1
+13579	13579	^\/[a-z]{4}(\d{1,3}\.){3}\d{1,3}[a-z]{6}\.txt	2	0	0	1
+13580	13580	^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+13581	13581	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+	2	0	0	1
+13582	13582	^[a-zA-Z0-9=/&?\x2e-]+$	2	0	0	1
+13583	13583	^[a-f0-9]{8}\.grp[0-9]*\.ping\.adm\.([a-f0-9]+\.){2,}	2	0	0	1
+13584	13584	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+13585	13585	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+13586	13586	^[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}$	2	0	0	1
+13587	13587	^[\x20-\x25\x27-\x3c\x3e-\x7e]{25,}$	2	0	0	1
+13588	13588	^(i686|x86_64|arm|mipsel)\-(static-linux|w64|iamsatan)\-(mingw32|uclibc(gnueabi)?)	2	0	0	1
+13589	13589	^[^\\\*\+\=\|\:\;\x22\?\>\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}[\d_]+\.(jpg|png)\x22\x0d\x0a	2	0	0	1
+13590	13590	^([A-Za-z0-9%2b%2f]{4})*([A-Za-z0-9%2b%2f]{2}%3d%3d|[A-Za-z0-9%2b%2f]{3}%3d|[A-Za-z0-9%2b%2f]{4})$	2	0	0	1
+13591	13591	^\/[^\x2f]+?\.htm$	2	0	0	1
+13592	13592	^\d{2,7}$	2	0	0	1
+13593	13593	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\.bin$	2	0	0	1
+13594	13594	^Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x3A\d{1,5}\r?$	2	0	0	1
+13595	13595	^Host\x3a[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(\r\n)?$	2	0	0	1
+13596	13596	(\/((p(lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|osts?\/[a-z0-9]+|rogcicicic)|s(ystem\/(logs|engine)\/[^\x2f]+?|e(rv(au|er)|ct)|gau\/.*?|alam|ucks|can|ke)|([a-z]*[0-9])([0-9]*[a-z])(setup\d+\.exe)[a-z0-9]{5,10}|a(d(min\/images\/\w+|obe)|salam|live|us)|m(edia\/files\/\w+|a(cros?|rch)|soffice)|d(o(c(\/[a-z0-9]+)?|ne)|bust)|(~.+?\/\.[^\x2f]+|\.css)\/.+?|in(voice\/[^\x2f]+|fos?)|c(onfig|hris|alc)|u(swinz\w+|pdate)|xml\/load\/[^\x2f]+|([Dd]ocumen|ve)t|Ozonecrytedserver|w(or[dk]|insys)|t(mp\/.+?|est)|fa(cture|soo)|n(otepad|ach)|k(be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe|(([a-z0-9]*?[3456789][a-z0-9]*?[3456789])([a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(^\/(image\/.+?\/[^\x2f]+|x\/setup)|keem)\.exe$)	2	0	0	1
+13597	13597	^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+13598	13598	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+13599	13599	^[a-zA-Z0-9\/+_-]{171}$	2	0	0	1
+13600	13600	^cnc\.[a-fA-F0-9]{14}.xyz$	2	0	0	1
+13601	13601	^[^&]+&[a-z]=[^&]+&[a-z]=[A-F0-9]+$	2	0	0	1
+13602	13602	^[A-Za-z0-9]{3,20}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13603	13603	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13604	13604	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13605	13605	_aWQ9[a-zA-Z0-9\/]{43,46}(JmdpZD|Z2lkP|ZnaWQ9)	2	0	0	1
+13606	13606	^\/[a-f0-9]+$	2	0	0	1
+13607	13607	^[A-Z]{4}	2	0	0	1
+13608	13608	\.php\?host=[^&]+&password=[a-f0-9]{32}$	2	0	0	1
+13609	13609	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+13610	13610	^\x2F[a-f0-9]{40,60}$	2	0	0	1
+13611	13611	^[^\r\n]+\.exe(\x3b)?$	2	0	0	1
+13612	13612	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13613	13613	\r\nHost\x3a[^\r\n]+\r\n(Content-Length\x3a\x20\d+\r\n)?Connection\x3a\x20Keep-Alive\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+13614	13614	Content-Disposition\x3a[^\r\n]+=[\x22\x27]?[a-z]?\d{1,3}(\.dat)?[\x22\x27]?\r\n	2	0	0	1
+13615	13615	Content-Disposition\x3a[^\r\n]+=[\x22\x27]?[a-z]?\d{1,3}(\.dat)?[\x22\x27]?\r\n	2	0	0	1
+13616	13616	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13617	13617	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13618	13618	^([A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+&)+([a-z]{0,9}[A-Z])([A-Z]{0,9}[a-z])[A-Za-z]{1,10}=([A-Za-z0-9_+\x2d\x2e%]*%[A-F0-9]{2}%[A-F0-9]{2}%[A-F0-9]{2})[A-Za-z0-9_+\x2d\x2e%]+\s*$	2	0	0	1
+13619	13619	^Host\x3a\x20[^\r\n]+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+13620	13620	^[a-z0-9]+\.appsync-api\.(eu|us)-(ea|we)st-[12]\.avsvmcloud\.com$	2	0	0	1
+13621	13621	^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$	2	0	0	1
+13622	13622	=[a-z0-9\(_~\-\.\x00]{300,}\x00$	2	0	0	1
+13623	13623	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$/Wm	2	0	0	1
+13624	13624	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$/Wm	2	0	0	1
+13625	13625	^[A-Z0-9\-]{30,42}$	2	0	0	1
+13626	13626	^\d+?\r\n	2	0	0	1
+13627	13627	^__io_r=[0-9]{10}_[01]_[0-9]{4,5}_[0-9]{7,8}_[0-9]{1,2}\x3b\x20__io_vl=[0-9]_[0-9]{6}_[0-9]{3}_[0-9]{2}\x3b\x20__io_bl=[0-9]{1,2}:[0-9]:[0-9]{4,5}:[0-9]{2}\x3b\x20Session_id=[0-9A-F]{12}\x3b\x20__io_uniq=[0-9A-F]{8,22}_[0-9A-F]{12,20}\x3b\x20__io_f=[0-9]{2}::[0-9]{10}::[0-9]{9,10}::[0-9]{9,10}$	2	0	0	1
+13628	13628	\.php\?c=[a-f0-9]{160}$	2	0	0	1
+13629	13629	Cache-Control\r\n(\r\n|Cookie\r\n\r\n)$	2	0	0	1
+13630	13630	^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$	2	0	0	1
+13631	13631	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+13632	13632	^dkv=[a-f0-9]{32}\x3bYSC=\d+$	2	0	0	1
+13633	13633	^(resp|onl|pr)=	2	0	0	1
+13634	13634	^id=\d+&cred=[a-z]+\x7c	2	0	0	1
+13635	13635	[\x80-\xff]	2	0	0	1
+13636	13636	(retdl|fb|step) HTTP\/1\.1$	2	0	0	1
+13637	13637	^\/[0-9]{6,16}-(pro|xl2|us1)$	2	0	0	1
+13638	13638	^(81|freq|domains|over|rate|npcap\.exe)\/?\s*[^\/]*$	2	0	0	1
+13639	13639	^\/[0-9a-f]{16}$	2	0	0	1
+13640	13640	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13641	13641	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13642	13642	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13643	13643	^[A-F0-9]{24}	2	0	0	1
+13644	13644	^[a-z0-9]{32}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13645	13645	^\/[a-z0-9]{32}\/\d\/$	2	0	0	1
+13646	13646	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13647	13647	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13648	13648	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13649	13649	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/Psi	2	0	0	1
+13650	13650	^transfer=[A-Za-z0-9/+=]+$	2	0	0	1
+13651	13651	^__gads=\d{9,10}:[01]:\d+:\d+(:\d{2,4})?\x3b\s_gat=(10|6)\.[0-3]\.\d{4,6}\.(32|64)\x3b\s_ga=\d\.\d+\.\d+\.\d+\x3b\s_u=[0-9A-F]+:[0-9A-F]+\x3b\s__io=\d{2}_\d{9,10}_\d{9,10}_\d{9,10}\x3b\s_gid=[0-9A-F]{12}$	2	0	0	1
+13652	13652	^[A-Z]{256}$	2	0	0	1
+13653	13653	^[0-9]{90,180}\r\n	2	0	0	1
+13654	13654	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r\n	2	0	0	1
+13655	13655	^\/vpn-service\/[a-z]{15}\/crunchyroll-vpn$	2	0	0	1
+13656	13656	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13657	13657	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13658	13658	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13659	13659	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13660	13660	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13661	13661	^SSID=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13662	13662	^(id|tfzT)=	2	0	0	1
+13663	13663	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13664	13664	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+13665	13665	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+13666	13666	^[a-zA-Z0-9]{32}\.dot$	2	0	0	1
+13667	13667	^[0-9A-F]{21,22}\x20HTTP\/1\.1$	2	0	0	1
+13668	13668	^[0-9A-F]+$	2	0	0	1
+13669	13669	^C=(M[ACDEGHKLMNOPQRSTUVWXYZ]|G[ABDEFGHILMNPQRSTUWY]|B[ABDEFGHIJMNORSTVWZ]|A[DEFGILMNOQRSTUWXZ]|S[ABCEGHIJKLMNRTUVZ]|C[ACFHIKLMNORSVXYZ]|T[CDFGHJKMNOPRTVWZ]|P[AEFGHKLMNRSTWY]|N[ACEFGILOPRTUZ]|K[EGHIMNRWYZ]|L[ACIKSTUVY]|I[DELMNOST]|E[CEGHRST]|F[IJKMORX]|U[AGKMSYZ]|V[ACEGINU]|D[EJKMOZ]|H[KMNRTU]|R[EOSUW]|J[EMOP]|W[FS]|Y[ET]|Z[AM]|OM|QA),\sST=((M[ADEINOST]|N[CDEHJMVY]|A[KLRZ]|I[ADLN]|W[AIVY]|C[AOT]|O[HKR]|[GLP]A|K[SY]|S[CD]|T[NX]|V[AT]|[HR]I|DE|FL|UT))[A-Z]{2},\sL=[A-Z][a-z]{2,15}(\s[A-Z][a-z]{2,10})?,\sO=[A-Z][a-z]{2,25}\s[A-Z][a-z]{2,25}(\s[A-Z][a-z]{2,25})?(\s[A-Z][a-z]{2,25})?(\s(Inc|LLC)\.)?,\sCN=[a-z]{4,11}\.[a-z]{2,4}$	2	0	0	1
+13670	13670	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13671	13671	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+13672	13672	\x1c([a-z0-9]{28})[^\r\n]+(\x03(net|com)|\x02in)	2	0	0	1
+13673	13673	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13674	13674	^[a-zA-Z0-9/+]{171}=$	2	0	0	1
+13675	13675	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13676	13676	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13677	13677	^OSID=[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+13678	13678	\=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13679	13679	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13680	13680	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13681	13681	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13682	13682	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13683	13683	^[a-z0-9_]{6}[^a-z0-9_]	2	0	0	1
+13684	13684	^[a-z0-9]{5}\.com$	2	0	0	1
+13685	13685	^[a-z]{3,15}\x3a\x20	2	0	0	1
+13686	13686	^[a-zA-z]{5,10}_[A-F0-9]{12}$	2	0	0	1
+13687	13687	^[a-zA-z]{5,10}_[A-F0-9]{12}$	2	0	0	1
+13688	13688	^[^\"]+\x7c\x22\x2c\x22	2	0	0	1
+13689	13689	^[a-z0-9]{32}	2	0	0	1
+13690	13690	^[a-z0-9]{32}	2	0	0	1
+13691	13691	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13692	13692	^(curl|wget)_?(c(ve_20(1((7_1161|8_760)0|9_10758)|20_16846)|url_xxljobUnauth)|tp5)$	2	0	0	1
+13693	13693	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13694	13694	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13695	13695	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13696	13696	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+13697	13697	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13698	13698	^_?([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13699	13699	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13700	13700	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13701	13701	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13702	13702	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13703	13703	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13704	13704	^[a-f0-9]{5,12}&a=	2	0	0	1
+13705	13705	CN=([^\r\n]+?\.)?hotjar\.info(\.)	2	0	0	1
+13706	13706	^\/\?d=[a-f0-9]{16}$	2	0	0	1
+13707	13707	^[a-z]{1}	2	0	0	1
+13708	13708	^Date\x3a\x20[^\r\n]+[0-9]{2}::[0-9]{2}\x20	2	0	0	1
+13709	13709	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+13710	13710	^[A-P]{256}$	2	0	0	1
+13711	13711	^[a-f0-9]{32}\r\n\r\nPK	2	0	0	1
+13712	13712	^pk=[A-Za-z0-9]{8,50}&value=[a-f0-9]{50,500}$	2	0	0	1
+13713	13713	^[A-Z]{2}-[A-Z0-9]{10,20}-[A-Z0-9]{6,10}-[A-Z0-9]{2,8}-[A-Z0-9]{2,8}-[0-9]{2,5}$	2	0	0	1
+13714	13714	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$	2	0	0	1
+13715	13715	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$	2	0	0	1
+13716	13716	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$	2	0	0	1
+13717	13717	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+13718	13718	^\.(93joshua|purrple|black)$	2	0	0	1
+13719	13719	Content-Disposition\x3a\x20form-data\x3b\s*name=\x22(source|formdata|billinfo|cardinfo)\x22	2	0	0	1
+13720	13720	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+13721	13721	^[A-Za-z0-9_-]+$	2	0	0	1
+13722	13722	(\/((p(lugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|o(sts?\/[a-z0-9]+|ny[a-z]*)|rogcicicic|m\d{1,2})|s(ystem\/(logs|engine)\/[^\x2f]+?|e(rv(au|er)|ct)|vchost[^\x2f]*|gau\/.*?|alam|ucks|can|ke)|([a-z]*[0-9])([0-9]*[a-z])(setup\d+\.exe)[a-z0-9]{5,10}|in(voice(\/[^\x2f]+|[^\x2f]*)|st\d+|fos?)|a(d(min\/images\/\w+|obe)|salam|live|us)|m(edia\/files\/\w+|a(cros?|rch)|soffice)|d(o(c(\/[a-z0-9]+)?|ne)|bust)|(~.+?\/\.[^\x2f]+|\.css)\/.+?|c(onfig|hris|alc)|u(swinz\w+|pdate)|xml\/load\/[^\x2f]+|([Dd]ocumen|ve)t|Ozonecrytedserver|w(or[dk]|insys)|t(mp\/.+?|est)|fa(cture|soo)|n(otepad|ach)|k(be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\d+)\.exe|(([a-z0-9]*?[3456789][a-z0-9]*?[3456789])([a-z0-9]*?[h-z])[a-z0-9]{3,31}\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\d+|Msword)\.exe)|(^\/(image\/.+?\/[^\x2f]+|x\/setup)|[\x2f\s]order|keem)\.exe$)	2	0	0	1
+13723	13723	^CN=www\.[0-9a-z]{8,20}\.net$	2	0	0	1
+13724	13724	^[A-F0-9]+$	2	0	0	1
+13725	13725	\.[dghbcijklmnfqrwxyz23stuopaev4569]{26}\.[a-z0-9_-]{1,50}\.[a-z]{2,8}$	2	0	0	1
+13726	13726	^[a-zA-z]{8}\.	2	0	0	1
+13727	13727	^[a-zA-z]{8}\.	2	0	0	1
+13728	13728	[^\x18][^\x44\x32\x33\x25\x64\x22\x23\x3a\x27\x24\x26\x34\x3b\x12][\x20\x21\x28-\x2f\x70-\x77\x79-\x7f\x60-\x63\x65\x66\x67-\x6f\x50-\x5f\x40-\x42\x46-\x4f\x30\x31\x35\x36\x38\x3e\x39\x3b]{1,14}\x18	2	0	0	1
+13729	13729	^[A-F0-9]{32}	2	0	0	1
+13730	13730	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13731	13731	^tt[cf]$	2	0	0	1
+13732	13732	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13733	13733	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13734	13734	^([1-3]?)\/download\.php\?filename=ccom	2	0	0	1
+13735	13735	^[a-z]$	2	0	0	1
+13736	13736	\/([0-9]*?[a-z]*?[a-z0-9)([a-z0-9]*[0-9][a-z]*[0-9][a-z0-9]*\.exe)(setup\d+\.exe)[a-z0-9]{5,15}\.exe	2	0	0	1
+13737	13737	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+13738	13738	^User-Agent\x3a\x20(Mozilla\/|Shockwave)	2	0	0	1
+13739	13739	id\x3d[a-z0-9]{8}\x2d[a-z0-9]{4}\x2d[a-z0-9]{4}\x2d[a-z0-9]{4}\x2d[a-z0-9]{12}\x26key\x3d[a-z0-9]{512}	2	0	0	1
+13740	13740	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+13741	13741	^([a-f0-9]{32})=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13742	13742	^[a-z0-9]{32}	2	0	0	1
+13743	13743	^[\x20-\x7e]+?.{8}\x7d\x9f	2	0	0	1
+13744	13744	^[\x20-\x7e]+?.{8}\x7a\x9f	2	0	0	1
+13745	13745	^[\x20-\x7e]+?.{8}\x78\x9a	2	0	0	1
+13746	13746	^[\x20-\x7e]+?.{8}\x7f\x9f	2	0	0	1
+13747	13747	^[\x20-\x7e]+?.{8}\xc3\x70	2	0	0	1
+13748	13748	^[\x20-\x7e]+?.{8}\x7c\x9e	2	0	0	1
+13749	13749	^.{4}[\x20-\x7e]+?.{4}\x78\x9c	2	0	0	1
+13750	13750	^[\x20-\x7e]+?.{8}\x7c\x99	2	0	0	1
+13751	13751	^[\x20-\x7e]+?.{8}\x7f\x9b	2	0	0	1
+13752	13752	^[\x20-\x7e]+?.{8}\x31\xd9	2	0	0	1
+13753	13753	^[\x20-\x7e]+?.{8}\x70\x9b	2	0	0	1
+13754	13754	^[\x20-\x7e]+?.{8}\xda\x41	2	0	0	1
+13755	13755	^[\x20-\x7e]+?.{8}\x7a\x9a	2	0	0	1
+13756	13756	^[\x20-\x7e]+?.{8}\x3f\xa6	2	0	0	1
+13757	13757	^[\x20-\x7e]+?.{8}\x70\x9b	2	0	0	1
+13758	13758	^[\x20-\x7e]+?.{8}\x39\xdd	2	0	0	1
+13759	13759	^.{4}[\x20-\x7e]+?.{4}\x78\x9c	2	0	0	1
+13760	13760	^[\x20-\x7e]+?.{8}\x3b\xd8	2	0	0	1
+13761	13761	^[\x20-\x7e]+?.{8}\x79\x9b	2	0	0	1
+13762	13762	^[\x20-\x7e]+?.{8}\x7c\x9c	2	0	0	1
+13763	13763	^[\x20-\x7e]+?.{8}\x79\x95	2	0	0	1
+13764	13764	^[\x20-\x7e]+?.{8}\x71\x95	2	0	0	1
+13765	13765	^[\x20-\x7e]{5,}.{8}\x78\x9c	2	0	0	1
+13766	13766	^[\x20-\x7e]+?.{8}\x7b\x95	2	0	0	1
+13767	13767	^[\x20-\x7e]+?.{8}\x79\x9f	2	0	0	1
+13768	13768	^[A-Z]{14}$	2	0	0	1
+13769	13769	^.{4}[\x20-\x7e]+?.{4}\x71\x94	2	0	0	1
+13770	13770	^[\x20-\x7e]*?.{8}\x79\x9e	2	0	0	1
+13771	13771	^.{4}[\x20-\x7e]+?.{4}\x7c\x9c	2	0	0	1
+13772	13772	^[\x20-\x7e]+?.{8}\x7f\x9d	2	0	0	1
+13773	13773	^[\x20-\x7e]+?.{8}\x49\xa5	2	0	0	1
+13774	13774	^[\x20-\x7e]+?.{8}\x79\x94	2	0	0	1
+13775	13775	^.{8}[\x20-\x7e]+?.{5}\x7b\x9e	2	0	0	1
+13776	13776	^.{4}[\x20-\x7e]+?.{4}\x7d\x94	2	0	0	1
+13777	13777	^[\x20-\x7e]+?.{8}\x7d\x94	2	0	0	1
+13778	13778	^multipart/form-data\x3b\x20boundary=[a-f0-9]{60}$	2	0	0	1
+13779	13779	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+13780	13780	^[\x20-\x7e]+?.{8}\x7b\x98	2	0	0	1
+13781	13781	^[\x20-\x7e]+?.{8}\x31\xad	2	0	0	1
+13782	13782	^[\x20-\x7e]+?.{8}\x40\xa3	2	0	0	1
+13783	13783	^[\x20-\x7e]+?.{8}\x7d\x98	2	0	0	1
+13784	13784	^.{4}[\x20-\x7e]{5}.{4}\x7a\x9a	2	0	0	1
+13785	13785	^[\x20-\x7e]+?.{8}\x71\x9d	2	0	0	1
+13786	13786	^[\x20-\x7e]+?.{8}\x7a\x9b	2	0	0	1
+13787	13787	^.{8}\x70\x94[\x20-\x7e]	2	0	0	1
+13788	13788	^[\x20-\x7e]+?.{8}\x79\xda	2	0	0	1
+13789	13789	^[\x20-\x7e]+?.{8}\x30\xa5	2	0	0	1
+13790	13790	^[\x20-\x7e]+?.{8}\x70\x9a	2	0	0	1
+13791	13791	^[\x20-\x7e]+?.{8}\x79\x9b	2	0	0	1
+13792	13792	^[\x20-\x7e]+?.{8}\x31\xd9	2	0	0	1
+13793	13793	^[\x20-\x7e]+?.{8}\x79\x9c	2	0	0	1
+13794	13794	^[\x20-\x7e]+?.{8}\x7d\x99	2	0	0	1
+13795	13795	^[\x20-\x7e]+?.{8}\x7b\x9d	2	0	0	1
+13796	13796	^[\x20-\x7e]+?.{8}\x2e\x96	2	0	0	1
+13797	13797	^[\x20-\x7e]+?.{8}\x78\x9c	2	0	0	1
+13798	13798	^[\x20-\x7e]+?.{8}\x70\x98	2	0	0	1
+13799	13799	^[\x20-\x7e]+?.{8}\x4a\xae	2	0	0	1
+13800	13800	^[\x20-\x7e]+?.{8}\x71\x9e	2	0	0	1
+13801	13801	^.{8}[\x20-\x7e]+?[\x00]*?\x78\x9c	2	0	0	1
+13802	13802	^.{8}[\x20-\x7e]+?[\x00]*?\x78\x9c	2	0	0	1
+13803	13803	^.{8}[\x20-\x7e]+?\x79\x94	2	0	0	1
+13804	13804	^[\x20-\x7e]+?.{8}\x84\x60	2	0	0	1
+13805	13805	^[\x20-\x7e]+?.{8}\x40\xd8	2	0	0	1
+13806	13806	^[\x20-\x7e]+?.{8}\x7f\x94	2	0	0	1
+13807	13807	^[\x20-\x7e]+?.{8}\x79\x9c	2	0	0	1
+13808	13808	^[\x20-\x7e]+?.{8}\x7a\x9c	2	0	0	1
+13809	13809	^[\x20-\x7e]+?.{8}\x7e\x9c	2	0	0	1
+13810	13810	^[\x20-\x7e]+?.{8}\x39\x99	2	0	0	1
+13811	13811	^[\x20-\x7e]+?.{8}\x49\xa2	2	0	0	1
+13812	13812	^[\x20-\x7e]+?.{8}\x79\x9d	2	0	0	1
+13813	13813	^[\x20-\x7e]+?.{8}\x7b\x9f	2	0	0	1
+13814	13814	^[\x20-\x7e]+?.{8}\x79\x9a	2	0	0	1
+13815	13815	^[\x20-\x7e]+?.{8}\x70\x94	2	0	0	1
+13816	13816	^[\x20-\x7e]+?.{8}\x44\xdf	2	0	0	1
+13817	13817	^.{4}[\x20-\x7e]+?.{4}\x7b\x9e	2	0	0	1
+13818	13818	^[\x20-\x7e]+?.{8}\x7b\x9e	2	0	0	1
+13819	13819	^[\x20-\x7e]+?.{8}\x83\x7f	2	0	0	1
+13820	13820	^.{8}[\x20-\x7e]+?\x7c\x9f	2	0	0	1
+13821	13821	^[\x20-\x7e]+?.{8}\x7d\x9a	2	0	0	1
+13822	13822	^.{9,28}\x78\x9c	2	0	0	1
+13823	13823	^.{8}[\x20-\x7e]{5}\x78\x9c	2	0	0	1
+13824	13824	^[\x20-\x7e]+?.{8}\x4a\xd5	2	0	0	1
+13825	13825	^[\x20-\x7e]+?.{8}\x79\xdd	2	0	0	1
+13826	13826	^[\x20-\x7e]+?.{8}\x70\x9e	2	0	0	1
+13827	13827	^[\x20-\x7e]+?.{10}\x7a\x5d	2	0	0	1
+13828	13828	^.{8}[\x20-\x7e]+?.{5}\x7c\x9e	2	0	0	1
+13829	13829	^[\x20-\x7e]+?.{8}\x7d\x9e	2	0	0	1
+13830	13830	^[\x20-\x7e]+?.{8}\x70\x9c	2	0	0	1
+13831	13831	^[\x20-\x7e]+?.{8}\x3b\xdf	2	0	0	1
+13832	13832	^[\x20-\x7e]+?.{8}\x47\xd9	2	0	0	1
+13833	13833	^[\x20-\x7e]+?.{8}\x79\x99	2	0	0	1
+13834	13834	^.{8}[\x20-\x7e]+?.{2}\x78\x9c	2	0	0	1
+13835	13835	^.{4}[\x20-\x7e]{5}.{4}\x96\x71	2	0	0	1
+13836	13836	^[\x20-\x7e]+?.{8}\x7b\x9b	2	0	0	1
+13837	13837	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13838	13838	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13839	13839	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13840	13840	([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13841	13841	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13842	13842	^[a-f0-9]{32}	2	0	0	1
+13843	13843	>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}>	2	0	0	1
+13844	13844	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13845	13845	^[A-Za-z0-9_]{20}\/[a-f0-9]{40}$	2	0	0	1
+13846	13846	\/[a-z0-9]{1,31}\.bin$	2	0	0	1
+13847	13847	^[A-Za-z0-9\-_~]{75,}$	2	0	0	1
+13848	13848	(JmJ1aWxkP|YnVpbGQ9|ZidWlsZD)	2	0	0	1
+13849	13849	^[\x80|\x40]\x00[\x80|\x40]\x00\x00\x00	2	0	0	1
+13850	13850	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13851	13851	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13852	13852	^[A-Za-z0-9]{16,32}$	2	0	0	1
+13853	13853	^[a-zA-Z0-9_-]{171}$	2	0	0	1
+13854	13854	(Q(k(MIdh|UMcR)|0IPdR)|(DQg91|FRghw)F|(NCD3U|VGCHA)X|C(Qwh2E|RQxxF)|J(DCHYT|FDHEW)|R(UYIcB|kIJcR)|GQglxE|ZCCXEQ)	2	0	0	1
+13855	13855	(fCxTeXN0ZW0gSWRsZS|wsU3lzdGVtIElkbGUg|8LFN5c3RlbSBJZGxlI)	2	0	0	1
+13856	13856	(I(iwidmFsdWUiO|sInZhbHVlIjo)i|iLCJ2YWx1ZSI6I)	2	0	0	1
+13857	13857	^[0-9a-f]{64}$	2	0	0	1
+13858	13858	^[0-9a-f]{64}$	2	0	0	1
+13859	13859	^[\x01-\x4c]$	2	0	0	1
+13860	13860	CN=([^\r\n]+?\.)?OU=Delegated\ Licensor,KYP\ SDT\ LTD(\.)	2	0	0	1
+13861	13861	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13862	13862	^key=\w+\&data=	2	0	0	1
+13863	13863	^\d+$	2	0	0	1
+13864	13864	\.php\?zs=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&t=[0-9]{1,2}$	2	0	0	1
+13865	13865	^[0-9D]+$	2	0	0	1
+13866	13866	\.(dll|exe|zip|json)$	2	0	0	1
+13867	13867	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13868	13868	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13869	13869	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13870	13870	^\/[a-zA-Z0-9]{9,12}\/t\.html$	2	0	0	1
+13871	13871	^\/[a-z]{3,10}\.php\?[a-z]{3,10}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13872	13872	^[a-z]{256}$	2	0	0	1
+13873	13873	^[0-9]&(index|pi|serv)=	2	0	0	1
+13874	13874	^[0-9]&(index|pi|serv)=	2	0	0	1
+13875	13875	^[0-9]&(index|pi|serv)=	2	0	0	1
+13876	13876	^\/[a-zA-Z0-9+=]{29,44}.{0,8}=$	2	0	0	1
+13877	13877	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+13878	13878	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})([\r\n]([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?$	2	0	0	1
+13879	13879	^[A-Za-z0-9]{1,15}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+13880	13880	(IiwiM2ZlMTEiOi|IsIjNmZTExIjoi|iLCIzZmUxMSI6I)	2	0	0	1
+13881	13881	(IiwiYXU1byI6I|IsImF1NW8iOi|iLCJhdTVvIjoi)	2	0	0	1
+13882	13882	(ifQ==|In0=|J9)$	2	0	0	1
+13883	13883	^[a-z]{256}-\.jpg$	2	0	0	1
+13884	13884	^[IJKL].*(PT0iLC|09Iiwi|9PSIsI)[a-zA-Z0-9+\/]+(PT0iLC|09Iiwi|9PSIsI)	2	0	0	1
+13885	13885	^[a-f0-9]{5,12}&a=	2	0	0	1
+13886	13886	^[a-zA-Z0-9]{12}\.onion	2	0	0	1
+13887	13887	^\x7b(\x22[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.[a-z]{2,10}\x22,){4}\x22[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.[a-z]{2,10}\x22\x7d$	2	0	0	1
+13888	13888	^[a-z]{256}\.gif$	2	0	0	1
+13889	13889	(JTBEJTBBJTBEJTBBJTREJTY1JTZEJTZGJTcyJTc5JTNBJTIw|UwRCUwQSUwRCUwQSU0RCU2NSU2RCU2RiU3MiU3OSUzQSUyM|lMEQlMEElMEQlMEElNEQlNjUlNkQlNkYlNzIlNzklM0ElMj)	2	0	0	1
+13890	13890	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d+)?$	2	0	0	1
+13891	13891	^\/[a-zA-Z0-9]{9,12}\/x\.html$	2	0	0	1
+13892	13892	^[0-9]+$	2	0	0	1
+13893	13893	^([A-Za-z0-9%+\/]{4,6})*([A-Za-z0-9%+\/]{2}==|[A-Za-z0-9%+\/]{3}=|[A-Za-z0-9%+\/]{4})$	2	0	0	1
+13894	13894	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13895	13895	^[\x01-\x04]	2	0	0	1
+13896	13896	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13897	13897	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13898	13898	[a-z]{8}.(:?psd|dib)	2	0	0	1
+13899	13899	[a-z]{8}.(:?dib|psd)	2	0	0	1
+13900	13900	https:\/\/[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}.[a-z]{3,12}.com\/[a-z]{3,4}\/[a-z0-9]{6}_[a-z0-9]{32}	2	0	0	1
+13901	13901	^[a-z0-9]{6}_[a-z0-9]{32}	2	0	0	1
+13902	13902	\.php\?[a-z]{3}=(baby|child|adult)	2	0	0	1
+13903	13903	^[a-f0-9=]{5,12}&ap=	2	0	0	1
+13904	13904	^[0-9]{8}$	2	0	0	1
+13905	13905	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13906	13906	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13907	13907	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13908	13908	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13909	13909	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13910	13910	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13911	13911	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13912	13912	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13913	13913	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13914	13914	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13915	13915	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$	2	0	0	1
+13916	13916	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$	2	0	0	1
+13917	13917	^(update|designs)$	2	0	0	1
+13918	13918	^\d$	2	0	0	1
+13919	13919	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a80$	2	0	0	1
+13920	13920	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13921	13921	\*\*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\*\*	2	0	0	1
+13922	13922	^\/wp\x2dcontent\/[a-z]{3}\/[0-9]{16}\.exe$	2	0	0	1
+13923	13923	^[A-Za-z0-9-_]{176}$	2	0	0	1
+13924	13924	^\/\.x\/irq\d$	2	0	0	1
+13925	13925	^\/\.x\/\dsh$	2	0	0	1
+13926	13926	^(?<len>.{2})\xc0\xff(=len)\x00\x00.{2}\x00\x00\x01\x78\x9c	2	0	0	1
+13927	13927	\x24url[0-9]{1}\s=\s'(http|https):\/\/[^']*\x27\x3b	2	0	0	1
+13928	13928	^\/[A-Za-z0-9]{10,11}\/	2	0	0	1
+13929	13929	\.php\?serial=[a-z0-9]{16}	2	0	0	1
+13930	13930	^[0-3]{2}_[0-2]{2}\.php$	2	0	0	1
+13931	13931	^dBrowser\x20\d\x20CallGetResponse\x3a\d$	2	0	0	1
+13932	13932	^\/\w$	2	0	0	1
+13933	13933	^\/wrte\?maid=[A-Z0-9]{8}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{12}$	2	0	0	1
+13934	13934	^\/[a-z0-9]{1,3}\/service\?uuid=[A-Z0-9]{8}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{12}$	2	0	0	1
+13935	13935	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n][\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n][\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+13936	13936	^\/wp-includes\/[A-Za-z0-9]{10}\/$	2	0	0	1
+13937	13937	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+13938	13938	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+13939	13939	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+13940	13940	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+13941	13941	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+13942	13942	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+13943	13943	^[A-Za-z0-9]{16,32}$	2	0	0	1
+13944	13944	^[A-Za-z0-9]{16,32}$	2	0	0	1
+13945	13945	^\d+$	2	0	0	1
+13946	13946	^\/[A-Za-z0-9]{30}\.php$	2	0	0	1
+13947	13947	^[a-f0-9]{5}([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})[a-f0-9]{2}-v[a-f0-9]{2}\x0a\x22\x3e\x0a\x3c	2	0	0	1
+13948	13948	^([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})$	2	0	0	1
+13949	13949	^[a-zA-Z0-9+\/]+([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})$	2	0	0	1
+13950	13950	^[a-zA-Z0-9+\/]+([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})$	2	0	0	1
+13951	13951	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13952	13952	^[a-z0-9]{8}\r\n	2	0	0	1
+13953	13953	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+13954	13954	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13955	13955	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13956	13956	^[0-9]{6,10}\.	2	0	0	1
+13957	13957	^\/[a-zA-z]{14}\/	2	0	0	1
+13958	13958	^\/[a-zA-z]{14}\/	2	0	0	1
+13959	13959	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13960	13960	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13961	13961	^[A-Z]{16}$	2	0	0	1
+13962	13962	^\/\x3fusername\x3d[a-z0-9]{2,3}_\d$	2	0	0	1
+13963	13963	^[A-Z]{16}$	2	0	0	1
+13964	13964	^[A-Z]{16}$	2	0	0	1
+13965	13965	^([A-F0-9]\x00){12}	2	0	0	1
+13966	13966	^([A-F0-9]\x00){12}	2	0	0	1
+13967	13967	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13968	13968	^[A-F0-9]{12}	2	0	0	1
+13969	13969	^([A-F0-9]\x00){12}	2	0	0	1
+13970	13970	^[A-F0-9]{12}	2	0	0	1
+13971	13971	^(<letter>[a-z])(=letter)\,	2	0	0	1
+13972	13972	O=(GoDaddy)[A-Z][a-z]+\s[A-Z][a-z]+\s(NL|Pty|Inc|Corp|Ltd)\.?,.+CN=[a-z]{5,}\.[a-z]{2,3}($|,)	2	0	0	1
+13973	13973	[eE]mail(Address)admin@	2	0	0	1
+13974	13974	^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email)	2	0	0	1
+13975	13975	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+13976	13976	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+13977	13977	^[A-F0-9]{12}	2	0	0	1
+13978	13978	^\d	2	0	0	1
+13979	13979	^\x2F[a-z]{1}\x2Ehtm$	2	0	0	1
+13980	13980	\/index.dat\?\d{5,9}$	2	0	0	1
+13981	13981	^\/[A-Za-z]{2,}\/\?[a-z]\sHTTP\/1\.[0-1]\r\nUser-Agent\x3a Mozilla\/4\.0 \x28compatible\x3b MSIE 7\.0\x3b Windows NT 5\.1\x3b SV1\x29\r\nHost\x3a\x20[^\r\n]+?(\x3a(443|8080|900[0-9]))?\r\n(Connection\x3a\x20Keep-Alive\r\n)?\r\n$	2	0	0	1
+13982	13982	^Host\x3a\x20([a-z0-9]{0,19}[A-Z])([A-Z0-9]{0,19}[a-z])[a-zA-Z0-9]{4,20}\.[a-z]{2,3}/H	2	0	0	1
+13983	13983	^[a-zA-Z0-9\+\/]+={0,2}$/P	2	0	0	1
+13984	13984	filename=[a-f0-9]{32}v\.(docm|zip)\x0d\x0a/Hmi	2	0	0	1
+13985	13985	^((\x00\x00\x00).)*?_\x00((\x00\x00).)*?_\x00((\x00\x00).)*?_\x00((\x00\x00).)*?\x2e\x00t\x00x\x00t	2	0	0	1
+13986	13986	^[a-z]\x29	2	0	0	1
+13987	13987	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title	2	0	0	1
+13988	13988	^.{2}([a-z]{0,15}\d)(<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x0a.{2}(=var)	2	0	0	1
+13989	13989	^\/[a-z]$	2	0	0	1
+13990	13990	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+13991	13991	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13992	13992	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13993	13993	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13994	13994	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13995	13995	^.{2}(<fake_loc>([asdfgh]+|[qwerty]+|[zxcvbn]+|[23werf]+)[01]).+?\x06\x03\x55\x04\x07.{2}(=fake_loc)	2	0	0	1
+13996	13996	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+13997	13997	^[a-z0-9/=\+]$	2	0	0	1
+13998	13998	^[a-z0-9/=\+]$	2	0	0	1
+13999	13999	^\/d\/[a-z]+\d+\.jpg$	2	0	0	1
+14000	14000	\/p?2p\/[0-9]{1,2}\.exe$	2	0	0	1
+14001	14001	^\/2p\/[a-z]{1,2}\.exe$	2	0	0	1
+14002	14002	\/[a-z0-9]{3,}\.gz$	2	0	0	1
+14003	14003	\/mss\d+\.exe$	2	0	0	1
+14004	14004	^\/download\/ftp\/(grabftp|grabftp64)\.bin$	2	0	0	1
+14005	14005	^\/image\/(data|flags)\/[^\x2f]+\.exe$	2	0	0	1
+14006	14006	(\x20MSIE\x20|rv\x3a11)	2	0	0	1
+14007	14007	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+14008	14008	^\/[a-z]{3,6}\/[a-z]{3,6}\.[a-z]{3}$	2	0	0	1
+14009	14009	^[A-Z]{2}-[0-9]{1,5}\x3aBegin$	2	0	0	1
+14010	14010	^[A-Z]{2}-[0-9]{1,5}\x3aStartU$	2	0	0	1
+14011	14011	^\/command\/[A-Fa-f0-9]{8}\-([A-Fa-f0-9]{4}\-){3}[A-Fa-f0-9]{12}\.cmd$	2	0	0	1
+14012	14012	^<CHECK>([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/CHECK>	2	0	0	1
+14013	14013	^\{\x22uid\x22\x3a\x22[a-f0-9]+\x22\}$	2	0	0	1
+14014	14014	^[A-Za-z0-9_-]{171}$	2	0	0	1
+14015	14015	^\/[a-f0-9]{8}\/\D+\d{8,10}\.html$	2	0	0	1
+14016	14016	^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}\/){1,10})\sHTTP\/1\.1\r\nReferer\x3a\x20http:\/\/(\d{1,3}\.){3}\d{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+14017	14017	^\x2f\x00{3}[A-Z0-9]{6}_[a-f0-9]+\x00{16}$	2	0	0	1
+14018	14018	[A-Za-z0-9]{62}	2	0	0	1
+14019	14019	^(php)?Yuok\\\d\d	2	0	0	1
+14020	14020	Data\\\d\d	2	0	0	1
+14021	14021	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+14022	14022	^\/\?id\=[A-Z]{12,28}[0-9]$	2	0	0	1
+14023	14023	^\/\?id\=[A-Z]{12,28}[0-9]$	2	0	0	1
+14024	14024	\/\?p=p52dcW[A-Za-z]{4}	2	0	0	1
+14025	14025	^.{2}(<var>[a-zA-Z0-9]{24}[01]).+?\x06\x03\x55\x04\x07.{2}(=var)	2	0	0	1
+14026	14026	^(<var>[a-zA-Z0-9]{1,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+14027	14027	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+14028	14028	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+14029	14029	^.(<orgname>.[^01]+).*?\x55\x04\x0b.(=orgname)	2	0	0	1
+14030	14030	[^\x15][^\x49\x3f\x3e\x28\x69\x2f\x2e\x37\x2a\x29\x2b\x39\x36][\x20-\x27\x2c\x2d\x30\x31\x33-\x36\x38\x3b-\x3d\x40-\x47\x4a-\x4d\x4f\x50-\x5f\x60\x68\x6b-\x6f\x70-\x74\x76-\x7f]{1,14}\x15	2	0	0	1
+14031	14031	^[0-9]-[0-9]-[0-9]{5}-[0-9]\r\n	2	0	0	1
+14032	14032	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+14033	14033	^[A-Za-z0-9\/_\-\+]{171}=$	2	0	0	1
+14034	14034	[a-zA-Z0-9]{8}\/	2	0	0	1
+14035	14035	^[a-z]\.(tech|online)$	2	0	0	1
+14036	14036	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+14037	14037	^[a-zA-Z0-9-_]{171}$	2	0	0	1
+14038	14038	[a-z0-9]{8}\/.*\?[a-z0-9]{3,10}=[a-z0-9]{8,11}$	2	0	0	1
+14039	14039	updateb\.php\?p=\d	2	0	0	1
+14040	14040	&os=[0-9a-z]{40}	2	0	0	1
+14041	14041	&(<vname>[a-z]+)1=[A-F0-9]+&(=vname)2=[A-F0-9]+&(=vname)3=[A-F0-9]+&(=vname)4=[A-F0-9]	2	0	0	1
+14042	14042	^[1-z]{13}=[0-9]{16}$	2	0	0	1
+14043	14043	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+14044	14044	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+14045	14045	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+14046	14046	^\/[A-F0-9]{33}$	2	0	0	1
+14047	14047	^\d+?\x00	2	0	0	1
+14048	14048	%(USERPROFILE|APPDATA)%	2	0	0	1
+14049	14049	%(USERPROFILE|APPDATA)%	2	0	0	1
+14050	14050	%(USERPROFILE|APPDATA)%	2	0	0	1
+14051	14051	%(USERPROFILE|APPDATA)%	2	0	0	1
+14052	14052	^[0-9]{10}$	2	0	0	1
+14053	14053	^key=[A-F0-9]{32}$	2	0	0	1
+14054	14054	^[a-f0-9]{60}\x0d\x0a	2	0	0	1
+14055	14055	^(pro)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+14056	14056	[0-9]{1,2}	2	0	0	1
+14057	14057	\d{1,2}	2	0	0	1
+14058	14058	[0-9]{1,2}	2	0	0	1
+14059	14059	[0-9]{1,2}	2	0	0	1
+14060	14060	[0-9]{1,2}	2	0	0	1
+14061	14061	[0-9]{1,2}	2	0	0	1
+14062	14062	CN=([^\r\n]+?\.)?supportmicrohere\.com(\.)	2	0	0	1
+14063	14063	CN=([^\r\n]+?\.)?jbdelmarket\.com(\.)	2	0	0	1
+14064	14064	[0-9]{1,3}	2	0	0	1
+14065	14065	[0-9]{1,3}	2	0	0	1
+14066	14066	^ETag\x3a\x20[0-9]{6}-[0-9]{3,5}-[0-9]{8}\r\n	2	0	0	1
+14067	14067	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+14068	14068	[a-f0-9]{60}$	2	0	0	1
+14069	14069	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+14070	14070	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+14071	14071	^[a-z0-9]{33}	2	0	0	1
+14072	14072	^[qbedm]{1}[a-zA-Z]{1,3}646[a-zA-Z0-9]{1,3}\.	2	0	0	1
+14073	14073	^[zjr9x]{1}[tmdhpz]{1}[0-9a-z]{1,6}266([a-zA-Z0-9]{1,6})?\.	2	0	0	1
+14074	14074	^5\.[0-2]\x20\d\d\x3a\d\d\x20	2	0	0	1
+14075	14075	^\d{1,5}\x00ll	2	0	0	1
+14076	14076	^LIST-[A-Za-z0-9]{16}\.	2	0	0	1
+14077	14077	^LS-[A-Za-z0-9]{16}\.	2	0	0	1
+14078	14078	^SIZE-[A-Za-z0-9]{16}\.	2	0	0	1
+14079	14079	^LD-[A-Za-z0-9]{16}\.	2	0	0	1
+14080	14080	^CB-[A-Za-z0-9]{16}\.	2	0	0	1
+14081	14081	^CD-[A-Za-z0-9]{16}\.	2	0	0	1
+14082	14082	^EX-[A-Za-z0-9]{16}\.	2	0	0	1
+14083	14083	^ALIVE-[A-Za-z0-9]{16}\.	2	0	0	1
+14084	14084	^EXIT-[A-Za-z0-9]{16}\.	2	0	0	1
+14085	14085	^finito-[A-Za-z0-9]{16}\.	2	0	0	1
+14086	14086	^.{4}(R(k(Z(GQkBG|CQEY)|BCRUVG)|0FFRkFH|UJDQUE)|Q(U(V(CQ0FB|GQUc)|NCRkI)|kFDQkZC|EJFRUY)|(Z(AQkVF|GRkJA)R|JBQ0JGQ)g|FFQkNBQQ|dBRUZBRw)	2	0	0	1
+14087	14087	\/([0-9]{2,8}\.)?[0-9]{4,16}\.dat$	2	0	0	1
+14088	14088	\/([0-9]{2,8}\.)?[0-9]{4,16}\.dat$	2	0	0	1
+14089	14089	^(send|receive)	2	0	0	1
+14090	14090	^(send|receive)	2	0	0	1
+14091	14091	^(send|receive)	2	0	0	1
+14092	14092	^(send|receive)	2	0	0	1
+14093	14093	^[0-9a-zA-Z]{32}	2	0	0	1
+14094	14094	^\/\.x\/var\/run\/tty\d$	2	0	0	1
+14095	14095	^\/var\/(run|tmp)\/pty$	2	0	0	1
+14096	14096	^\/[a-z0-9]{45,60}\/[a-z0-9]{35,65}\/[a-z0-9]{38,60}\.php\?data=active$	2	0	0	1
+14097	14097	^\/\?m=[abcde]&p1=[a-f0-9-]{8,40}(&p2=[^&]+)?(&p3=[^&]+)?$	2	0	0	1
+14098	14098	^sg\x3a\x20[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}[\r\n]+$	2	0	0	1
+14099	14099	\/\?m=[a-z]&p1=[a-z0-9]{8,12}(&p2=[^&]+)?(&p3=[^&]+)?$	2	0	0	1
+14100	14100	^[A-Za-z0-9+=/]{172}$	2	0	0	1
+14101	14101	^(FileManager|PortScan|ExecuteCommand|DatabaseManager)	2	0	0	1
+14102	14102	^[A-Za-z]{15,20}$	2	0	0	1
+14103	14103	^PHPSESSID=[a-z0-9]{26}$	2	0	0	1
+14104	14104	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+14105	14105	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+14106	14106	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+14107	14107	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+14108	14108	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+14109	14109	^[\da-z]{11}	2	0	0	1
+14110	14110	^[A-Z]{2}	2	0	0	1
+14111	14111	^[A-Z]{2}	2	0	0	1
+14112	14112	^\/admin[0-9]?\/client\.php$	2	0	0	1
+14113	14113	^\/[a-z0-9]{16}\/	2	0	0	1
+14114	14114	^(\d{1,3}\.){3}\d{1,3}\|\|	2	0	0	1
+14115	14115	^\/[a-zA-Z0-9]{1,25}\-[a-f0-9]{8}$	2	0	0	1
+14116	14116	^[a-f0-9]{32}	2	0	0	1
+14117	14117	^[A-Z]{2}[A-F0-9]{16}	2	0	0	1
+14118	14118	^Referer\x3a\x20[a-zA-Z0-9_\-.]+\x28[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]\x29\w+\x0d\x0a	2	0	0	1
+14119	14119	^[A-Z0-9]{18}$	2	0	0	1
+14120	14120	^[A-Za-z0-9+/=]{730,}	2	0	0	1
+14121	14121	^[a-f0-9]{32}	2	0	0	1
+14122	14122	^[a-f0-9]{32}	2	0	0	1
+14123	14123	\/([a-zA-Z0-9+/\x20]{4})*([a-zA-Z0-9+/\x20]{2}==|[a-zA-Z0-9+/\x20]{5}=|[a-zA-Z0-9+/\x20]{4})([a-zA-Z=]{4}?)$	2	0	0	1
+14124	14124	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+14125	14125	^\/([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})([a-zA-Z=]{4})?(\x20?)$	2	0	0	1
+14126	14126	^\/([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})([a-zA-Z=]{4})?(\x20?)$	2	0	0	1
+14127	14127	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+14128	14128	(([a-zA-Z0-9]\0){10,})	2	0	0	1
+14129	14129	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+14130	14130	^\/([a-zA-Z0-9]{280,408})$	2	0	0	1
+14131	14131	^\/([a-zA-Z0-9=]{60,408})$	2	0	0	1
+14132	14132	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+14133	14133	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+14134	14134	(TWljcm9zb2Z0IENvcnBvcmF0aW9uL|1pY3Jvc29mdCBDb3Jwb3JhdGlvbi|NaWNyb3NvZnQgQ29ycG9yYXRpb24u)[a-zA-Z0-9\x2f\x2b]{25,35}(Cg0KQzpc|oNCkM6XD|KDQpDOlw\x2b)	2	0	0	1
+14135	14135	^[0-9]{3}$	2	0	0	1
+14136	14136	(www\.((b(an(co(dobrasil|hsbc)|espa)|radesco(prime)?|b)|hsbc(pr(ivatebank|emier)|ba(merindus|nk))?|s(antander(banespa|net)?|erasa(experian)?)|uolhost)\.com\.br|c((aixa((economica(federal)?|qui)\.gov|\.(com|gov))|onsultasintegradas\.rs\.gov|ef\.(com|gov))\.br|redicard\.com(\.br)?)|itau(p(ersonnalite|rivatebank)|uniclass)?\.com\.br,|ame(ricanexpress\.com(\.br)?|x\.com\.br))|((b(an(co(dobrasil|hsbc)|risul)|radesco(prime)?|b)|hsbc(pr(ivatebank|emier)|ba(merindus|nk))?|s(erasa(experian)?|antander)|uolhost)\.com|c(aixa((economica(federal)?|qui)\.gov|\.(com|gov))|onsultasintegradas\.rs\.gov|ef\.(com|gov)|redicard\.com))\.br|itau((p(ersonnalite|rivatebank)|uniclass)\.com\.br|\.com\.br,)|ame(ricanexpress.com(\.br)?|x\.com\.br)|\*(linhadefensiva*|hsbc*))	2	0	0	1
+14137	14137	^\/(GetProDownConfig|downservers|ShopIp)\.aspx\?ShopId=[0-9]+$	2	0	0	1
+14138	14138	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+14139	14139	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+14140	14140	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+14141	14141	^\x5b[A-Z]{2}\x5d\x20[A-Z0-9]{32}\x20\x5b[0-9]{2}\x2d[0-9]{2}\x2d[0-9]{4}\x20[0-9]{2}\x2d[0-9]{2}\x2d[0-9]{2}\x5d\x5bsplit\x5d	2	0	0	1
+14142	14142	Subject\x3a[0-9]{1,2}\x2f[0-9]{1,2}\x2f[0-9]{4}\x20[0-9]{1,2}\x3a[0-9]{1,2}\x3a[0-9]{2}\x20[AP]	2	0	0	1
+14143	14143	^\d{3,6}$	2	0	0	1
+14144	14144	^.{2}([A-Z]{0,32}[^A-Z01])(<var>[^01]{4,33}[01]).+?\x06\x03\x55\x04\x08.{2}(=var)	2	0	0	1
+14145	14145	^\/[A-Za-z0-9]{16}\/[A-Za-z0-9]{16}\.php$	2	0	0	1
+14146	14146	^\/[A-Za-z0-9]{16}\/[A-Za-z0-9]{48}\.mp3$	2	0	0	1
+14147	14147	[A-Za-z0-9]{16}\x0d\x0a/Content|2d|Disposition|3a	2	0	0	1
+14148	14148	^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}	2	0	0	1
+14149	14149	^[A-Za-z0-9=/+]{100}	2	0	0	1
+14150	14150	^[A-Za-z0-9=/+]{100}	2	0	0	1
+14151	14151	CN=([^\r\n]+?\.)?edou\.me(\.)	2	0	0	1
+14152	14152	^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}\}	2	0	0	1
+14153	14153	^###\d+###[a-zA-Z0-9\-\.]{2,63}###\x00+$	2	0	0	1
+14154	14154	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+14155	14155	^([A-Za-z0-9]{4})*([A-Za-z0-9]{2}==|[A-Za-z0-9]{3}=|[A-Za-z0-9]{4})$	2	0	0	1
+14156	14156	^[A-Za-z0-9=+/\x22\x00]{100,1000}$	2	0	0	1
+14157	14157	^([A-F0-9]\x00){12}	2	0	0	1
+14158	14158	^[A-Za-z0-9]{262}$	2	0	0	1
+14159	14159	^[a-f0-9]{32}	2	0	0	1
+14160	14160	^(\x3a\d{1,5})?$	2	0	0	1
+14161	14161	^[A-Za-z0-9-_]{171}$	2	0	0	1
+14162	14162	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+14163	14163	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+14164	14164	\|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\|	2	0	0	1
+14165	14165	^(([a-z0-9])()){33,}\.ru$	2	0	0	1
+14166	14166	^\x12\x0b\x01\x00\x00\x01[\x00]{6}.[a-f0-9]{6,}(([\x01|\x02|\x03]\d{1,3}){4}|\x03::1)\x00\x00\x01	2	0	0	1
+14167	14167	^(0\x3d\w\x261\x3d\d{3}\x262\x3d\d{3})$	2	0	0	1
+14168	14168	^\d{6}	2	0	0	1
+14169	14169	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+14170	14170	^.(<servercert>[\x00-\xff][\x20-\x7f]{1,50})\x30.+?\x55\x04\x03.(=servercert)\x30	2	0	0	1
+14171	14171	[a-f0-9]{24}\.[a-f0-9]{16}	2	0	0	1
+14172	14172	^[a-z]{4}\x3d	2	0	0	1
+14173	14173	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+14174	14174	^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}	2	0	0	1
+14175	14175	^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}	2	0	0	1
+14176	14176	^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}	2	0	0	1
+14177	14177	^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}	2	0	0	1
+14178	14178	^[a-f0-9]{32}\x7c\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x7c	2	0	0	1
+14179	14179	^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+14180	14180	^(ct_start|chr_start|moz_start|grb_start|upl_start)	2	0	0	1
+14181	14181	^(sqlite|mozglue|nss3|freebl3|softokn3)	2	0	0	1
+14182	14182	\{[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}\}	2	0	0	1
+14183	14183	\.jpg\?id=\d+$	2	0	0	1
+14184	14184	^[a-f0-9]{8}-([a-f0-9]{4}-){3}[a-f0-9]{12}	2	0	0	1
+14185	14185	^([A-Za-z0-9\x2b\x2f\x3d]){15,25}$	2	0	0	1
+14186	14186	^([A-Za-z0-9\x2b\x2f\x3d]){10,30}$	2	0	0	1
+14187	14187	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+14188	14188	^\/[a-zA-Z0-9]{32}$	2	0	0	1
+14189	14189	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+14190	14190	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+14191	14191	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+14192	14192	^[A-F0-9]{8}\-[A-F0-9]{4}\-[A-F0-9]{4}\-[A-F0-9]{4}\-[A-F0-9]{12}$	2	0	0	1
+14193	14193	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14194	14194	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14195	14195	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14196	14196	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14197	14197	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14198	14198	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14199	14199	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14200	14200	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14201	14201	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14202	14202	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14203	14203	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14204	14204	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14205	14205	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14206	14206	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14207	14207	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14208	14208	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14209	14209	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14210	14210	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)	2	0	0	1
+14211	14211	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14212	14212	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14213	14213	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14214	14214	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14215	14215	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14216	14216	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14217	14217	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14218	14218	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14219	14219	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14220	14220	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14221	14221	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)	2	0	0	1
+14222	14222	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14223	14223	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14224	14224	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14225	14225	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14226	14226	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14227	14227	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)	2	0	0	1
+14228	14228	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14229	14229	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14230	14230	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14231	14231	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14232	14232	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14233	14233	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14234	14234	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14235	14235	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14236	14236	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14237	14237	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14238	14238	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14239	14239	^(\x00\x00\x00)?([\x40-\x42]|[\x45-\x47]|\x26\x66)/P	2	0	0	1
+14240	14240	^([\x4b-\x4c]|[\x48-\x49]|[\x4e-\x4f]|\x2f\xfb)	2	0	0	1
+14241	14241	^\d{4}\/\w{2,8}_\w{8}\.bmp	2	0	0	1
+14242	14242	\.(bmp|png|jpe?g)$	2	0	0	1
+14243	14243	\.(bmp|png|jpe?g)$	2	0	0	1
+14244	14244	\.(bmp|png|jpe?g)$	2	0	0	1
+14245	14245	\.(bmp|png|jpe?g)$	2	0	0	1
+14246	14246	\.(bmp|png|jpe?g)$	2	0	0	1
+14247	14247	\/\d{6,8}\/\w{2,5}_\w{8}\.bmp$	2	0	0	1
+14248	14248	^[0-9]{15,16}\x7d$	2	0	0	1
+14249	14249	^[a-z0-9]{19}	2	0	0	1
+14250	14250	^[a-f0-9]{32}\.gif\"	2	0	0	1
+14251	14251	^[A-Za-z0-9]{3,20}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+14252	14252	^[a-f0-9]{32}	2	0	0	1
+14253	14253	^\d{14}\.jpg\x22/P	2	0	0	1
+14254	14254	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+14255	14255	^((([a-f0-9]){2}){16})	2	0	0	1
+14256	14256	^[A-Z0-9]{12}$	2	0	0	1
+14257	14257	^[A-Z0-9]{10}\x22	2	0	0	1
+14258	14258	^images[a-f0-9]{8}\.	2	0	0	1
+14259	14259	^[a-f0-9]{12}	2	0	0	1
+14260	14260	^[A-F0-9]{32}	2	0	0	1
+14261	14261	^([A-Za-z0-9~\+\/]{4})*([A-Za-z0-9~\+\/]{2}==|[A-Za-z0-9~\+\/]{3}=|[A-Za-z0-9~\+\/]{4})$	2	0	0	1
+14262	14262	^\d+\.\d+\.\d{3,5}	2	0	0	1
+14263	14263	^([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\x7c	2	0	0	1
+14264	14264	^([0-9A-F]{2}(-)?){16}\x7c	2	0	0	1
+14265	14265	^http|3a 2f 2f|[a-z]{5,10}.(com|org|net)\/$	2	0	0	1
+14266	14266	^[a-f0-9]{8}\-[a-f0-9]{8}\x22\x0d\x0a	2	0	0	1
+14267	14267	^AUTHINFO\s+USER\s[^\n]{200}	2	0	0	1
+14268	14268	^SEARCH\s+[^\n]{1024}	2	0	0	1
+14269	14269	--backup-dir\s+\x2e\x2e\x2f	2	0	0	1
+14270	14270	^200\s[^\n]{64}	2	0	0	1
+14271	14271	^Location\x3a[^\n]{128}	2	0	0	1
+14272	14272	^newgroup\x3a[^\n]{21}	2	0	0	1
+14273	14273	^XAT\s+[^\n]{1024}	2	0	0	1
+14274	14274	^sendsys\x3a[^\n]{21}	2	0	0	1
+14275	14275	^checkgroups\x3a[^\n]{21}	2	0	0	1
+14276	14276	^ihave\x3a[^\n]{21}	2	0	0	1
+14277	14277	^rmgroup\x3a[^\n]{21}	2	0	0	1
+14278	14278	^sendme\x3a[^\n]{21}	2	0	0	1
+14279	14279	^senduuname\x3a[^\n]{21}	2	0	0	1
+14280	14280	^version\x3a[^\n]{21}	2	0	0	1
+14281	14281	Enter User Name\x3a(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*\s*(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*f(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*a(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*c(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*t(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*o(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*r(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*y(\xff[\xf0-\xff](\xff|[\x00-\x22]))*\x00*\x7f*\x08*[\r\n]	2	0	0	1
+14282	14282	\x2FHiShowServlet\x2Fservlet.+(InstalNum|UserActivation)	2	0	0	1
+14283	14283	Host\x3A[^\n\r]*jiao.com/Hi	2	0	0	1
+14284	14284	imei=\d{2}-?\d{6}-?\d{6,}-?\d{1,}	2	0	0	1
+14285	14285	^\s*?\(\s*?(<var>[^\x3d\x3b\)\s]+)\s*\s*?0\s*?\x3b\s*?(=var)\s*?\<\s*?(0x)?\d{4,}\s*?\x3b\s*?(=var)\+\+\s*?\)\s*?\x7b\s*?(<var2>[^\x3d\x3b\)\s]+)\s*\s*?(=var2)\s*?\+\s*?[\x22\x27]\d+[\x22\x27]	2	0	0	1
+14286	14286	^\s*?\(\s*?(<var>[^\x3d\x3b\)\s]+)\s*\s*?0\s*?\x3b\s*?(=var)\s*?\<\s*?(0x)?\d{4,}\s*?\x3b\s*?(=var)\+\+\s*?\)\s*?\x7b\s*?(<var2>[^\x3d\x3b\)\s]+)\s*\s*?(=var2)\s*?\+\s*?[\x22\x27]\d+[\x22\x27]	2	0	0	1
+14287	14287	\/kt\/JpNx9n$	2	0	0	1
+14288	14288	^\d{15}\r\n$	2	0	0	1
+14289	14289	^[a-f0-9]	2	0	0	1
+14290	14290	^[a-f0-9]	2	0	0	1
+14291	14291	^(update|startcharge)	2	0	0	1
+14292	14292	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+14293	14293	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+14294	14294	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+14295	14295	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+14296	14296	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+14297	14297	^((sear|wat)ch|results|close|find|open)\/\?[a-zA-Z]{2,8}=	2	0	0	1
+14298	14298	^bot_id=[a-f0-9]{32}&	2	0	0	1
+14299	14299	\/RequestActionsToExecute$	2	0	0	1
+14300	14300	\/n\/\d{15}$	2	0	0	1
+14301	14301	\/ad-(strat|devi)\/$	2	0	0	1
+14302	14302	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+14303	14303	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+14304	14304	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+14305	14305	^[a-f0-9]{30,35}&app_package_name=	2	0	0	1
+14306	14306	^\/flash\/api\.php\?id=\d	2	0	0	1
+14307	14307	^Host\x3a[^\r\n]+?dmp\.[^\r\n]+?\r?$	2	0	0	1
+14308	14308	^\/gac\/[a-f0-9]{15}$	2	0	0	1
+14309	14309	&game=[a-f0-9]{40}$	2	0	0	1
+14310	14310	&id=\d{15}$	2	0	0	1
+14311	14311	^Host\x3a\x20[a-z0-9.]+\.bb800\.com	2	0	0	1
+14312	14312	^Host\x3a\x20[a-z0-9.]+\.bb800\.com	2	0	0	1
+14313	14313	\/NotifyLog$	2	0	0	1
+14314	14314	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+14315	14315	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+14316	14316	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+14317	14317	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+14318	14318	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+14319	14319	^d(id|ei)=[A-F0-9]{10,100}&method=IS[A-Z]{1,10}$	2	0	0	1
+14320	14320	&data=(([A-Za-z0-9]|%2[FB]){4})*(([A-Za-z0-9]|%2[FB]){2}==|([A-Za-z0-9]|%2[FB]){3}=|([A-Za-z0-9]|%2[FB]){4})$	2	0	0	1
+14321	14321	^Host\x3a[^\n\r]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}[\r\n]+$	2	0	0	1
+14322	14322	\.php\?id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&type=	2	0	0	1
+14323	14323	\?id=([a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})$	2	0	0	1
+14324	14324	\/\?(text|from|a(gs|q)|oe|btnG|oprnd|utm|channel)=	2	0	0	1
+14325	14325	Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r)	2	0	0	1
+14326	14326	(^|&|\x22|\{\x22)id(=|\x22\x3a\x22)([a-f0-9]{32}|[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})(&|\x22|$)	2	0	0	1
+14327	14327	^\{\x22(os|type)\x22\x3a	2	0	0	1
+14328	14328	^[a-z]{15}\.(com|ru|cn|su)$/W	2	0	0	1
+14329	14329	^[a-z]{15}\.(com|ru|cn|su)$/W	2	0	0	1
+14330	14330	^[a-z]{15}\.(com|ru|cn|su)$/W	2	0	0	1
+14331	14331	\.php\?m=[abcdefgh]&p1=[a-f0-9]{16}&p2=[^\r\n]+$	2	0	0	1
+14332	14332	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+14333	14333	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+14334	14334	\.php\?m=[abcdefgh]&p1=[a-f0-9]{16}$	2	0	0	1
+14335	14335	^[a-z]{15}\.(ru|su|cn)$	2	0	0	1
+14336	14336	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+14337	14337	^([0-9]{15})$	2	0	0	1
+14338	14338	(\x00\\\x00.*?){2}\x00{2}\xFF{2}.{128,}[\x04-\xFF][\x00-\xFF]{3}\x00{4}$	2	0	0	1
+14339	14339	(\x00\\\x00.*?){2}\x00{2}\xFF{2}.{128,}[\x04-\xFF][\x00-\xFF]{3}\x00{4}$	2	0	0	1
+14340	14340	^.{4}	2	0	0	1
+14341	14341	^.{4}	2	0	0	1
+14342	14342	^.{4}	2	0	0	1
+14343	14343	^.{27}	2	0	0	1
+14344	14344	^.{27}	2	0	0	1
+14345	14345	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14346	14346	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14347	14347	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14348	14348	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14349	14349	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14350	14350	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14351	14351	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14352	14352	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14353	14353	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14354	14354	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14355	14355	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14356	14356	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14357	14357	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14358	14358	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14359	14359	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14360	14360	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14361	14361	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14362	14362	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14363	14363	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14364	14364	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14365	14365	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14366	14366	^.{27}	2	0	0	1
+14367	14367	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14368	14368	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14369	14369	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14370	14370	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14371	14371	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14372	14372	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14373	14373	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14374	14374	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14375	14375	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14376	14376	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14377	14377	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14378	14378	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14379	14379	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14380	14380	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14381	14381	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14382	14382	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14383	14383	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14384	14384	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14385	14385	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14386	14386	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14387	14387	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14388	14388	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14389	14389	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14390	14390	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14391	14391	^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14392	14392	^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14393	14393	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14394	14394	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14395	14395	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14396	14396	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14397	14397	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14398	14398	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14399	14399	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14400	14400	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14401	14401	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14402	14402	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+14403	14403	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14404	14404	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14405	14405	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+14406	14406	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14407	14407	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14408	14408	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14409	14409	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14410	14410	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14411	14411	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14412	14412	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14413	14413	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14414	14414	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14415	14415	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14416	14416	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14417	14417	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14418	14418	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14419	14419	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14420	14420	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14421	14421	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14422	14422	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14423	14423	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14424	14424	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14425	14425	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14426	14426	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14427	14427	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14428	14428	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14429	14429	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14430	14430	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14431	14431	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14432	14432	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14433	14433	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14434	14434	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14435	14435	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14436	14436	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14437	14437	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14438	14438	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14439	14439	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14440	14440	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14441	14441	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14442	14442	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14443	14443	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14444	14444	^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14445	14445	^(\x75|\x2d|\x2f|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14446	14446	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14447	14447	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14448	14448	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14449	14449	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14450	14450	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14451	14451	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14452	14452	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14453	14453	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14454	14454	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14455	14455	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14456	14456	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+14457	14457	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14458	14458	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14459	14459	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+14460	14460	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14461	14461	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14462	14462	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14463	14463	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14464	14464	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14465	14465	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14466	14466	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14467	14467	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14468	14468	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14469	14469	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14470	14470	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14471	14471	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14472	14472	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14473	14473	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14474	14474	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14475	14475	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14476	14476	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14477	14477	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14478	14478	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14479	14479	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14480	14480	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14481	14481	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14482	14482	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14483	14483	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14484	14484	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14485	14485	^.{4}	2	0	0	1
+14486	14486	^.{4}	2	0	0	1
+14487	14487	^.{4}	2	0	0	1
+14488	14488	^.{4}	2	0	0	1
+14489	14489	^.{4}	2	0	0	1
+14490	14490	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+14491	14491	^.{4}	2	0	0	1
+14492	14492	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+14493	14493	^.{4}	2	0	0	1
+14494	14494	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+14495	14495	^.{4}	2	0	0	1
+14496	14496	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+14497	14497	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14498	14498	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14499	14499	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14500	14500	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14501	14501	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14502	14502	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14503	14503	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14504	14504	^(\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14505	14505	^.{4}	2	0	0	1
+14506	14506	^.{4}	2	0	0	1
+14507	14507	^.{4}	2	0	0	1
+14508	14508	^.{4}	2	0	0	1
+14509	14509	^.{4}	2	0	0	1
+14510	14510	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+14511	14511	^.{4}	2	0	0	1
+14512	14512	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+14513	14513	^\x00.{3}\xFFSMB(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f).{28}(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f)	2	0	0	1
+14514	14514	^.{4}	2	0	0	1
+14515	14515	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+14516	14516	^(\x75|\x2d|\x2f|\x73|\x2e|\x24|\x74)	2	0	0	1
+14517	14517	^\x00.{3}\xFFSMB(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f).{28}(\x73|\x74|\x75|\xa2|\x24|\x2d|\x2e|\x2f)	2	0	0	1
+14518	14518	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+14519	14519	^PRIVMSG\s+[^\s]+\s+\x3a\s*\x01SENDLINK\x7c[^\x7c]{69}	2	0	0	1
+14520	14520	^\s*?\d+?\s*?\)https\x3a\x2f	2	0	0	1
+14521	14521	\/tslyphper([A-Za-z0-9+/-_]{4})*([A-Za-z0-9+/-_]{2}==|[A-Za-z0-9+/-_]{3}=|[A-Za-z0-9+/-_]{4})\.html$	2	0	0	1
+14522	14522	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x22|\x27	2	0	0	1
+14523	14523	\.php$	2	0	0	1
+14524	14524	\.php$	2	0	0	1
+14525	14525	\.php$	2	0	0	1
+14526	14526	\.php\?usernms=[^@]+@[^\r\n]+$	2	0	0	1
+14527	14527	^\s*\.\s*location\s*\.\s*href\s*=\s*redirect_url	2	0	0	1
+14528	14528	^[a-z0-9_]{50,}	2	0	0	1
+14529	14529	^(www(1\.masterconsultas\.com\.ar|\.linkedin\.com)|(tools\.google|facebook)\.com|cfspart\.impots\.gouv\.fr)	2	0	0	1
+14530	14530	^\s*?\d+?\s*?\)https\/\/[^/]+\.edu\/	2	0	0	1
+14531	14531	^\s*?\d+?\s*?\)(https://(w(ww(\.((bankofamerica|paypal|ups|wellsfargo)\.com|a(dobecloud\.com|mazon\.co\.jp)|tax\.service\.gov\.uk|cibc\.mobi)|1\.royalbank\.com)|ebmail\.(i(llinois|ndstate)\.ed|optusnet\.com\.a)u)|(s(i(tekey\.bankofamerica|gnin\.ebay)|ecure(\.bankofamerica|05c\.chase))|login\.((microsoftonlin|liv)e|verizonwireless|alibaba)|my\.screenname\.aol)\.com|((ex(change\.(louisvill|purdu)|mail\.oregonstat)e|owa\.uaa\.alaska)\.ed|ib\.nab\.com\.a)u|voscomptesenligne\.labanquepostale\.fr|auth\.centurylink\.net)|/logon/logon/chaseOnline|#www\.kucoin\.com)	2	0	0	1
+14532	14532	^[^/]+(xfinity|comcast)\.(com|net)	2	0	0	1
+14533	14533	^\s*\.\s*style\s*\.\s*visibility\s*=\s*[\x22\x27]visible[\x22\x27]	2	0	0	1
+14534	14534	^["']?post	2	0	0	1
+14535	14535	^((\.php).+)\.php\x22	2	0	0	1
+14536	14536	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+14537	14537	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+14538	14538	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+14539	14539	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+14540	14540	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+14541	14541	^[^\x22]+<\s*?script\s*?.+data\x3atext/html\x3bbase64,	2	0	0	1
+14542	14542	=[A-Za-z0-9._+-]+%40[A-Za-z0-9.-]+\.[A-Za-z]{2,6}&data	2	0	0	1
+14543	14543	[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}$	2	0	0	1
+14544	14544	\/usaa\.com(\.|-)(sec(ure)?|inet|ent)(\.|-)	2	0	0	1
+14545	14545	^\s*?\d+?\s*?\)https?\x3a\x2f	2	0	0	1
+14546	14546	^(l(o(ading|gin)|imited)|(proccess|card)ing|b(illing|ank)|success)\.php	2	0	0	1
+14547	14547	\x3b[a-f0-9]{32}	2	0	0	1
+14548	14548	Content\-Length\x3a\x20\d{3}\x0d\x0a	2	0	0	1
+14549	14549	\.asp$	2	0	0	1
+14550	14550	\/[a-f0-9]{32}\/\?\d$	2	0	0	1
+14551	14551	\/[a-f0-9]{32}\/\?\d$	2	0	0	1
+14552	14552	\s*(<var>[^)]+)\s*\).+window\s*\.\s*location\s*=\s*\(\s*(=var)	2	0	0	1
+14553	14553	\/webapps\/[a-f0-9]{5}\/websrc	2	0	0	1
+14554	14554	\.asp$	2	0	0	1
+14555	14555	(\/mpp\/[0-9a-f]{32}\/|\/[0-9a-f]{32}\/mpp\/)	2	0	0	1
+14556	14556	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}$	2	0	0	1
+14557	14557	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}$	2	0	0	1
+14558	14558	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+14559	14559	^[a-z]*?[0-9]{3,9}\.[a-z]{2,4}	2	0	0	1
+14560	14560	^[a-f0-9]{32}\??\x0d\x0a	2	0	0	1
+14561	14561	^data=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+14562	14562	\/submit$	2	0	0	1
+14563	14563	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+14564	14564	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+14565	14565	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+14566	14566	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+14567	14567	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+14568	14568	(udo\.photo|ulcraft\.com|biennale\.info|topstyle\.me|urest\.org|ukit\.me)$	2	0	0	1
+14569	14569	(udo\.photo|ulcraft\.com|biennale\.info|topstyle\.me|urest\.org|ukit\.me)$	2	0	0	1
+14570	14570	^\s*?\(\s*[^,]+,\s*?[^,]+,\s*?(128|256|512)\s*?\)	2	0	0	1
+14571	14571	^\d{5,20}\x22/Q	2	0	0	1
+14572	14572	^[^\x22|\x27]+<\s*?script((<\s*?\/\s*?script).)+?data\x3atext\/html\x3b(charset=UTF-8\x3b)?base64\x2c	2	0	0	1
+14573	14573	^[a-z]+\-[a-z]+\-[a-z0-9]{8,11}\.glitch\.me$	2	0	0	1
+14574	14574	^[a-z]*?[0-9]{3,9}[a-z]*?\.[a-z]{2,4}	2	0	0	1
+14575	14575	^[a-z]*?[0-9]{3,9}[a-z]*?\.[a-z]{2,4}$	2	0	0	1
+14576	14576	^\s*?\(\s*?unescape\s*?\(	2	0	0	1
+14577	14577	^[a-z0-9]{15}\.	2	0	0	1
+14578	14578	^\s*?\(\s*[^,]+,\s*?[^,]+,\s*?(128|256|512)\s*?\)	2	0	0	1
+14579	14579	^ui=[^&]+&pw=	2	0	0	1
+14580	14580	^id=[^&%]+%40[^&]+&pass=	2	0	0	1
+14581	14581	^\s*(\./|\.\./)*(s(e(curity(-check|cvv)|rver|condpage)|uccess)|l(o(ad(ing|er)|g(off))|iamg)|d(e(livery|tails)|one|hl)|i(d(entity)?|ndex2|i)|p(ro(cess(ing)?|file)|hone|ass|in|ayment)|w(e(iter|bsc)|ait)|t(hanky[o0]u|racking)|v(alidate|erify?|bv)|L(oginVerification|L1|2|ogin2)|f(orward|irst|in(al|ish))|b(illing2?|ank)|e(rror|xcel|nd)|questions|1loader|account|recova|confirm|outlook|update(bill|card)?|good|SS|verification|qes|upgrade2?|activation|check(ing)?|ex|indexx|warning|re(name|try))\.	2	0	0	1
+14582	14582	^id=[^&]+&ps=	2	0	0	1
+14583	14583	\.(ga|gq|cf|ml|gdn|tk|icu)$	2	0	0	1
+14584	14584	^mail=[^\x25]+\x2540[^&]+&pass=[^&]+$	2	0	0	1
+14585	14585	^a=[^\x25]+\x2540[^&]+&b=[^&]+	2	0	0	1
+14586	14586	^email=[^\x25]+\x2540[^&]+&epass=[^&]+	2	0	0	1
+14587	14587	^(s)?\x3a\/\/[^\/]*((a(m(ericanexpress|azon)|(dob|ppl)e|libaba|ol)|r(e(gions|max)|bcroyalbank)|f(irst-online|acebook|edex)|m(icrosoft(online)?|atch)|u(s(bank|aa|ps)|ps)|(technologyordi|googl)e|na(twest|ver)|d(ropbox|hl)|yahoo(mail)?|1(26|63)|keybank|qq)\.com|i(n(t(ertekgroup\.org|uit\.com)|vestorjunkie\.com|g\.nl)|c(icibank\.com|scards\.nl)|mpots\.gouv\.fr|rs\.gov)|c((h(ristianmingl|as)e|apitalone(360)?|ibcfcib|panel)\.com|om(mbank\.com\.au|cast\.net)|redit-agricole\.fr)|b(a(nkofamerica\.com|rclays\.co\.uk)|(igpond|t)\.com|luewin\.ch)|o((utlook|ffice)\.com|range\.(co\.uk|fr)|nline\.hmrc\.gov\.uk)|s(((aatchiar|untrus)t|c)\.com|ecure\.lcl\.fr|parkasse\.de)|h(a(lifax(-online)?\.co\.uk|waiiantel\.net)|otmail\.com)|p((rimelocation|aypal)\.com|ostbank\.de)|l(i(nkedin|ve)\.com|abanquepostale\.fr)|we(llsfargo\.com|stpac\.co\.nz)|etisalat\.ae)\/?	2	0	0	1
+14588	14588	^ud=[^&]*&pd=[^&]*	2	0	0	1
+14589	14589	^uname=[^&]+&psw=	2	0	0	1
+14590	14590	=[a-f0-9]{32}&session=[a-f0-9]{40}$	2	0	0	1
+14591	14591	^password=[^&]*&submit=Next$	2	0	0	1
+14592	14592	\?rid=[a-f0-9]{64}$	2	0	0	1
+14593	14593	\?rid=[a-f0-9]{64}\x0d\x0a	2	0	0	1
+14594	14594	\x0d\x0aReferer\x3a\x20[^\r\n]+[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,6}\r\n	2	0	0	1
+14595	14595	\/\?email=[a-zA-Z0-9+&*-]+(\.[a-zA-Z0-9_+&*-]+)*@([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}\x0d\x0a	2	0	0	1
+14596	14596	^Editbox1=[^%]+(@|%40)[^&]+&	2	0	0	1
+14597	14597	^EM=[^%]+(@|%40)[^&]+&	2	0	0	1
+14598	14598	^e=[^%]+(@|%40)[^&]+&	2	0	0	1
+14599	14599	\.(tk|gq|ga|xyz|ml|cf)$	2	0	0	1
+14600	14600	^userid=[^&]*&passid=[^&]*&Token=$	2	0	0	1
+14601	14601	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14602	14602	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14603	14603	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14604	14604	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14605	14605	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14606	14606	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14607	14607	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14608	14608	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14609	14609	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14610	14610	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14611	14611	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14612	14612	^[^\r\n]+(s(e(rvic|cur)e|c(otia|ure)|antander|ign\-?in|napchat)|c(h(eck(out)?|a(in|se))|ustomer|onfirm|loud)|p(ay(pa[il]|ment)|(hon|ost)e|rivacy)|i(n(terac|sta)|cloud|phone|tunes)|re(solution|covery|fund|port|dir)|a(pp(id|le)|ccount|mazon)|n(otification|etflix|terac)|l(o(cked|gin)|imited)|(etransf|twitt|ord)er|d(ocusign|ropbox)|f(acebook|orgot)|veri(tas|f)|upd(ate|t)|yahoo|bofa|hmrc)	2	0	0	1
+14613	14613	^(s)?\x3a\/\/[^\/]*(ebay\.co\.uk|singtel\.com|blockchain\.com)\/?	2	0	0	1
+14614	14614	^(s)?\x3a\/\/[^\/]*(s(ocietegenerale\.com|parkasse\.at|ina\.com\.cn|wisscom\.ch|ec\.gov)|b(bva(compass\.com|\.com\.co)|anque-accord\.fr|mo\.com)|g(o((ogle\.co|v)\.uk|daddy\.com)|mail\.com)|(z(illow|oosk)|images\.kw|office365)\.com|t(el(stra\.com\.au|ekom\.com)|-online\.de)|c(reditmutuel\.fr|panel\.net|iti\.com)|((realestate|nab)\.com\.a|unc\.ed)u|d(esjardins\.c(om|a)|iscover\.com)|e(arthlink\.net|ftel\.com\.au|bay\.de)|a(bl\.com\.pk|liyun\.com|nz\.co\.nz)|w(estpac\.com\.au|ikimedia\.org)|v(isaeurope\.ch|erizon\.net)|h(blibank\.com\.pk|sbc\.com)|paypal\.co\.uk)\/?	2	0	0	1
+14615	14615	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14616	14616	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14617	14617	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14618	14618	^POST\x20(?<var>[^\x20]+).+Referer\x3a\x20[^\r\n]+(=var)[\r\n]+	2	0	0	1
+14619	14619	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14620	14620	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14621	14621	^s?\x3a\/\/[^\/]*(goo(gle(\.(c(om\.[en]g|a)|r[ou])|apps\.com)|\.gl)|c(iovaccocapital\.com|entrin\.net\.id|artasi\.it)|s((antander\.com\.b|fr\.f)r|tandardbank\.co\.za)|(aliexpress|vanguard|tdbank|ibm)\.com|e(xperienceasb\.co\.nz|im\.ae)|n((avy)?fcu\.org|wolb\.com)|unicredit\.it|mbna\.co\.uk|oney\.fr|zkb\.ch)\/?	2	0	0	1
+14622	14622	^[a-z]{36,38}\-dot\-[a-z]+\-[a-z]+\-\d{6}\.[a-z]{2}\.[a-z]\.appspot\.com$	2	0	0	1
+14623	14623	^[a-f0-9]{32}(\/index\.php)?\x0d\x0a	2	0	0	1
+14624	14624	^[^\r\n]+\.edu	2	0	0	1
+14625	14625	^(s)?\x3a\/\/[^\/]*((t(dcanadatrust|escobank|radekey)|r(ealtyexecutive|bcd)s|x(finity|oom)|ourtime)\.com|a(s(perasoft\.com|b\.co\.nz)|(ccesbankplc|nz)\.com|mazon\.co\.uk|ruba\.it)|m((icrosoftstore|organstanley|sn)\.com|a(de-in-china\.com|il\.ru))|s((eniorpeoplemeet|cotiabank)\.com|antander\.co\.uk|uddenlink\.net)|c(o((ldwellbankerpreviews|x)\.com|mpresso\.co\.th)|fapubs\.org)|w(e(althmanagement\.com|bmail\.sfr\.fr)|ww-01\.ibm\.com)|l((endingtree|loydsbank)\.com|abanquepostale\.mobi)|v((aluewalk|ideotron)\.com|erifyemailaddress\.org)|n(a(tionwide\.co\.uk|vyfederal\.org)|etsuite\.com)|b(a(nquepopulaire\.fr|9hus\.in)|iztree\.com)|i(nternetbanking\.caixa\.gov\.br|cloud\.com)|d(iscoverbank\.com|hl\.co\.uk)|k(iwibank\.co\.nz|eybank\.com)|fidelitybank\.ng|paypal\.fr|ebay\.it)\/?	2	0	0	1
+14626	14626	^(d((ocu|uco)sign|ropbox)|o(ffice365|nedrive)|adobe|gdoc)	2	0	0	1
+14627	14627	^(d((ocu|uco)sign|ropbox)|o(ffice365|nedrive)|adobe|gdoc)	2	0	0	1
+14628	14628	<title>\s*(log\s*in|sign\s*in)	2	0	0	1
+14629	14629	<title>\s*(s(e(nd money, pay online or set up a merchant|cure) account|uspicious (transaction |activities))|con(firm card security information|to limitato)|(profile updat|mot de pass)e|login)\s*-\s*paypal\s*<\/title>	2	0	0	1
+14630	14630	^\/v0\/b\/(send|hit|few|lik|mtn|eli|rfda)\d.*\.appspot\.com\/	2	0	0	1
+14631	14631	^em=[^&]*&ps=[^&]*$	2	0	0	1
+14632	14632	https\/\/[^/]+\.edu	2	0	0	1
+14633	14633	^[a-z0-9]{24,28}\.php\?client_id=	2	0	0	1
+14634	14634	\.php\?template=[^\r\n]+&valid=[^\r\n]+&session=[a-f0-9]{32,}$	2	0	0	1
+14635	14635	^uname=[^&]*&pass	2	0	0	1
+14636	14636	^emid=[^&]*&epass	2	0	0	1
+14637	14637	(verify|support|account|copyright|help|verified|service|badge|verification|safety)?.{0,30}tiktok(verify|support|account|copyright|help|verified|service|badge|verification|safety)?.{0,30}(\.ml|\.ga|\.cf|\.gq|\.tk|\.xyz$)	2	0	0	1
+14638	14638	^[a-f0-9]{42}\.js\x27\x29\.then\x28(.{1,1000}themes\/js\/[a-f0-9]{42}\.js\x27\x29\.then\x28){5,}	2	0	0	1
+14639	14639	\w{1,255}\/\w{1,255}'\]\s*==\s*"\w{1,255}\"	2	0	0	1
+14640	14640	^[a-f0-9]{42}\.css\x27\x29\.then\x28(.{1,1000}themes\/css\/[a-f0-9]{42}\.css\x27\x29\.then\x28){5,}	2	0	0	1
+14641	14641	[\w\d]{8}\.	2	0	0	1
+14642	14642	[\w\d]{8}	2	0	0	1
+14643	14643	\.(jpe?g|png|svg)$	2	0	0	1
+14644	14644	\.(css|ttf|woff2?|js)$	2	0	0	1
+14645	14645	^[a-f0-9]{8}-([a-f0-9]{4}-){3}a-f0-9]{12}	2	0	0	1
+14646	14646	[a-z0-9]{32}	2	0	0	1
+14647	14647	^\s*?\.\s*?Ctr\s*?\.\s*?decrypt	2	0	0	1
+14648	14648	^\s*?\.\s*?Ctr\s*?\.\s*?decrypt	2	0	0	1
+14649	14649	\.php\?e=[a-zA-Z0-9+&*-]+(\.[a-zA-Z0-9_+&*-]+)*@([a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$	2	0	0	1
+14650	14650	^1=[^%]+(@|%40)[^&]+&	2	0	0	1
+14651	14651	^username=[^%]+(@|%40)[^&]+&	2	0	0	1
+14652	14652	^POST[^\r\n]+(<hash>[a-f0-9]{32})\/([^\r\n]+\r\n)+Referer\x3a\x20http(s)\/\/[^\r\n]+(=hash)	2	0	0	1
+14653	14653	\.php	2	0	0	1
+14654	14654	^([^0-9][a-zA-Z0-9_]{1,254}),\s*([^0-9][a-zA-Z0-9_$]{1,254}),\s*256\)\x3b	2	0	0	1
+14655	14655	\/nrp=[a-f0-9]{32}$	2	0	0	1
+14656	14656	\/nrp=[a-f0-9]{32}$	2	0	0	1
+14657	14657	nrp=[a-f0-9]{32}	2	0	0	1
+14658	14658	(outlook|helpdesk|help desk)	2	0	0	1
+14659	14659	Set-Cookie\x3a\x20[a-z0-9]{4}=\x22\x22\x3b	2	0	0	1
+14660	14660	^/?username=[a-zA-Z0-9.-]+@[a-zA-Z0-9.]+.[a-zA-Z]{2,3}$	2	0	0	1
+14661	14661	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x22\x7d$	2	0	0	1
+14662	14662	[a-f0-9]{8}.	2	0	0	1
+14663	14663	[a-f0-9]{8}.	2	0	0	1
+14664	14664	[a-f0-9]{8}.	2	0	0	1
+14665	14665	[a-f0-9]{8}.	2	0	0	1
+14666	14666	[a-f0-9]{8}.	2	0	0	1
+14667	14667	[a-f0-9]{8}.	2	0	0	1
+14668	14668	[a-f0-9]{8}.	2	0	0	1
+14669	14669	[a-f0-9]{8}.	2	0	0	1
+14670	14670	[a-f0-9]{8}.	2	0	0	1
+14671	14671	[a-f0-9]{8}.	2	0	0	1
+14672	14672	[a-f0-9]{8}.	2	0	0	1
+14673	14673	&a_failed=[01]$	2	0	0	1
+14674	14674	&a_failed=[01]$	2	0	0	1
+14675	14675	^[0-9]{3,4}	2	0	0	1
+14676	14676	^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}-[a-f0-9]{8}\.	2	0	0	1
+14677	14677	^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}-[a-f0-9]{8}\.	2	0	0	1
+14678	14678	^[a-f0-9]{8}(-[a-f0-9]{4}){3}-[a-f0-9]{12}-[a-f0-9]{8}\.	2	0	0	1
+14679	14679	^(php|html)$	2	0	0	1
+14680	14680	^(php|html)$	2	0	0	1
+14681	14681	 (6011|5[1-5]\d{2}|4\d{3}|3\d{3}) \d{4} \d{4} \d{4}	2	0	0	1
+14682	14682	 (6011|5[1-5]\d{2}|4\d{3}|3\d{3})-\d{4}-\d{4}-\d{4}	2	0	0	1
+14683	14683	 (6011|5[1-5]\d{2}|4\d{3}|3\d{3})\d{12} 	2	0	0	1
+14684	14684	 (3[4|7]\d{2}|2014|2149|2131|1800)\d{11} 	2	0	0	1
+14685	14685	 (3[4|7]\d{2}|2014|2149|2131|1800) \d{4} \d{4} \d{3} 	2	0	0	1
+14686	14686	 (3[4|7]\d{2}|2014|2149|2131|1800)-\d{4}-\d{4}-\d{3} 	2	0	0	1
+14687	14687	 (30[0-5]\d|36\d{2}|38\d{2})\d{10} 	2	0	0	1
+14688	14688	 (30[0-5]\d|36\d{2}|38\d{2}) \d{4} \d{4} \d{2} 	2	0	0	1
+14689	14689	 (30[0-5]\d|36\d{2}|38\d{2})-\d{4}-\d{4}-\d{2} 	2	0	0	1
+14690	14690	 (3[4|7]\d{2}|2014|2149|2131|1800) \d{6} \d{5} 	2	0	0	1
+14691	14691	 (3[4|7]\d{2}|2014|2149|2131|1800)-\d{6}-\d{5} 	2	0	0	1
+14692	14692	filename=\s*[^\n]+\.exe	2	0	0	1
+14693	14693	 \d\d-\d{7} 	2	0	0	1
+14694	14694	 ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])-\d{2}-\d{4} 	2	0	0	1
+14695	14695	 ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2]) \d{2} \d{4} 	2	0	0	1
+14696	14696	SSN ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])\d{6} 	2	0	0	1
+14697	14697	SSN# ([0-6]\d\d|7[0-256]\d|73[0-3]|77[0-2])\d{6} 	2	0	0	1
+14698	14698	User-Agent\x3a[^\n]+McAfee AutoUpdate	2	0	0	1
+14699	14699	User-Agent\x3a[^\n]+Winamp/Hi	2	0	0	1
+14700	14700	(gif|car(d|tao)|jpe?g)\.exe$	2	0	0	1
+14701	14701	\.exe$	2	0	0	1
+14702	14702	User-Agent\x3a[^\n]+Windows-Update-Agent	2	0	0	1
+14703	14703	((\?|&))password=(&)	2	0	0	1
+14704	14704	((\?|&))passwd=(&)	2	0	0	1
+14705	14705	((\?|&))pass=(&)	2	0	0	1
+14706	14706	((\?|&))pwd=(&)	2	0	0	1
+14707	14707	((\?|&))pw=(&)	2	0	0	1
+14708	14708	((\?|&))passphrase=(&)	2	0	0	1
+14709	14709	((\?|&))pword=(&)	2	0	0	1
+14710	14710	\x3C\x3C[^>]*\x2FJavaScript	2	0	0	1
+14711	14711	Location\: (http\:\/\/)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/	2	0	0	1
+14712	14712	\.png$	2	0	0	1
+14713	14713	\.jpeg$	2	0	0	1
+14714	14714	\.bmp$	2	0	0	1
+14715	14715	^User-Agent\:[^\n]+Java\/\d\.\d/Hmi	2	0	0	1
+14716	14716	^Content-Type\x3a\s*([av])(video\/x\-ms\-(w[vm]x|asf)|a(udio\/x\-ms\-w(m[av]|ax)|pplication\/x\-ms\-wm[zd]))/Hi	2	0	0	1
+14717	14717	\.exe\b	2	0	0	1
+14718	14718	^(ANONYMOUS|PASSDSS-3DES-1)\r\n	2	0	0	1
+14719	14719	((\x0d|\x05)Admin(istrator)?|\x04root|\x06USERID)	2	0	0	1
+14720	14720	^[^/s]*(eth_(g(et(B(lock(TransactionCountBy(Number|Hash)|By(Number|Hash))|alance)|Transaction(By(Block(Number|Hash)AndIndex|Hash)|(Receip|Coun)t)|Uncle(ByBlock(Number|Hash)AndIndex|CountByBlock(Number|Hash))|(Filter(Change|Log)|Log)s|Co(mpilers|de)|StorageAt|Work)|asPrice)|((new(PendingTransaction|Block)?|uninstall)Filt|blockNumb)er|s((end(Raw)?Transactio|ig)n|ubmit(Hashrate|Work)|yncing)|c(o(mpile(S(olidity|erpent)|LLL)|inbase)|all)|(estimateGa|account)s|protocolVersion|hashrate|mining)|shh_(new(Identity|Filter|Group)|get(FilterChan|Messa)ges|uninstallFilter|hasIdentity|addToGroup|version|post)|db_(get(String|Hex)|put(String|Hex))|net_(listening|peerCount|version)|web3_(clientVersion|sha3))	2	0	0	1
+14721	14721	\x3C\x3C[^>]*\x2FEmbeddedFile	2	0	0	1
+14722	14722	&|#|\+|!	2	0	0	1
+14723	14723	[0-9a-f]{40}[^0-9a-f]/P	2	0	0	1
+14724	14724	^.\x04[^\x08\x10\x14\x20\x30\x40]	2	0	0	1
+14725	14725	^[\x80-\xff]	2	0	0	1
+14726	14726	^[67]\.[01235]	2	0	0	1
+14727	14727	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+14728	14728	^\d\d?\.\d	2	0	0	1
+14729	14729	OS 4_2_[0-9] like	2	0	0	1
+14730	14730	\/\?v=\d	2	0	0	1
+14731	14731	^\d+\.\d	2	0	0	1
+14732	14732	((command(statu)?|bookmark|shortcut)s|h(omepage|istory)|eula(status)?|installation|activate|dumplog)	2	0	0	1
+14733	14733	^(\x3a\d{1,5})?$	2	0	0	1
+14734	14734	^(\x3a\d{1,5})?$	2	0	0	1
+14735	14735	filename\x3d[\x27\x22][a-z0-9]{1,3}\x2Eexe	2	0	0	1
+14736	14736	select[^\r\n]+from	2	0	0	1
+14737	14737	\x26Phone(Number\x3D|\x5FNumber\x3D|\x2DNumber\x3D)	2	0	0	1
+14738	14738	^(\x3a\d{1,5})?$	2	0	0	1
+14739	14739	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]\x7d	2	0	0	1
+14740	14740	User-Agent|3a|[^\n]+Windows-Update-Agent/Hsmi	2	0	0	1
+14741	14741	\x0d\x0aContent-Length\x3a \d{0,6}\x0d\x0a	2	0	0	1
+14742	14742	^(sh|lu|to)	2	0	0	1
+14743	14743	^(\x3a\d{1,5})?$	2	0	0	1
+14744	14744	[0-9a-f]{40}[^0-9a-f]	2	0	0	1
+14745	14745	^[^\r\n]+showip\.[a-z]+(\x3a\d{1,5})?$	2	0	0	1
+14746	14746	^(\x3a\d{1,5})?$	2	0	0	1
+14747	14747	^[a-z0-9\-\.]{1,60}\.dns-report\.com$	2	0	0	1
+14748	14748	^\/(text|json|xml)?$	2	0	0	1
+14749	14749	^\/changelog\/(appversion|changelog|help)$	2	0	0	1
+14750	14750	\d/\d+.jpg	2	0	0	1
+14751	14751	^(com|io|host)	2	0	0	1
+14752	14752	^[A-Z]=([A-Za-z0-9+/])+=?$	2	0	0	1
+14753	14753	^[0-9]{18}\/[0-9]{18}\/[a-zA-Z0-9]{5,7}$	2	0	0	1
+14754	14754	[A-F0-9]{96}$	2	0	0	1
+14755	14755	^CN=www\.[0-9a-z]{8,20}\.net$	2	0	0	1
+14756	14756	^(\x01|\x02)(\x4b|\x4c|\x4d)	2	0	0	1
+14757	14757	^[A-Za-z0-9+\/]{50,}={0,2} HTTP\/	2	0	0	1
+14758	14758	CN=([^\r\n\,]+?[\.-])?app\d	2	0	0	1
+14759	14759	^[a-z0-9]{40,}	2	0	0	1
+14760	14760	OS 4_2_[0-9] like	2	0	0	1
+14761	14761	^AUTH\s[^\n]{50}	2	0	0	1
+14762	14762	^LIST\s[^\n]{10}	2	0	0	1
+14763	14763	^XTND\s[^\n]{50}	2	0	0	1
+14764	14764	^APOP\s[^\n]{256}	2	0	0	1
+14765	14765	^PASS\s[^\n]{50}	2	0	0	1
+14766	14766	^USER\s+[^\n]*?%	2	0	0	1
+14767	14767	^UIDL\s+-\d	2	0	0	1
+14768	14768	^DELE\s+-\d	2	0	0	1
+14769	14769	^RSET\s[^\n]{10}	2	0	0	1
+14770	14770	^DELE\s[^\n]{10}	2	0	0	1
+14771	14771	^STAT\s[^\n]{10}	2	0	0	1
+14772	14772	^TOP\s[^\n]{10}	2	0	0	1
+14773	14773	^CAPA\s[^\n]{10}	2	0	0	1
+14774	14774	^APOP\s+USER\s[^\n]{256}	2	0	0	1
+14775	14775	^PASS\s+[^\n]*?%	2	0	0	1
+14776	14776	^USER\s[^\n]{50}	2	0	0	1
+14777	14777	\x64\x12\x54\x6a[\x20\x10\x02]\x00\x00\x00\xf4\x1f\x00\x00	2	0	0	1
+14778	14778	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D25FCAFC-F795-4609-89BB-5F78B4ACAF2C	2	0	0	1
+14779	14779	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BD9E5104-2F20-4A9F-AB14-82D558FF374E	2	0	0	1
+14780	14780	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2BBD45A5-28AE-11D1-ACAC-0800170967D9	2	0	0	1
+14781	14781	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2BBD45A5-28AE-11D1-ACAC-0800170967D9	2	0	0	1
+14782	14782	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2BBD45A5-28AE-11D1-ACAC-0800170967D9	2	0	0	1
+14783	14783	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02000002-9DFA-4B37-ABE9-1929F4BCDEA2	2	0	0	1
+14784	14784	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02000002-9DFA-4B37-ABE9-1929F4BCDEA2	2	0	0	1
+14785	14785	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3310FA24-A027-47B3-8C49-1091077317E9	2	0	0	1
+14786	14786	^[^>]*?classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*?083B40D3-CCBA-11D2-AFE0-00C04F7993D6	2	0	0	1
+14787	14787	^[^>]*?classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*083B40D3-CCBA-11D2-AFE0-00C04F7993D6	2	0	0	1
+14788	14788	^PASS\s+PRO(-|\s)*search\s+Crawler	2	0	0	1
+14789	14789	^\x2f	2	0	0	1
+14790	14790	^Authorization\x3a\s*Basic\s+YWRtaW46cGFzc3dvcmQ/Hi	2	0	0	1
+14791	14791	\x20AND\x20[0-9]{6}\x3D[0-9]{4}	2	0	0	1
+14792	14792	Range\x3a\s?bytes=[-0-9,\x20]{100}/iH	2	0	0	1
+14793	14793	530\s+(Login|User|Failed|Not)	2	0	0	1
+14794	14794	^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{16}\/	2	0	0	1
+14795	14795	^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{16}\/	2	0	0	1
+14796	14796	Arachni\/v?\d\.\d\.\d$	2	0	0	1
+14797	14797	User-Agent\:[^\n]+WHCC	2	0	0	1
+14798	14798	^.+\x3a\s(test.)?C\:\/WINDOWS\/system32\/calc\.exe(.test)?\r$	2	0	0	1
+14799	14799	\x2Frandom\w+?\x2E(c(f[cm]|gi)|ht(ml?|r)|(ws|x)dl|a(sp|xd)|p(hp3|l)|bat|swf|vbs|do)	2	0	0	1
+14800	14800	^DEMONS((\/|\s)[0-9]\.0)?$	2	0	0	1
+14801	14801	^Hakai((\/|\s)[0-9]\.0)?$	2	0	0	1
+14802	14802	^Messiah((\/|\s)[0-9]\.0)?$	2	0	0	1
+14803	14803	^Liquor((\/|\s)[0-9]\.0)?$	2	0	0	1
+14804	14804	^Nija((\/|\s)[0-9]\.0)?$	2	0	0	1
+14805	14805	^Gemini((\/|\s)[0-9]\.0)?$	2	0	0	1
+14806	14806	^Sector((\/|\s)[0-9]\.0)?$	2	0	0	1
+14807	14807	^Kayla((\/|\s)[0-9]\.0)?$	2	0	0	1
+14808	14808	^OSIRIS((\/|\s)[0-9]\.0)?$	2	0	0	1
+14809	14809	^Hello, World((\/|\s)[0-9]\.0)?$	2	0	0	1
+14810	14810	(%U([0-9a-f]{2})){6}	2	0	0	1
+14811	14811	(%U([0-9a-f]{4})){6}	2	0	0	1
+14812	14812	writeByte\x280x[a-z,0-9]{2}.+writeByte\x280x[a-z,0-9]{2}.+writeByte\x280x[a-z,0-9]{2}	2	0	0	1
+14813	14813	\x5Cu[a-f,0-9]{2,4}\x5Cu[a-f,0-9]{2,4}\x5Cu[a-f,0-9]{2,4}	2	0	0	1
+14814	14814	var\x20[a-z,0-9]{1,30}\x20\x3D\x20unescape\x28.\x25u[a-f,0-9]{2,4}\x25u[a-f,0-9]{2,4}	2	0	0	1
+14815	14815	var\x20[a-z,0-9]{1,30}\x20\x3D\x20unescape\x28.\x5Cu[a-f,0-9]{2,4}\x5Cu[a-f,0-9]{2,4}	2	0	0	1
+14816	14816	\x220\x22\x20\x2B\x20\x22[a-d]\x22\x20\x2B\x20\x22	2	0	0	1
+14817	14817	\x7Cu0[a-d](\x7Cu0|0)[a-d]/\x7Cu0[a-d](\x7Cu0|0)[a-d]	2	0	0	1
+14818	14818	\x5Cu0[a-d](\x5Cu0|0)[a-d]/\x5Cu0[a-d](\x5Cu0|0)[a-d]	2	0	0	1
+14819	14819	var\x20[^\n\r]*\x3D[^\n\r]*heap\x2E	2	0	0	1
+14820	14820	u0[a-d]u0[a-d]u0[a-d]u0[a-d]	2	0	0	1
+14821	14821	u0[a-d]0[a-d]u0[a-d]0[a-d]	2	0	0	1
+14822	14822	unescape.+\x25u[0-9,a-f]{2,4}\x25u[0-9,a-f]{2,4}	2	0	0	1
+14823	14823	unescape\x28(\x22|\x27)\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}\x5Cx[a-f,0-9]{2}	2	0	0	1
+14824	14824	^[a-f0-9]{4}	2	0	0	1
+14825	14825	^[a-f0-9]{4}	2	0	0	1
+14826	14826	filename\s*=\s*.*?\.([abcdehijlmnoprsvwx])(a(d[ep]|s[dfx])|c([ho]m|li|md|pp)|d(iz|ll|ot)|e(m[fl]|xe)|h(lp|sq|ta)|jse?|m(d[abew]|s[ip])|p(p[st]|if|[lm]|ot)|r(eg|tf)|s(cr|[hy]s|wf)|v(b[es]?|cf|xd)|w(m[dfsz]|p[dmsz]|s[cfh])|xl[tw]|bat|ini|lnk|nws|ocx)[\x27\x22\n\r\s]	2	0	0	1
+14827	14827	^expn\s+\*@	2	0	0	1
+14828	14828	^expn\s+decode	2	0	0	1
+14829	14829	^expn\s+root	2	0	0	1
+14830	14830	^vrfy\s+decode	2	0	0	1
+14831	14831	^vrfy\s+root	2	0	0	1
+14832	14832	^RCPT TO\x3a\s[^\n]{300}	2	0	0	1
+14833	14833	^EXPN[^\n]{255}	2	0	0	1
+14834	14834	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnBpZ|5waW|ucGlm)	2	0	0	1
+14835	14835	^(<boundary>[\x20\x27-\x29\x2b-\x2f0-9\x3a\x3d\x3fA-Z\x5fa-z]{0,69}?[^\x2d])--(\x0d\x0a(--|\x2e|RSET)[^\r\n]*?)*\x0d\x0a--(=boundary)\x0d\x0a	2	0	0	1
+14836	14836	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*package_prefix[\r\n\s]*=>[\r\n\s]*|package_prefix\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*procedure_prefix[\r\n\s]*=>[\r\n\s]*|procedure_prefix\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14837	14837	TO_CHAR\s*\(\s*SYSTIMESTAMP\s*,\s*(\x27[^\x27]{256}|\x22[^\x22]{256})	2	0	0	1
+14838	14838	CREATE\s.*?FILE\s+((AS|MEMBER|TO)\s+)?(\x27[^\x27]{512}|\x22[^\x22]{512})	2	0	0	1
+14839	14839	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*logfile[\r\n\s]*=>[\r\n\s]*|logfile\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\d+\s*,\s*){3}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14840	14840	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14841	14841	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{512,}\x27|\x22[^\x22]{512,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*|layer\s*=>\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,})|\(\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,}))	2	0	0	1
+14842	14842	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{128,}\x27|\x22[^\x22]{128,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*|layer\s*=>\s*(\x27[^\x27]{128,}|\x22[^\x22]{128,})|\(\s*(\x27[^\x27]{128,}|\x22[^\x22]{128,}))	2	0	0	1
+14843	14843	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*layer[\r\n\s]*=>[\r\n\s]*|layer\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14844	14844	numtoyminterval\s*\(\s*\d+\s*,\s*(\x27[^\x27]{32}|\x22[^\x22]{32})	2	0	0	1
+14845	14845	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*qt_name[\r\n\s]*=>[\r\n\s]*|qt_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14846	14846	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14847	14847	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14848	14848	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*src_queue_name[\r\n\s]*=>[\r\n\s]*|src_queue_name\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14849	14849	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*destination[\r\n\s]*=>[\r\n\s]*|destination\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14850	14850	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*dblink[\r\n\s]*=>[\r\n\s]*|dblink\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14851	14851	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14852	14852	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14853	14853	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14854	14854	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*missing_rows_oname1[\r\n\s]*=>[\r\n\s]*|missing_rows_oname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname1[\r\n\s]*=>[\r\n\s]*|sname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14855	14855	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*missing_rows_oname1[\r\n\s]*=>[\r\n\s]*|missing_rows_oname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname1[\r\n\s]*=>[\r\n\s]*|sname1\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14856	14856	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14857	14857	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*|userid\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14858	14858	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*userid[\r\n\s]*=>[\r\n\s]*|userid\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14859	14859	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14860	14860	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14861	14861	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14862	14862	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14863	14863	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14864	14864	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14865	14865	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14866	14866	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14867	14867	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14868	14868	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14869	14869	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14870	14870	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14871	14871	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14872	14872	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14873	14873	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14874	14874	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14875	14875	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14876	14876	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14877	14877	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14878	14878	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14879	14879	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14880	14880	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14881	14881	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14882	14882	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14883	14883	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14884	14884	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14885	14885	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14886	14886	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14887	14887	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14888	14888	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14889	14889	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14890	14890	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14891	14891	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14892	14892	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14893	14893	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14894	14894	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14895	14895	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14896	14896	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14897	14897	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14898	14898	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14899	14899	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14900	14900	\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})	2	0	0	1
+14901	14901	(\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14902	14902	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14903	14903	(\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14904	14904	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14905	14905	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14906	14906	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14907	14907	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14908	14908	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14909	14909	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14910	14910	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14911	14911	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14912	14912	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14913	14913	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14914	14914	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14915	14915	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14916	14916	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14917	14917	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14918	14918	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14919	14919	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14920	14920	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname)[\r\n\s]*=>[\r\n\s]*|(sname|oname)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14921	14921	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14922	14922	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14923	14923	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*SCHEMA_NAME[\r\n\s]*=>[\r\n\s]*|SCHEMA_NAME\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14924	14924	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14925	14925	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14926	14926	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type|gname|gowner)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type|gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){7}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14927	14927	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14928	14928	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14929	14929	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14930	14930	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14931	14931	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14932	14932	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14933	14933	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14934	14934	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14935	14935	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14936	14936	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14937	14937	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14938	14938	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14939	14939	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14940	14940	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){3}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14941	14941	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|fname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|fname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){5}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14942	14942	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14943	14943	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(sname|oname|type)[\r\n\s]*=>[\r\n\s]*|(sname|oname|type)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14944	14944	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14945	14945	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){4}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14946	14946	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14947	14947	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14948	14948	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14949	14949	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14950	14950	(\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14951	14951	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*CANON_GNAME[\r\n\s]*=>[\r\n\s]*|CANON_GNAME\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14952	14952	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*type[\r\n\s]*=>[\r\n\s]*|type\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){2}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14953	14953	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*tst[\r\n\s]*=>[\r\n\s]*|tst\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*\d+\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14954	14954	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{512,}\x27|\x22[^\x22]{512,}\x22)[\r\n\s]*\x3b.*repgrpname[\r\n\s]*=>[\r\n\s]*|repgrpname\s*=>\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,})|\(\s*(\x27[^\x27]{512,}|\x22[^\x22]{512,}))	2	0	0	1
+14955	14955	\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})	2	0	0	1
+14956	14956	TIME_ZONE\s*=\s*((\x27[^\x27]{1000,})|(\x22[^\x22]{1000,}))	2	0	0	1
+14957	14957	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14958	14958	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14959	14959	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))|((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22 ]{1000})))	2	0	0	1
+14960	14960	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14961	14961	\(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){4}\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+14962	14962	\((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){2}\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14963	14963	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))|((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+14964	14964	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14965	14965	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14966	14966	\(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+14967	14967	\((\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))|\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+14968	14968	\(((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000})))	2	0	0	1
+14969	14969	\(\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,(\s*(true|false)\s*,\s*){3}((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14970	14970	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14971	14971	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14972	14972	\((\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,){2}\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14973	14973	\(\s*(\x27[^\x27]*'|\x22[^\x22]+\x22)\s*,\s*(true|false)\s*,\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14974	14974	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14975	14975	\(\s*TIMESTAMP\s*(\s*(\x27[^\x27]+'|\x22[^\x22]+\x22)\s*,)\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14976	14976	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14977	14977	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14978	14978	\(\s*((\x27[^\x27]{1000})|(\x22[^\x22]{1000}))	2	0	0	1
+14979	14979	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14980	14980	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*logfile[\r\n\s]*=>[\r\n\s]*|logfile\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14981	14981	ALTER\s.*?FILE\s+((AS|MEMBER|TO)\s+)?(\x27[^\x27]{512}|\x22[^\x22]{512})	2	0	0	1
+14982	14982	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14983	14983	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14984	14984	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14985	14985	\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})	2	0	0	1
+14986	14986	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14987	14987	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14988	14988	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14989	14989	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14990	14990	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14991	14991	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(missing_rows_oname1|missing_rows_oname2)[\r\n\s]*=>[\r\n\s]*|(missing_rows_oname1|missing_rows_oname2)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){10}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14992	14992	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(missing_rows_oname1|missing_rows_oname2)[\r\n\s]*=>[\r\n\s]*|(missing_rows_oname1|missing_rows_oname2)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){8}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*((\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*){9}(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14993	14993	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14994	14994	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14995	14995	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14996	14996	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*sname[\r\n\s]*=>[\r\n\s]*|sname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|(\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1024,}\x27|\x22[^\x22]{1024,}\x22)[\r\n\s]*\x3b.*oname[\r\n\s]*=>[\r\n\s]*|oname\s*=>\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1024,}|\x22[^\x22]{1024,}))	2	0	0	1
+14997	14997	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14998	14998	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+14999	14999	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+15000	15000	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
\ No newline at end of file
diff --git a/test/benchmark/regex_rules/REGEX_1K b/test/benchmark/regex_rules/REGEX_1K
new file mode 100644
index 0000000..04fa963
--- /dev/null
+++ b/test/benchmark/regex_rules/REGEX_1K
@@ -0,0 +1,1001 @@
+1000
+1	1	User-Agent:\s.*.abc.net	2	0	0	1
+2	2	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5	2	0	0	1
+3	3	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980	2	0	0	1
+4	4	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E	2	0	0	1
+5	5	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333	2	0	0	1
+6	6	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C	2	0	0	1
+7	7	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E	2	0	0	1
+8	8	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+9	9	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+10	10	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+11	11	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08	2	0	0	1
+12	12	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42	2	0	0	1
+13	13	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4	2	0	0	1
+14	14	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980	2	0	0	1
+15	15	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3	2	0	0	1
+16	16	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980	2	0	0	1
+17	17	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB	2	0	0	1
+18	18	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+19	19	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+20	20	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664	2	0	0	1
+21	21	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C	2	0	0	1
+22	22	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980	2	0	0	1
+23	23	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+24	24	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+25	25	(EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters)	2	0	0	1
+26	26	(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+27	27	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+28	28	(ReadMolFile|SaveasMolFile)	2	0	0	1
+29	29	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+30	30	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+31	31	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C	2	0	0	1
+32	32	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+33	33	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+34	34	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000	2	0	0	1
+35	35	file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+36	36	[0-9]{3,}	2	0	0	1
+37	37	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194	2	0	0	1
+38	38	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2	2	0	0	1
+39	39	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510	2	0	0	1
+40	40	(setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch)	2	0	0	1
+41	41	param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20}	2	0	0	1
+42	42	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C	2	0	0	1
+43	43	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+44	44	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79	2	0	0	1
+45	45	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD	2	0	0	1
+46	46	(Text|EditSelText|EditText|CellFontName|Archive)	2	0	0	1
+47	47	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+48	48	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c	2	0	0	1
+49	49	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B	2	0	0	1
+50	50	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA	2	0	0	1
+51	51	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted)	2	0	0	1
+52	52	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam)	2	0	0	1
+53	53	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+54	54	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8	2	0	0	1
+55	55	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E	2	0	0	1
+56	56	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726	2	0	0	1
+57	57	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598	2	0	0	1
+58	58	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E	2	0	0	1
+59	59	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E	2	0	0	1
+60	60	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E	2	0	0	1
+61	61	(exe|bat|com|dll|ini)	2	0	0	1
+62	62	(exe|bat|com|dll|ini)	2	0	0	1
+63	63	(exe|bat|com|dll|ini)	2	0	0	1
+64	64	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E	2	0	0	1
+65	65	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7	2	0	0	1
+66	66	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91	2	0	0	1
+67	67	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980	2	0	0	1
+68	68	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02	2	0	0	1
+69	69	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3	2	0	0	1
+70	70	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90	2	0	0	1
+71	71	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E	2	0	0	1
+72	72	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E	2	0	0	1
+73	73	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112	2	0	0	1
+74	74	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1	2	0	0	1
+75	75	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6	2	0	0	1
+76	76	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F	2	0	0	1
+77	77	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+78	78	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA	2	0	0	1
+79	79	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258	2	0	0	1
+80	80	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B	2	0	0	1
+81	81	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1	2	0	0	1
+82	82	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7	2	0	0	1
+83	83	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D	2	0	0	1
+84	84	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61	2	0	0	1
+85	85	(Src|Background|PackageXml)	2	0	0	1
+86	86	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters)	2	0	0	1
+87	87	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+88	88	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+89	89	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+90	90	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+91	91	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755	2	0	0	1
+92	92	(Save|SaveLayoutChanges|SaveMenuUsageData)	2	0	0	1
+93	93	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61	2	0	0	1
+94	94	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+95	95	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+96	96	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+97	97	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+98	98	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0	2	0	0	1
+99	99	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3	2	0	0	1
+100	100	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679	2	0	0	1
+101	101	(SaveFile|ExportToXML)	2	0	0	1
+102	102	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE	2	0	0	1
+103	103	(SnapShotToFile|SnapShotX)	2	0	0	1
+104	104	(SnapShotToFile|SnapShotX)	2	0	0	1
+105	105	(SnapShotToFile|SnapShotX)	2	0	0	1
+106	106	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+107	107	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28	2	0	0	1
+108	108	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003	2	0	0	1
+109	109	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+110	110	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+111	111	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+112	112	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+113	113	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE	2	0	0	1
+114	114	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB	2	0	0	1
+115	115	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile)	2	0	0	1
+116	116	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD	2	0	0	1
+117	117	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA	2	0	0	1
+118	118	(Run|SetRegistryValueAsString|PerformUpdateAsync)	2	0	0	1
+119	119	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+120	120	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+121	121	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084	2	0	0	1
+122	122	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6	2	0	0	1
+123	123	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF	2	0	0	1
+124	124	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5	2	0	0	1
+125	125	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C	2	0	0	1
+126	126	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA	2	0	0	1
+127	127	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020	2	0	0	1
+128	128	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020	2	0	0	1
+129	129	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B	2	0	0	1
+130	130	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356	2	0	0	1
+131	131	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520	2	0	0	1
+132	132	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C	2	0	0	1
+133	133	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26	2	0	0	1
+134	134	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0	2	0	0	1
+135	135	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF	2	0	0	1
+136	136	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142	2	0	0	1
+137	137	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB	2	0	0	1
+138	138	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7	2	0	0	1
+139	139	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747	2	0	0	1
+140	140	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456	2	0	0	1
+141	141	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0	2	0	0	1
+142	142	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999	2	0	0	1
+143	143	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899	2	0	0	1
+144	144	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5	2	0	0	1
+145	145	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E	2	0	0	1
+146	146	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F	2	0	0	1
+147	147	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9	2	0	0	1
+148	148	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F	2	0	0	1
+149	149	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448	2	0	0	1
+150	150	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92	2	0	0	1
+151	151	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F	2	0	0	1
+152	152	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED	2	0	0	1
+153	153	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB	2	0	0	1
+154	154	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305	2	0	0	1
+155	155	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7	2	0	0	1
+156	156	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B	2	0	0	1
+157	157	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C	2	0	0	1
+158	158	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627	2	0	0	1
+159	159	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E	2	0	0	1
+160	160	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE	2	0	0	1
+161	161	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496	2	0	0	1
+162	162	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0	2	0	0	1
+163	163	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E	2	0	0	1
+164	164	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C	2	0	0	1
+165	165	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53	2	0	0	1
+166	166	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014	2	0	0	1
+167	167	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+168	168	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+169	169	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741	2	0	0	1
+170	170	(SaveToBMP|SaveToFile)	2	0	0	1
+171	171	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2	2	0	0	1
+172	172	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667	2	0	0	1
+173	173	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+174	174	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+175	175	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+176	176	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D	2	0	0	1
+177	177	(SaveBarCode|SaveEnhWMF)	2	0	0	1
+178	178	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B	2	0	0	1
+179	179	<object\s*[^>]*\s*classid\s*=\s*(.+<q1>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>)	2	0	0	1
+180	180	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000	2	0	0	1
+181	181	(exe|bat|com|dll|ini)	2	0	0	1
+182	182	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E	2	0	0	1
+183	183	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E	2	0	0	1
+184	184	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87	2	0	0	1
+185	185	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+186	186	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+187	187	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+188	188	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+189	189	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+190	190	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E	2	0	0	1
+191	191	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344	2	0	0	1
+192	192	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C	2	0	0	1
+193	193	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30	2	0	0	1
+194	194	(Packagefiles|SaveDna|SetIdentity|AddFile)	2	0	0	1
+195	195	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9	2	0	0	1
+196	196	(_DOWText)|(_MonthText)	2	0	0	1
+197	197	(SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour)	2	0	0	1
+198	198	classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE	2	0	0	1
+199	199	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+200	200	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+201	201	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F	2	0	0	1
+202	202	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5	2	0	0	1
+203	203	[\w\W]{2500,}	2	0	0	1
+204	204	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3	2	0	0	1
+205	205	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8	2	0	0	1
+206	206	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04	2	0	0	1
+207	207	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue)	2	0	0	1
+208	208	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356	2	0	0	1
+209	209	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E	2	0	0	1
+210	210	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574	2	0	0	1
+211	211	(WriteIniFileString|ShellExecute)	2	0	0	1
+212	212	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906	2	0	0	1
+213	213	(txt|ini|com|exe|bat|dll|dat)	2	0	0	1
+214	214	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8	2	0	0	1
+215	215	42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733	2	0	0	1
+216	216	(Save|ExportImage)	2	0	0	1
+217	217	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790	2	0	0	1
+218	218	(DeleteFile|write)	2	0	0	1
+219	219	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+220	220	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+221	221	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+222	222	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+223	223	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967	2	0	0	1
+224	224	WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext)	2	0	0	1
+225	225	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9	2	0	0	1
+226	226	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5	2	0	0	1
+227	227	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6	2	0	0	1
+228	228	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+229	229	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+230	230	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24	2	0	0	1
+231	231	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9	2	0	0	1
+232	232	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA	2	0	0	1
+233	233	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec)	2	0	0	1
+234	234	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5	2	0	0	1
+235	235	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+236	236	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+237	237	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+238	238	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83	2	0	0	1
+239	239	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA	2	0	0	1
+240	240	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566	2	0	0	1
+241	241	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+242	242	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+243	243	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B	2	0	0	1
+244	244	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F	2	0	0	1
+245	245	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+246	246	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+247	247	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED	2	0	0	1
+248	248	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619	2	0	0	1
+249	249	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E	2	0	0	1
+250	250	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258	2	0	0	1
+251	251	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196	2	0	0	1
+252	252	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E	2	0	0	1
+253	253	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD	2	0	0	1
+254	254	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4	2	0	0	1
+255	255	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118	2	0	0	1
+256	256	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616	2	0	0	1
+257	257	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+258	258	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+259	259	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+260	260	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11	2	0	0	1
+261	261	(ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1	2	0	0	1
+262	262	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020	2	0	0	1
+263	263	(PostURL|AddSeperator|AddString|Post)	2	0	0	1
+264	264	(SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF)	2	0	0	1
+265	265	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>)	2	0	0	1
+266	266	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\>	2	0	0	1
+267	267	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\>	2	0	0	1
+268	268	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\>	2	0	0	1
+269	269	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\>	2	0	0	1
+270	270	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+271	271	(Buildpath|GetDriveName|DriveExists|DeleteFile)	2	0	0	1
+272	272	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+273	273	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+274	274	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+275	275	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>)	2	0	0	1
+276	276	\x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission]	2	0	0	1
+277	277	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\>	2	0	0	1
+278	278	000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F	2	0	0	1
+279	279	(javascript|http|ftp|vbscript)	2	0	0	1
+280	280	(SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen)	2	0	0	1
+281	281	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000	2	0	0	1
+282	282	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407	2	0	0	1
+283	283	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414	2	0	0	1
+284	284	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+285	285	(AddAttachment|SubmitToExpress)	2	0	0	1
+286	286	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6	2	0	0	1
+287	287	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0	2	0	0	1
+288	288	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D	2	0	0	1
+289	289	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile)	2	0	0	1
+290	290	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\>	2	0	0	1
+291	291	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\>	2	0	0	1
+292	292	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC	2	0	0	1
+293	293	src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape	2	0	0	1
+294	294	(LogFile|ClearLogFile|SaveToFile)	2	0	0	1
+295	295	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)	2	0	0	1
+296	296	User-Agent\x3a Downloader \d\.\d\r?$/Hm	2	0	0	1
+297	297	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P	2	0	0	1
+298	298	^((\r?\n\r?\n).)*?\r?\n\r?\nMZ	2	0	0	1
+299	299	instructions\/\d{2}\.xml	2	0	0	1
+300	300	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp	2	0	0	1
+301	301	\/updatestats\/update\d+?\.xml$	2	0	0	1
+302	302	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab	2	0	0	1
+303	303	ctxad-\d+\.sig	2	0	0	1
+304	304	/user\d+/counter\.htm	2	0	0	1
+305	305	(cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr	2	0	0	1
+306	306	(discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe	2	0	0	1
+307	307	loaderadv\d+\.jar	2	0	0	1
+308	308	\/adv\/\d+\/win32\.exe	2	0	0	1
+309	309	\/Message\/\S+\/\S+\.xml	2	0	0	1
+310	310	\/abt\?data=\S{150}	2	0	0	1
+311	311	User-Agent\x3a.+ZangoToolbar.+\r$/Hmi	2	0	0	1
+312	312	User-Agent\:[^\n]+wbi_v\d/iH	2	0	0	1
+313	313	User-Agent\x3a[^\n]+AskBar/iH	2	0	0	1
+314	314	\/tbrequest\d+\.php	2	0	0	1
+315	315	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+316	316	sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+317	317	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+318	318	cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+319	319	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+320	320	UID=\d	2	0	0	1
+321	321	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+322	322	REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P	2	0	0	1
+323	323	victim\.php\?\d\d\d\d\d	2	0	0	1
+324	324	\/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d	2	0	0	1
+325	325	\/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+	2	0	0	1
+326	326	&ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d	2	0	0	1
+327	327	\/sd\?s=\d+&f=\d&C=\d	2	0	0	1
+328	328	\.txt$	2	0	0	1
+329	329	\.cfg$	2	0	0	1
+330	330	User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H	2	0	0	1
+331	331	Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r?$/Hi	2	0	0	1
+332	332	\x00[\x02-\x1E][0-9]{2,30}\x02cn\x00	2	0	0	1
+333	333	\x00[\x02-\x1E][0-9]{2,30}\x02ru\x00	2	0	0	1
+334	334	^[A-F0-9]+$	2	0	0	1
+335	335	\/sd\?s=\d+&f=\d	2	0	0	1
+336	336	loadadv\d+\.exe	2	0	0	1
+337	337	\/ms\d\d\dcfg\.jsp	2	0	0	1
+338	338	^0x[0-9a-f]+$	2	0	0	1
+339	339	^[^a-z]*?[0-9]{2,30}\.ru$	2	0	0	1
+340	340	filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe	2	0	0	1
+341	341	^MM \d\.\d+$	2	0	0	1
+342	342	^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4}	2	0	0	1
+343	343	^\w+pcsetup_\w+	2	0	0	1
+344	344	\x2Fv[0-9]{3,4}[\x2F\x3F]	2	0	0	1
+345	345	[a-f0-9]{32}\?v=	2	0	0	1
+346	346	^\/[a-z]{2}\x3Fv\x3D[0-9]$	2	0	0	1
+347	347	^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$	2	0	0	1
+348	348	^\/entrance\?s1=[a-f0-9]{100,}$	2	0	0	1
+349	349	^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=	2	0	0	1
+350	350	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+351	351	^[0-9][a-z]+	2	0	0	1
+352	352	\.php$	2	0	0	1
+353	353	^\/([^\x2f]+\/)*log\/\?[bc]=	2	0	0	1
+354	354	^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/))	2	0	0	1
+355	355	^\/\?pcrc=\d+&v=[\d.]+$	2	0	0	1
+356	356	^\/\?v=[\d.]+&pcrc=\d+$	2	0	0	1
+357	357	\/v\d\/[^.]+\.asp$	2	0	0	1
+358	358	\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$	2	0	0	1
+359	359	\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$	2	0	0	1
+360	360	^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$	2	0	0	1
+361	361	^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$	2	0	0	1
+362	362	\?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})	2	0	0	1
+363	363	^Downloader\s\d+\.\d+$	2	0	0	1
+364	364	^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100}	2	0	0	1
+365	365	\/get_xml\?(file_id|stb)=	2	0	0	1
+366	366	(_[a-z]{2}){1,3}_[a-z]{3}_install\.exe	2	0	0	1
+367	367	\d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows	2	0	0	1
+368	368	^[a-zA-Z0-9_-]+$	2	0	0	1
+369	369	^\/([a-zA-Z0-9]|%2[fb]){400,}$	2	0	0	1
+370	370	User-Agent\:[^\n]+searchengine	2	0	0	1
+371	371	User-Agent\:[^\n]+SurferPlugin	2	0	0	1
+372	372	User-Agent\:[^\n]+THNALL[^\n]+\.EXE	2	0	0	1
+373	373	User-Agent\:[^\n]+XupiterToolbar	2	0	0	1
+374	374	User-Agent\:[^\n]+spywareaxe	2	0	0	1
+375	375	User-Agent\:[^\n]+iMeshBar	2	0	0	1
+376	376	User-Agent\:[^\n]+Oemji	2	0	0	1
+377	377	^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$	2	0	0	1
+378	378	^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$	2	0	0	1
+379	379	^\/(get|install)\/\?q=	2	0	0	1
+380	380	^\/[a-f0-9]{50,}$	2	0	0	1
+381	381	^\/[\w-]{50,}$	2	0	0	1
+382	382	^\/\?pcrc=[0-9]{7,10}$	2	0	0	1
+383	383	^Downloader \d\.\d$	2	0	0	1
+384	384	\/Socks[45]\.txt$	2	0	0	1
+385	385	^Feat[^\r\n]+(Install|Updat)er	2	0	0	1
+386	386	User-Agent\:[^\n]+host(ie|oe|oi|ol)	2	0	0	1
+387	387	User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}	2	0	0	1
+388	388	^BWL(\sToplist|\d_UPDATE)	2	0	0	1
+389	389	^\x2F[A-F0-9]{25,40}$	2	0	0	1
+390	390	^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$	2	0	0	1
+391	391	^\d+\sHTTP/1.1$	2	0	0	1
+392	392	^[a-zA-Z0-9_-]+	2	0	0	1
+393	393	[a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12}	2	0	0	1
+394	394	\/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id=	2	0	0	1
+395	395	\{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\}	2	0	0	1
+396	396	CN=([^\r\n]+?\.)?showmypc\.com(\.)	2	0	0	1
+397	397	^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$	2	0	0	1
+398	398	(SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk)	2	0	0	1
+399	399	(DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog)	2	0	0	1
+400	400	\d{13}$	2	0	0	1
+401	401	^[a-f0-9]{32}	2	0	0	1
+402	402	^[a-f0-9]{32}\"	2	0	0	1
+403	403	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+404	404	^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}	2	0	0	1
+405	405	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+406	406	^[A-F0-9]{12}	2	0	0	1
+407	407	^[A-Z0-9]{9}	2	0	0	1
+408	408	^\d+[^\r\n\s]+	2	0	0	1
+409	409	^ SQL[-_ ]Server	2	0	0	1
+410	410	^ \d+ Driver	2	0	0	1
+411	411	ORA-\d{4}	2	0	0	1
+412	412	Warning.*\Woci_	2	0	0	1
+413	413	Warning.*\Wora_	2	0	0	1
+414	414	CLI Driver.*DB2	2	0	0	1
+415	415	bdb2_\w+\(	2	0	0	1
+416	416	Exception.*Informix	2	0	0	1
+417	417	Warning.*SQLite3::	2	0	0	1
+418	418	SQL error.*POS\([0-9]+\)	2	0	0	1
+419	419	Warning.*maxdb	2	0	0	1
+420	420	i?Warning.*sybase	2	0	0	1
+421	421	Warning.*ingres_	2	0	0	1
+422	422	Warning.*sqlite_	2	0	0	1
+423	423	Ingres\W.*Driver	2	0	0	1
+424	424	Exception (condition )\d+\. Transaction rollback\.	2	0	0	1
+425	425	SQL Server.*?error \x27[0-9a-f]{8}	2	0	0	1
+426	426	^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$	2	0	0	1
+427	427	^(<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll	2	0	0	1
+428	428	^...\x30\x82..\x02\x82...{256,257}	2	0	0	1
+429	429	\/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php	2	0	0	1
+430	430	\/notify\/(single|mass)$	2	0	0	1
+431	431	a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php)	2	0	0	1
+432	432	Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a	2	0	0	1
+433	433	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+434	434	[-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10}	2	0	0	1
+435	435	^\d+(\+|\-|\\|\*)\d+	2	0	0	1
+436	436	^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9	2	0	0	1
+437	437	^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u	2	0	0	1
+438	438	ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b	2	0	0	1
+439	439	^\d{4}[01]	2	0	0	1
+440	440	^\d{4}[01]	2	0	0	1
+441	441	^\d{4}[01]	2	0	0	1
+442	442	^\d{4}[01]	2	0	0	1
+443	443	^\d{4}[01]	2	0	0	1
+444	444	^\d{4}[01]	2	0	0	1
+445	445	^\d{4}[01]	2	0	0	1
+446	446	^\d{4}[01]	2	0	0	1
+447	447	^\d{4}[01]	2	0	0	1
+448	448	^\d{4}[01]	2	0	0	1
+449	449	^\d{4}[01]	2	0	0	1
+450	450	^\d{4}[01]	2	0	0	1
+451	451	^\d{4}[01]	2	0	0	1
+452	452	^\d{4}[01]	2	0	0	1
+453	453	^\d{4}[01]	2	0	0	1
+454	454	^\d{4}[01]	2	0	0	1
+455	455	^\d{4}[01]	2	0	0	1
+456	456	^\d{4}[01]	2	0	0	1
+457	457	^\d{4}[01]	2	0	0	1
+458	458	^\d{4}[01]	2	0	0	1
+459	459	^\d{4}[01]	2	0	0	1
+460	460	^\d{4}[01]	2	0	0	1
+461	461	^\d{4}[01]	2	0	0	1
+462	462	^\d{4}[01]	2	0	0	1
+463	463	^\d{4}[01]	2	0	0	1
+464	464	^\d{4}[01]	2	0	0	1
+465	465	^\d{4}[01]	2	0	0	1
+466	466	^\d{4}[01]	2	0	0	1
+467	467	^\d{4}[01]	2	0	0	1
+468	468	^\d{4}[01]	2	0	0	1
+469	469	^\d{4}[01]	2	0	0	1
+470	470	^\d{4}[01]	2	0	0	1
+471	471	^\d{4}[01]	2	0	0	1
+472	472	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+473	473	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+474	474	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+475	475	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+476	476	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+477	477	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+478	478	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+479	479	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+480	480	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+481	481	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+482	482	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+483	483	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+484	484	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+485	485	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+486	486	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+487	487	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+488	488	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+489	489	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+490	490	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+491	491	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+492	492	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+493	493	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+494	494	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+495	495	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+496	496	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+497	497	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+498	498	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+499	499	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+500	500	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+501	501	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+502	502	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+503	503	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+504	504	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+505	505	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+506	506	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+507	507	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+508	508	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+509	509	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+510	510	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+511	511	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+512	512	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+513	513	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+514	514	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+515	515	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+516	516	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+517	517	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+518	518	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+519	519	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+520	520	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+521	521	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+522	522	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+523	523	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+524	524	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+525	525	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+526	526	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+527	527	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+528	528	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+529	529	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+530	530	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+531	531	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+532	532	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+533	533	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+534	534	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+535	535	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+536	536	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+537	537	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+538	538	^\d{4}[01]	2	0	0	1
+539	539	^\d{4}[01]	2	0	0	1
+540	540	^\d{4}[01]	2	0	0	1
+541	541	^\d{4}[01]	2	0	0	1
+542	542	^\d{4}[01]	2	0	0	1
+543	543	^\d{4}[01]	2	0	0	1
+544	544	^\d{4}[01]	2	0	0	1
+545	545	^\d{4}[01]	2	0	0	1
+546	546	^\d{4}[01]	2	0	0	1
+547	547	^\d{4}[01]	2	0	0	1
+548	548	^\d{4}[01]	2	0	0	1
+549	549	^\d{4}[01]	2	0	0	1
+550	550	^\d{4}[01]	2	0	0	1
+551	551	^\d{4}[01]	2	0	0	1
+552	552	^\d{4}[01]	2	0	0	1
+553	553	^\d{4}[01]	2	0	0	1
+554	554	^\d{4}[01]	2	0	0	1
+555	555	^\d{4}[01]	2	0	0	1
+556	556	^\d{4}[01]	2	0	0	1
+557	557	^\d{4}[01]	2	0	0	1
+558	558	^\d{4}[01]	2	0	0	1
+559	559	^\d{4}[01]	2	0	0	1
+560	560	^\d{4}[01]	2	0	0	1
+561	561	^\d{4}[01]	2	0	0	1
+562	562	^\d{4}[01]	2	0	0	1
+563	563	^\d{4}[01]	2	0	0	1
+564	564	^\d{4}[01]	2	0	0	1
+565	565	^\d{4}[01]	2	0	0	1
+566	566	^\d{4}[01]	2	0	0	1
+567	567	^\d{4}[01]	2	0	0	1
+568	568	^\d{4}[01]	2	0	0	1
+569	569	^\d{4}[01]	2	0	0	1
+570	570	^\d{4}[01]	2	0	0	1
+571	571	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+572	572	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+573	573	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+574	574	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+575	575	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+576	576	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+577	577	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+578	578	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+579	579	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+580	580	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+581	581	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+582	582	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+583	583	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+584	584	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+585	585	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+586	586	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+587	587	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+588	588	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+589	589	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+590	590	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+591	591	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+592	592	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+593	593	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+594	594	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+595	595	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+596	596	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+597	597	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+598	598	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+599	599	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+600	600	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+601	601	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+602	602	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+603	603	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+604	604	^\d{4}[01]	2	0	0	1
+605	605	^\d{4}[01]	2	0	0	1
+606	606	^\d{4}[01]	2	0	0	1
+607	607	^\d{4}[01]	2	0	0	1
+608	608	^\d{4}[01]	2	0	0	1
+609	609	^\d{4}[01]	2	0	0	1
+610	610	^\d{4}[01]	2	0	0	1
+611	611	^\d{4}[01]	2	0	0	1
+612	612	^\d{4}[01]	2	0	0	1
+613	613	^\d{4}[01]	2	0	0	1
+614	614	^\d{4}[01]	2	0	0	1
+615	615	^\d{4}[01]	2	0	0	1
+616	616	^\d{4}[01]	2	0	0	1
+617	617	^\d{4}[01]	2	0	0	1
+618	618	^\d{4}[01]	2	0	0	1
+619	619	^\d{4}[01]	2	0	0	1
+620	620	^\d{4}[01]	2	0	0	1
+621	621	^\d{4}[01]	2	0	0	1
+622	622	^\d{4}[01]	2	0	0	1
+623	623	^\d{4}[01]	2	0	0	1
+624	624	^\d{4}[01]	2	0	0	1
+625	625	^\d{4}[01]	2	0	0	1
+626	626	^\d{4}[01]	2	0	0	1
+627	627	^\d{4}[01]	2	0	0	1
+628	628	^\d{4}[01]	2	0	0	1
+629	629	^\d{4}[01]	2	0	0	1
+630	630	^\d{4}[01]	2	0	0	1
+631	631	^\d{4}[01]	2	0	0	1
+632	632	^\d{4}[01]	2	0	0	1
+633	633	^\d{4}[01]	2	0	0	1
+634	634	^\d{4}[01]	2	0	0	1
+635	635	^\d{4}[01]	2	0	0	1
+636	636	^\d{4}[01]	2	0	0	1
+637	637	^\d{4}[01]	2	0	0	1
+638	638	^\d{4}[01]	2	0	0	1
+639	639	^\d{4}[01]	2	0	0	1
+640	640	^\d{4}[01]	2	0	0	1
+641	641	^\d{4}[01]	2	0	0	1
+642	642	^\d{4}[01]	2	0	0	1
+643	643	^\d{4}[01]	2	0	0	1
+644	644	^\d{4}[01]	2	0	0	1
+645	645	^\d{4}[01]	2	0	0	1
+646	646	^\d{4}[01]	2	0	0	1
+647	647	^\d{4}[01]	2	0	0	1
+648	648	^\d{4}[01]	2	0	0	1
+649	649	^\d{4}[01]	2	0	0	1
+650	650	^\d{4}[01]	2	0	0	1
+651	651	^\d{4}[01]	2	0	0	1
+652	652	^\d{4}[01]	2	0	0	1
+653	653	^\d{4}[01]	2	0	0	1
+654	654	^\d{4}[01]	2	0	0	1
+655	655	^\d{4}[01]	2	0	0	1
+656	656	^\d{4}[01]	2	0	0	1
+657	657	^\d{4}[01]	2	0	0	1
+658	658	^\d{4}[01]	2	0	0	1
+659	659	^\d{4}[01]	2	0	0	1
+660	660	^\d{4}[01]	2	0	0	1
+661	661	^\d{4}[01]	2	0	0	1
+662	662	^\d{4}[01]	2	0	0	1
+663	663	^\d{4}[01]	2	0	0	1
+664	664	^\d{4}[01]	2	0	0	1
+665	665	^\d{4}[01]	2	0	0	1
+666	666	^\d{4}[01]	2	0	0	1
+667	667	^\d{4}[01]	2	0	0	1
+668	668	^\d{4}[01]	2	0	0	1
+669	669	^\d{4}[01]	2	0	0	1
+670	670	^\d{4}[01]	2	0	0	1
+671	671	^\d{4}[01]	2	0	0	1
+672	672	^\d{4}[01]	2	0	0	1
+673	673	^\d{4}[01]	2	0	0	1
+674	674	^\d{4}[01]	2	0	0	1
+675	675	^\d{4}[01]	2	0	0	1
+676	676	^\d{4}[01]	2	0	0	1
+677	677	^\d{4}[01]	2	0	0	1
+678	678	^\d{4}[01]	2	0	0	1
+679	679	^\d{4}[01]	2	0	0	1
+680	680	^\d{4}[01]	2	0	0	1
+681	681	^\d{4}[01]	2	0	0	1
+682	682	^\d{4}[01]	2	0	0	1
+683	683	^\d{4}[01]	2	0	0	1
+684	684	^\d{4}[01]	2	0	0	1
+685	685	^\d{4}[01]	2	0	0	1
+686	686	^\d{4}[01]	2	0	0	1
+687	687	^\d{4}[01]	2	0	0	1
+688	688	^\d{4}[01]	2	0	0	1
+689	689	^\d{4}[01]	2	0	0	1
+690	690	^\d{4}[01]	2	0	0	1
+691	691	^\d{4}[01]	2	0	0	1
+692	692	^\d{4}[01]	2	0	0	1
+693	693	^\d{4}[01]	2	0	0	1
+694	694	^\d{4}[01]	2	0	0	1
+695	695	^\d{4}[01]	2	0	0	1
+696	696	^\d{4}[01]	2	0	0	1
+697	697	^\d{4}[01]	2	0	0	1
+698	698	^\d{4}[01]	2	0	0	1
+699	699	^\d{4}[01]	2	0	0	1
+700	700	^\d{4}[01]	2	0	0	1
+701	701	^\d{4}[01]	2	0	0	1
+702	702	^\d{4}[01]	2	0	0	1
+703	703	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+704	704	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+705	705	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+706	706	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+707	707	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+708	708	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+709	709	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+710	710	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+711	711	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+712	712	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+713	713	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+714	714	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+715	715	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+716	716	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+717	717	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+718	718	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+719	719	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+720	720	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+721	721	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+722	722	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+723	723	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+724	724	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+725	725	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+726	726	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+727	727	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+728	728	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+729	729	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+730	730	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+731	731	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+732	732	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+733	733	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+734	734	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+735	735	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+736	736	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+737	737	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+738	738	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+739	739	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+740	740	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+741	741	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+742	742	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+743	743	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+744	744	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+745	745	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+746	746	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+747	747	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+748	748	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+749	749	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+750	750	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+751	751	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+752	752	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+753	753	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+754	754	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+755	755	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+756	756	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+757	757	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+758	758	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+759	759	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+760	760	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+761	761	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+762	762	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+763	763	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+764	764	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+765	765	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+766	766	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+767	767	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+768	768	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+769	769	^\d{4}[01]	2	0	0	1
+770	770	^\d{4}[01]	2	0	0	1
+771	771	^\d{4}[01]	2	0	0	1
+772	772	^\d{4}[01]	2	0	0	1
+773	773	^\d{4}[01]	2	0	0	1
+774	774	^\d{4}[01]	2	0	0	1
+775	775	^\d{4}[01]	2	0	0	1
+776	776	^\d{4}[01]	2	0	0	1
+777	777	^\d{4}[01]	2	0	0	1
+778	778	^\d{4}[01]	2	0	0	1
+779	779	^\d{4}[01]	2	0	0	1
+780	780	^\d{4}[01]	2	0	0	1
+781	781	^\d{4}[01]	2	0	0	1
+782	782	^\d{4}[01]	2	0	0	1
+783	783	^\d{4}[01]	2	0	0	1
+784	784	^\d{4}[01]	2	0	0	1
+785	785	^\d{4}[01]	2	0	0	1
+786	786	^\d{4}[01]	2	0	0	1
+787	787	^\d{4}[01]	2	0	0	1
+788	788	^\d{4}[01]	2	0	0	1
+789	789	^\d{4}[01]	2	0	0	1
+790	790	^\d{4}[01]	2	0	0	1
+791	791	^\d{4}[01]	2	0	0	1
+792	792	^\d{4}[01]	2	0	0	1
+793	793	^\d{4}[01]	2	0	0	1
+794	794	^\d{4}[01]	2	0	0	1
+795	795	^\d{4}[01]	2	0	0	1
+796	796	^\d{4}[01]	2	0	0	1
+797	797	^\d{4}[01]	2	0	0	1
+798	798	^\d{4}[01]	2	0	0	1
+799	799	^\d{4}[01]	2	0	0	1
+800	800	^\d{4}[01]	2	0	0	1
+801	801	^\d{4}[01]	2	0	0	1
+802	802	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+803	803	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+804	804	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+805	805	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+806	806	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+807	807	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+808	808	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+809	809	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+810	810	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+811	811	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+812	812	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+813	813	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+814	814	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+815	815	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+816	816	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+817	817	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+818	818	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+819	819	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+820	820	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+821	821	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+822	822	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+823	823	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+824	824	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+825	825	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+826	826	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+827	827	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+828	828	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+829	829	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+830	830	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+831	831	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+832	832	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+833	833	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+834	834	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+835	835	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+836	836	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+837	837	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+838	838	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+839	839	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+840	840	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+841	841	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+842	842	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+843	843	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+844	844	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+845	845	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+846	846	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+847	847	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+848	848	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+849	849	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+850	850	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+851	851	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+852	852	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+853	853	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+854	854	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+855	855	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+856	856	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+857	857	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+858	858	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+859	859	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+860	860	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+861	861	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+862	862	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+863	863	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+864	864	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+865	865	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+866	866	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+867	867	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+868	868	^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+869	869	^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+870	870	\x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,}	2	0	0	1
+871	871	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+872	872	appid\x3a\s+2	2	0	0	1
+873	873	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+874	874	\x22mining\x2E(subscribe|authorize)\x22	2	0	0	1
+875	875	^\s*(<var>[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start	2	0	0	1
+876	876	^\/api\/(bit|lite)coin\/balance\/	2	0	0	1
+877	877	miner[^a-z]	2	0	0	1
+878	878	(\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22)	2	0	0	1
+879	879	(\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22)	2	0	0	1
+880	880	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+881	881	\/tmp\/[^\/]+\.swf$	2	0	0	1
+882	882	name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22	2	0	0	1
+883	883	name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22	2	0	0	1
+884	884	=[0-9a-f]{8}\.jar/H	2	0	0	1
+885	885	^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\?	2	0	0	1
+886	886	^\/[a-z0-9]{32}\?s=1$	2	0	0	1
+887	887	^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))	2	0	0	1
+888	888	^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>]	2	0	0	1
+889	889	^(mous)?\.class	2	0	0	1
+890	890	\/chrome\/google_chrome_(update|installer)\.exe$	2	0	0	1
+891	891	^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+892	892	^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P	2	0	0	1
+893	893	findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$	2	0	0	1
+894	894	^[^=]+[^\x22\x27\x3b]*?(<q>[\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m	2	0	0	1
+895	895	\.php\?cashe=\d+$	2	0	0	1
+896	896	\.jar\?m=[1-2]$	2	0	0	1
+897	897	\.pdf\?p=1&s=[1-2]$	2	0	0	1
+898	898	Host\x3a [^\r\n]+?\.bit\r\n$/Hmi	2	0	0	1
+899	899	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[^\/\.]+$	2	0	0	1
+900	900	\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$	2	0	0	1
+901	901	\/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+902	902	\/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+903	903	\/tds\/[a-f0-9]{32}$	2	0	0	1
+904	904	^[a-f0-9]{32}[\x22\x27]	2	0	0	1
+905	905	Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi	2	0	0	1
+906	906	(\.\.\/)+kboxwww\/tmp\/	2	0	0	1
+907	907	^(<var>.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22	2	0	0	1
+908	908	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+909	909	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+910	910	\/\?[0-9a-f]{60,66}[\;\d\x2c]*$	2	0	0	1
+911	911	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15}	2	0	0	1
+912	912	\/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php	2	0	0	1
+913	913	debugenableplugins=[a-zA-Z0-9]+?\x3b	2	0	0	1
+914	914	^\/[a-z0-9]+\/load\.php$	2	0	0	1
+915	915	^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H	2	0	0	1
+916	916	^\/xteas\/code$	2	0	0	1
+917	917	\/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash=	2	0	0	1
+918	918	=\w{8}\.pdf/Hi	2	0	0	1
+919	919	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[A-Za-z0-9]+$	2	0	0	1
+920	920	User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$/H	2	0	0	1
+921	921	Host\x3a\s.+\.in\r?$/Hmi	2	0	0	1
+922	922	name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22	2	0	0	1
+923	923	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+924	924	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+925	925	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+926	926	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+927	927	Location\x3a\x20[a-f0-9]{32}\/e\.html\r$/Hm	2	0	0	1
+928	928	^\/(v(1\/buckets\/default\/ext-5dkJ19tFufpMZjVJbsWCiqDcclDw\/records|4\/links\/activity-stream|3\/links\/ping-centre)|gp\/(aj\/private\/reviewsGallery\/get-(application-resource|image-gallery-asset)s|cerberus\/gv)|en-us\/(p\/(onerf\/MeSilentPassport|book-2\/8MCPZJJCC98C)|store\/api\/checkproductinwishlist)|wp-(content\/themes\/am43-6\/dist\/records|includes\/js\/script\/indigo-migrate)|api2\/json\/(cluster\/(resource|task)s|access\/ticket))	2	0	0	1
+929	929	^(\/updates|\/license\/eula|\/docs\/office|\/software-activation)	2	0	0	1
+930	930	^GET\s(\/((v(i-assets\/static-asset|[12]\/preference)|idcta\/translation)s|ads\/google))	2	0	0	1
+931	931	^([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9_\/\+\-]{2}==|[a-zA-Z0-9_\/\+\-]{3}=|[a-zA-Z0-9_\/\+\-]{4})\x3b	2	0	0	1
+932	932	^(\/track|\/api\/v1\/survey\/embed|\/svc\/weather\/v2)	2	0	0	1
+933	933	\/api\/v1\/user\/(512|124)\/avatar	2	0	0	1
+934	934	^GET [^\r\n]{0,256}&parent_request_id=([A-Za-z0-9_\/\+\-%]{128,1024})={0,2}[^\r\n]{0,256} HTTP\/1\.[01]	2	0	0	1
+935	935	^\/v1\/(queue|profile|docs\/wsdl|pull)	2	0	0	1
+936	936	^GET\s(\/USAT-GUP\/user\/|\/entertainment\/|\/entertainment\/navdd-q1a2z3Z6TET4gv2PNfXpaJAniOzOajK7M\.min\.json|\/global-q1a2z3C4M2nNlQYzWhCC0oMSEFjQbW1KA\.min\.json|\/life\/|\/news\/weather\/|\/opinion\/|\/sports\/|\/sports\/navdd-q1a2z3JHa8KzCRLOQAnDoVywVWF7UwxJs\.min\.json|\/tangstatic\/js\/main-q1a2z3b37df2b1\.min\.js|\/tangstatic\/js\/pbjsandwich-q1a2z300ab4198\.min\.js|\/tangstatic\/js\/pg-q1a2z3bbc110a4\.min\.js|\/tangsvc\/pg\/3221104001\/|\/tangsvc\/pg\/5059005002\/|\/tangsvc\/pg\/5066496002\/|\/tech\/|\/travel\/)	2	0	0	1
+937	937	^POST\s(\/v4\/links\/check-activity\/check|\/v1\/stats|\/gql|\/api2\/json\/check\/ticket|\/1.5\/95648064\/storage\/history|\/1.5\/95648064\/storage\/tabs|\/u\/0\/_\/og\/botguard\/get|\/ev\/prd001001|\/ev\/ext001001|\/gp\/aw\/ybh\/handlers|\/v3\/links\/ping-beat\/check)	2	0	0	1
+938	938	^[^\n]*[\x00-\x08\x0e-\x1f]	2	0	0	1
+939	939	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+940	940	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+941	941	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+942	942	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+943	943	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+944	944	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(IMCON|IMC)[\s\w,/-]*(//(X1|MR))	2	0	0	1
+945	945	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+946	946	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+947	947	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+948	948	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+949	949	(TOP\s|T)(SECRET|S)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+950	950	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+951	951	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+952	952	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+953	953	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+954	954	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+955	955	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+956	956	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+957	957	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+958	958	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+959	959	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+960	960	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+961	961	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+962	962	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+963	963	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+964	964	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+965	965	\[\[\d{1,3}\,\[\\\"\w\\\"\,\\\"[email protected].+\\\"\,\\\"	2	0	0	1
+966	966	User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER	2	0	0	1
+967	967	\x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20)	2	0	0	1
+968	968	PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20)	2	0	0	1
+969	969	\x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\s*\x29\x3Aend\s+function\x3A	2	0	0	1
+970	970	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000	2	0	0	1
+971	971	filename\s*=\s*"WU_Details_.....\.zip	2	0	0	1
+972	972	filename\s*=\s*MySpace_document_[0-9]{5}\.zip	2	0	0	1
+973	973	filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22	2	0	0	1
+974	974	filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22	2	0	0	1
+975	975	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E	2	0	0	1
+976	976	MyValue=[a-f0-9]{32}	2	0	0	1
+977	977	\x0d\x0aUser-Agent\: 0\:0\:[^\n]{120}	2	0	0	1
+978	978	User-Agent\: 0\:0\:[^\x0a|\x0d]{128}	2	0	0	1
+979	979	01E04581-4EEE-11D0-BFE9-00AA005B4383|AF604EFE-8897-11D1-B944-00A0C90312E1|7849596A-48EA-486E-8937-A2A3009F31A9|FBEB8A05-BEEE-4442-804E-409D6C4515E9|3050F391-98B5-11CF-BB82-00AA00BDCE0B|8EE42293-C315-11D0-8D6F-00A0C9A06E1F|2A6EB050-7F1C-11CE-BE57-00AA0051FE20|510A4910-7F1C-11CE-BE57-00AA0051FE20|6D36CE10-7F1C-11CE-BE57-00AA0051FE20|860D28D0-8BF4-11CE-BE59-00AA0051FE20|9478F640-7F1C-11CE-BE57-00AA0051FE20|B0516FF0-7F1C-11CE-BE57-00AA0051FE20|D99F7670-7F1A-11CE-BE57-00AA0051FE20	2	0	0	1
+980	980	(\.\.\/){1,}	2	0	0	1
+981	981	\/cgi-bin\/pr2\.cgi\?[a-zA-Z0-9]{172}	2	0	0	1
+982	982	03D9F3F2-B0E3-11D2-B081-006008039BF0|860BB310-5D01-11D0-BD3B-00A0C911CE86|E0F158E1-CB04-11D0-BD4E-00A0C911CE86|33D9A761-90C8-11D0-BD43-00A0C911CE86|4EFE2452-168A-11D1-BC76-00C04FB9453B|33D9A760-90C8-11D0-BD43-00A0C911CE86|33D9A762-90C8-11D0-BD43-00A0C911CE86|083863F1-70DE-11D0-BD40-00A0C911CE86|18AB439E-FCF4-40D4-90DA-F79BAA3B0655|31087270-D348-432C-899E-2D2F38FF29A0|D2923B86-15F1-46FF-A19A-DE825F919576|FD78D554-4C6E-11D0-970D-00A0C9191601|52CA3BCF-3B9B-419E-A3D6-5D28C0B0B50C	2	0	0	1
+983	983	4FAAB301-CEF6-477C-9F58-F601039E9B78|6CBE0382-A879-4D2A-8EC3-1F2A43611BA8|F117831B-C052-11D1-B1C0-00C04FC2F3EF|3050F667-98B5-11CF-BB82-00AA00BDCE0B|1AA06BA1-0E88-11D1-8391-00C04FBD7C09|F28D867A-DDB1-11D3-B8E8-00A0C981AEEB|6B7F1602-D44C-11D0-A7D9-AE3D17000000|7007ACCF-3202-11D1-AAD2-00805FC1270E|992CFFA0-F557-101A-88EC-00DD010CCC48|00020420-0000-0000-C000-000000000046|0006F02A-0000-0000-C000-000000000046|ABBA001B-3075-11D6-88A4-00B0D0200F88|CE292861-FC88-11D0-9E69-00C04FD7C15B	2	0	0	1
+984	984	php\?r=\d+&p=	2	0	0	1
+985	985	\/socks\.php\?name=[^&]+&port=\d{1,5}$	2	0	0	1
+986	986	SELECT.+FROM	2	0	0	1
+987	987	UNION\s+SELECT	2	0	0	1
+988	988	INSERT.+INTO	2	0	0	1
+989	989	DELETE.+FROM	2	0	0	1
+990	990	ASCII\(.+SELECT	2	0	0	1
+991	991	UPDATE.+SET	2	0	0	1
+992	992	EEED4C20-7F1B-11CE-BE57-00AA0051FE20|C7B6C04A-CBB5-11D0-BB4C-00C04FC2F410|85BBD920-42A0-1069-A2E4-08002B30309D|E846F0A0-D367-11D1-8286-00A0C9231C29|B4B3AECB-DFD6-11D1-9DAA-00805F85CFE3|ECABB0BF-7F19-11D2-978E-0000F8757E2A|466D66FA-9616-11D2-9342-0000F875AE17|67DCC487-AA48-11D1-8F4F-00C04FB611C7|00022613-0000-0000-C000-000000000046|D2D588B5-D081-11D0-99E0-00C04FC2F8EC|5D08B586-343A-11D0-AD46-00C04FD8FDFF|CC7BFB42-F175-11D1-A392-00E0291F3959|CC7BFB43-F175-11D1-A392-00E0291F3959|3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5	2	0	0	1
+993	993	BC5F1E51-5110-11D1-AFF5-006097C9A284|F27CE930-4CA3-11D1-AFF2-006097C9A284|3BC4F3A7-652A-11D1-B4D4-00C04FC2DB8D|ECABAFC2-7F19-11D2-978E-0000F8757E2A|283807B8-2C60-11D0-A31D-00AA00B92C03|250770F3-6AF2-11CF-A915-008029E31FCD|D24D4453-1F01-11D1-8E63-006097D2DF48|03CB9467-FD9D-42A8-82F9-8615B4223E6E|598EBA02-B49A-11D2-A1C1-00609778EA66|8FE7E181-BB96-11D2-A1CB-00609778EA66|4CFB5280-800B-4367-848F-5A13EBF27F1D|B3E0E785-BD78-4366-9560-B7DABE2723BE|208DD6A3-E12B-4755-9607-2E39EF84CFC5	2	0	0	1
+994	994	6E227101-F799-11CF-9227-00AA00A1EB95|7057E952-BD1B-11D1-8919-00C04FC2C836|7007ACC7-3202-11D1-AAD2-00805FC1270E|4622AD11-FF23-11D0-8D34-00A0C90F2719|98CB4060-D3E7-42A1-8D65-949D34EBFE14|47C6C527-6204-4F91-849D-66E234DEE015|35CEC8A3-2BE6-11D2-8773-92E220524153|730F6CDC-2C86-11D2-8773-92E220524153|2C10A98F-D64F-43B4-BED6-DD0E1BF2074C|6F9F3481-84DD-4B14-B09C-6B4288ECCDE8|8E26BFC1-AFD6-11CF-BFFC-00AA003CFDFC|F0975AFE-5C7F-11D2-8B74-00104B2AFB41	2	0	0	1
+995	995	index\.php\?q=(uggc|jjj|http|www|aHR0c|d3d3)	2	0	0	1
+996	996	(file=\|.+\|)	2	0	0	1
+997	997	SELECT.+FROM	2	0	0	1
+998	998	UNION\s+SELECT	2	0	0	1
+999	999	INSERT.+INTO	2	0	0	1
+1000	1000	DELETE.+FROM	2	0	0	1
\ No newline at end of file
diff --git a/test/benchmark/regex_rules/REGEX_200 b/test/benchmark/regex_rules/REGEX_200
new file mode 100644
index 0000000..23f235a
--- /dev/null
+++ b/test/benchmark/regex_rules/REGEX_200
@@ -0,0 +1,201 @@
+200
+1	1	User-Agent:\s.*.abc.net	2	0	0	1
+2	2	(#\d{1,2}){20}	2	0	0	1
+3	3	(((DestFile|encryptPass)\x3D[^\x26]{50})|((BaseDN|SearchFilter)\x3D[^\x26]{128}))	2	0	0	1
+4	4	(((c|l)pi\x00.{1}(-\d|0)\x21)|(columns\x00.{1}(-\d|0)\x21)|(page-(right|left|top|bottom)\x00.{1}(-\d|0|([3-9]\d{5}|24\d{4}|236\d{3}|23593\d{1}|23592[2-9])\x21)))	2	0	0	1
+5	5	(,\d{1,3}){20}	2	0	0	1
+6	6	(3BFFE033-BF43-11d5-A271-00A024A51325|iNotes6\.iNotes6|E008A543-CEFB-4559-912F-C27C2B89F13B|dwa7\.dwa7)	2	0	0	1
+7	7	(?P<obj>[A-Z\d_]+)\.DataURL\s*=\s*(\x22[^\x22]{128}|\x27[^\x27]{128})	2	0	0	1
+8	8	(Context|Action)\x3D[^\x26\x3b]{1024}	2	0	0	1
+9	9	(DisableSandboxAndDrop|ConfusedClass|FieldAccessVerifierExpl)\.class	2	0	0	1
+10	10	(INSERT|UPDATE)\s*[\s\w]*((mysql\.)?func)[^\r\n]+values\s*\([^\)]+\x2c[\x22\x27][^\x22\x27]*\x2f	2	0	0	1
+11	11	(Image|Doc)	2	0	0	1
+12	12	(OvAcceptLang|Accept-Language)\s*[\x3D\x3A]\s*[^\n]{69}	2	0	0	1
+13	13	(OvJavaScript|OvTitleFrame|OvHelpWindow|OvMap|OvSession|OvJavaLocale|OvOSLocale|OvWebSession)\s*\x3D[^\x3B\x2C]{1024}	2	0	0	1
+14	14	(Set|Check)\x10Properties	2	0	0	1
+15	15	(USER|PASS)[^\x80-\xff]*[\x80-\xff]	2	0	0	1
+16	16	([sp]key|csk)=[^\r\n\x26]+(script|onclick|onload|onmouseover|html|[\x22\x27\x3c\x3e\x28\x29])	2	0	0	1
+17	17	(\x22|\x27)daap\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+18	18	(\x22|\x27)itms\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+19	19	(\x22|\x27)itmss\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+20	20	(\x22|\x27)itpc\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+21	21	(\x22|\x27)pcast\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+22	22	(\x25(n|t|d)\x20){85}	2	0	0	1
+23	23	(\x3F|\x26)[^\x3D]*(\x27|%27)[^\x3D]*(\x3C|%3c)script(\x3E|%3e)	2	0	0	1
+24	24	(\x40\x09.{19}|\x41\x0b.{23})[\xf0-\xff].{8}\x01\x00[\x00\x01\x02\x04\x08\x10\x18\x20]\x00	2	0	0	1
+25	25	(^|&)SelectedID=[^&]+?(\x3B|%3B)	2	0	0	1
+26	26	(^|&)paths(%5b|\x5b)(%5d|\x5d)=[^&]*?(%2e|\x2e){2}(%2f|\x2f)	2	0	0	1
+27	27	(^|&)selectedLocale=[^&]+?([\x22\x27]|%22|%27)	2	0	0	1
+28	28	(^|[\x3b\x7b\x7d]|%3b|%7b|%7d)O(%3a|\x3a)(\x2b|%2b)?[0-9]+?(%3a|\x3a)(%22|\x22)	2	0	0	1
+29	29	(action|setup)=[a-z]{1,4}	2	0	0	1
+30	30	(arg=[^\x26]*?OVwSelection[^\x26]*?\x26.*?sel=[^\s\x26]{1023}|sel=[^\x26]{1023,}\x26.*?arg=[^\s\x26]*?OVwSelection)	2	0	0	1
+31	31	(caption,\x22\x5c\x5c\x5c|\x22\x5cn\x5cn\x5cn\x22\x20\x2b\x20str)	2	0	0	1
+32	32	(data_select1|nameParams|schdParams|text1|schd_select1)=[^\x26]{512}	2	0	0	1
+33	33	(displayWidth[\x2b\x20]\d[^\x2b\s\n]{128})	2	0	0	1
+34	34	(filename|type)=[^\x26]*?\x2E\x2E	2	0	0	1
+35	35	(ora_osb_bgcookie|rbtool)=[^\x20\x26\x3b]{1}	2	0	0	1
+36	36	(sIda\/sId|urua\/uru)[abcd]\.classPK	2	0	0	1
+37	37	.{20}[\x01\x02]\x00\x03\x00.*?\x5c\x00\x5c\x00	2	0	0	1
+38	38	5FDC81917DE08A41A6AC(E9B8ECA1EE.8|.98ECB1EEA8E)	2	0	0	1
+39	39	<FILE>(\x2e\x2e\x5c|%2E%2E%5C){2}[^<]+?</FILE>	2	0	0	1
+40	40	<SelectedID>[^<]+?(\x3B|%3B)	2	0	0	1
+41	41	<[^>]*?style\s*[>=].{1,1024}margin\s*\x3a\s*[^\x3b\x7d]*?-(\d{4}|1[0-9][1-9]|[2-9]\d\d)[ce][mx].*?[\x7b\x3b]	2	0	0	1
+42	42	<\?(php)?.{1,256}define\s*\x28\s*str_repeat\s*\x28\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s*\x2c\s*\x24argv	2	0	0	1
+43	43	<\s*object[^>]*?data\s*\x3A[^,>]*?base64	2	0	0	1
+44	44	<\s*valitem[^>]*\s(value|name)\s*=\s*([\x22\x27])[^\x22\x27]{104}	2	0	0	1
+45	45	<\x21DOCTYPE\s+[^>]*?SYSTEM[^>]*?>.*?\x2EparseError	2	0	0	1
+46	46	<\x21ENTITY[^>]+SYSTEM[^>]+http\x3A\x2F\x2F[^>\s]+http\x3A\x2F\x2F	2	0	0	1
+47	47	<applet[^>]+(archive|src)\s*?=\s*?(\x22|\x27|)\s*?(\d{5}\.jar|[^>]+\/\d{5}\.jar)	2	0	0	1
+48	48	<figure[^>]+?dir\s*?=\s*?[\x22\x27]\s*?rtl\s*?[\x22\x27].*?(&#?x?[a-z\d]{2,4}\x3b){100}	2	0	0	1
+49	49	<iframe[^>]*?height\x3d\s*[\x22\x27]?\s*[0-9]{6}	2	0	0	1
+50	50	<script[^>]*?for\s*=\s*[\x22\x27]?.*?event\s*=\s*[\x22\x27]?onpropertychange[\x22\x27]?[^>]*?>	2	0	0	1
+51	51	<script[^>]*src\s*=\s*[\x22\x27][^\x22\x27]*\.json[\x22\x27][^>]*language=vbs	2	0	0	1
+52	52	<title>CRiMEPACK [\d\.]+</title>	2	0	0	1
+53	53	<treechildren.*?ordinal=.*?<treechildren	2	0	0	1
+54	54	<zombis>\s*<JUNIPER-M3>.*?</JUNIPER-M3>\s*</zombis>	2	0	0	1
+55	55	AdminServlet.*(userid|adminurl)[^\x26\x20\x0a]*<script	2	0	0	1
+56	56	Authorization\s*\x3A\s*Basic\s*[^\n]{437}	2	0	0	1
+57	57	Collab\x2EaddStateModel\s*\x28\s*\x7B.*cName\s*\x3A\s*\x22(\x22|\x5Cx00)	2	0	0	1
+58	58	ComputerName\s*\x3d\s*\x22[^\x22]{256}	2	0	0	1
+59	59	Content-Type\x3A\s*misc/ultravox.+?(\r?\n){2}\x5A.9\x01	2	0	0	1
+60	60	CreationDate\x28[^\x3c\x29]{500}	2	0	0	1
+61	61	DBMS_ASSERT\x2Esimple_sql_name\x28[^\x29\x22]*?\x22	2	0	0	1
+62	62	EnteredAttrName=[^&]{32}	2	0	0	1
+63	63	Entry\x20\x2f[^\x2f]*\x2f[^\x2f]{68}	2	0	0	1
+64	64	ExecWB\s*\x28\s*[^\x2c\x29]*(7|IDM_PRINTPREVIEW)[^\x29]+http\x3a\x2f\x2f	2	0	0	1
+65	65	FILECODE=[^&]{96}	2	0	0	1
+66	66	HEADER[\x20\r]*\n[\x20]*9[\x20\r]*\n\x24[^\n]{92}	2	0	0	1
+67	67	HTTP\/1.[01]\r\nUser\x2dAgent\x3a\x20[ -~]+\r\nHost\x3a\x20[a-z0-9\x2d\x2e]+\.info\r\n	2	0	0	1
+68	68	HostList=([^\r\n\x3B]{,296}\x3B)*[^\r\n\x3B]{297}	2	0	0	1
+69	69	Host\x3A\s*[^\x0D\x0A]{121}	2	0	0	1
+70	70	Hostname\x3D[^\x26\x3F\x3B\x0D\x0A\s]{300}	2	0	0	1
+71	71	ICount\x3D\x2D[^\x26\x3F\x3B\x0D\x0A\s]{300}	2	0	0	1
+72	72	IP=(https?|ftps?)	2	0	0	1
+73	73	InformixServerList=([^\r\n\x3B]{,293}\x3B)*[^\r\n\x3B]{294}	2	0	0	1
+74	74	Libs\/Starter(CmdExec|NetUtils|Rec|ScreenShots|Settings)\.py	2	0	0	1
+75	75	Math\x2efloor([^\x7d]{1,3})?\x7dcatch\x28	2	0	0	1
+76	76	Math\x2eround([^\x7d]{1,3})?\x7dcatch\x28	2	0	0	1
+77	77	MaxAge\x3D[^\x26\x3F\x3B\x0D\x0A]{300}	2	0	0	1
+78	78	Oid\x3D[^\x0D\x0A]{1000}	2	0	0	1
+79	79	OvAcceptLang\s*\x3d\s*[^\x3b\n]{300}	2	0	0	1
+80	80	OvOSLocale\s*\x3d\s*[^\x3b\s]{249}	2	0	0	1
+81	81	Referer\x3a[^\x0d\x0a]*\/world\/	2	0	0	1
+82	82	Referer\x3a\s*?http\x3a\x2f{2}[a-z0-9\x2e\x2d]+\x2fs\x2f\x3fk\x3d	2	0	0	1
+83	83	RegExp?\x23.{0,5}\x28\x3f[^\x29]{0,4}i.*?\x28\x3f\x2d[^\x29]{0,4}i.{0,50}\x7c\x7c	2	0	0	1
+84	84	SET_(SENDFROM|MAILHOST)\x28\x27[^\x27]{256}	2	0	0	1
+85	85	SOAPAction\x3A\s*?\x22[^\x22\x23]+?\x23([^\x22]{2048}|[^\x22]+$)	2	0	0	1
+86	86	SYS\.LT\.FINDRICSET\([^,\)]*\'\'\|\|	2	0	0	1
+87	87	SYS\x2eDBMS\x5fAQADM\x5fSYS\x2eGRANT\x5fTYPE\x5fACCESS\s*\x28\s*\x27[^\x2c\x20\x27]*[\x2c\x20]	2	0	0	1
+88	88	SelectedSubTabId=[^>]*?([\x22\x27]|%22|%27)\s*?>\s*?<[^>]*?script	2	0	0	1
+89	89	SignUrl=[^\x26\s]*[\x22\x27\x28\x29\x3C\x3E]	2	0	0	1
+90	90	SoftwareRegistration\.do.*?updateRegn=[^\x26\r\n]+(script|onclick|onload|onmouseover|html)	2	0	0	1
+91	91	TMlogonEncrypted=(\!|\%21)CRYPT(\!|\%21)[A-Z0-9]{512}	2	0	0	1
+92	92	Template\x3D[^\x0D\x0A]{1000}	2	0	0	1
+93	93	TimerMethod\x3D[^\x26]*[\x3C\x28\x22\x27]	2	0	0	1
+94	94	USER\s*[^\x0d]+\x25\x27	2	0	0	1
+95	95	User-Agent\:[^\x0a\x0d]+?Havij	2	0	0	1
+96	96	User-Agent\x3A\s+?mus[\x0d\x0a]	2	0	0	1
+97	97	User-Agent\x3a[^\x0d\x0a]*Java\/1\.	2	0	0	1
+98	98	User-Agent\x3a\x20Agent\d{5,9}	2	0	0	1
+99	99	User-Agent\x3a\x20[^\n]*?WinHttp\x2eWinHttpRequest.*?\n	2	0	0	1
+100	100	Visio \x28TM\x29 Drawing\r\n\x00{4}([^\x00]|\x00[^\x00]|\x00\x00[^\x01-\x06\x0b]|\x00\x00[\x01-\x06\x0b][^\x00])	2	0	0	1
+101	101	[1-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}	2	0	0	1
+102	102	[?&](CallbackParam|CallbackFn)=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|eval|script|onload|src)	2	0	0	1
+103	103	[?&](k|u|cs)=[^&]+?<	2	0	0	1
+104	104	[?&](path|file)Name=[^&]*?\x2e\x2e\x2f	2	0	0	1
+105	105	[?&](search|topic)=[^&]*?(\x27|%27)(\s*|(%20)*)(\x3b|%3b)	2	0	0	1
+106	106	[?&]SelectedSubTabId=[^&]*?([\x22\x27\x3c\x3e\x28\x29]|onload|src)	2	0	0	1
+107	107	[?&]Using=_layouts/query.iqy.*?&List=[^&]+(script|src|location|document|onlick|onload)	2	0	0	1
+108	108	[?&]appName=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+109	109	[?&]arg=[^-][^+&$]{189}	2	0	0	1
+110	110	[?&]configName=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+111	111	[?&]filename=[^&]*?[\x22\x27][^&]*?\x3B	2	0	0	1
+112	112	[?&]iprange=[^&]{68}	2	0	0	1
+113	113	[?&]key=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+114	114	[?&]name=(\x5c\x5c|%5c%5c)	2	0	0	1
+115	115	[?&]name=[^&]*\x2e\x2e\x2f[^&]*\x2e\x2e\x2f[^&]*\x2e\x2e\x2f	2	0	0	1
+116	116	[?&]name=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+117	117	[?&]site2pstoretoken=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+118	118	[\x35\x36\x41\x42\x44-\x49]\x00\x00	2	0	0	1
+119	119	[\x37-\x40\x43]\x00\x00	2	0	0	1
+120	120	[\x3f\x26]id=\d*[\x28\x29\x22\x27]	2	0	0	1
+121	121	[^&]+&[a-z]=[a-f0-9]{16}&[a-z]=[a-f0-9]{16}$	2	0	0	1
+122	122	[^R]CHAR\(.*?[^R]CHAR\(.*?[^R]CHAR\(.*?[^R]CHAR\(.*?[^R]CHAR\(	2	0	0	1
+123	123	[^\x3E]*?text\s*\x3D\s*(\x27[^\x27]{500}|\x22[^\x22]{500}|\S{500})	2	0	0	1
+124	124	[^\x3a\s]{309}\sPRIVMSG	2	0	0	1
+125	125	[^\x3e]{0,300}\x2fURI \x28data	2	0	0	1
+126	126	[^\x5C\x2F\x3A\x2A\x3F\x22\x3C\x3E\x7C\x3D\s]{256}\x2Eppt($|\x3f)	2	0	0	1
+127	127	[a-z0-9]{32}\.jar	2	0	0	1
+128	128	\%5b\%5f[0-9]{16}	2	0	0	1
+129	129	\&h=\d{5}$	2	0	0	1
+130	130	\.(jsp|html)\?[^\r\n]*PG=SPEEDBAR	2	0	0	1
+131	131	\.dashstyle\.array\.length\s*?=[^\x3b]*?-\s*?\d	2	0	0	1
+132	132	\.jpg\x20HTTP\/1\.[01]\r\nUser\x2dAgent\x3a\x20[a-z]+\r\nHost\x3a\x20[a-z0-9\x2d\x2e]+\.com\.br\r\n\r\n$	2	0	0	1
+133	133	\.js\/\?[a-z]+\=[a-z]{1,4}	2	0	0	1
+134	134	\.location(\.href)?\s*=\s*new\s+String\s*\x28\s*\x22\s*javascript\x3A	2	0	0	1
+135	135	\.onpropertychange\s*=\s*function[^{]*?\{[^}]*?\w+\.swapNode\x28	2	0	0	1
+136	136	\.php\?[a-z]{2,12}=[a-f0-9]{10,64}&[a-z]{2,12}=.*?&[a-z]{2,12}=	2	0	0	1
+137	137	\.php\?[a-z]{2,8}=[a-z0-9]{2}\x3a[a-z0-9]{2}\x3a[a-z0-9]{2}\x3a[a-z0-9]{2}\x3a[a-z0-9]{2}\&[a-z]{2,8}=	2	0	0	1
+138	138	\.php\?action=jv\&h=\d+	2	0	0	1
+139	139	\.php\?b=[A-F0-9]+&v=1\.	2	0	0	1
+140	140	\.php\?j=1&k=[0-9](i=[0-9])?$	2	0	0	1
+141	141	\.php\?mac\x3d([a-f0-9]{2}\x3a){5}[a-f0-9]{2}$	2	0	0	1
+142	142	\.php\?setup=d\&s=\d+\&r=\d+	2	0	0	1
+143	143	\.php\x3fw\x3d\d+\x26n\x3d\d+	2	0	0	1
+144	144	\.png$	2	0	0	1
+145	145	\.replace\x28\x2F[^\x2F]+\x2F[A-Z]*\x2C(\x22\x22|\x27\x27)	2	0	0	1
+146	146	\/$	2	0	0	1
+147	147	\/%2E%2E(\\|%5C)\/	2	0	0	1
+148	148	\/([0-9][0-9a-z]{2}|[0-9a-z][0-9][0-9a-z]|[0-9a-z]{2}[0-9])\.jar$	2	0	0	1
+149	149	\/(\\|%5C)%2E%2E\/	2	0	0	1
+150	150	\/AES\d+O\d+\.jsp\?[a-z0-9=\x2b\x2f]{20}	2	0	0	1
+151	151	\/AES\d{9}O\d{4,5}\x2ejsp	2	0	0	1
+152	152	\/CreationDate\x28[^\x3c\x29]{500}	2	0	0	1
+153	153	\/DES\d+O\d+\.jsp\?[a-z0-9=\x2b\x2f]{20}	2	0	0	1
+154	154	\/DES\d{9}O\d{4,5}\x2ejsp	2	0	0	1
+155	155	\/F[^\/>]+\.(exe|dll|swf)	2	0	0	1
+156	156	\/Java([0-9]{1,2})?\.jar\?java=[0-9]{2}	2	0	0	1
+157	157	\/La(.)*?\s*?\/F[^\/>]+\.(exe|dll|swf)	2	0	0	1
+158	158	\/MacApp\/\d{2}(-\d{2}){3}(:\d{2}){2}\.png\r\n[^\x89]+?\x89PNG	2	0	0	1
+159	159	\/OvCgi\/(jovgraph|webappmon)\.exe	2	0	0	1
+160	160	\/OvCgi\/(jovgraph|webappmon)\.exe.*?-textFile+[^+]{201}	2	0	0	1
+161	161	\/SUS\d+O\d+\.jsp\?[a-z0-9=\x2b\x2f]{20}	2	0	0	1
+162	162	\/VertexNet\/adduser\.php\?uid=\x7B[^\r\n]+\x7D\x26la[^\r\n]+\x26cmpname=	2	0	0	1
+163	163	\/VertexNet\/tasks\.php\?uid=\x7B[^\r\n]+\x7D\x26la[^\r\n]+\x26cmpname=	2	0	0	1
+164	164	\/ZES\d+O\d+\.jsp\?[a-z0-9=\x2b\x2f]{20}	2	0	0	1
+165	165	\/[a-f0-9]{16}([a-f0-9]{16})?\/ff\.php	2	0	0	1
+166	166	\/[a-f0-9]{16}\/a\.php	2	0	0	1
+167	167	\/[a-f0-9]{16}\/q\.php	2	0	0	1
+168	168	\/[a-f0-9]{32}\/a\.php	2	0	0	1
+169	169	\/[a-f0-9]{32}\/q\.php	2	0	0	1
+170	170	\/[a-z0-9]{12}\.txt$	2	0	0	1
+171	171	\/[a-zA-Z0-9]{150,}\/getmyfile\.exe\?o=1\&h=11$	2	0	0	1
+172	172	\/[a-z]{4}\.html\?h\=\d{6,7}$	2	0	0	1
+173	173	\/[a-z]{4}\.html\?i\=\d{6,7}$	2	0	0	1
+174	174	\/[a-z]{4}\.html\?j\=\d{6,7}$	2	0	0	1
+175	175	\/\?[0-9a-f]{60,66}[\;\d]*$	2	0	0	1
+176	176	\/\?id=\d+\x26AnSSip=	2	0	0	1
+177	177	\/\?java\=[0-9]{2,4}	2	0	0	1
+178	178	\/\[fx]\.jar$	2	0	0	1
+179	179	\/\d{2}\.html$	2	0	0	1
+180	180	\/api\/urls\/\?ts=[a-z0-9]+&affid=\d{5}	2	0	0	1
+181	181	\/app\/\?prj=\d\x26pid=[^\r\n]+\x26mac=	2	0	0	1
+182	182	\/blog/images/3521\.jpg\?v\d{2}=\d{2}\x26tq=	2	0	0	1
+183	183	\/count\d{2}\.php$	2	0	0	1
+184	184	\/elections\.php\?([a-z0-9]+\x3d\d{1,3}\&){9}[a-z0-9]+\x3d\d{1,3}$	2	0	0	1
+185	185	\/f\.php\?k=\d	2	0	0	1
+186	186	\/html\/license_[0-9A-F]{550,}\.html$	2	0	0	1
+187	187	\/images\/[a-zA-Z]\.php\?id\=[0-9]{2,3}(\.\d)?$	2	0	0	1
+188	188	\/index\d{9}\.asp	2	0	0	1
+189	189	\/install\.asp\?mac=[A-F\d]{12}\x26mode	2	0	0	1
+190	190	\/jdb\/inf\.php\?id=[a-f0-9]{32}$	2	0	0	1
+191	191	\/jlnp\.html$	2	0	0	1
+192	192	\/jorg\.html$	2	0	0	1
+193	193	\/jovf\.html$	2	0	0	1
+194	194	\/loader\.cpl$	2	0	0	1
+195	195	\/pdfx\.html$	2	0	0	1
+196	196	\/pte\.aspx\?ver=\d\.\d\.\d+\.\d\x26rnd=\d{5}	2	0	0	1
+197	197	\/r_autoidcnt\.asp\?mer_seq=\d[^\r\n]*\x26mac=	2	0	0	1
+198	198	\/se\/[a-f0-9]{100,200}\/[a-f0-9]{6,9}\/[A-Z0-9_]{4,200}\.com	2	0	0	1
+199	199	\/setup_b\.asp\?prj=\d\x26pid=[^\r\n]*\x26mac=	2	0	0	1
+200	200	\/stat_d\/$	2	0	0	1
\ No newline at end of file
diff --git a/test/benchmark/regex_rules/REGEX_2K b/test/benchmark/regex_rules/REGEX_2K
new file mode 100644
index 0000000..7332b1f
--- /dev/null
+++ b/test/benchmark/regex_rules/REGEX_2K
@@ -0,0 +1,2001 @@
+2000
+1	1	User-Agent:\s.*.abc.net	2	0	0	1
+2	2	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5	2	0	0	1
+3	3	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980	2	0	0	1
+4	4	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E	2	0	0	1
+5	5	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333	2	0	0	1
+6	6	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C	2	0	0	1
+7	7	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E	2	0	0	1
+8	8	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+9	9	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+10	10	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+11	11	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08	2	0	0	1
+12	12	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42	2	0	0	1
+13	13	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4	2	0	0	1
+14	14	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980	2	0	0	1
+15	15	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3	2	0	0	1
+16	16	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980	2	0	0	1
+17	17	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB	2	0	0	1
+18	18	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+19	19	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+20	20	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664	2	0	0	1
+21	21	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C	2	0	0	1
+22	22	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980	2	0	0	1
+23	23	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+24	24	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+25	25	(EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters)	2	0	0	1
+26	26	(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+27	27	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+28	28	(ReadMolFile|SaveasMolFile)	2	0	0	1
+29	29	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+30	30	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+31	31	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C	2	0	0	1
+32	32	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+33	33	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+34	34	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000	2	0	0	1
+35	35	file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+36	36	[0-9]{3,}	2	0	0	1
+37	37	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194	2	0	0	1
+38	38	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2	2	0	0	1
+39	39	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510	2	0	0	1
+40	40	(setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch)	2	0	0	1
+41	41	param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20}	2	0	0	1
+42	42	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C	2	0	0	1
+43	43	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+44	44	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79	2	0	0	1
+45	45	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD	2	0	0	1
+46	46	(Text|EditSelText|EditText|CellFontName|Archive)	2	0	0	1
+47	47	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+48	48	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c	2	0	0	1
+49	49	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B	2	0	0	1
+50	50	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA	2	0	0	1
+51	51	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted)	2	0	0	1
+52	52	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam)	2	0	0	1
+53	53	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+54	54	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8	2	0	0	1
+55	55	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E	2	0	0	1
+56	56	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726	2	0	0	1
+57	57	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598	2	0	0	1
+58	58	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E	2	0	0	1
+59	59	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E	2	0	0	1
+60	60	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E	2	0	0	1
+61	61	(exe|bat|com|dll|ini)	2	0	0	1
+62	62	(exe|bat|com|dll|ini)	2	0	0	1
+63	63	(exe|bat|com|dll|ini)	2	0	0	1
+64	64	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E	2	0	0	1
+65	65	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7	2	0	0	1
+66	66	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91	2	0	0	1
+67	67	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980	2	0	0	1
+68	68	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02	2	0	0	1
+69	69	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3	2	0	0	1
+70	70	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90	2	0	0	1
+71	71	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E	2	0	0	1
+72	72	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E	2	0	0	1
+73	73	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112	2	0	0	1
+74	74	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1	2	0	0	1
+75	75	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6	2	0	0	1
+76	76	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F	2	0	0	1
+77	77	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+78	78	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA	2	0	0	1
+79	79	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258	2	0	0	1
+80	80	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B	2	0	0	1
+81	81	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1	2	0	0	1
+82	82	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7	2	0	0	1
+83	83	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D	2	0	0	1
+84	84	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61	2	0	0	1
+85	85	(Src|Background|PackageXml)	2	0	0	1
+86	86	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters)	2	0	0	1
+87	87	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+88	88	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+89	89	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+90	90	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+91	91	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755	2	0	0	1
+92	92	(Save|SaveLayoutChanges|SaveMenuUsageData)	2	0	0	1
+93	93	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61	2	0	0	1
+94	94	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+95	95	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+96	96	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+97	97	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+98	98	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0	2	0	0	1
+99	99	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3	2	0	0	1
+100	100	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679	2	0	0	1
+101	101	(SaveFile|ExportToXML)	2	0	0	1
+102	102	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE	2	0	0	1
+103	103	(SnapShotToFile|SnapShotX)	2	0	0	1
+104	104	(SnapShotToFile|SnapShotX)	2	0	0	1
+105	105	(SnapShotToFile|SnapShotX)	2	0	0	1
+106	106	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+107	107	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28	2	0	0	1
+108	108	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003	2	0	0	1
+109	109	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+110	110	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+111	111	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+112	112	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+113	113	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE	2	0	0	1
+114	114	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB	2	0	0	1
+115	115	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile)	2	0	0	1
+116	116	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD	2	0	0	1
+117	117	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA	2	0	0	1
+118	118	(Run|SetRegistryValueAsString|PerformUpdateAsync)	2	0	0	1
+119	119	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+120	120	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+121	121	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084	2	0	0	1
+122	122	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6	2	0	0	1
+123	123	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF	2	0	0	1
+124	124	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5	2	0	0	1
+125	125	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C	2	0	0	1
+126	126	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA	2	0	0	1
+127	127	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020	2	0	0	1
+128	128	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020	2	0	0	1
+129	129	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B	2	0	0	1
+130	130	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356	2	0	0	1
+131	131	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520	2	0	0	1
+132	132	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C	2	0	0	1
+133	133	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26	2	0	0	1
+134	134	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0	2	0	0	1
+135	135	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF	2	0	0	1
+136	136	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142	2	0	0	1
+137	137	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB	2	0	0	1
+138	138	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7	2	0	0	1
+139	139	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747	2	0	0	1
+140	140	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456	2	0	0	1
+141	141	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0	2	0	0	1
+142	142	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999	2	0	0	1
+143	143	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899	2	0	0	1
+144	144	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5	2	0	0	1
+145	145	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E	2	0	0	1
+146	146	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F	2	0	0	1
+147	147	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9	2	0	0	1
+148	148	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F	2	0	0	1
+149	149	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448	2	0	0	1
+150	150	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92	2	0	0	1
+151	151	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F	2	0	0	1
+152	152	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED	2	0	0	1
+153	153	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB	2	0	0	1
+154	154	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305	2	0	0	1
+155	155	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7	2	0	0	1
+156	156	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B	2	0	0	1
+157	157	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C	2	0	0	1
+158	158	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627	2	0	0	1
+159	159	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E	2	0	0	1
+160	160	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE	2	0	0	1
+161	161	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496	2	0	0	1
+162	162	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0	2	0	0	1
+163	163	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E	2	0	0	1
+164	164	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C	2	0	0	1
+165	165	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53	2	0	0	1
+166	166	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014	2	0	0	1
+167	167	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+168	168	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+169	169	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741	2	0	0	1
+170	170	(SaveToBMP|SaveToFile)	2	0	0	1
+171	171	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2	2	0	0	1
+172	172	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667	2	0	0	1
+173	173	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+174	174	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+175	175	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+176	176	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D	2	0	0	1
+177	177	(SaveBarCode|SaveEnhWMF)	2	0	0	1
+178	178	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B	2	0	0	1
+179	179	<object\s*[^>]*\s*classid\s*=\s*(.+<q1>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>)	2	0	0	1
+180	180	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000	2	0	0	1
+181	181	(exe|bat|com|dll|ini)	2	0	0	1
+182	182	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E	2	0	0	1
+183	183	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E	2	0	0	1
+184	184	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87	2	0	0	1
+185	185	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+186	186	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+187	187	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+188	188	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+189	189	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+190	190	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E	2	0	0	1
+191	191	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344	2	0	0	1
+192	192	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C	2	0	0	1
+193	193	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30	2	0	0	1
+194	194	(Packagefiles|SaveDna|SetIdentity|AddFile)	2	0	0	1
+195	195	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9	2	0	0	1
+196	196	(_DOWText)|(_MonthText)	2	0	0	1
+197	197	(SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour)	2	0	0	1
+198	198	classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE	2	0	0	1
+199	199	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+200	200	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+201	201	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F	2	0	0	1
+202	202	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5	2	0	0	1
+203	203	[\w\W]{2500,}	2	0	0	1
+204	204	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3	2	0	0	1
+205	205	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8	2	0	0	1
+206	206	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04	2	0	0	1
+207	207	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue)	2	0	0	1
+208	208	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356	2	0	0	1
+209	209	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E	2	0	0	1
+210	210	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574	2	0	0	1
+211	211	(WriteIniFileString|ShellExecute)	2	0	0	1
+212	212	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906	2	0	0	1
+213	213	(txt|ini|com|exe|bat|dll|dat)	2	0	0	1
+214	214	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8	2	0	0	1
+215	215	42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733	2	0	0	1
+216	216	(Save|ExportImage)	2	0	0	1
+217	217	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790	2	0	0	1
+218	218	(DeleteFile|write)	2	0	0	1
+219	219	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+220	220	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+221	221	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+222	222	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+223	223	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967	2	0	0	1
+224	224	WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext)	2	0	0	1
+225	225	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9	2	0	0	1
+226	226	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5	2	0	0	1
+227	227	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6	2	0	0	1
+228	228	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+229	229	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+230	230	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24	2	0	0	1
+231	231	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9	2	0	0	1
+232	232	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA	2	0	0	1
+233	233	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec)	2	0	0	1
+234	234	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5	2	0	0	1
+235	235	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+236	236	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+237	237	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+238	238	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83	2	0	0	1
+239	239	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA	2	0	0	1
+240	240	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566	2	0	0	1
+241	241	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+242	242	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+243	243	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B	2	0	0	1
+244	244	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F	2	0	0	1
+245	245	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+246	246	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+247	247	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED	2	0	0	1
+248	248	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619	2	0	0	1
+249	249	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E	2	0	0	1
+250	250	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258	2	0	0	1
+251	251	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196	2	0	0	1
+252	252	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E	2	0	0	1
+253	253	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD	2	0	0	1
+254	254	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4	2	0	0	1
+255	255	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118	2	0	0	1
+256	256	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616	2	0	0	1
+257	257	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+258	258	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+259	259	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+260	260	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11	2	0	0	1
+261	261	(ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1	2	0	0	1
+262	262	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020	2	0	0	1
+263	263	(PostURL|AddSeperator|AddString|Post)	2	0	0	1
+264	264	(SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF)	2	0	0	1
+265	265	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>)	2	0	0	1
+266	266	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\>	2	0	0	1
+267	267	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\>	2	0	0	1
+268	268	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\>	2	0	0	1
+269	269	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\>	2	0	0	1
+270	270	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+271	271	(Buildpath|GetDriveName|DriveExists|DeleteFile)	2	0	0	1
+272	272	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+273	273	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+274	274	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+275	275	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>)	2	0	0	1
+276	276	\x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission]	2	0	0	1
+277	277	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\>	2	0	0	1
+278	278	000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F	2	0	0	1
+279	279	(javascript|http|ftp|vbscript)	2	0	0	1
+280	280	(SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen)	2	0	0	1
+281	281	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000	2	0	0	1
+282	282	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407	2	0	0	1
+283	283	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414	2	0	0	1
+284	284	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+285	285	(AddAttachment|SubmitToExpress)	2	0	0	1
+286	286	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6	2	0	0	1
+287	287	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0	2	0	0	1
+288	288	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D	2	0	0	1
+289	289	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile)	2	0	0	1
+290	290	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\>	2	0	0	1
+291	291	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\>	2	0	0	1
+292	292	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC	2	0	0	1
+293	293	src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape	2	0	0	1
+294	294	(LogFile|ClearLogFile|SaveToFile)	2	0	0	1
+295	295	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)	2	0	0	1
+296	296	User-Agent\x3a Downloader \d\.\d\r	2	0	0	1
+297	297	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P	2	0	0	1
+298	298	^((\r?\n\r?\n).)*?\r?\n\r?\nMZ	2	0	0	1
+299	299	instructions\/\d{2}\.xml	2	0	0	1
+300	300	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp	2	0	0	1
+301	301	\/updatestats\/update\d+?\.xml$	2	0	0	1
+302	302	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab	2	0	0	1
+303	303	ctxad-\d+\.sig	2	0	0	1
+304	304	/user\d+/counter\.htm	2	0	0	1
+305	305	(cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr	2	0	0	1
+306	306	(discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe	2	0	0	1
+307	307	loaderadv\d+\.jar	2	0	0	1
+308	308	\/adv\/\d+\/win32\.exe	2	0	0	1
+309	309	\/Message\/\S+\/\S+\.xml	2	0	0	1
+310	310	\/abt\?data=\S{150}	2	0	0	1
+311	311	User-Agent\x3a.+ZangoToolbar.+\r	2	0	0	1
+312	312	User-Agent\:[^\n]+wbi_v\d/iH	2	0	0	1
+313	313	User-Agent\x3a[^\n]+AskBar/iH	2	0	0	1
+314	314	\/tbrequest\d+\.php	2	0	0	1
+315	315	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+316	316	sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+317	317	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+318	318	cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+319	319	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+320	320	UID=\d	2	0	0	1
+321	321	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+322	322	REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P	2	0	0	1
+323	323	victim\.php\?\d\d\d\d\d	2	0	0	1
+324	324	\/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d	2	0	0	1
+325	325	\/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+	2	0	0	1
+326	326	&ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d	2	0	0	1
+327	327	\/sd\?s=\d+&f=\d&C=\d	2	0	0	1
+328	328	\.txt$	2	0	0	1
+329	329	\.cfg$	2	0	0	1
+330	330	User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H	2	0	0	1
+331	331	Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r	2	0	0	1
+332	332	\x00[\x02-\x1E][0-9]{2,30}\x02cn\x00	2	0	0	1
+333	333	\x00[\x02-\x1E][0-9]{2,30}\x02ru\x00	2	0	0	1
+334	334	^[A-F0-9]+$	2	0	0	1
+335	335	\/sd\?s=\d+&f=\d	2	0	0	1
+336	336	loadadv\d+\.exe	2	0	0	1
+337	337	\/ms\d\d\dcfg\.jsp	2	0	0	1
+338	338	^0x[0-9a-f]+$	2	0	0	1
+339	339	^[^a-z]*?[0-9]{2,30}\.ru$	2	0	0	1
+340	340	filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe	2	0	0	1
+341	341	^MM \d\.\d+$	2	0	0	1
+342	342	^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4}	2	0	0	1
+343	343	^\w+pcsetup_\w+	2	0	0	1
+344	344	\x2Fv[0-9]{3,4}[\x2F\x3F]	2	0	0	1
+345	345	[a-f0-9]{32}\?v=	2	0	0	1
+346	346	^\/[a-z]{2}\x3Fv\x3D[0-9]$	2	0	0	1
+347	347	^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$	2	0	0	1
+348	348	^\/entrance\?s1=[a-f0-9]{100,}$	2	0	0	1
+349	349	^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=	2	0	0	1
+350	350	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+351	351	^[0-9][a-z]+	2	0	0	1
+352	352	\.php$	2	0	0	1
+353	353	^\/([^\x2f]+\/)*log\/\?[bc]=	2	0	0	1
+354	354	^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/))	2	0	0	1
+355	355	^\/\?pcrc=\d+&v=[\d.]+$	2	0	0	1
+356	356	^\/\?v=[\d.]+&pcrc=\d+$	2	0	0	1
+357	357	\/v\d\/[^.]+\.asp$	2	0	0	1
+358	358	\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$	2	0	0	1
+359	359	\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$	2	0	0	1
+360	360	^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$	2	0	0	1
+361	361	^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$	2	0	0	1
+362	362	\?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})	2	0	0	1
+363	363	^Downloader\s\d+\.\d+$	2	0	0	1
+364	364	^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100}	2	0	0	1
+365	365	\/get_xml\?(file_id|stb)=	2	0	0	1
+366	366	(_[a-z]{2}){1,3}_[a-z]{3}_install\.exe	2	0	0	1
+367	367	\d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows	2	0	0	1
+368	368	^[a-zA-Z0-9_-]+$	2	0	0	1
+369	369	^\/([a-zA-Z0-9]|%2[fb]){400,}$	2	0	0	1
+370	370	User-Agent\:[^\n]+searchengine	2	0	0	1
+371	371	User-Agent\:[^\n]+SurferPlugin	2	0	0	1
+372	372	User-Agent\:[^\n]+THNALL[^\n]+\.EXE	2	0	0	1
+373	373	User-Agent\:[^\n]+XupiterToolbar	2	0	0	1
+374	374	User-Agent\:[^\n]+spywareaxe	2	0	0	1
+375	375	User-Agent\:[^\n]+iMeshBar	2	0	0	1
+376	376	User-Agent\:[^\n]+Oemji	2	0	0	1
+377	377	^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$	2	0	0	1
+378	378	^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$	2	0	0	1
+379	379	^\/(get|install)\/\?q=	2	0	0	1
+380	380	^\/[a-f0-9]{50,}$	2	0	0	1
+381	381	^\/[\w-]{50,}$	2	0	0	1
+382	382	^\/\?pcrc=[0-9]{7,10}$	2	0	0	1
+383	383	^Downloader \d\.\d$	2	0	0	1
+384	384	\/Socks[45]\.txt$	2	0	0	1
+385	385	^Feat[^\r\n]+(Install|Updat)er	2	0	0	1
+386	386	User-Agent\:[^\n]+host(ie|oe|oi|ol)	2	0	0	1
+387	387	User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}	2	0	0	1
+388	388	^BWL(\sToplist|\d_UPDATE)	2	0	0	1
+389	389	^\x2F[A-F0-9]{25,40}$	2	0	0	1
+390	390	^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$	2	0	0	1
+391	391	^\d+\sHTTP/1.1$	2	0	0	1
+392	392	^[a-zA-Z0-9_-]+	2	0	0	1
+393	393	[a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12}	2	0	0	1
+394	394	\/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id=	2	0	0	1
+395	395	\{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\}	2	0	0	1
+396	396	CN=([^\r\n]+?\.)?showmypc\.com(\.)	2	0	0	1
+397	397	^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$	2	0	0	1
+398	398	(SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk)	2	0	0	1
+399	399	(DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog)	2	0	0	1
+400	400	\d{13}$	2	0	0	1
+401	401	^[a-f0-9]{32}	2	0	0	1
+402	402	^[a-f0-9]{32}\"	2	0	0	1
+403	403	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+404	404	^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}	2	0	0	1
+405	405	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+406	406	^[A-F0-9]{12}	2	0	0	1
+407	407	^[A-Z0-9]{9}	2	0	0	1
+408	408	^\d+[^\r\n\s]+	2	0	0	1
+409	409	^ SQL[-_ ]Server	2	0	0	1
+410	410	^ \d+ Driver	2	0	0	1
+411	411	ORA-\d{4}	2	0	0	1
+412	412	Warning.*\Woci_	2	0	0	1
+413	413	Warning.*\Wora_	2	0	0	1
+414	414	CLI Driver.*DB2	2	0	0	1
+415	415	bdb2_\w+\(	2	0	0	1
+416	416	Exception.*Informix	2	0	0	1
+417	417	Warning.*SQLite3::	2	0	0	1
+418	418	SQL error.*POS\([0-9]+\)	2	0	0	1
+419	419	Warning.*maxdb	2	0	0	1
+420	420	i?Warning.*sybase	2	0	0	1
+421	421	Warning.*ingres_	2	0	0	1
+422	422	Warning.*sqlite_	2	0	0	1
+423	423	Ingres\W.*Driver	2	0	0	1
+424	424	Exception (condition )\d+\. Transaction rollback\.	2	0	0	1
+425	425	SQL Server.*?error \x27[0-9a-f]{8}	2	0	0	1
+426	426	^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$	2	0	0	1
+427	427	^(<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll	2	0	0	1
+428	428	^...\x30\x82..\x02\x82...{256,257}	2	0	0	1
+429	429	\/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php	2	0	0	1
+430	430	\/notify\/(single|mass)$	2	0	0	1
+431	431	a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php)	2	0	0	1
+432	432	Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a	2	0	0	1
+433	433	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+434	434	[-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10}	2	0	0	1
+435	435	^\d+(\+|\-|\\|\*)\d+	2	0	0	1
+436	436	^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9	2	0	0	1
+437	437	^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u	2	0	0	1
+438	438	ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b	2	0	0	1
+439	439	^\d{4}[01]	2	0	0	1
+440	440	^\d{4}[01]	2	0	0	1
+441	441	^\d{4}[01]	2	0	0	1
+442	442	^\d{4}[01]	2	0	0	1
+443	443	^\d{4}[01]	2	0	0	1
+444	444	^\d{4}[01]	2	0	0	1
+445	445	^\d{4}[01]	2	0	0	1
+446	446	^\d{4}[01]	2	0	0	1
+447	447	^\d{4}[01]	2	0	0	1
+448	448	^\d{4}[01]	2	0	0	1
+449	449	^\d{4}[01]	2	0	0	1
+450	450	^\d{4}[01]	2	0	0	1
+451	451	^\d{4}[01]	2	0	0	1
+452	452	^\d{4}[01]	2	0	0	1
+453	453	^\d{4}[01]	2	0	0	1
+454	454	^\d{4}[01]	2	0	0	1
+455	455	^\d{4}[01]	2	0	0	1
+456	456	^\d{4}[01]	2	0	0	1
+457	457	^\d{4}[01]	2	0	0	1
+458	458	^\d{4}[01]	2	0	0	1
+459	459	^\d{4}[01]	2	0	0	1
+460	460	^\d{4}[01]	2	0	0	1
+461	461	^\d{4}[01]	2	0	0	1
+462	462	^\d{4}[01]	2	0	0	1
+463	463	^\d{4}[01]	2	0	0	1
+464	464	^\d{4}[01]	2	0	0	1
+465	465	^\d{4}[01]	2	0	0	1
+466	466	^\d{4}[01]	2	0	0	1
+467	467	^\d{4}[01]	2	0	0	1
+468	468	^\d{4}[01]	2	0	0	1
+469	469	^\d{4}[01]	2	0	0	1
+470	470	^\d{4}[01]	2	0	0	1
+471	471	^\d{4}[01]	2	0	0	1
+472	472	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+473	473	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+474	474	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+475	475	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+476	476	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+477	477	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+478	478	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+479	479	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+480	480	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+481	481	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+482	482	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+483	483	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+484	484	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+485	485	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+486	486	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+487	487	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+488	488	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+489	489	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+490	490	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+491	491	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+492	492	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+493	493	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+494	494	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+495	495	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+496	496	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+497	497	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+498	498	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+499	499	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+500	500	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+501	501	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+502	502	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+503	503	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+504	504	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+505	505	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+506	506	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+507	507	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+508	508	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+509	509	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+510	510	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+511	511	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+512	512	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+513	513	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+514	514	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+515	515	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+516	516	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+517	517	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+518	518	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+519	519	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+520	520	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+521	521	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+522	522	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+523	523	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+524	524	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+525	525	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+526	526	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+527	527	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+528	528	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+529	529	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+530	530	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+531	531	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+532	532	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+533	533	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+534	534	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+535	535	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+536	536	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+537	537	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+538	538	^\d{4}[01]	2	0	0	1
+539	539	^\d{4}[01]	2	0	0	1
+540	540	^\d{4}[01]	2	0	0	1
+541	541	^\d{4}[01]	2	0	0	1
+542	542	^\d{4}[01]	2	0	0	1
+543	543	^\d{4}[01]	2	0	0	1
+544	544	^\d{4}[01]	2	0	0	1
+545	545	^\d{4}[01]	2	0	0	1
+546	546	^\d{4}[01]	2	0	0	1
+547	547	^\d{4}[01]	2	0	0	1
+548	548	^\d{4}[01]	2	0	0	1
+549	549	^\d{4}[01]	2	0	0	1
+550	550	^\d{4}[01]	2	0	0	1
+551	551	^\d{4}[01]	2	0	0	1
+552	552	^\d{4}[01]	2	0	0	1
+553	553	^\d{4}[01]	2	0	0	1
+554	554	^\d{4}[01]	2	0	0	1
+555	555	^\d{4}[01]	2	0	0	1
+556	556	^\d{4}[01]	2	0	0	1
+557	557	^\d{4}[01]	2	0	0	1
+558	558	^\d{4}[01]	2	0	0	1
+559	559	^\d{4}[01]	2	0	0	1
+560	560	^\d{4}[01]	2	0	0	1
+561	561	^\d{4}[01]	2	0	0	1
+562	562	^\d{4}[01]	2	0	0	1
+563	563	^\d{4}[01]	2	0	0	1
+564	564	^\d{4}[01]	2	0	0	1
+565	565	^\d{4}[01]	2	0	0	1
+566	566	^\d{4}[01]	2	0	0	1
+567	567	^\d{4}[01]	2	0	0	1
+568	568	^\d{4}[01]	2	0	0	1
+569	569	^\d{4}[01]	2	0	0	1
+570	570	^\d{4}[01]	2	0	0	1
+571	571	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+572	572	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+573	573	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+574	574	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+575	575	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+576	576	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+577	577	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+578	578	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+579	579	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+580	580	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+581	581	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+582	582	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+583	583	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+584	584	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+585	585	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+586	586	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+587	587	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+588	588	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+589	589	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+590	590	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+591	591	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+592	592	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+593	593	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+594	594	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+595	595	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+596	596	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+597	597	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+598	598	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+599	599	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+600	600	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+601	601	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+602	602	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+603	603	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+604	604	^\d{4}[01]	2	0	0	1
+605	605	^\d{4}[01]	2	0	0	1
+606	606	^\d{4}[01]	2	0	0	1
+607	607	^\d{4}[01]	2	0	0	1
+608	608	^\d{4}[01]	2	0	0	1
+609	609	^\d{4}[01]	2	0	0	1
+610	610	^\d{4}[01]	2	0	0	1
+611	611	^\d{4}[01]	2	0	0	1
+612	612	^\d{4}[01]	2	0	0	1
+613	613	^\d{4}[01]	2	0	0	1
+614	614	^\d{4}[01]	2	0	0	1
+615	615	^\d{4}[01]	2	0	0	1
+616	616	^\d{4}[01]	2	0	0	1
+617	617	^\d{4}[01]	2	0	0	1
+618	618	^\d{4}[01]	2	0	0	1
+619	619	^\d{4}[01]	2	0	0	1
+620	620	^\d{4}[01]	2	0	0	1
+621	621	^\d{4}[01]	2	0	0	1
+622	622	^\d{4}[01]	2	0	0	1
+623	623	^\d{4}[01]	2	0	0	1
+624	624	^\d{4}[01]	2	0	0	1
+625	625	^\d{4}[01]	2	0	0	1
+626	626	^\d{4}[01]	2	0	0	1
+627	627	^\d{4}[01]	2	0	0	1
+628	628	^\d{4}[01]	2	0	0	1
+629	629	^\d{4}[01]	2	0	0	1
+630	630	^\d{4}[01]	2	0	0	1
+631	631	^\d{4}[01]	2	0	0	1
+632	632	^\d{4}[01]	2	0	0	1
+633	633	^\d{4}[01]	2	0	0	1
+634	634	^\d{4}[01]	2	0	0	1
+635	635	^\d{4}[01]	2	0	0	1
+636	636	^\d{4}[01]	2	0	0	1
+637	637	^\d{4}[01]	2	0	0	1
+638	638	^\d{4}[01]	2	0	0	1
+639	639	^\d{4}[01]	2	0	0	1
+640	640	^\d{4}[01]	2	0	0	1
+641	641	^\d{4}[01]	2	0	0	1
+642	642	^\d{4}[01]	2	0	0	1
+643	643	^\d{4}[01]	2	0	0	1
+644	644	^\d{4}[01]	2	0	0	1
+645	645	^\d{4}[01]	2	0	0	1
+646	646	^\d{4}[01]	2	0	0	1
+647	647	^\d{4}[01]	2	0	0	1
+648	648	^\d{4}[01]	2	0	0	1
+649	649	^\d{4}[01]	2	0	0	1
+650	650	^\d{4}[01]	2	0	0	1
+651	651	^\d{4}[01]	2	0	0	1
+652	652	^\d{4}[01]	2	0	0	1
+653	653	^\d{4}[01]	2	0	0	1
+654	654	^\d{4}[01]	2	0	0	1
+655	655	^\d{4}[01]	2	0	0	1
+656	656	^\d{4}[01]	2	0	0	1
+657	657	^\d{4}[01]	2	0	0	1
+658	658	^\d{4}[01]	2	0	0	1
+659	659	^\d{4}[01]	2	0	0	1
+660	660	^\d{4}[01]	2	0	0	1
+661	661	^\d{4}[01]	2	0	0	1
+662	662	^\d{4}[01]	2	0	0	1
+663	663	^\d{4}[01]	2	0	0	1
+664	664	^\d{4}[01]	2	0	0	1
+665	665	^\d{4}[01]	2	0	0	1
+666	666	^\d{4}[01]	2	0	0	1
+667	667	^\d{4}[01]	2	0	0	1
+668	668	^\d{4}[01]	2	0	0	1
+669	669	^\d{4}[01]	2	0	0	1
+670	670	^\d{4}[01]	2	0	0	1
+671	671	^\d{4}[01]	2	0	0	1
+672	672	^\d{4}[01]	2	0	0	1
+673	673	^\d{4}[01]	2	0	0	1
+674	674	^\d{4}[01]	2	0	0	1
+675	675	^\d{4}[01]	2	0	0	1
+676	676	^\d{4}[01]	2	0	0	1
+677	677	^\d{4}[01]	2	0	0	1
+678	678	^\d{4}[01]	2	0	0	1
+679	679	^\d{4}[01]	2	0	0	1
+680	680	^\d{4}[01]	2	0	0	1
+681	681	^\d{4}[01]	2	0	0	1
+682	682	^\d{4}[01]	2	0	0	1
+683	683	^\d{4}[01]	2	0	0	1
+684	684	^\d{4}[01]	2	0	0	1
+685	685	^\d{4}[01]	2	0	0	1
+686	686	^\d{4}[01]	2	0	0	1
+687	687	^\d{4}[01]	2	0	0	1
+688	688	^\d{4}[01]	2	0	0	1
+689	689	^\d{4}[01]	2	0	0	1
+690	690	^\d{4}[01]	2	0	0	1
+691	691	^\d{4}[01]	2	0	0	1
+692	692	^\d{4}[01]	2	0	0	1
+693	693	^\d{4}[01]	2	0	0	1
+694	694	^\d{4}[01]	2	0	0	1
+695	695	^\d{4}[01]	2	0	0	1
+696	696	^\d{4}[01]	2	0	0	1
+697	697	^\d{4}[01]	2	0	0	1
+698	698	^\d{4}[01]	2	0	0	1
+699	699	^\d{4}[01]	2	0	0	1
+700	700	^\d{4}[01]	2	0	0	1
+701	701	^\d{4}[01]	2	0	0	1
+702	702	^\d{4}[01]	2	0	0	1
+703	703	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+704	704	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+705	705	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+706	706	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+707	707	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+708	708	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+709	709	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+710	710	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+711	711	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+712	712	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+713	713	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+714	714	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+715	715	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+716	716	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+717	717	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+718	718	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+719	719	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+720	720	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+721	721	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+722	722	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+723	723	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+724	724	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+725	725	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+726	726	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+727	727	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+728	728	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+729	729	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+730	730	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+731	731	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+732	732	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+733	733	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+734	734	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+735	735	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+736	736	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+737	737	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+738	738	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+739	739	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+740	740	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+741	741	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+742	742	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+743	743	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+744	744	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+745	745	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+746	746	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+747	747	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+748	748	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+749	749	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+750	750	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+751	751	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+752	752	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+753	753	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+754	754	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+755	755	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+756	756	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+757	757	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+758	758	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+759	759	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+760	760	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+761	761	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+762	762	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+763	763	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+764	764	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+765	765	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+766	766	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+767	767	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+768	768	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+769	769	^\d{4}[01]	2	0	0	1
+770	770	^\d{4}[01]	2	0	0	1
+771	771	^\d{4}[01]	2	0	0	1
+772	772	^\d{4}[01]	2	0	0	1
+773	773	^\d{4}[01]	2	0	0	1
+774	774	^\d{4}[01]	2	0	0	1
+775	775	^\d{4}[01]	2	0	0	1
+776	776	^\d{4}[01]	2	0	0	1
+777	777	^\d{4}[01]	2	0	0	1
+778	778	^\d{4}[01]	2	0	0	1
+779	779	^\d{4}[01]	2	0	0	1
+780	780	^\d{4}[01]	2	0	0	1
+781	781	^\d{4}[01]	2	0	0	1
+782	782	^\d{4}[01]	2	0	0	1
+783	783	^\d{4}[01]	2	0	0	1
+784	784	^\d{4}[01]	2	0	0	1
+785	785	^\d{4}[01]	2	0	0	1
+786	786	^\d{4}[01]	2	0	0	1
+787	787	^\d{4}[01]	2	0	0	1
+788	788	^\d{4}[01]	2	0	0	1
+789	789	^\d{4}[01]	2	0	0	1
+790	790	^\d{4}[01]	2	0	0	1
+791	791	^\d{4}[01]	2	0	0	1
+792	792	^\d{4}[01]	2	0	0	1
+793	793	^\d{4}[01]	2	0	0	1
+794	794	^\d{4}[01]	2	0	0	1
+795	795	^\d{4}[01]	2	0	0	1
+796	796	^\d{4}[01]	2	0	0	1
+797	797	^\d{4}[01]	2	0	0	1
+798	798	^\d{4}[01]	2	0	0	1
+799	799	^\d{4}[01]	2	0	0	1
+800	800	^\d{4}[01]	2	0	0	1
+801	801	^\d{4}[01]	2	0	0	1
+802	802	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+803	803	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+804	804	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+805	805	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+806	806	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+807	807	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+808	808	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+809	809	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+810	810	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+811	811	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+812	812	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+813	813	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+814	814	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+815	815	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+816	816	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+817	817	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+818	818	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+819	819	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+820	820	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+821	821	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+822	822	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+823	823	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+824	824	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+825	825	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+826	826	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+827	827	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+828	828	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+829	829	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+830	830	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+831	831	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+832	832	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+833	833	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+834	834	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+835	835	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+836	836	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+837	837	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+838	838	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+839	839	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+840	840	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+841	841	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+842	842	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+843	843	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+844	844	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+845	845	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+846	846	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+847	847	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+848	848	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+849	849	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+850	850	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+851	851	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+852	852	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+853	853	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+854	854	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+855	855	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+856	856	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+857	857	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+858	858	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+859	859	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+860	860	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+861	861	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+862	862	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+863	863	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+864	864	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+865	865	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+866	866	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+867	867	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+868	868	^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+869	869	^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+870	870	\x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,}	2	0	0	1
+871	871	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+872	872	appid\x3a\s+2	2	0	0	1
+873	873	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+874	874	\x22mining\x2E(subscribe|authorize)\x22	2	0	0	1
+875	875	^\s*(<var>[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start	2	0	0	1
+876	876	^\/api\/(bit|lite)coin\/balance\/	2	0	0	1
+877	877	miner[^a-z]	2	0	0	1
+878	878	(\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22)	2	0	0	1
+879	879	(\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22)	2	0	0	1
+880	880	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+881	881	\/tmp\/[^\/]+\.swf$	2	0	0	1
+882	882	name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22	2	0	0	1
+883	883	name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22	2	0	0	1
+884	884	=[0-9a-f]{8}\.jar/H	2	0	0	1
+885	885	^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\?	2	0	0	1
+886	886	^\/[a-z0-9]{32}\?s=1$	2	0	0	1
+887	887	^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))	2	0	0	1
+888	888	^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>]	2	0	0	1
+889	889	^(mous)?\.class	2	0	0	1
+890	890	\/chrome\/google_chrome_(update|installer)\.exe$	2	0	0	1
+891	891	^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+892	892	^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P	2	0	0	1
+893	893	findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$	2	0	0	1
+894	894	^[^=]+[^\x22\x27\x3b]*?(<q>[\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m	2	0	0	1
+895	895	\.php\?cashe=\d+$	2	0	0	1
+896	896	\.jar\?m=[1-2]$	2	0	0	1
+897	897	\.pdf\?p=1&s=[1-2]$	2	0	0	1
+898	898	Host\x3a [^\r\n]+?\.bit\r\n	2	0	0	1
+899	899	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[^\/\.]+$	2	0	0	1
+900	900	\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$	2	0	0	1
+901	901	\/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+902	902	\/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+903	903	\/tds\/[a-f0-9]{32}$	2	0	0	1
+904	904	^[a-f0-9]{32}[\x22\x27]	2	0	0	1
+905	905	Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi	2	0	0	1
+906	906	(\.\.\/)+kboxwww\/tmp\/	2	0	0	1
+907	907	^(<var>.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22	2	0	0	1
+908	908	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+909	909	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+910	910	\/\?[0-9a-f]{60,66}[\;\d\x2c]*$	2	0	0	1
+911	911	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15}	2	0	0	1
+912	912	\/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php	2	0	0	1
+913	913	debugenableplugins=[a-zA-Z0-9]+?\x3b	2	0	0	1
+914	914	^\/[a-z0-9]+\/load\.php$	2	0	0	1
+915	915	^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H	2	0	0	1
+916	916	^\/xteas\/code$	2	0	0	1
+917	917	\/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash=	2	0	0	1
+918	918	=\w{8}\.pdf/Hi	2	0	0	1
+919	919	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[A-Za-z0-9]+$	2	0	0	1
+920	920	User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)	2	0	0	1
+921	921	Host\x3a\s.+\.in	2	0	0	1
+922	922	name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22	2	0	0	1
+923	923	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+924	924	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+925	925	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+926	926	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+927	927	Location\x3a\x20[a-f0-9]{32}\/e\.html	2	0	0	1
+928	928	^\/(v(1\/buckets\/default\/ext-5dkJ19tFufpMZjVJbsWCiqDcclDw\/records|4\/links\/activity-stream|3\/links\/ping-centre)|gp\/(aj\/private\/reviewsGallery\/get-(application-resource|image-gallery-asset)s|cerberus\/gv)|en-us\/(p\/(onerf\/MeSilentPassport|book-2\/8MCPZJJCC98C)|store\/api\/checkproductinwishlist)|wp-(content\/themes\/am43-6\/dist\/records|includes\/js\/script\/indigo-migrate)|api2\/json\/(cluster\/(resource|task)s|access\/ticket))	2	0	0	1
+929	929	^(\/updates|\/license\/eula|\/docs\/office|\/software-activation)	2	0	0	1
+930	930	^GET\s(\/((v(i-assets\/static-asset|[12]\/preference)|idcta\/translation)s|ads\/google))	2	0	0	1
+931	931	^([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9_\/\+\-]{2}==|[a-zA-Z0-9_\/\+\-]{3}=|[a-zA-Z0-9_\/\+\-]{4})\x3b	2	0	0	1
+932	932	^(\/track|\/api\/v1\/survey\/embed|\/svc\/weather\/v2)	2	0	0	1
+933	933	\/api\/v1\/user\/(512|124)\/avatar	2	0	0	1
+934	934	^GET [^\r\n]{0,256}&parent_request_id=([A-Za-z0-9_\/\+\-%]{128,1024})={0,2}[^\r\n]{0,256} HTTP\/1\.[01]	2	0	0	1
+935	935	^\/v1\/(queue|profile|docs\/wsdl|pull)	2	0	0	1
+936	936	^GET\s(\/USAT-GUP\/user\/|\/entertainment\/|\/entertainment\/navdd-q1a2z3Z6TET4gv2PNfXpaJAniOzOajK7M\.min\.json|\/global-q1a2z3C4M2nNlQYzWhCC0oMSEFjQbW1KA\.min\.json|\/life\/|\/news\/weather\/|\/opinion\/|\/sports\/|\/sports\/navdd-q1a2z3JHa8KzCRLOQAnDoVywVWF7UwxJs\.min\.json|\/tangstatic\/js\/main-q1a2z3b37df2b1\.min\.js|\/tangstatic\/js\/pbjsandwich-q1a2z300ab4198\.min\.js|\/tangstatic\/js\/pg-q1a2z3bbc110a4\.min\.js|\/tangsvc\/pg\/3221104001\/|\/tangsvc\/pg\/5059005002\/|\/tangsvc\/pg\/5066496002\/|\/tech\/|\/travel\/)	2	0	0	1
+937	937	^POST\s(\/v4\/links\/check-activity\/check|\/v1\/stats|\/gql|\/api2\/json\/check\/ticket|\/1.5\/95648064\/storage\/history|\/1.5\/95648064\/storage\/tabs|\/u\/0\/_\/og\/botguard\/get|\/ev\/prd001001|\/ev\/ext001001|\/gp\/aw\/ybh\/handlers|\/v3\/links\/ping-beat\/check)	2	0	0	1
+938	938	^[^\n]*[\x00-\x08\x0e-\x1f]	2	0	0	1
+939	939	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+940	940	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+941	941	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+942	942	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+943	943	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+944	944	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(IMCON|IMC)[\s\w,/-]*(//(X1|MR))	2	0	0	1
+945	945	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+946	946	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+947	947	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+948	948	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+949	949	(TOP\s|T)(SECRET|S)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+950	950	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+951	951	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+952	952	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+953	953	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+954	954	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+955	955	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+956	956	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+957	957	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+958	958	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+959	959	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+960	960	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+961	961	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+962	962	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+963	963	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+964	964	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+965	965	\[\[\d{1,3}\,\[\\\"\w\\\"\,\\\"[email protected].+\\\"\,\\\"	2	0	0	1
+966	966	User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER	2	0	0	1
+967	967	\x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20)	2	0	0	1
+968	968	PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20)	2	0	0	1
+969	969	\x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\s*\x29\x3Aend\s+function\x3A	2	0	0	1
+970	970	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000	2	0	0	1
+971	971	filename\s*=\s*"WU_Details_.....\.zip	2	0	0	1
+972	972	filename\s*=\s*MySpace_document_[0-9]{5}\.zip	2	0	0	1
+973	973	filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22	2	0	0	1
+974	974	filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22	2	0	0	1
+975	975	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E	2	0	0	1
+976	976	MyValue=[a-f0-9]{32}	2	0	0	1
+977	977	\x0d\x0aUser-Agent\: 0\:0\:[^\n]{120}	2	0	0	1
+978	978	User-Agent\: 0\:0\:[^\x0a|\x0d]{128}	2	0	0	1
+979	979	01E04581-4EEE-11D0-BFE9-00AA005B4383|AF604EFE-8897-11D1-B944-00A0C90312E1|7849596A-48EA-486E-8937-A2A3009F31A9|FBEB8A05-BEEE-4442-804E-409D6C4515E9|3050F391-98B5-11CF-BB82-00AA00BDCE0B|8EE42293-C315-11D0-8D6F-00A0C9A06E1F|2A6EB050-7F1C-11CE-BE57-00AA0051FE20|510A4910-7F1C-11CE-BE57-00AA0051FE20|6D36CE10-7F1C-11CE-BE57-00AA0051FE20|860D28D0-8BF4-11CE-BE59-00AA0051FE20|9478F640-7F1C-11CE-BE57-00AA0051FE20|B0516FF0-7F1C-11CE-BE57-00AA0051FE20|D99F7670-7F1A-11CE-BE57-00AA0051FE20	2	0	0	1
+980	980	(\.\.\/){1,}	2	0	0	1
+981	981	\/cgi-bin\/pr2\.cgi\?[a-zA-Z0-9]{172}	2	0	0	1
+982	982	03D9F3F2-B0E3-11D2-B081-006008039BF0|860BB310-5D01-11D0-BD3B-00A0C911CE86|E0F158E1-CB04-11D0-BD4E-00A0C911CE86|33D9A761-90C8-11D0-BD43-00A0C911CE86|4EFE2452-168A-11D1-BC76-00C04FB9453B|33D9A760-90C8-11D0-BD43-00A0C911CE86|33D9A762-90C8-11D0-BD43-00A0C911CE86|083863F1-70DE-11D0-BD40-00A0C911CE86|18AB439E-FCF4-40D4-90DA-F79BAA3B0655|31087270-D348-432C-899E-2D2F38FF29A0|D2923B86-15F1-46FF-A19A-DE825F919576|FD78D554-4C6E-11D0-970D-00A0C9191601|52CA3BCF-3B9B-419E-A3D6-5D28C0B0B50C	2	0	0	1
+983	983	4FAAB301-CEF6-477C-9F58-F601039E9B78|6CBE0382-A879-4D2A-8EC3-1F2A43611BA8|F117831B-C052-11D1-B1C0-00C04FC2F3EF|3050F667-98B5-11CF-BB82-00AA00BDCE0B|1AA06BA1-0E88-11D1-8391-00C04FBD7C09|F28D867A-DDB1-11D3-B8E8-00A0C981AEEB|6B7F1602-D44C-11D0-A7D9-AE3D17000000|7007ACCF-3202-11D1-AAD2-00805FC1270E|992CFFA0-F557-101A-88EC-00DD010CCC48|00020420-0000-0000-C000-000000000046|0006F02A-0000-0000-C000-000000000046|ABBA001B-3075-11D6-88A4-00B0D0200F88|CE292861-FC88-11D0-9E69-00C04FD7C15B	2	0	0	1
+984	984	php\?r=\d+&p=	2	0	0	1
+985	985	\/socks\.php\?name=[^&]+&port=\d{1,5}$	2	0	0	1
+986	986	SELECT.+FROM	2	0	0	1
+987	987	UNION\s+SELECT	2	0	0	1
+988	988	INSERT.+INTO	2	0	0	1
+989	989	DELETE.+FROM	2	0	0	1
+990	990	ASCII\(.+SELECT	2	0	0	1
+991	991	UPDATE.+SET	2	0	0	1
+992	992	EEED4C20-7F1B-11CE-BE57-00AA0051FE20|C7B6C04A-CBB5-11D0-BB4C-00C04FC2F410|85BBD920-42A0-1069-A2E4-08002B30309D|E846F0A0-D367-11D1-8286-00A0C9231C29|B4B3AECB-DFD6-11D1-9DAA-00805F85CFE3|ECABB0BF-7F19-11D2-978E-0000F8757E2A|466D66FA-9616-11D2-9342-0000F875AE17|67DCC487-AA48-11D1-8F4F-00C04FB611C7|00022613-0000-0000-C000-000000000046|D2D588B5-D081-11D0-99E0-00C04FC2F8EC|5D08B586-343A-11D0-AD46-00C04FD8FDFF|CC7BFB42-F175-11D1-A392-00E0291F3959|CC7BFB43-F175-11D1-A392-00E0291F3959|3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5	2	0	0	1
+993	993	BC5F1E51-5110-11D1-AFF5-006097C9A284|F27CE930-4CA3-11D1-AFF2-006097C9A284|3BC4F3A7-652A-11D1-B4D4-00C04FC2DB8D|ECABAFC2-7F19-11D2-978E-0000F8757E2A|283807B8-2C60-11D0-A31D-00AA00B92C03|250770F3-6AF2-11CF-A915-008029E31FCD|D24D4453-1F01-11D1-8E63-006097D2DF48|03CB9467-FD9D-42A8-82F9-8615B4223E6E|598EBA02-B49A-11D2-A1C1-00609778EA66|8FE7E181-BB96-11D2-A1CB-00609778EA66|4CFB5280-800B-4367-848F-5A13EBF27F1D|B3E0E785-BD78-4366-9560-B7DABE2723BE|208DD6A3-E12B-4755-9607-2E39EF84CFC5	2	0	0	1
+994	994	6E227101-F799-11CF-9227-00AA00A1EB95|7057E952-BD1B-11D1-8919-00C04FC2C836|7007ACC7-3202-11D1-AAD2-00805FC1270E|4622AD11-FF23-11D0-8D34-00A0C90F2719|98CB4060-D3E7-42A1-8D65-949D34EBFE14|47C6C527-6204-4F91-849D-66E234DEE015|35CEC8A3-2BE6-11D2-8773-92E220524153|730F6CDC-2C86-11D2-8773-92E220524153|2C10A98F-D64F-43B4-BED6-DD0E1BF2074C|6F9F3481-84DD-4B14-B09C-6B4288ECCDE8|8E26BFC1-AFD6-11CF-BFFC-00AA003CFDFC|F0975AFE-5C7F-11D2-8B74-00104B2AFB41	2	0	0	1
+995	995	index\.php\?q=(uggc|jjj|http|www|aHR0c|d3d3)	2	0	0	1
+996	996	(file=\|.+\|)	2	0	0	1
+997	997	SELECT.+FROM	2	0	0	1
+998	998	UNION\s+SELECT	2	0	0	1
+999	999	INSERT.+INTO	2	0	0	1
+1000	1000	DELETE.+FROM	2	0	0	1
+1001	1001	ASCII\(.+SELECT	2	0	0	1
+1002	1002	UPDATE.+SET	2	0	0	1
+1003	1003	SELECT.+FROM	2	0	0	1
+1004	1004	UNION\s+SELECT	2	0	0	1
+1005	1005	INSERT.+INTO	2	0	0	1
+1006	1006	DELETE.+FROM	2	0	0	1
+1007	1007	ASCII\(.+SELECT	2	0	0	1
+1008	1008	UPDATE.+SET	2	0	0	1
+1009	1009	SELECT.+FROM	2	0	0	1
+1010	1010	UNION\s+SELECT	2	0	0	1
+1011	1011	INSERT.+INTO	2	0	0	1
+1012	1012	DELETE.+FROM	2	0	0	1
+1013	1013	ASCII\(.+SELECT	2	0	0	1
+1014	1014	UPDATE.+SET	2	0	0	1
+1015	1015	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+1016	1016	filename=\x22Facebook_(Password|Support|Document)_[A-Z0-9]{4,7}\.zip\x22	2	0	0	1
+1017	1017	\x2FU3D\x2FLength\x20172[0-5][0-9]{2}	2	0	0	1
+1018	1018	\/000[a-z][0-9]{3}\x2Eso	2	0	0	1
+1019	1019	\/000[a-z][0-9]{3}\x2Eexe	2	0	0	1
+1020	1020	UPDATE.+SET	2	0	0	1
+1021	1021	PDF-.+[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F]	2	0	0	1
+1022	1022	^FOLD\s[^\n]{256}	2	0	0	1
+1023	1023	^FOLD\s+\/	2	0	0	1
+1024	1024	^Username\:[^\n]{100}	2	0	0	1
+1025	1025	^http\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1026	1026	^http\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1027	1027	^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\}	2	0	0	1
+1028	1028	^file\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1029	1029	\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JBIG2Decode](J|#4A)(B|#42)(I|#49)(G|#47)(2|#32)(D|#44)(e|#65)(c|#63)(o|#6F)(d|#64)(e|#65)	2	0	0	1
+1030	1030	OS 4_[0-3]_[1-4] like/H	2	0	0	1
+1031	1031	[a-f0-9]{16}$	2	0	0	1
+1032	1032	mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+1033	1033	(/joomla/admin|/joomla/administrator|/joomla/manage|/joomla/administration)	2	0	0	1
+1034	1034	\x3A\x02\x5B(Atk33|Exploiting|Finished|GOOGLE.*|HTTP.{0,8}|PKS-SCAN.{0,20}|Results|RSH|SCAN|TCP.{0,8}|UDP.{0,8}|v6.{0,12}|VERSION)\x5D\x02	2	0	0	1
+1035	1035	\x3A\x02(Alvo dos Pacotes|Conectando-se em|M.dia de envio|Tempo.*|Total .*)\x02	2	0	0	1
+1036	1036	NICK\x20\S+\x0AUSER\x20\S+localhost\x20localhost\x20\x3A	2	0	0	1
+1037	1037	\x3a.4\x7c.12.\x3a.4	2	0	0	1
+1038	1038	(cheguei gazelas|meh que tao|Status|Tempo|Total pacotes|Total bytes|M?dia de envio|portas? aberta)	2	0	0	1
+1039	1039	keepalive([0-9]{4}|\x7c[0-9]{4})	2	0	0	1
+1040	1040	User-Agent\x3a[^\n]+sbu-hb-	2	0	0	1
+1041	1041	User-Agent\:[^\n]+Peer Points/iH	2	0	0	1
+1042	1042	User-Agent\:[^\n]+zbu-hb-/Hi	2	0	0	1
+1043	1043	User-Agent\:[^\n]+HSN/iH	2	0	0	1
+1044	1044	User-Agent\:[^\n]+Wildtangent/iH	2	0	0	1
+1045	1045	^RMD\s+\x2f$	2	0	0	1
+1046	1046	User-Agent\x3A[^\n]+TheWorld/H	2	0	0	1
+1047	1047	^Max-dotdot[\s\r\n]*\d{3,}	2	0	0	1
+1048	1048	^Authorization\x3a Basic\s+=	2	0	0	1
+1049	1049	^Authorization\x3a Basic\s+=	2	0	0	1
+1050	1050	Host\x3a\s[a-z]{16}\.ru/H	2	0	0	1
+1051	1051	CREATE.+ENDPOINT	2	0	0	1
+1052	1052	\/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir=	2	0	0	1
+1053	1053	MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w	2	0	0	1
+1054	1054	MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w	2	0	0	1
+1055	1055	\x00[0-9]{4,7}\x02co\x00	2	0	0	1
+1056	1056	\x2fsogou(config)?\x2f	2	0	0	1
+1057	1057	\/\d{8,}\/\d{4,}\/\d{4,}\.jsp	2	0	0	1
+1058	1058	adv\d+\.php	2	0	0	1
+1059	1059	a=\%[0-9a-fA-F]{2}\&b	2	0	0	1
+1060	1060	\Wcustomer\slist(s)?\W	2	0	0	1
+1061	1061	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1062	1062	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1063	1063	\Wannual\sincome(s)?\W	2	0	0	1
+1064	1064	\Wpayment\shistory\W	2	0	0	1
+1065	1065	\Waccount\sbalance(s)?\W	2	0	0	1
+1066	1066	\Wappraisal(s)?\W	2	0	0	1
+1067	1067	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1068	1068	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1069	1069	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1070	1070	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1071	1071	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1072	1072	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1073	1073	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1074	1074	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1075	1075	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1076	1076	\Winternal\suse\sonly\W	2	0	0	1
+1077	1077	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1078	1078	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1079	1079	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1080	1080	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1081	1081	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1082	1082	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1083	1083	(//)\Wconfidential[^\w/]	2	0	0	1
+1084	1084	(//)\Wrestricted[^\w/]	2	0	0	1
+1085	1085	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1086	1086	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1087	1087	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1088	1088	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1089	1089	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1090	1090	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1091	1091	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1092	1092	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1093	1093	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1094	1094	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1095	1095	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1096	1096	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1097	1097	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1098	1098	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1099	1099	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1100	1100	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1101	1101	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1102	1102	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1103	1103	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1104	1104	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1105	1105	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1106	1106	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1107	1107	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1108	1108	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1109	1109	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1110	1110	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1111	1111	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1112	1112	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1113	1113	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1114	1114	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1115	1115	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1116	1116	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1117	1117	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1118	1118	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1119	1119	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1120	1120	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1121	1121	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1122	1122	(//)\Wrestricted[^\w/]	2	0	0	1
+1123	1123	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1124	1124	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1125	1125	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1126	1126	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1127	1127	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1128	1128	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1129	1129	\Winternal\suse\sonly\W	2	0	0	1
+1130	1130	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1131	1131	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1132	1132	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1133	1133	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1134	1134	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1135	1135	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1136	1136	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1137	1137	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1138	1138	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1139	1139	\Wappraisal(s)?\W	2	0	0	1
+1140	1140	\Waccount\sbalance(s)?\W	2	0	0	1
+1141	1141	\Wannual\sincome(s)?\W	2	0	0	1
+1142	1142	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1143	1143	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1144	1144	\Wcustomer\slist(s)?\W	2	0	0	1
+1145	1145	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1146	1146	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1147	1147	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1148	1148	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1149	1149	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1150	1150	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1151	1151	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1152	1152	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1153	1153	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1154	1154	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1155	1155	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1156	1156	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1157	1157	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1158	1158	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1159	1159	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1160	1160	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1161	1161	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1162	1162	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1163	1163	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1164	1164	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1165	1165	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1166	1166	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1167	1167	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1168	1168	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1169	1169	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1170	1170	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1171	1171	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1172	1172	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1173	1173	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1174	1174	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1175	1175	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1176	1176	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1177	1177	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1178	1178	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1179	1179	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1180	1180	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1181	1181	(//)\Wrestricted[^\w/]	2	0	0	1
+1182	1182	(//)\Wconfidential[^\w/]	2	0	0	1
+1183	1183	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1184	1184	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1185	1185	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1186	1186	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1187	1187	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1188	1188	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1189	1189	\Winternal\suse\sonly\W	2	0	0	1
+1190	1190	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1191	1191	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1192	1192	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1193	1193	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1194	1194	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1195	1195	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1196	1196	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1197	1197	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1198	1198	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1199	1199	\Wappraisal(s)?\W	2	0	0	1
+1200	1200	\Waccount\sbalance(s)?\W	2	0	0	1
+1201	1201	\Wpayment\shistory\W	2	0	0	1
+1202	1202	\Wannual\sincome(s)?\W	2	0	0	1
+1203	1203	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1204	1204	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1205	1205	\Wcustomer\slist(s)?\W	2	0	0	1
+1206	1206	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1207	1207	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1208	1208	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1209	1209	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1210	1210	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1211	1211	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1212	1212	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1213	1213	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1214	1214	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1215	1215	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1216	1216	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1217	1217	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1218	1218	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1219	1219	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1220	1220	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1221	1221	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1222	1222	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1223	1223	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1224	1224	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1225	1225	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1226	1226	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1227	1227	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1228	1228	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1229	1229	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1230	1230	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1231	1231	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1232	1232	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1233	1233	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1234	1234	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1235	1235	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1236	1236	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1237	1237	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1238	1238	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1239	1239	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1240	1240	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1241	1241	User-Agent\x3a \d{6}\x0d\x0a/H	2	0	0	1
+1242	1242	(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/s\/l\/firstping	2	0	0	1
+1243	1243	\.dyndns\.((biz|info|org|tv))\x0d\x0a/iH	2	0	0	1
+1244	1244	\.dyndns-((at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work))\.com\x0d\x0a/iH	2	0	0	1
+1245	1245	\.jpg\?t\x3d\d\.\d	2	0	0	1
+1246	1246	[0-9]{1,16}[a-f]{1,16}[0-9]{1,16}$	2	0	0	1
+1247	1247	^Content-Length\x3a\s*-\d+	2	0	0	1
+1248	1248	\W[0-9]{5}\.jar	2	0	0	1
+1249	1249	machine_id={[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+}	2	0	0	1
+1250	1250	[0-9]{1,8}[a-f]{1,8}[0-9]{1,8}$	2	0	0	1
+1251	1251	^[a-z0-9]{6}..\x00\x00	2	0	0	1
+1252	1252	^[a-z0-9]{7}..\x00\x00	2	0	0	1
+1253	1253	\sLOGIN\s[^\n]*?%	2	0	0	1
+1254	1254	({(\d+}[^\n]*?\sAUTH)|AUTH\s[^\n]*?{(\d+}))	2	0	0	1
+1255	1255	^\/\?[a-f0-9]{32}$	2	0	0	1
+1256	1256	[a-z]{9}[0-9]\.exe/H	2	0	0	1
+1257	1257	\.php\?inst_result=.+&hwid=	2	0	0	1
+1258	1258	^.{1,5}[a-f0-9]{100}	2	0	0	1
+1259	1259	\/scr5\.php\?p=\d+&id=\d	2	0	0	1
+1260	1260	^User-Agent\: App\d/Hmi	2	0	0	1
+1261	1261	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$	2	0	0	1
+1262	1262	\x00\x07[a-z]{7}\x02eu\x00	2	0	0	1
+1263	1263	REGISTER.{400}	2	0	0	1
+1264	1264	\/content\/jav\d?\.jar$	2	0	0	1
+1265	1265	^\/\?[a-f0-9]{32}$	2	0	0	1
+1266	1266	\.php\?[a-z]+=[a-f0-9]{64}&[^\?]+=[a-f0-9]{20}&	2	0	0	1
+1267	1267	^HTTP\x2f1\.[01] 200	2	0	0	1
+1268	1268	\.php\?[a-z]+=(([1-2][a-z]|3[0-9])\x3a){3,}([1-2][a-z]|3[0-9])&	2	0	0	1
+1269	1269	IP\:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+1270	1270	^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$	2	0	0	1
+1271	1271	\.(jpg|png|gif|cgi)\?pr=	2	0	0	1
+1272	1272	^\/\?affid=\d+&promo_type=\d+&promo_opt=\d+$	2	0	0	1
+1273	1273	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1274	1274	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1275	1275	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1276	1276	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1277	1277	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1278	1278	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1279	1279	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1280	1280	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1281	1281	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1282	1282	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1283	1283	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1284	1284	(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/.*perl\/fr\.pl	2	0	0	1
+1285	1285	\x2F[a-z\x2D]{60,120}.+\x2D\x2Ephp$	2	0	0	1
+1286	1286	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1287	1287	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1288	1288	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1289	1289	^\/[a-z0-9A-Z]{25,35}\/(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+(_[e7uxMhp1Kt]+)?|a2\.\.)Z(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+|a2\.\.)\/	2	0	0	1
+1290	1290	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$	2	0	0	1
+1291	1291	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$	2	0	0	1
+1292	1292	applet\/code=[\x22\x27](<val1>[a-zA-Z0-9]+)[a-z]\.(=val1)[a-z][\x22\x27][^\x3e]+\.jar[\x22\x27]	2	0	0	1
+1293	1293	code\x3D\x22[a-z]{4}\x2E[a-z]{4}\x22	2	0	0	1
+1294	1294	\x7B\x22e(v|x22\x2B\x22)(v|x22\x2B\x22|a)(a|v|x22\x2B\x22)[^\x5D]*?l\x22\x5D	2	0	0	1
+1295	1295	\x2Fgo\x2Ephp\x3Dd\x3D[a-f0-9]{16}$	2	0	0	1
+1296	1296	^[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}=	2	0	0	1
+1297	1297	\.php\?\w{2,9}\=(0[0-9a-b]|3[0-9]){5}\&\w{3,9}\=(3[0-9a-f]|4[0-9a-f])\&\w{3,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{3,9}\=(0[0-9a-b]{1,8})00020002$	2	0	0	1
+1298	1298	^\d+?.\x00\x00\x00	2	0	0	1
+1299	1299	\/[0-9a-f]{32}\.jar$	2	0	0	1
+1300	1300	\/[a-f0-9]{5,}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1301	1301	^[^OGHPDTCMLUVRBAS]	2	0	0	1
+1302	1302	&s=\{[A-Z0-9]{8}-([A-Z0-9]{4}-){3}[A-Z0-9]{12}\}&w=(\d{1,2}\.){2}\d{1,2}&b=(32|64)$/Pi	2	0	0	1
+1303	1303	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$	2	0	0	1
+1304	1304	AjaxHandler\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+1305	1305	DELETE.+FROM	2	0	0	1
+1306	1306	UNION.+SELECT	2	0	0	1
+1307	1307	UPDATE.+SET	2	0	0	1
+1308	1308	ASCII\(.+SELECT	2	0	0	1
+1309	1309	DELETE.+FROM	2	0	0	1
+1310	1310	INSERT.+INTO	2	0	0	1
+1311	1311	UNION\s+SELECT	2	0	0	1
+1312	1312	SELECT.+FROM	2	0	0	1
+1313	1313	UPDATE.+SET	2	0	0	1
+1314	1314	ASCII\(.+SELECT	2	0	0	1
+1315	1315	DELETE.+FROM	2	0	0	1
+1316	1316	INSERT.+INTO	2	0	0	1
+1317	1317	SELECT.+FROM	2	0	0	1
+1318	1318	\/\S+\.cab	2	0	0	1
+1319	1319	User-Agent\x3a[^\n]+AskTB/iH	2	0	0	1
+1320	1320	(<p>[0-7]{3})(<d>[0-7]{3})(=p)(=d)([0-7]{3}){10}(<q>[0-7]{3})[0-7]{3}(<dot>[0-7]{3})[0-7]{3}(=dot)[0-7]{3}(=q)	2	0	0	1
+1321	1321	(<p>[0-7]{2,4})(<sep>[^0-7])(<d>((=p))[0-7]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-7]{2,4}(=sep)){10}(<q>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(<dot>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(=dot)(=sep)[0-7]{2,4}(=sep)(=q)	2	0	0	1
+1322	1322	^\/(p(a(rs|g)e|rocess)|(securit|quer)y|(defaul|abou)t|index|login|user)\.jsp\?[a-z]{2}\x3d[a-z0-9]{9}[A-F0-9]{9}$	2	0	0	1
+1323	1323	\/gate\.php\?cmd=urls$	2	0	0	1
+1324	1324	\/gate\.php\?cmd=getexe$	2	0	0	1
+1325	1325	^User-Agent\x3a[^\r\n]*?\sMSIE\s/H	2	0	0	1
+1326	1326	^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email)	2	0	0	1
+1327	1327	[^a-z0-9\-\.][a-z0-9]{32,48}\x02ru\x00\x00	2	0	0	1
+1328	1328	[^a-z0-9\-\.][a-z0-9]{32,48}\x04info\x00\x00	2	0	0	1
+1329	1329	[^a-z0-9\-\.][a-z0-9]{32,48}\x03biz\x00\x00	2	0	0	1
+1330	1330	\x2flogo\x2egif\x3f([0-9a-z]){5}\x3d\d{6,7}	2	0	0	1
+1331	1331	\.php\?label=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1332	1332	\.php\?id=[A-F0-9]+\-[A-F0-9]+&v1=[A-F0-9]+&v2=[A-F0-9]+&q=[A-F0-9]+$	2	0	0	1
+1333	1333	^\/[A-Za-z0-9]{7,8}\/index\.html?$	2	0	0	1
+1334	1334	^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/js\.js$	2	0	0	1
+1335	1335	^Host\x3a\x20www\d+?\.[^\.]+?\.[^\.]+?\.([^\.]+\.)*?[a-z]{2,4}(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1336	1336	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1337	1337	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1338	1338	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1339	1339	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1340	1340	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(refresh_template_name|user_name)[\r\n\s]*=>[\r\n\s]*|(refresh_template_name|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1341	1341	^\/b\/(eve|opt|req)\/[\-f0-9A-F]{24}$	2	0	0	1
+1342	1342	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+1343	1343	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+1344	1344	\/[a-z]{1,6}\.html\?0\.[0-9]+[a-z]?$	2	0	0	1
+1345	1345	^[^\r\n]{15}\x5f[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}	2	0	0	1
+1346	1346	^Host\x3a[^\r\n]+\.passinggas\.net(\x3a\d{1,5})?\r?$/Hmi	2	0	0	1
+1347	1347	Server\: nginx/[a-zA-Z]	2	0	0	1
+1348	1348	^\x23\d\d\d\x2f\x21	2	0	0	1
+1349	1349	XPantivirus20\d{2}_v\d{6}\.exe	2	0	0	1
+1350	1350	\d\d\d\d\d\d\x0a	2	0	0	1
+1351	1351	PASS\s.*?\x0d\x0aNICK\s.*?\x0d\x0aUSER\s.*?\s\d\s\d\s\:\S	2	0	0	1
+1352	1352	[0-9A-Z]{240,}	2	0	0	1
+1353	1353	\x26[\x00-\xff]\x09\x00	2	0	0	1
+1354	1354	\x26[\x00-\xff]\x09\x00	2	0	0	1
+1355	1355	\.php\?id=\d+_[0-9a-f]{8}-[0-9a-f]+-[0-9a-f]{8}&cnt=	2	0	0	1
+1356	1356	OS 4_[0-3]_[1-4] like/H	2	0	0	1
+1357	1357	\.php\?f=\d+$	2	0	0	1
+1358	1358	Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H	2	0	0	1
+1359	1359	User-Agent\x3a We[a-z0-9]{4}\x0d\x0a/H	2	0	0	1
+1360	1360	\.php\?t=\d{2,7}$	2	0	0	1
+1361	1361	filename=.*facebook.*\.(rar|exe|zip)	2	0	0	1
+1362	1362	filename\s*[^\n]*?(UPS|United Parcel Service)[^\n]*?\.(rar|exe|zip)	2	0	0	1
+1363	1363	flash-[A-Z0-9]+-plugin\.[A-Z0-9]+\.exe	2	0	0	1
+1364	1364	\x2Fget\x5Fdr\x2Ephp\x3F(e|ini)\x3D	2	0	0	1
+1365	1365	MalvRem_\d{3,4}\.exe	2	0	0	1
+1366	1366	avdistr_\d{3,4}\.exe	2	0	0	1
+1367	1367	RunAV_\d{3,4}\.exe	2	0	0	1
+1368	1368	installer\.\d{4}\.exe	2	0	0	1
+1369	1369	\/stetement_id\.\d+\/	2	0	0	1
+1370	1370	^\/stream\?\d$	2	0	0	1
+1371	1371	loads2\.php\?r=[0-9]{2}\.[0-9]	2	0	0	1
+1372	1372	^[\x20-\x7e]{5}.{4}\x7c\x01	2	0	0	1
+1373	1373	(\/[a-z-]+)+\.php\?[a-z]+=[0-9]+[^\r\n]+HTTP\/1\.1	2	0	0	1
+1374	1374	&cid=\d+$	2	0	0	1
+1375	1375	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+1376	1376	^Content-Disposition\x3a\x20attachment\x3b\x20filename=[^\r\n]+?\.[a-z]{2,4}\.exe\r?$/Hmi	2	0	0	1
+1377	1377	^\/[a-z0-9A-Z]{15,35}\/((\d+[A-Z]){3}\d+|null)\/	2	0	0	1
+1378	1378	^Content-Length\x3a 2\d{2}\r?$/Hmi	2	0	0	1
+1379	1379	\/[a-z]{2,9}\.php\?([a-z0-9]{2,4}|[cktw])=[a-zA-Z0-9\x2b\x2f\x5c]{43,56}=?$	2	0	0	1
+1380	1380	\.((testdlls|threads|netstatp|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|stats|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\x|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r])	2	0	0	1
+1381	1381	\x2B\x22l\x22(\x3B|\x5D)	2	0	0	1
+1382	1382	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1383	1383	^Referer\x3a[^\r\n]+\.swf/Hmi	2	0	0	1
+1384	1384	\.jpg\?id=\d+$	2	0	0	1
+1385	1385	^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){3,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$	2	0	0	1
+1386	1386	^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$	2	0	0	1
+1387	1387	^\/[a-z]{4}\.html?(\?[h-j]=\d+)?$	2	0	0	1
+1388	1388	^\/h[a-z]{3}\.html?$	2	0	0	1
+1389	1389	^\/[0-9]{8}\.html$	2	0	0	1
+1390	1390	^\/lists\/\d{15}(\d{5})?$	2	0	0	1
+1391	1391	^\/[a-z0-9]{2}\.jar$	2	0	0	1
+1392	1392	^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$	2	0	0	1
+1393	1393	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+1394	1394	^([a-zA-Z]{0,119}[0-9])(<var>[a-zA-Z0-9]{9,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+1395	1395	^\/0[a-z0-9]{13}$	2	0	0	1
+1396	1396	^\/[-a-zA-Z0-9_]{70,75}==?$	2	0	0	1
+1397	1397	^User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)/Hmi	2	0	0	1
+1398	1398	\/[a-f0-9]{32}\.eot$	2	0	0	1
+1399	1399	^\/0[a-z0-9]{13}$	2	0	0	1
+1400	1400	^\/([a-z0-9_-]{0,47}?[A-Z][a-z0-9_-]{0,46}?[A-Z])([A-Z0-9_-]{0,47}?[a-z][A-Z0-9_-]{0,46}?[a-z])([A-Za-z_-]{0,47}?[0-9][A-Za-z_-]{0,46}?[0-9])[A-Za-z0-9_-]{48}\.[a-z]{2,25}\d?\??	2	0	0	1
+1401	1401	^[\x00-\x0c]\x00\x00\x00[a-z0-9]{6,12}\x00	2	0	0	1
+1402	1402	^(\x62|\x1b)	2	0	0	1
+1403	1403	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])3((=sep)|\d)*?$	2	0	0	1
+1404	1404	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])4((=sep)|\d)*?$	2	0	0	1
+1405	1405	^(\x8b|\xf2)	2	0	0	1
+1406	1406	^[a-z0-9\x02-\x50]{100,}\x00\x00\x01\x00\x01$	2	0	0	1
+1407	1407	^Host\x3a\x20[^\r\n]+\.pw\r?$/Hmi	2	0	0	1
+1408	1408	GRANT.{1,5}TO	2	0	0	1
+1409	1409	^\/\?[a-f0-9]{32}$	2	0	0	1
+1410	1410	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])0((=sep)|\d)*?$	2	0	0	1
+1411	1411	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])1((=sep)|\d)*?$	2	0	0	1
+1412	1412	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])2((=sep)|\d)*?$	2	0	0	1
+1413	1413	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])5((=sep)|\d)*?$	2	0	0	1
+1414	1414	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])6((=sep)|\d)*?$	2	0	0	1
+1415	1415	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])7((=sep)|\d)*?$	2	0	0	1
+1416	1416	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])8((=sep)|\d)*?$	2	0	0	1
+1417	1417	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])9((=sep)|\d)*?$	2	0	0	1
+1418	1418	\/\w{1,2}\/\w{1,2}\.class$	2	0	0	1
+1419	1419	User-Agent\:[^\n]+zb-hb-/Hi	2	0	0	1
+1420	1420	^[^\r\n]*\/[0-9a-f]{78}\sHTTP	2	0	0	1
+1421	1421	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20((=refhost))/Hsi	2	0	0	1
+1422	1422	Host\x3a\x20(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1423	1423	^\/index\.php\?[a-z]{8,80}=(\d{10,13}|\d{15,20})$	2	0	0	1
+1424	1424	Host\x3a\x20([0-9]{0,22}[a-z])([a-z]*?[0-9][a-z]{0,22}[0-9])[a-z0-9]{23}\x2e[^\x2e\r\n]+\x2e[^\x2e\r\n]/H	2	0	0	1
+1425	1425	&id=\d+(\x3a([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{10,}\.{0,2})?&catid=\d+&itemid=\d+$	2	0	0	1
+1426	1426	\/pd\.php\?id=[a-f0-9]+$	2	0	0	1
+1427	1427	^\x2Fsearch\x2F\x3F[a-z]{2,5}\x3D	2	0	0	1
+1428	1428	^Referer\x3a\x20http\x3a\/\/[^\x2f]+\/[a-z0-9]{6}\/[a-z0-9]{5}\.html\r?$/Hm	2	0	0	1
+1429	1429	^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text\/vbscript[\x22\x27])	2	0	0	1
+1430	1430	filename=\x22\d+?\x22/P	2	0	0	1
+1431	1431	^\/log\.php\?f=[0-1](\.[a-z]+)?$	2	0	0	1
+1432	1432	(<p>[0-9a-f]{2,4})(<sep>[\x2e\x2c\x3b\x3a])(<d>((=p))[0-9a-f]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-9a-f]{2,4}(=sep)){10}(<q>(((=p)|(=d)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(<dot>(((=p)|(=d)|(=q)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(=dot)(=sep)[0-9a-f]{2,4}(=sep)(=q)	2	0	0	1
+1433	1433	^Host\x3a[^\r\n]+craigslist\.org[^\r\n]{20,}\r\n/Hmi	2	0	0	1
+1434	1434	^Host\x3a[^\r\n]+\r\nConnection\x3a\x20Keep-Alive\r\n(\r\n)?$/H	2	0	0	1
+1435	1435	^Content-Length\x3a[^\r\n]*?\{([^\r\n]*java\.)[^\r\n]*\.ognl[^\r\n]*\}	2	0	0	1
+1436	1436	\/j[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1437	1437	\/j[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1438	1438	\/j[a-z]+?\?f[a-z]+[a-z]+$	2	0	0	1
+1439	1439	\/f[a-z]+?\?f[a-z]+[a-z]+$	2	0	0	1
+1440	1440	\.php$	2	0	0	1
+1441	1441	\.php$	2	0	0	1
+1442	1442	GET\s[^\r\n]*?(<name>\/[^\.\/]+\.html)\?id\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(:?\d{1,5})?\r\n	2	0	0	1
+1443	1443	^\d{4}\r$	2	0	0	1
+1444	1444	^Host\x3a\x20[^\r\n]+\-login\.id\-107sbtd9cbhsbt[^\r]+$/Hmi	2	0	0	1
+1445	1445	\/form\/submit\/$	2	0	0	1
+1446	1446	pch\.php\?f=\d+$	2	0	0	1
+1447	1447	hcp_vbs\.php\?f=\d+&d=\d+$	2	0	0	1
+1448	1448	\.php\?e=\w+&f=\w+$	2	0	0	1
+1449	1449	pch2.php?c=\d+$	2	0	0	1
+1450	1450	\.jar\?t=\d+&h=[^&]+$	2	0	0	1
+1451	1451	\/adp\d\.php\[0-9a-z]{2,6}	2	0	0	1
+1452	1452	attachment\x3b[^\r\n]*?info\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1453	1453	attachment\x3b[^\r\n]*?contacts\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1454	1454	attachment\x3b[^\r\n]*?calc\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1455	1455	attachment\x3b[^\r\n]*?about\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1456	1456	hhcp.php?c=[a-f0-9]{5}$	2	0	0	1
+1457	1457	attachment\x3b[^\r\n]*?readme\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1458	1458	\/content\/jav\d?\.jar$	2	0	0	1
+1459	1459	\.php\?[^&]{1,8}=[a-f0-9]{16}[\x22\x27\x3b\x20\x0a\x0d]	2	0	0	1
+1460	1460	=.*[a-f].*$	2	0	0	1
+1461	1461	<title>[a-f0-9]{10}<\/title>	2	0	0	1
+1462	1462	=[0-9a-f]{8}\.jar/H	2	0	0	1
+1463	1463	\x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}$	2	0	0	1
+1464	1464	\x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}\x3A\x3A[0-9]{1,5}$	2	0	0	1
+1465	1465	display\x3Anone\x3B\x22\x3E[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}[^\r\n]*\x3C\x2Fpre\x3E\x3Cscript\x3E	2	0	0	1
+1466	1466	(\x3D|\x5B\x22])e\x22\x2B\x22va	2	0	0	1
+1467	1467	(\x3D|\x5B\x22])e\x22\x2B\x22v\x22\x2B\x22a	2	0	0	1
+1468	1468	(\x3D|\x5B\x22])ev\x22\x2B\x22a	2	0	0	1
+1469	1469	\x2B\x22al\x22(\x3B|\x5D)	2	0	0	1
+1470	1470	\x2B\x22val\x22(\x3B|\x5D)	2	0	0	1
+1471	1471	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jnlp(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1472	1472	\.php\?[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}=	2	0	0	1
+1473	1473	^.{1,5}[a-f0-9]{100}	2	0	0	1
+1474	1474	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.eot(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1475	1475	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jar(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1476	1476	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.exe(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1477	1477	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.php(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1478	1478	\.php\?\w{2,8}\=(0[0-9a-b]|3[0-9]){5,32}\&\w{2,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{1,8}\=\d{2}\&\w{1,8}\=\w{1,8}\&\w{1,8}\=\w{1,8}$	2	0	0	1
+1479	1479	\/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php$	2	0	0	1
+1480	1480	\/news\/enter\/2012-1[0-2]-([0-2][0-9]|3[0-1])\.php	2	0	0	1
+1481	1481	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.txt(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1482	1482	\/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php	2	0	0	1
+1483	1483	^\/[0-9a-f]{16}\/q\.php$	2	0	0	1
+1484	1484	^\/[0-9a-f]{16}\/q\.php	2	0	0	1
+1485	1485	^\/[0-9a-f]{32}\/ff\.php$	2	0	0	1
+1486	1486	^\/[0-9a-f]{32}\/ff\.php	2	0	0	1
+1487	1487	^\/[0-9a-f]{16}\/ff\.php$	2	0	0	1
+1488	1488	^\/[0-9a-f]{16}\/ff\.php	2	0	0	1
+1489	1489	^\/closest\/(([a-z]{1,16}[-_]){1,4}[a-z]{1,16}|[a-z0-9]{20,})\.php	2	0	0	1
+1490	1490	&jopa=\d+$	2	0	0	1
+1491	1491	\.php\?jnlp=[a-f0-9]{10}(,|$)	2	0	0	1
+1492	1492	\/[0-9a-f]{32}\/a\.php$	2	0	0	1
+1493	1493	\/[0-9a-f]{32}\/a\.php	2	0	0	1
+1494	1494	\/[0-9a-f]{16}\/a\.php$	2	0	0	1
+1495	1495	\/[0-9a-f]{16}\/a\.php	2	0	0	1
+1496	1496	\.php\?[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){5}&[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){10}&	2	0	0	1
+1497	1497	\/([^\/]+?\/[a-z]{2,16}[_-][a-z]{2,16}([_-][a-z]{2,16})*?|[a-z]{16,20}\/[a-z]{16,20}|closest\/[a-z0-9]+)\.php\?[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+&[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+$	2	0	0	1
+1498	1498	^([0-9a-z]{8})?(<p>[0-9a-z]{2})(<d>((=p))[0-9a-z]{2})(=p)(=d)([0-9a-z]{2}){10}(<q>[0-9a-z]{2})[0-9a-z]{2}(<dot>[0-9a-z]{2})[0-9a-z]{2}(=dot)[0-9a-z]{2}(=q)	2	0	0	1
+1499	1499	\.php\?[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){5}&[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){10}&	2	0	0	1
+1500	1500	\.php\?[^=]+=([^&](5[5-9a-e]|8[9a-e])){5}[^=]+=[^&]+&[^=]+=([^&](5[5-9a-f]|8[9a-e])){10}([^&]60[^&]60([^&](5[5-9a-f]|8[9a-e])){10})*?&	2	0	0	1
+1501	1501	\.php\?[^=]+=[^&]{10}&[^=]+=[^&]+&[^=]+=[^&]{20}((<sep>[^&]{2})(=sep)[^&]{20})*?&	2	0	0	1
+1502	1502	^\/[a-z0-9]{6,10}\/\?[0-9]{1,2}$	2	0	0	1
+1503	1503	@\x00i\x00m\x00p\x00o\x00r\x00t\x00\x20.{4,20}[^\x00\w\s.]	2	0	0	1
+1504	1504	^\s*?\(\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27]	2	0	0	1
+1505	1505	^\s*?\(\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27]	2	0	0	1
+1506	1506	^Referer\x3a[^\r\n]+\x3a\d+\/([a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,3}|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3})/Hm	2	0	0	1
+1507	1507	^\s*?value\s*\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27]	2	0	0	1
+1508	1508	^\s*?value\s*\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27]	2	0	0	1
+1509	1509	^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$	2	0	0	1
+1510	1510	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1511	1511	Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=refhost)/Hsi	2	0	0	1
+1512	1512	^Host\x3a[^\r\n]*?\x3a((80(80)|312[89]))\d+\r$/Hm	2	0	0	1
+1513	1513	^(((<\/object>).)*?<param([^>]*?name\s*\s*?\x22bgcolor\x22)[^>]*?value\s*\s*?\x22#ffffff\x22)((<\/object>).)*?<param([^>]*?name\s*\s*?\x22movie\x22)[^>]*?value\s*\s*?\x22([^\x22]+\.[Ss][Ww][Ff])[^\x22]*?\x22	2	0	0	1
+1514	1514	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1515	1515	Host\x3a\x20(<host>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?Referer\x3a\x20http\x3a\x2f\x2f(=host)\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n/Hsi	2	0	0	1
+1516	1516	Referer\x3a\x20http\x3a\x2f\x2f(<host>[^\r\n\x3a\x2f]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=host)(\x3a\d{1,5})?\r\n/Hsi	2	0	0	1
+1517	1517	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1518	1518	^\s*=\s*(<var1>[\x22\x27][a-z]+[\x22\x27]).+?\sid\s*=\s*(=var1)	2	0	0	1
+1519	1519	^([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$	2	0	0	1
+1520	1520	^(\s*var\s[a-z]+\s*=\s*\d+\x3b\s*\n)*\s*<\/script>\s*<object([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$	2	0	0	1
+1521	1521	^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27]	2	0	0	1
+1522	1522	^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|([a-z]*\d+[a-z]+\d)(\d*[a-z]+\d+[a-z])[a-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27]	2	0	0	1
+1523	1523	^\s*=\s*[\x22\x27][a-z]+[\x22\x27]	2	0	0	1
+1524	1524	^\s*=\s*[\x22\x27][a-z]+[\x22\x27]	2	0	0	1
+1525	1525	^\s*=\s*[\x22\x27]\/[^\x22\x27]*\.html\.swf[\x22\x27]	2	0	0	1
+1526	1526	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1527	1527	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1528	1528	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)	2	0	0	1
+1529	1529	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1530	1530	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)	2	0	0	1
+1531	1531	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27]	2	0	0	1
+1532	1532	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)	2	0	0	1
+1533	1533	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)	2	0	0	1
+1534	1534	\/m[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1535	1535	^h[a-z0-9]{0,10}\x3d[a-f0-9]{24}&p[a-z0-9]{0,10}\x3d[a-z0-9]{1,11}&i/P	2	0	0	1
+1536	1536	^p[a-z0-9]{0,20}\x3d[a-z0-9]{1,20}&i[a-z0-9]{0,20}\x3d%[0-9A-F]{2}/P	2	0	0	1
+1537	1537	\x28[\r\n\s]*?(<qa1>[\x22\x27]?)[a-f0-9]{24}(=qa1)[\r\n\s]*?,[\r\n\s]*?(<qa2>[\x22\x27]?)[a-z0-9]{1,20}(=qa2)[\r\n\s]*?	2	0	0	1
+1538	1538	=%25[0-9A-F]{2}%25[0-9A-F]{2}/P	2	0	0	1
+1539	1539	^\/a[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?q[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1540	1540	^\/s[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?d[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1541	1541	^\/k[a-z]{4,13}\?e[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1542	1542	^\/g[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?t[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1543	1543	\/r[a-z]+?\?j[a-z]+[a-z]+$	2	0	0	1
+1544	1544	\/f[a-z]+?\?j[a-z]+[a-z]+$	2	0	0	1
+1545	1545	^\/o[a-z]{4,13}\?h[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1546	1546	\/b[a-z]+?\?n[a-z]+[a-z]+$	2	0	0	1
+1547	1547	\/v[a-z]+?\?n[a-z]+[a-z]+$	2	0	0	1
+1548	1548	^\/[a-z]{5,14}\?[a-z]{5,12}=\d{6,7}$	2	0	0	1
+1549	1549	^\/[a-z]{5,14}\?[a-z]{5,12}=[a-z]{6,11}$	2	0	0	1
+1550	1550	^[\r\n\s]*?\,	2	0	0	1
+1551	1551	\bdig\.dll\b	2	0	0	1
+1552	1552	^\/[a-z]+?\?[a-z]+[a-z]+$	2	0	0	1
+1553	1553	^Host\x3a\x20[^\r\n]+\.(d(yndns\.[a-z]{2,3}|esi)|c(ricket|a?fe?)|(lin|wor)k|s(u|pace)|accountant|t(k|op)|g[aq]|xyz|ml|pw)(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1554	1554	^\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)$	2	0	0	1
+1555	1555	^(<windname>[a-z0-9]+)(<plug1>([sj]|f1))=true.+?window\.(=windname)(<plug2>(((=plug1))([sj]|f1)))=true.+?window\.(=windname)(((=plug1)|(=plug2)))([sj]|f1)=true	2	0	0	1
+1556	1556	^\/1[a-z0-9]{13}$	2	0	0	1
+1557	1557	^GET \/0(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n	2	0	0	1
+1558	1558	^\/1[a-z0-9]{13}$	2	0	0	1
+1559	1559	^GET \/4(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n	2	0	0	1
+1560	1560	^\/3[a-z0-9]{13}$	2	0	0	1
+1561	1561	\/4[a-z0-9]{13}\?&xkey=	2	0	0	1
+1562	1562	^[a-zA-Z0-9\/\+]+?ODAvM[a-zA-Z0-9\/\+]{18}(=|%3D)[\x22\x27]	2	0	0	1
+1563	1563	^[a-zA-Z0-9\/\+]+?4MC8x[a-zA-Z0-9\/\+]{18}(=|%3D){2}[\x22\x27]	2	0	0	1
+1564	1564	^[a-zA-Z0-9\/\+]+?OjgwL[a-zA-Z0-9\/\+]{19}[\x22\x27]	2	0	0	1
+1565	1565	^(\s*?|\/\*((\*\/).)*?\*\/)*?\((\s*?|\/\*((\*\/).)*?\*\/)*?(<vname>[^\s>=]+)(\s*?|\/\*((\*\/).)*?\*\/)*?<(\s*?|\/\*((\*\/).)*?\*\/)*?32\b.{0,200}(=vname)(\s*?|\/\*((\*\/).)*?\*\/)*?\x3d(\s*?|\/\*((\*\/).)*?\*\/)*?63\b.{1,200}\+=.{0,200}\((\s*?|\/\*((\*\/).)*?\*\/)*?(=vname)	2	0	0	1
+1566	1566	^[a-zA-Z0-9]+\*\/	2	0	0	1
+1567	1567	[a-z0-9]+?\*\/	2	0	0	1
+1568	1568	^\s*?<script>\s*?(<func>[A-Za-z0-9]+)\s*?\(\s*?[\x22\x27](<var>[^1\x22\x27]+)1[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)2[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)3[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>	2	0	0	1
+1569	1569	^\s*?\n\s*?(<func>[^\x28\r\n\s]+)\s*?\(\s*?(<var>[^\+\x29]+)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+	2	0	0	1
+1570	1570	^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$	2	0	0	1
+1571	1571	^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$	2	0	0	1
+1572	1572	^Referer\x3a[^\r\n]+\/([a-z0-9]+\.php|\d+)\r$/Hm	2	0	0	1
+1573	1573	Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2039/H	2	0	0	1
+1574	1574	Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2040/H	2	0	0	1
+1575	1575	^\W	2	0	0	1
+1576	1576	^\W	2	0	0	1
+1577	1577	^\/[a-z]{3}\?[A-F0-9]{8}$	2	0	0	1
+1578	1578	^Referer\x3a\x20http\x3a\x2f\x2f?[^\x2f]+\/[a-z]{3,20}((<sep>[_-]?)[a-z]{3,20}(=sep)([a-z]{3,20}(=sep))?)?[a-z]{3,20}\/\d{10,20}(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+1579	1579	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi	2	0	0	1
+1580	1580	Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1581	1581	^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}\r$/Hmi	2	0	0	1
+1582	1582	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi	2	0	0	1
+1583	1583	Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1584	1584	^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1585	1585	^((<\/body).)+?Content\s*?loading.*lease wait.*?<iframe	2	0	0	1
+1586	1586	^(\x4c|\x35)	2	0	0	1
+1587	1587	^(\x76|\x0f)	2	0	0	1
+1588	1588	\/wp-(content|admin|includes)\/	2	0	0	1
+1589	1589	^\d\x00\d	2	0	0	1
+1590	1590	\.php\?$	2	0	0	1
+1591	1591	\?showforum=$	2	0	0	1
+1592	1592	^\s*5a\s*90\s*00\s*03\s*00\s*00\s*00	2	0	0	1
+1593	1593	\x2Fphp-calendar-1.1\x2Fupdate(08|10)\x2Ephp(\x3F|.*(\x26|\x3B))configfile=[^\x26\x3B]*[^a-zA-Z0-9_]	2	0	0	1
+1594	1594	(\.\.\/){1,}	2	0	0	1
+1595	1595	(\.\.\/){1,}	2	0	0	1
+1596	1596	=(https?|ftps?|php)\:\/.{0,100}cmd=	2	0	0	1
+1597	1597	MEAS\.TYPE=((link|class)&)	2	0	0	1
+1598	1598	url=.{8000}	2	0	0	1
+1599	1599	\/ssp\/files\/annonce\.pdf$	2	0	0	1
+1600	1600	\/ssp\/loadjavad\.php$	2	0	0	1
+1601	1601	\/wywg\/[a-z0-9]{2,5}\/[a-z0-9]+\.exe$	2	0	0	1
+1602	1602	\/xml\/p\.php\?id=\d{2,}	2	0	0	1
+1603	1603	ts\/in\.cgi\?pepsi\d+	2	0	0	1
+1604	1604	cs_base_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+1605	1605	\x0d\x0aHost\: (www\.)?nacha\.org\.	2	0	0	1
+1606	1606	\x26n\x3d[a-z]{5}\d{4}	2	0	0	1
+1607	1607	name=(https?|ftps?|php)	2	0	0	1
+1608	1608	\/script\.php?\d{8}	2	0	0	1
+1609	1609	Host\: \d+\.\d+\.\d+\.\d+\x0d\x0a	2	0	0	1
+1610	1610	\/[a-z]+\/[a-z0-9]{120,}\/[a-z0-9]+\/.+\.com$	2	0	0	1
+1611	1611	UPDATE.+SET	2	0	0	1
+1612	1612	ASCII\(.+SELECT	2	0	0	1
+1613	1613	DELETE.+FROM	2	0	0	1
+1614	1614	INSERT.+INTO	2	0	0	1
+1615	1615	UNION\s+SELECT	2	0	0	1
+1616	1616	SELECT.+FROM	2	0	0	1
+1617	1617	UPDATE.+SET	2	0	0	1
+1618	1618	ASCII\(.+SELECT	2	0	0	1
+1619	1619	DELETE.+FROM	2	0	0	1
+1620	1620	INSERT.+INTO	2	0	0	1
+1621	1621	UNION\s+SELECT	2	0	0	1
+1622	1622	SELECT.+FROM	2	0	0	1
+1623	1623	ver=[v\d]+	2	0	0	1
+1624	1624	\/Setup_[0-9]{3}([A-Z][0-9])?\.exe$	2	0	0	1
+1625	1625	\/\d+\/installer\/Installer(Clean)?\.exe$	2	0	0	1
+1626	1626	\/(nte|ld)\/[0-9A-Z]*trest1[0-9](\.php|\s\.asp|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$	2	0	0	1
+1627	1627	^[a-z0-9\x40\x2d\x5f]{5,12}..\x00\x00..\x00\x00\x78\x9c	2	0	0	1
+1628	1628	=sent$	2	0	0	1
+1629	1629	\.php\?get[^=]*=\d_\d{5,}$	2	0	0	1
+1630	1630	\.php\?[a-z]_info=[a-z0-9]{1,4}_\d+?$	2	0	0	1
+1631	1631	Host\x3A\x20[^\r\n]*.rr.nu/H	2	0	0	1
+1632	1632	^(.{0,63}\x00.{0,62}\x00.{0,61}\x00.{0,60}\x00)(.{0,62}\x00{2})(.{0,59}[A-Za-z0-9]{5})((<b1>.).{0,63}(=b1).{0,62}(=b1).{0,61}(=b1).{0,60}(=b1))(.(<b2>.).{0,62}(=b2).{0,61}(=b2).{0,60}(=b2).{0,59}(=b2))(..(<b3>.).{0,61}(=b3).{0,60}(=b3).{0,59}(=b3).{0,58}(=b3))(...(<b4>.).{0,60}(=b4).{0,59}(=b4).{0,58}(=b4).{0,57}(=b4))(....(<b5>.).{0,59}(=b5).{0,58}(=b5).{0,57}(=b5).{0,56}(=b5))(.....(<b6>.).{0,58}(=b6).{0,57}(=b6).{0,56}(=b6).{0,55}(=b6))(......(<b7>.).{0,57}(=b7).{0,56}(=b7).{0,55}(=b7).{0,54}(=b7))(.......(<b8>.).{0,56}(=b8).{0,55}(=b8).{0,54}(=b8).{0,53}(=b8))(........(<b9>.).{0,55}(=b9).{0,54}(=b9).{0,53}(=b9).{0,52}(=b9))(.........(<b10>.).{0,54}(=b10).{0,53}(=b10).{0,52}(=b10).{0,51}(=b10))	2	0	0	1
+1633	1633	\.tar$	2	0	0	1
+1634	1634	\x2Fjs\x2F[\r\n]*\x2Eexe$	2	0	0	1
+1635	1635	^(<mac_addr>[\x00-\xff]{6})(=mac_addr){2,}$	2	0	0	1
+1636	1636	^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED)	2	0	0	1
+1637	1637	^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED)	2	0	0	1
+1638	1638	^(\\r\\n|\x0d\x0a)C	2	0	0	1
+1639	1639	\/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+1640	1640	<iframe.*?src.*.*?<\/iframe>	2	0	0	1
+1641	1641	[a-z]{4,10}\x08velodrivve\x03biz\x00	2	0	0	1
+1642	1642	PRIVMSG.*@(portscan|nmap|back|udpflood|tcpflood|httpflood|linuxhelp|rfi|system|milw0rm|logcleaner|sendmail|join|part|help)	2	0	0	1
+1643	1643	\/[A-Z]Setup_[0-9]{4}\.exe$	2	0	0	1
+1644	1644	\.php.+?(c((onfi|f)g|alendar)|p(a(ge|th)|rog)|l(ang(uage)?|ib)|f(older|ile|ad)|d(omain|ir|f)|s(ettings|bp)|a(genda|uth)|i(con|ncl|d)|n(ame|ews)|r(oot|f)|gallery|type|ext|mod|[a-z](\[.*\])+?)\s*=\s*https?	2	0	0	1
+1645	1645	\/[a-f0-9]{16}\/.+?\.(exe|zip)$	2	0	0	1
+1646	1646	^\s?\+x=[0-9]*\;\ +y=[0-9]	2	0	0	1
+1647	1647	User-Agent\:[^\n]+\; UA\d\d\d\d\d\;/H	2	0	0	1
+1648	1648	^\/load.php\?showforum=(ato|obe|rhino|lib)$	2	0	0	1
+1649	1649	^[a-z]{5}\d=\x5f\d\x5f	2	0	0	1
+1650	1650	index.php\?[0-9a-f]{32}$	2	0	0	1
+1651	1651	o/\d{9}\/[0-9a-f]{32}\/[0-9]$	2	0	0	1
+1652	1652	\/out.php\?id=\d$	2	0	0	1
+1653	1653	\/\?[a-z0-9]{5,}=[a-zA-Z0-9\x25]{40,}\x253D$	2	0	0	1
+1654	1654	^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$	2	0	0	1
+1655	1655	\/((article|contact|new)s|read|(fo|tu)r)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.eot|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.EOT)$	2	0	0	1
+1656	1656	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})1\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}1\.PDF)$	2	0	0	1
+1657	1657	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})2\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}2\.PDF)$	2	0	0	1
+1658	1658	^(\/[a-z]{3,20})?\/([a-z]{3,20}[-_])+[a-z]{3,20}\.jar$	2	0	0	1
+1659	1659	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})3\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}3\.PDF)$	2	0	0	1
+1660	1660	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/foto\.png$	2	0	0	1
+1661	1661	\.png$	2	0	0	1
+1662	1662	^\/[a-zA-Z0-9_\x2f-]{300,}\.html?$	2	0	0	1
+1663	1663	\/\d+\.mp3\x3frnd\x3d\d+$	2	0	0	1
+1664	1664	(Is|CheckRemote)DebuggerPresent	2	0	0	1
+1665	1665	(Create|Connect|Peek)NamedPipe	2	0	0	1
+1666	1666	ftp(open|get)file	2	0	0	1
+1667	1667	^\/r\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1668	1668	^\/t\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1669	1669	^\/[a-f0-9]{32}\.eot$	2	0	0	1
+1670	1670	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/new\.png$	2	0	0	1
+1671	1671	\.gif$	2	0	0	1
+1672	1672	\/(w(hite|orld)|step)\/\d+$	2	0	0	1
+1673	1673	\.psd$	2	0	0	1
+1674	1674	\.jpeg$	2	0	0	1
+1675	1675	\/(w(hite|orld)|step)\/mypic\.dll$	2	0	0	1
+1676	1676	getqq\.jpg$	2	0	0	1
+1677	1677	^[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(((=q)).)+?\.txt\?e=\d+(&[fh]=\d+)?(=q)	2	0	0	1
+1678	1678	\.php\?t[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1679	1679	([a-z+-]{0,4}[0-9.*]+[a-z$+-]{0,4},){24}	2	0	0	1
+1680	1680	[\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]+	2	0	0	1
+1681	1681	\.php\?spl=[A-Z]{3}	2	0	0	1
+1682	1682	\.php\?b[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1683	1683	\.php\?n[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1684	1684	^[^?#]+?\.php\?page[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1685	1685	\.php\?v[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1686	1686	\.php\?doit[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1687	1687	^[^?#]+?\.php\?id[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1688	1688	(-?\d+\x3a-?\d+\x3a){100}	2	0	0	1
+1689	1689	\x2Fsrc\x2Ephp\x3Fcase\x3D[a-f0-9]{16}$	2	0	0	1
+1690	1690	[\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]	2	0	0	1
+1691	1691	value\x3D\x22\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23	2	0	0	1
+1692	1692	\x2Fredirect\x2Ephp\x3Fd\x3D[0-9a-f]{8}$	2	0	0	1
+1693	1693	\/\d+\.js\?\d+&[a-f0-9]{16}$	2	0	0	1
+1694	1694	^\/[a-z0-9_\-]{48}$	2	0	0	1
+1695	1695	\.php\?e=[^&]+?$	2	0	0	1
+1696	1696	\/[a-z]\/[0-9]\/[0-9a-f]{32}$	2	0	0	1
+1697	1697	archive=[^\x3e]+?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+1698	1698	^\/[a-z]+\/$	2	0	0	1
+1699	1699	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/image\.gif$	2	0	0	1
+1700	1700	\/w(hite|orld|step)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.PDF)$	2	0	0	1
+1701	1701	\/(w(hite|orld)|step)\/get(a+|n+)\.jpg	2	0	0	1
+1702	1702	\.php\?usernms=[^@]+@[^\r\n]+$	2	0	0	1
+1703	1703	^(\x3a\d{1,5})?$	2	0	0	1
+1704	1704	^[^\r\n]+?\.(c(o(l(leg(e((confidential|-station|prowler)\.net|s?explained\.com)|iate(explained|info)\.com)|(o(rado-springs-jobs|nexplained)|umnexplore)\.com)|m(p(uter(explained\.com|themes\.net)|assiondefinition\.com)|m(oditylingerie|unesinfo|ercekid)\.com)|n(ce(rtparis\.net|ptsets\.com)|trolwedding\.com)|((rnell|upon)explained|peguide)\.com|7\.us)|a(((mpaign|talog|det)explained|n(cersexplained|adadaycore)|p(itali[sz]eguide|ricornhi)|b(leexplained|indynamic))\.com|r((tograph(yanalysis|erwhat)|cinomas?explained|scratch-remover|eblack)\.com|insurance-compare\.net)|ce\.us)|h((a(r(med-episodes|les-proxy|tpixel)|p(elsinfo|terball)|nnelexplained)|ristmas(gift-ideas|motion)|inesenewyearboom|eckingwatch)\.com|(orizo|urros)\.es)|(e(l(lularexplained|iac-diet)|ntigrade(explained|info))|(li(nical|ck)|ustomized)explained|r(uiseshipdating|iticsmart)|pu-benchmark|nc-cs)\.com|8\.biz|z\.cc)|a((ll(about(((collegi|gradu)at|yal)e|s(eminary|tudent)|(facul|varsi)ty|bestsellers|academic|teaching|harvard|ucla|pro)|babyours)|n((tip	2	0	0	1
+1705	1705	desbi|alyzelan)d|onymous-film)|(mericas-nexttopmode|gentsbal)l|r(chitectureice|lingtonwriter)|c(ademicexplaine|tionmo)d|ero(flotinfo|bicfund))\.com|u((toma(tedexplained|kers24)|stralia-airlines|xiliaryverb)\.com|di(t(jewellery\.com|report\.net)|o-planet\.com))|p((rilfools(hotel|spin)|ple-airport)\.com|[fh]i\.biz)|ir((bnb-coupon|waysinfo)\.com|portshuttleseattle\.net)|v(enue(domain|hello)\.com|li\.biz)|\.e\.gy)|b((a(c(helorexplained|kpackscope)|by(online-shop|revision)|(rcelonarea|ggagecoo)l|s(icexplained|escope)|ttle-field-3)|e((st-hoteldeal|er-calorie|t-award)s|nefitexplained)|u(y-invite|dgetyep)|logger-com)\.com|r((o(adbandinternet-providers|king(explained|guide))|unomarsalbum|yan-college)\.com|ea(st(cancertattoos\.net|explained\.com)|dmachine-recipes\.com))|o(((om(ing|s)|nd)explained|tany(explained|info)|dybuildingdomains|rrowings?24)\.com|stoncolleges\.net)|irthcertificatetemplate\.net|3g\.biz)|d(e((((benture|posit)explaine|alershipislan)d|n(guefevertreatment|verhowto)|ductguide|veloptea)\.com|(xterstre	2	0	0	1
+1706	1706	ming|ciduoustrees)\.net)|o((ctorate(s?explained|info)|llar-converter|gwalking-jobs|texplained|mainsknow)\.com|wnload(starcraft|-films|ubuntu)\.net)|(a(ncecentralsonglist|rtmouthexplained)|na-replication|hcp-server|vd-codec|rivewww)\.com|i((s(count|ease)explained|nnerparty-recipes|walifile)\.com|rect-golf\.net))|e((a(r(fulexplained|th-clinic)|sy(-costumes|repayment))|conomic(save|24))\.com|\.gy)|4((4qs|h5)\.com|[jp]\.org|ql\.biz)|3(vt\.info|gb\.biz|q\.org)|2(eat\.com|sf\.biz|u\.se)|8(c1\.net|x\.biz)|7(c\.org|p\.biz)|11r\.(biz|us))(\x3a\d{1,5})?$	2	0	0	1
+1707	1707	^[^\r\n]+?\.(f((a(c(ultyexplained|e-bok)|(ncy-font|ke-nail)s|ir(explained|fuse)|shion-wallpaper|lterguide)|i(nanc(i(al|ng)explained|epets)|rm(explained|s24)|lter-coffee)|o(r(umexplained|ecastbooks|ceestate)|x-drama)|udaninfo)\.com|re(e(-(((foodcoupon|angrybird)s|s(oundclips|tock)|photoeditor)\.com|music-download\.net)|(p(owerpointthem|roduct-sampl)es|dom-ofspeech)\.com|fileconverter\.net)|snoever\.com)|l(a(shplayerdownload\.net|tbelly-diet\.com)|oridaunemploymentclaim\.com|v-downloader\.net)|e(rtility-calculator\.net|stivalexplained\.com)|b(-smileys\.com|skins\.net))|l((i(n(k(explained|master)|colnsbirthdaytea)|(ability|ver)explained|(berty-saf|ftmov)e|stings(biz|red)|teraturemulti)|u(ng(explained|abscess)|ggageboom)|o(cationssecure|ndon-riots|gback))\.com|e((a(singexplained|ther-trousers)|(edsunited-new|d-candle)s|cturer(explained|info)|nd(ing|er)explained|isure-diving)\.com|u(kemiaexplained\.com|e\.biz)|tup\.org)|a(guay\.(com|es)|-gazzetta\.com)|6\.org)|i(n(s((ur(er(s(explained|24)|explained)|ancesexplain	2	0	0	1
+1708	1708	d)|ide-film)\.com|(pection-camera|taflex)\.net)|d(e(pendenceday(portal|realty)|mnityexplained)\.com|ividual-healthinsurance\.net)|t(er(estexplained\.com|trigo\.net)|ranet(explained|pm)\.com)|((vestment|centive)explained|expensivehyper)\.com|f(ections?explained\.com|o\.se))|((mmersio|sd)nexplained|ronmancom|pone-5)\.com|i(nkai|lg)\.biz)|m((e(tropolis((cruis|fac|mov)e|pixel)|(lanoma|dical)explained|r(idiantotal|cedes-cls)|ntal-healthjobs|morialdaycon|ssenger-mac|ansgift)|i(ami(-holidays|what)|di-editor)|baexplained)\.com|a(r((tial-empires|ket-hq)\.com|iogames-online\.net)|n((agejoin|ualzap)\.com|ipal-university\.net)|(lignanthypertension|gazinedownload)\.net|s(on(wave|car)|tersexplained)\.com|c2\.org))|e((s(ta(tes(mob|fx)|blishstyle)|lexplained)|mploy(e(eexplained|r24)|mentexplained))\.com|n(((gagement-photo|able-cookie)s|rollexplained)\.com|trepreneur-ideas\.net)|x(((hibition|po)explained|ecutive-decision)\.com|tremedeal\.net)|l(ect(ronicexplained|orate123)\.com|guay\.(com|es))|q(uityexplained\.com|8\.biz))|	2	0	0	1
+1709	1709	((o(a(d(minister|vertize|just)|cademic|llocate)|(thic-literatur|handl)e|(bailou|conduc)t|govern)|r(a(duate(explained|sinfo)|ndparentsdayplan)|oceryexplained|4)|ym(glas|car)s|m[69])\.com|a(((llaudet|te)explained|mevelocity|rnerguide)\.com|511\.net)|cwsa\.org)|h(o((me(made-biscuits|pageexplained)|(nours|tline|using)explained|6)\.com|stel-barcelona\.net)|a(r(dback(city|yoga)|vardexplained)|n(dlechange|ukkahbio)|lloweenorange)\.com|y(perthyroidsymptoms\.net|d\.me)|ellokittypictures\.net)|j((o(urnalism(explained|info)|hn-grisham|ker-tattoo)|query-examples)\.com|a(cksonvillepath\.com|vacollection\.net)|(vvg|6)\.org)|k(ilometersreach|udosexplained|jyg)\.com)(\x3a\d{1,5})?$	2	0	0	1
+1710	1710	^[^\r\n]+?\.(p(r(o(pert(ies(-forsale\.net|winters\.com)|y-(singapore|rental)\.net)|(fessors|state)explained\.com)|e(miums(e(xplained|ek)|guide)|(acher|cinct|late)sinfo|pexplained)\.com|i(va(te(car-sales|explained)\.com|do\.info)|nceton\.me))|e((n(sionexplained|thousepal|cetruck)|diatricsexplained)\.com|rsonal(trainer-certification\.net|-injuryclaims\.com)|tardo\.es)|o((wer(borrowings?|repayment|debts)|rt(land-holidays|alexplained)|intexplained|litical24)\.com|kertexas-holdem\.net)|a((ss(engersinfo|agepix)|ge(explained|as)|cemaker-surgery|ttinson-robert|rk-edu)\.com|loaltocollege\.net)|(u(blicationgift|pils?info)|ickups(articles|gen)|neumoniaexplained|sychologyquotes|lus-sign)\.com|h(o(toedit(orfreedownload\.net|ingsite\.com)|neexplained\.com)|pbb-themes\.com|yscology\.net)|cbp\.net|9\.org)|o(n(line(((f(o(ster|rce)|irstborn|raternal|ulltime)|b(r(idegroom|owse)|oxoffice)|e((valuat|xpress)e|fficient)|-(collegecourse|radiostation)|d(escendant|aughter|iscusse)|v(illage|acant)|re(sidence|al))s|c((r(iti(c(ize|al)|	2	0	0	1
+1711	1711	ue)|ew)|o(nsider|usin)|a(pture|meo)|elluloid)s|ha(racters|teau))|a(((vailabl|doptiv|llianc|pprais)e|ss(esse|ay)|unt)s|n((cestor|alyze)s|imated)|way)|per(sonal-trainer|manents))\.com|mediaconverter\.net)|e-lyrics\.com|amia\.biz)|(ver(seasexplained|drawnreal)|(wnership|ffline)explained|cean(ic-cable|you)|rphanagesinfo|klahomafuse)\.com|a(klandour\.com|pg\.org))|r(e((s(idenc(e(attorney|dating|cook|food)|yexplained)|erves(development|core))|(c(o(ver(ing|ed)|up)|laim)guid|laxationhyp|bateventur)e|g(i(on(private|mentor)|stercommunity)|ainguide)|t(r(ainingexplained|ieveguide)|ailexplained)|motecontrol-helicopter|viewwinters|payment24)\.com|alestate-perth\.net)|(a(cetracksinfo|veexplained|iserepair|tetask)|ising-antivirus|bnnetwork)\.com|o((o(m(sfootball|mateco)|fcute)|admodern)\.com|yallondonhospital\.net))|s((o((lventsourc|ftenguid)e|urceexplained|cietiesinfo|ng-india)|a(n(antoniosource|diegodiscover)|l(aryexplaine|euploa)d)|ta(nford(explained|info)|(bilis|v)eguide|r-treck)|p(ecialtyexplained|iralwatch|orts-tab)|	2	0	0	1
+1712	1712	h(oolexplained|eduleedu)|ites?explained)\.com|e((minar(y(explained|info)|explained)|c((urities|tor)explained|what)|aworld-coupons)\.com|rvertransfer\.net)|m(ier\.org|oz\.us)|hellgascard\.net|gba\.biz)|m(o((t(oristsinfo|iveshare)|ntre-breitling|dernexplained|squesinfo)\.com|hamed\.me)|(y(borrowings|-husband)|ultimediaexplained|inistriesinfo)\.com|mcd\.us)|n((a(ming(mac|our)|uticalfit|vigateadd)|e(tworkexplained|w-college))\.com|8\.biz))(\x3a\d{1,5})?$	2	0	0	1
+1713	1713	^[^\r\n]+?\.(t(e((l(e(phoneexplained|comsguide)|learth)|n(ured(explained|info)|nis-ranking))\.com|mp(l(ates-gratis\.com|ecollege\.net)|converter\.net)|a(ching(-certificate\.net|explained\.com)|m\.pro))|r(a(((nsferbyt|de-)e|in(eesinf|ge)o|mray)\.com|vel(insurance-comparison\.net|agentnerd\.com))|e(k-bicycles|nd-online)\.net|uckstool\.com|onco\.es)|(o(wn(housepic|study|euro|meta)|(tal-tool|memap)s|pgamebook|olboxsol)|u(mors?explained|lsatrain|rn-ons)|attoo-websites|ype-racer|wainfo)\.com|h((anksgivinggaming|riftexplained)\.com|e(sis-examples\.com|atreparis\.net))|i(mezonevendor\.com|dl\.net)|cmn\.biz)|w(e(b((b(estseller|ailout)|administer)\.com|site(downloader\.net|explained\.com)|developertoolbar\.net)|(l(lesley|fare)explained|akenguide)\.com)|or(th(voice|war)\.com|ld-records\.net)|ater(front-property\.net|-plants\.com)|(riterpics|hoiscan)\.com|pbh\.org|sse\.us)|s((t(ud(ent(financecontact|s?explained)|yexplained)|r(eetmaphub|ongat)|patricksweightloss|onewhat)|wissairinfo)\.com|u((mmertimelyrics|nset-wallpape	2	0	0	1
+1714	1714	|per-committee|itegraphic)\.com|b\.(name|cat|es)))|v((i(llage((in|na)no|crystal)|deo(-mediaset|explained)|ta(minssms|lwow)|rtualexplained)|o(lumesynergy|ucheragent|ters24)|a(rsityexplained|lentinesproxy)|entureexplained)\.com|qtel\.net|f1\.us)|u(n(i(versityexplained\.com|nstalltool\.net|\.me)|((secured|am)explained|ravelguide)\.com|limited-web-hosting\.net)|(cla(explained|info)|s-inflation|alinfo|zdom)\.com|[04]\.org)|y((o(u(ngstersinfo|rbroking)|mkippursocial)|(eshiva|ale)explained|vxs)\.com|nna\.biz)|zwr\.org)(\x3a\d{1,5})?$	2	0	0	1
+1715	1715	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+1716	1716	[a-z]{8}.(:?tif|gif)	2	0	0	1
+1717	1717	^.{2}[a-zA-Z0-9]+\x2e[01]	2	0	0	1
+1718	1718	(\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(	2	0	0	1
+1719	1719	^\w+?\[[^\]]+?\]\.src[\r\n\s]*=	2	0	0	1
+1720	1720	(\/(php)?|\.php)\?[\s\+]*\-[A-Za-z]	2	0	0	1
+1721	1721	^[A-Z]=[A-Za-z/+0-9=]{200,400}$	2	0	0	1
+1722	1722	^\{?[a-fA-F0-9]{4}\}?(\x5cu\{?[a-fA-F0-9]{4}\}?){20}	2	0	0	1
+1723	1723	^\{?[a-fA-F0-9]{4}\}?(\x25u\{?[a-fA-F0-9]{4}\}?){20}	2	0	0	1
+1724	1724	[^a-zA-Z0-9_\-\.][a-zA-Z]{7}\.class	2	0	0	1
+1725	1725	^[\r\n\s]*?\\?\(.+?\\?\)\.keep\.previous[\r\n\s]*[\r\n\s]*?[\x22\x27]contentArea	2	0	0	1
+1726	1726	\/vw\.php\?i=[a-fA-F0-9]+?\-[a-fA-F0-9]+?$	2	0	0	1
+1727	1727	^[\x11\x21-\x26\x41\x45\x70-\x79]	2	0	0	1
+1728	1728	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1729	1729	^.{0,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.jsp\x22	2	0	0	1
+1730	1730	^..[\x81\x82\x83\x84\x85\x86\x87]\x81	2	0	0	1
+1731	1731	^..[\x81\x82\x83\x84\x85\x86\x87]\x83	2	0	0	1
+1732	1732	^..[\x81\x82\x83\x84\x85\x86\x87]\x84	2	0	0	1
+1733	1733	^..[\x81\x82\x83\x84\x85\x86\x87]\x85	2	0	0	1
+1734	1734	REGISTER.{400}	2	0	0	1
+1735	1735	SELECT.+geometrycollectionfromwkb	2	0	0	1
+1736	1736	SELECT.+WHERE.+SELECT.+\x60	2	0	0	1
+1737	1737	ALTER.+DATABASE.+\x22\x2E(\x22|\x2E\x22|\x2E\x2E\x2F\x22).+UPGRADE.+DATA	2	0	0	1
+1738	1738	^Authorization\x3A Basic.{120}/Hmi	2	0	0	1
+1739	1739	^Host\x3a[^\x3a\r\n]+?\x3a[^\r\n]{6}/Hmi	2	0	0	1
+1740	1740	^[^\x00]+?\x00	2	0	0	1
+1741	1741	^[^\x00]+?\x00	2	0	0	1
+1742	1742	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*22C83263-E4B8-4233-82CD-FB047C6BF13E	2	0	0	1
+1743	1743	^Cache-Control\x3a\x20(max-age=0|no-cache)\r?$	2	0	0	1
+1744	1744	^\/\?id=[0-9]{13}&msg=	2	0	0	1
+1745	1745	^13\d{11}	2	0	0	1
+1746	1746	^Callback\x3a\x20<http[^>]+><http	2	0	0	1
+1747	1747	^[^\r\n]*uuid\x3a[^\r\n\x3a]{181}	2	0	0	1
+1748	1748	^[^\r\n]+#[^\x22\r\n]{2049}	2	0	0	1
+1749	1749	^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1750	1750	^[^\r\n]*urn\x3aservice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1751	1751	^[^\r\n]*urn\x3adevice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1752	1752	^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{1,180}\x3a[^\r\n\x3a]{181}	2	0	0	1
+1753	1753	M-SEARCH\s+[^\n]{500}	2	0	0	1
+1754	1754	(\/\.){70,}	2	0	0	1
+1755	1755	[\w]{70,}	2	0	0	1
+1756	1756	\xB6\x29\x8C\x23\xFF\xFF\xFF[\xF8-\xFF]	2	0	0	1
+1757	1757	^.{27}	2	0	0	1
+1758	1758	[0-9a-zA-Z]{200,}	2	0	0	1
+1759	1759	(GET).\/%.{1586,}	2	0	0	1
+1760	1760	ctxsys\x2Edrvxtabc\x2Ecreate\x5Ftables.+(SELECT|DELETE|CREATE|INSERT|UPDATE|OUTFILE)	2	0	0	1
+1761	1761	[^a-zA-Z0-9]+\.message	2	0	0	1
+1762	1762	\x3d[^\x26]{720}	2	0	0	1
+1763	1763	ENTER\x20LANGUAGE\x20\x3D.{55}	2	0	0	1
+1764	1764	[a-zA-Z0-9]{1000,}	2	0	0	1
+1765	1765	\xbc[\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4]	2	0	0	1
+1766	1766	\xae[\xef\xcf][\xf0\xd0][\xe5\xc5][\xee\xce]\xa0\xa2[\xe7\xc7][\xe5\xc5][\xf4\xd4]\xa2	2	0	0	1
+1767	1767	[\xf3\xd3][\xe8\xc8][\xe5\xc5][\xec\xcc][\xec\xcc][\xe5\xc5][\xf8\xd8][\xe5\xc5][\xe3\xc3][\xf5\xd5][\xf4\xd4][\xe5\xc5]	2	0	0	1
+1768	1768	[\xf6\xd6][\xe2\xc2][\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4]	2	0	0	1
+1769	1769	Cookie\:\ +REMOTE_ADDR=	2	0	0	1
+1770	1770	Authorization\x3a\s*Basic\s*[a-zA-Z0-9]{255,}==	2	0	0	1
+1771	1771	\x2findex\x2etmpl(\x3a\x3a\x24DATA|\x2f|\x2e)\x0d\x0a	2	0	0	1
+1772	1772	\/[a-z0-9]{30,}\.php\?height=\d+&sid=\d+&width=[a-z0-9]+&	2	0	0	1
+1773	1773	\.php\?sex=\d+&children=\d+&userid=	2	0	0	1
+1774	1774	^SSH-\s[^\n]{200}	2	0	0	1
+1775	1775	value\x22[^\x22]*\x2Eswf\x3finfo\x3D	2	0	0	1
+1776	1776	^(CLIENT|MACHINE)_INFO	2	0	0	1
+1777	1777	Host\x3a \d{8,10}(\x0d\x0a|\x3a\d{1,5}\x0d\x0a)/H	2	0	0	1
+1778	1778	\/tmp\/[^\/]+\.pdf$	2	0	0	1
+1779	1779	\/tmp\/[^\/]+\.jar$	2	0	0	1
+1780	1780	^Directory	2	0	0	1
+1781	1781	^HEAD[^s]{432}	2	0	0	1
+1782	1782	^PUT[^s]{432}	2	0	0	1
+1783	1783	^POST[^s]{432}	2	0	0	1
+1784	1784	^TRACE[^s]{432}	2	0	0	1
+1785	1785	^DELETE[^s]{432}	2	0	0	1
+1786	1786	^LOCK[^s]{432}	2	0	0	1
+1787	1787	^MKCOL[^s]{432}	2	0	0	1
+1788	1788	^COPY[^s]{432}	2	0	0	1
+1789	1789	^MOVE[^s]{432}	2	0	0	1
+1790	1790	\x2Frequests\x2Fstatus\x2Exml\x3F[^\x0A\x0D]*input\x3D[^\x0A\x0D\x26\x3B]{1000}	2	0	0	1
+1791	1791	^\/[0-9]{5}\.jar$	2	0	0	1
+1792	1792	Host\x3a \d{4,}[^A-Za-z\.]	2	0	0	1
+1793	1793	^\/[0-9]$	2	0	0	1
+1794	1794	^\/[a-z]{13,14}\.jar$	2	0	0	1
+1795	1795	^\s*?STOR\s+[^\r\n]*?nsswitch\.conf\r$	2	0	0	1
+1796	1796	^\s*?STOR\s+[^\r\n]*?\x2f(tgt|trace|rbp(c|p))\.conf\r$	2	0	0	1
+1797	1797	T.*?T.*?Y.*.*?R.*?O.*?M.*.*?T	2	0	0	1
+1798	1798	[0-9a-zA-Z]{10}	2	0	0	1
+1799	1799	[0-9a-zA-Z]{10}	2	0	0	1
+1800	1800	Host\x3a \d{4,}[^A-Za-z\.]	2	0	0	1
+1801	1801	^\/m[a-zA-Z0-9-_]{3,14}\/[a-zA-Z0-9-_]{3,17}$	2	0	0	1
+1802	1802	SELECT data FROM [^\x20]+?\x20INTO DUMPFILE [\x27\x22]c\x3a\/windows\/system32\/[a-z0-9_-]+?\.exe[\x27\x22]	2	0	0	1
+1803	1803	[a-zA-Z0-9]{5}	2	0	0	1
+1804	1804	[0-9a-zA-Z]{50}	2	0	0	1
+1805	1805	\x90{200}	2	0	0	1
+1806	1806	^\s+A{500}	2	0	0	1
+1807	1807	^[\r\n\s]*?\x28[^\x29]*?shellcode	2	0	0	1
+1808	1808	^[\r\n\s]*?\x28[^\x29]*?shellcode	2	0	0	1
+1809	1809	\.(php|asp|py|exe|htm|html)\/[joewxy](U[0-9a-f]{8})?H[0-9a-f]{8}V[0-9a-f]{8}\d{3}R[0-9a-f]{8}\d{3}T[0-9a-f]{8,}	2	0	0	1
+1810	1810	[\r\n\s]+(<var1>([a-z]([a-z0-9_])*|_+([a-z0-9])([a-z0-9_])*))[\r\n\s]*\x3d[\r\n\s]*CreateObject\(\s*[\x22\x27]Wscript\.Shell[\x27\x22]\s*\).+?(=var1)\.run	2	0	0	1
+1811	1811	^((>>).)+?#([46][1-9a-fA-F]|[57][\daA])	2	0	0	1
+1812	1812	^\s*?fun\s*?\(	2	0	0	1
+1813	1813	[\?&]mail=[^&]+?[\x3b\x2c\x7c\x27]	2	0	0	1
+1814	1814	WSH\.run\x28\x5c+?[\x22\x27][a-z0-9_-]+?\.exe	2	0	0	1
+1815	1815	^(90|0x5a|0+?132)\s*?,\s*?(71|0x47|0+?107)\s*?,\s*?(70|0x46|0+?106)\s*?,\s*?(48|0x30|0+?60)\s*?,\s*?(89|0x59|0+?131)\s*?,\s*?(84|0x54|0+?124)\s*?,\s*?(112|0x70|0+?160)	2	0	0	1
+1816	1816	\/\??[a-f0-9]{60,}(\x3b\d+){1,4}$	2	0	0	1
+1817	1817	\/\??[a-f0-9]{60,}\x3b4[0-1]\d{5}$	2	0	0	1
+1818	1818	^\/([a-z0-9]{3,7}\/)?[a-z]{3,7}\.swf$	2	0	0	1
+1819	1819	^(25)?282176\x25(25)?29\x25(25)?26chrw\x25(25)?2801	2	0	0	1
+1820	1820	^Referer\x3a[^\r\n]+\/gate.php\r$/Hm	2	0	0	1
+1821	1821	Host\x3a\x20(\.*[a-f0-9]\.*){32}\./Hm	2	0	0	1
+1822	1822	^( Systems|\.com\/techsupport)	2	0	0	1
+1823	1823	^\s*?(<v1>[^\x29\s]+)\s*?\x29\s*?To Ubound\x28(=v1)\s*?\x29\s*?(dim\s*?)?(<v2>[^\s\x3d]+)\s*?\x3d\s*?(=v2)\+Cstr\x28\s*?Chr\x28(=v1)\x28i\x29[\+\-]\d+\x29\x29.+?Execute\s*?(=v2)	2	0	0	1
+1824	1824	^[0-9][^=]	2	0	0	1
+1825	1825	^\s*?\d[\d\x2e]{255}	2	0	0	1
+1826	1826	^\s*?\d[\d\x2e]{255}	2	0	0	1
+1827	1827	\s+?trigger\s+?[^\x20]+?\s+?after\s+?insert\s+?on\s+?	2	0	0	1
+1828	1828	^..[^\x00]+\x00	2	0	0	1
+1829	1829	^..[^\x00]+\x00	2	0	0	1
+1830	1830	^..[^\x00]+\x00	2	0	0	1
+1831	1831	^..[^\x00]+\x00	2	0	0	1
+1832	1832	^([^>]*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]*?\.swf[\x22\x27])([^>]*?\swidth\s*\s*?[\x22\x27]0[\x22\x27])[^>]*?\sheight\s*\s*?[\x22\x27]0[\x22\x27]	2	0	0	1
+1833	1833	^(<addr1>.{4})(<addr2>.{4})(=addr2)(=addr1)	2	0	0	1
+1834	1834	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1835	1835	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1836	1836	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1837	1837	Type\x2FAction.+Launch.+\x28\x2F[a-z]\x2F[a-z].+NewWindow\x20true	2	0	0	1
+1838	1838	^=\s*\x22\s*[^\s\x22\x28]{1000}	2	0	0	1
+1839	1839	^(USE|PASS|SELECT|UPDATE|INSERT|ASCII|SHOW|CREATE|DESCRIBE|DROP|ALTER)\s+?(.{1}){300}	2	0	0	1
+1840	1840	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d+?&){3,}[a-z\_\-]{4,10}=-?[a-z0-9]+$	2	0	0	1
+1841	1841	^\s*\[\s*[\x22\x27]\\u[a-f0-9]{4}\\u[a-f0-9]{4}	2	0	0	1
+1842	1842	^[^\x00]+\x00\x00\x01	2	0	0	1
+1843	1843	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1844	1844	^.{6}[^\x00]+	2	0	0	1
+1845	1845	^.{6}[^\x00]+	2	0	0	1
+1846	1846	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1847	1847	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1848	1848	^\x20+\x3a\x20([0-9A-F]{2}\x3a){5}[0-9A-F]{2}\x0d\x00\x0a	2	0	0	1
+1849	1849	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1850	1850	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1851	1851	^(\x01((\x01((\x04((\x03(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x04(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?|\x02(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?))?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|\x02([\x01\x02\x03\x04])?|\x03([\x01\x02])?))?|\x03((\x03(\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e])?)?)?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13])?|\x02([\x01\x02])?))?|\x05((\x02(\x01([\x01\x02\x03\x04\x05\x06\x07])?)?|\x01([\x01\x02\x03])?))?|\x02(([\x01\x02]|\x03(\x01([\x01\x02\x03])?)?))?|\x06(\x01([\x01\x02\x03\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x07([\x01\x02])?|\x04))?|\x02((\x02([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|(\x01)?\x01))?)	2	0	0	1
+1852	1852	^(\x41\xd8\x41\xd8\x41\xdc){2,}\x41\x00	2	0	0	1
+1853	1853	^\s*\x28\s*retPtrAddr\.add\s*\x28\s*i\s*\*\s*8\s*\x29\s*,\s*rop\s*\x5b	2	0	0	1
+1854	1854	^\S+?drivestoredirect	2	0	0	1
+1855	1855	^\s*(f0VMR|9FTE|\/RUxG)	2	0	0	1
+1856	1856	^\s*=\s*[\x27\x22]\s*POST	2	0	0	1
+1857	1857	^.*?[\x24\x60]	2	0	0	1
+1858	1858	^\s*=\s*[^>]*file\x3a[^>]*\/\x24MFT\/	2	0	0	1
+1859	1859	^\s*(\x28|\%28)s	2	0	0	1
+1860	1860	^\s*\d*[^\x20-\x7e\r\n\t]	2	0	0	1
+1861	1861	^[\x30-\x3f\x7D]	2	0	0	1
+1862	1862	^[\x30-\x3f\x7D]	2	0	0	1
+1863	1863	AUTH\s+\S+\s+([a-zA-Z0-9\+\/=]{4})*[a-zA-Z0-9\+\/=]{3}\s	2	0	0	1
+1864	1864	^\s*((>).)+?\s*src\s*=\s*[\x22\x27]\s*[^\x27\x28]+?[\x22\x27]\s*onError\s*=\s*prompt\s*\x28\s*[^)]*?(document|s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+1865	1865	legal[^x7B]*\x7B[^\x7D]*restore	2	0	0	1
+1866	1866	legal[^x7B]*\x7B[^\x7D]*restore	2	0	0	1
+1867	1867	errordict\s+\x2Finvalidfileaccess	2	0	0	1
+1868	1868	errordict\s+\x2Finvalidfileaccess	2	0	0	1
+1869	1869	\x2Ebindnow[^\x7D]*\x7D\s*stopped	2	0	0	1
+1870	1870	\x2Ebindnow[^\x7D]+\x7D\s*stopped	2	0	0	1
+1871	1871	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1872	1872	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1873	1873	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1874	1874	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1875	1875	^\s*	2	0	0	1
+1876	1876	^\s*	2	0	0	1
+1877	1877	^\s*	2	0	0	1
+1878	1878	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){5}	2	0	0	1
+1879	1879	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7}	2	0	0	1
+1880	1880	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7}	2	0	0	1
+1881	1881	Template=.*\.\.	2	0	0	1
+1882	1882	act\x3D[^\x26\s\r\n]{257}	2	0	0	1
+1883	1883	app\x3D[^\x26\s\r\n]{257}	2	0	0	1
+1884	1884	[\x20-\x7e]{5,}\x5c\x00[\x20-\x7e]{5,}	2	0	0	1
+1885	1885	^[\x50-\x59]	2	0	0	1
+1886	1886	^[^\r\n]*?\x60[^\x60]*?\$\{IFS\}	2	0	0	1
+1887	1887	\bsolusvmc-node\b	2	0	0	1
+1888	1888	^\s*?\(\s*?[^,\s]*?\s*?,\s*?[\x22\x27][a-f0-9]{100}	2	0	0	1
+1889	1889	^mail\s*?from\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b	2	0	0	1
+1890	1890	^(\x25(25)*?20|\s)*?runmumaa\W	2	0	0	1
+1891	1891	^\s*?(<var>[^=\s\x3b]+)\s*\s*?getBits\(\s*?\)\x3b.+?flashvars\s*\s*?\x5c\x22(=var)\s*\s*?\x22\s*?\+\s*?(=var)\s*?\+\s*?\x22\x5c\x22	2	0	0	1
+1892	1892	^[a-z-]+\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b.*\x3b.*\x7d\s*\x3b(=[\r\n])	2	0	0	1
+1893	1893	^\s*\x28\s*[\x22\x27]\s*message	2	0	0	1
+1894	1894	^(\.|\[\s*?[\x22\x27])defineProperties\s*?\x28	2	0	0	1
+1895	1895	^[^\r\n]+\.hta\r?\n	2	0	0	1
+1896	1896	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1897	1897	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1898	1898	^(<num_value>\d+)\x7d,\x22id\x22\x3a(=num_value)	2	0	0	1
+1899	1899	^[(\x60|%60)(\x27|%27)]	2	0	0	1
+1900	1900	^\/(home\/a3user|root)\/agile3\/patches\/	2	0	0	1
+1901	1901	^.*?\x26	2	0	0	1
+1902	1902	(\x0a|\\n)\/s1Caa6	2	0	0	1
+1903	1903	^(\\r\\n|\x0d\x0a)C	2	0	0	1
+1904	1904	^\d{3}	2	0	0	1
+1905	1905	^(https\/\/|(\d{1,3}\.){3}\d{1,3}|([a-z0-9-]+\.)+[a-z]{1,8})	2	0	0	1
+1906	1906	^(==[A-Z0-9+/]{2}|=[A-Z0-9+/]{3}|[A-Z0-9+/]{4})([A-Z0-9+/]{4})*$	2	0	0	1
+1907	1907	^[A-Za-z0-9+/]{2}([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1908	1908	[\?\&]cmd_param=[^\&\r\n]{500}	2	0	0	1
+1909	1909	(%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))	2	0	0	1
+1910	1910	^.{11}([\xC0-\xC1]|[\xF5-\xFF]|\xE0[\x80-\x9F]|\xF0[\x80-\x8F]|[\xC2-\xDF]([\x80-\xBF])|[\xE0-\xEF]([\x80-\xBF]{2})|[\xF0-\xF4]([\x80-\xBF]{3})|([\x00-\x7F\xF5-\xFF])[\x80-\xBF]|([\xC2-\xDF]|[\xE0-\xEF]|[\xE0-\xEF][\x80-\xBF]|[\xF0-\xF4]|[\xF0-\xF4][\x80-\xBF]|[\xF0-\xF4][\x80-\xBF]{2})[\x80-\xBF]|([\xE0-\xEF])[\x80-\xBF]([\x80-\xBF])|([\xF0-\xF4])[\x80-\xBF]([\x80-\xBF]{2})|([\xF0-\xF4][\x80-\xBF])[\x80-\xBF]([\x80-\xBF]))	2	0	0	1
+1911	1911	^[^\x22]*[\x24\x60]+	2	0	0	1
+1912	1912	^[^\x22]*[\x24\x60]+	2	0	0	1
+1913	1913	^[a-z0-9\-_\.\/]+\x00	2	0	0	1
+1914	1914	^SOAPAction\x3a\s+?[^\r\n]*?http\x3a\/\/purenetworks\.com\/HNAP1\/([^\x2f]+?[\x2f])?[^\x2f]	2	0	0	1
+1915	1915	\/dev-report-overview\.html[^\"]*?\x3b	2	0	0	1
+1916	1916	^\s*\x22{2}	2	0	0	1
+1917	1917	^[\x22\x27]t(eamviewer(\d+|api)|v(c(hat|ontrol)|filetransfer|joinv|present|s(endfile|q(customer|support))|v(ideocall|pn))\d)	2	0	0	1
+1918	1918	^Host\x3a[^\n]{0,50}?\x3b	2	0	0	1
+1919	1919	^[\s>]	2	0	0	1
+1920	1920	^[\s>]	2	0	0	1
+1921	1921	^((\x0d\x0a).)+\x22(https?|file):\x2f\x2f	2	0	0	1
+1922	1922	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1923	1923	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1924	1924	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1925	1925	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1926	1926	^\s*?\x29	2	0	0	1
+1927	1927	^\s*?\(x\s*,\s*1,\s*24000\s*\x29	2	0	0	1
+1928	1928	^\s*[\x22\x27][^\x22\x27]{0,128}\x2e\x2e	2	0	0	1
+1929	1929	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1930	1930	=\s*\x25\s*\{\s*.+?\bProcessBuilder\b	2	0	0	1
+1931	1931	^[ a-zA-Z0-9+_]*[\x27\x3b]	2	0	0	1
+1932	1932	destination=[^&]*\x24\x28	2	0	0	1
+1933	1933	name=[^&]*\x24\x28	2	0	0	1
+1934	1934	^[^&]+\x2527(UNION|SELECT)	2	0	0	1
+1935	1935	[^&]*(\x60|\x24)	2	0	0	1
+1936	1936	(\x60|\x24)	2	0	0	1
+1937	1937	(\/GponForm\/diag_FORM\?images\/|\.html\?images\/)	2	0	0	1
+1938	1938	^((\S\:\\){2,}|\S\:\\\S\:\S\:|S\:\\\\\\([0-9]{1,3}\.){3}[0-9]{1,3}|\S\:\\\\\\([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+1939	1939	^(www\.)?(cisco|linksys)\.com\/jnap\/	2	0	0	1
+1940	1940	^.{1,10}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)	2	0	0	1
+1941	1941	(\%3C){1000}	2	0	0	1
+1942	1942	A{1000}	2	0	0	1
+1943	1943	id\=[^\r\n]*?(select|delete|union|update|insert)	2	0	0	1
+1944	1944	^\d{2,5}(\&|\d)	2	0	0	1
+1945	1945	^(8=|9BQQ==)\r?\n?	2	0	0	1
+1946	1946	=\s*\x25\s*\{\s*(.+?\bgetRunTime\b).+?\bexec\b	2	0	0	1
+1947	1947	^[0-9]+	2	0	0	1
+1948	1948	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\[[^\x5d]*?\W	2	0	0	1
+1949	1949	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\%5b[^\x5d]*?\W	2	0	0	1
+1950	1950	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\[[^\x5d]*?\W	2	0	0	1
+1951	1951	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\%5b[^\x5d]*?\W	2	0	0	1
+1952	1952	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\[[^\x5d]*?\W	2	0	0	1
+1953	1953	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1954	1954	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1955	1955	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1956	1956	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\[[^\x5d]*?\W	2	0	0	1
+1957	1957	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\%5b[^\x5d]*?\W	2	0	0	1
+1958	1958	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\[[^\x5d]*?\W	2	0	0	1
+1959	1959	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\%5b[^\x5d]*?\W	2	0	0	1
+1960	1960	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\[[^\x5d]*?\W	2	0	0	1
+1961	1961	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1962	1962	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1963	1963	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1964	1964	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\[[^\x5d]*?\W	2	0	0	1
+1965	1965	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\%5b[^\x5d]*?\W	2	0	0	1
+1966	1966	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\[[^\x5d]*?\W	2	0	0	1
+1967	1967	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\%5b[^\x5d]*?\W	2	0	0	1
+1968	1968	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\[[^\x5d]*?\W	2	0	0	1
+1969	1969	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1970	1970	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1971	1971	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1972	1972	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\[[^\x5d]*?\W	2	0	0	1
+1973	1973	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\%5b[^\x5d]*?\W	2	0	0	1
+1974	1974	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\[[^\x5d]*?\W	2	0	0	1
+1975	1975	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\%5b[^\x5d]*?\W	2	0	0	1
+1976	1976	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\[[^\x5d]*?\W	2	0	0	1
+1977	1977	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1978	1978	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1979	1979	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1980	1980	ping_addr=[\d.]*[^\d.]	2	0	0	1
+1981	1981	\?write_(m(ac|sn)|hdv|pid|tan)&[^&]*\x3b	2	0	0	1
+1982	1982	^User-Agent\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}	2	0	0	1
+1983	1983	^X-Forwarded-For\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}	2	0	0	1
+1984	1984	pjl\x5Fready\x5Fmessage\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+1985	1985	^[^=]{1,}$	2	0	0	1
+1986	1986	^\x22[^\x22]*\x3b[^\x22]*\x22/P	2	0	0	1
+1987	1987	^\s*[\x22\x27]	2	0	0	1
+1988	1988	\.hta([?&]|$)	2	0	0	1
+1989	1989	^[A-Za-z0-9+/]{0,4}?[^\x20-\x7e]	2	0	0	1
+1990	1990	\%(25)?temp\%	2	0	0	1
+1991	1991	^[a-zA-Z0-9]+$	2	0	0	1
+1992	1992	[^&]*(\x60|\x24)	2	0	0	1
+1993	1993	^User-Agent\x3a[^\r\n]*JDatabaseDriverMysqli/Hmi	2	0	0	1
+1994	1994	(localhost|127\.0\.0\.1)/W	2	0	0	1
+1995	1995	^[^\r\n]{128,}\r\n	2	0	0	1
+1996	1996	^[^\+]+\+0A	2	0	0	1
+1997	1997	^[^\+]+(\+[A-F0-9]{2}){4,}	2	0	0	1
+1998	1998	^.{0,100}\+0A.{0,100}\x40	2	0	0	1
+1999	1999	^[^\r\n]{50,}	2	0	0	1
+2000	2000	^\S{0,7}\/(meeting|fb\/smb|namedusers|metric)	2	0	0	1
\ No newline at end of file
diff --git a/test/benchmark/regex_rules/REGEX_300 b/test/benchmark/regex_rules/REGEX_300
new file mode 100644
index 0000000..c5540c8
--- /dev/null
+++ b/test/benchmark/regex_rules/REGEX_300
@@ -0,0 +1,301 @@
+300
+1	1	User-Agent:\s.*.abc.net	2	0	0	1
+2	2	(#\d{1,2}){20}	2	0	0	1
+3	3	(((DestFile|encryptPass)\x3D[^\x26]{50})|((BaseDN|SearchFilter)\x3D[^\x26]{128}))	2	0	0	1
+4	4	(((c|l)pi\x00.{1}(-\d|0)\x21)|(columns\x00.{1}(-\d|0)\x21)|(page-(right|left|top|bottom)\x00.{1}(-\d|0|([3-9]\d{5}|24\d{4}|236\d{3}|23593\d{1}|23592[2-9])\x21)))	2	0	0	1
+5	5	(,\d{1,3}){20}	2	0	0	1
+6	6	(3BFFE033-BF43-11d5-A271-00A024A51325|iNotes6\.iNotes6|E008A543-CEFB-4559-912F-C27C2B89F13B|dwa7\.dwa7)	2	0	0	1
+7	7	(?P<obj>[A-Z\d_]+)\.DataURL\s*=\s*(\x22[^\x22]{128}|\x27[^\x27]{128})	2	0	0	1
+8	8	(Context|Action)\x3D[^\x26\x3b]{1024}	2	0	0	1
+9	9	(DisableSandboxAndDrop|ConfusedClass|FieldAccessVerifierExpl)\.class	2	0	0	1
+10	10	(INSERT|UPDATE)\s*[\s\w]*((mysql\.)?func)[^\r\n]+values\s*\([^\)]+\x2c[\x22\x27][^\x22\x27]*\x2f	2	0	0	1
+11	11	(Image|Doc)	2	0	0	1
+12	12	(OvAcceptLang|Accept-Language)\s*[\x3D\x3A]\s*[^\n]{69}	2	0	0	1
+13	13	(OvJavaScript|OvTitleFrame|OvHelpWindow|OvMap|OvSession|OvJavaLocale|OvOSLocale|OvWebSession)\s*\x3D[^\x3B\x2C]{1024}	2	0	0	1
+14	14	(Set|Check)\x10Properties	2	0	0	1
+15	15	(USER|PASS)[^\x80-\xff]*[\x80-\xff]	2	0	0	1
+16	16	([sp]key|csk)=[^\r\n\x26]+(script|onclick|onload|onmouseover|html|[\x22\x27\x3c\x3e\x28\x29])	2	0	0	1
+17	17	(\x22|\x27)daap\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+18	18	(\x22|\x27)itms\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+19	19	(\x22|\x27)itmss\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+20	20	(\x22|\x27)itpc\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+21	21	(\x22|\x27)pcast\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+22	22	(\x25(n|t|d)\x20){85}	2	0	0	1
+23	23	(\x3F|\x26)[^\x3D]*(\x27|%27)[^\x3D]*(\x3C|%3c)script(\x3E|%3e)	2	0	0	1
+24	24	(\x40\x09.{19}|\x41\x0b.{23})[\xf0-\xff].{8}\x01\x00[\x00\x01\x02\x04\x08\x10\x18\x20]\x00	2	0	0	1
+25	25	(^|&)SelectedID=[^&]+?(\x3B|%3B)	2	0	0	1
+26	26	(^|&)paths(%5b|\x5b)(%5d|\x5d)=[^&]*?(%2e|\x2e){2}(%2f|\x2f)	2	0	0	1
+27	27	(^|&)selectedLocale=[^&]+?([\x22\x27]|%22|%27)	2	0	0	1
+28	28	(^|[\x3b\x7b\x7d]|%3b|%7b|%7d)O(%3a|\x3a)(\x2b|%2b)?[0-9]+?(%3a|\x3a)(%22|\x22)	2	0	0	1
+29	29	(action|setup)=[a-z]{1,4}	2	0	0	1
+30	30	(arg=[^\x26]*?OVwSelection[^\x26]*?\x26.*?sel=[^\s\x26]{1023}|sel=[^\x26]{1023,}\x26.*?arg=[^\s\x26]*?OVwSelection)	2	0	0	1
+31	31	(caption,\x22\x5c\x5c\x5c|\x22\x5cn\x5cn\x5cn\x22\x20\x2b\x20str)	2	0	0	1
+32	32	(data_select1|nameParams|schdParams|text1|schd_select1)=[^\x26]{512}	2	0	0	1
+33	33	(displayWidth[\x2b\x20]\d[^\x2b\s\n]{128})	2	0	0	1
+34	34	(filename|type)=[^\x26]*?\x2E\x2E	2	0	0	1
+35	35	(ora_osb_bgcookie|rbtool)=[^\x20\x26\x3b]{1}	2	0	0	1
+36	36	(sIda\/sId|urua\/uru)[abcd]\.classPK	2	0	0	1
+37	37	.{20}[\x01\x02]\x00\x03\x00.*?\x5c\x00\x5c\x00	2	0	0	1
+38	38	5FDC81917DE08A41A6AC(E9B8ECA1EE.8|.98ECB1EEA8E)	2	0	0	1
+39	39	<FILE>(\x2e\x2e\x5c|%2E%2E%5C){2}[^<]+?</FILE>	2	0	0	1
+40	40	<SelectedID>[^<]+?(\x3B|%3B)	2	0	0	1
+41	41	<[^>]*?style\s*[>=].{1,1024}margin\s*\x3a\s*[^\x3b\x7d]*?-(\d{4}|1[0-9][1-9]|[2-9]\d\d)[ce][mx].*?[\x7b\x3b]	2	0	0	1
+42	42	<\?(php)?.{1,256}define\s*\x28\s*str_repeat\s*\x28\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s*\x2c\s*\x24argv	2	0	0	1
+43	43	<\s*object[^>]*?data\s*\x3A[^,>]*?base64	2	0	0	1
+44	44	<\s*valitem[^>]*\s(value|name)\s*=\s*([\x22\x27])[^\x22\x27]{104}	2	0	0	1
+45	45	<\x21DOCTYPE\s+[^>]*?SYSTEM[^>]*?>.*?\x2EparseError	2	0	0	1
+46	46	<\x21ENTITY[^>]+SYSTEM[^>]+http\x3A\x2F\x2F[^>\s]+http\x3A\x2F\x2F	2	0	0	1
+47	47	<applet[^>]+(archive|src)\s*?=\s*?(\x22|\x27|)\s*?(\d{5}\.jar|[^>]+\/\d{5}\.jar)	2	0	0	1
+48	48	<figure[^>]+?dir\s*?=\s*?[\x22\x27]\s*?rtl\s*?[\x22\x27].*?(&#?x?[a-z\d]{2,4}\x3b){100}	2	0	0	1
+49	49	<iframe[^>]*?height\x3d\s*[\x22\x27]?\s*[0-9]{6}	2	0	0	1
+50	50	<script[^>]*?for\s*=\s*[\x22\x27]?.*?event\s*=\s*[\x22\x27]?onpropertychange[\x22\x27]?[^>]*?>	2	0	0	1
+51	51	<script[^>]*src\s*=\s*[\x22\x27][^\x22\x27]*\.json[\x22\x27][^>]*language=vbs	2	0	0	1
+52	52	<title>CRiMEPACK [\d\.]+</title>	2	0	0	1
+53	53	<treechildren.*?ordinal=.*?<treechildren	2	0	0	1
+54	54	<zombis>\s*<JUNIPER-M3>.*?</JUNIPER-M3>\s*</zombis>	2	0	0	1
+55	55	AdminServlet.*(userid|adminurl)[^\x26\x20\x0a]*<script	2	0	0	1
+56	56	Authorization\s*\x3A\s*Basic\s*[^\n]{437}	2	0	0	1
+57	57	Collab\x2EaddStateModel\s*\x28\s*\x7B.*cName\s*\x3A\s*\x22(\x22|\x5Cx00)	2	0	0	1
+58	58	ComputerName\s*\x3d\s*\x22[^\x22]{256}	2	0	0	1
+59	59	Content-Type\x3A\s*misc/ultravox.+?(\r?\n){2}\x5A.9\x01	2	0	0	1
+60	60	CreationDate\x28[^\x3c\x29]{500}	2	0	0	1
+61	61	DBMS_ASSERT\x2Esimple_sql_name\x28[^\x29\x22]*?\x22	2	0	0	1
+62	62	EnteredAttrName=[^&]{32}	2	0	0	1
+63	63	Entry\x20\x2f[^\x2f]*\x2f[^\x2f]{68}	2	0	0	1
+64	64	ExecWB\s*\x28\s*[^\x2c\x29]*(7|IDM_PRINTPREVIEW)[^\x29]+http\x3a\x2f\x2f	2	0	0	1
+65	65	FILECODE=[^&]{96}	2	0	0	1
+66	66	HEADER[\x20\r]*\n[\x20]*9[\x20\r]*\n\x24[^\n]{92}	2	0	0	1
+67	67	HTTP\/1.[01]\r\nUser\x2dAgent\x3a\x20[ -~]+\r\nHost\x3a\x20[a-z0-9\x2d\x2e]+\.info\r\n	2	0	0	1
+68	68	HostList=([^\r\n\x3B]{,296}\x3B)*[^\r\n\x3B]{297}	2	0	0	1
+69	69	Host\x3A\s*[^\x0D\x0A]{121}	2	0	0	1
+70	70	Hostname\x3D[^\x26\x3F\x3B\x0D\x0A\s]{300}	2	0	0	1
+71	71	ICount\x3D\x2D[^\x26\x3F\x3B\x0D\x0A\s]{300}	2	0	0	1
+72	72	IP=(https?|ftps?)	2	0	0	1
+73	73	InformixServerList=([^\r\n\x3B]{,293}\x3B)*[^\r\n\x3B]{294}	2	0	0	1
+74	74	Libs\/Starter(CmdExec|NetUtils|Rec|ScreenShots|Settings)\.py	2	0	0	1
+75	75	Math\x2efloor([^\x7d]{1,3})?\x7dcatch\x28	2	0	0	1
+76	76	Math\x2eround([^\x7d]{1,3})?\x7dcatch\x28	2	0	0	1
+77	77	MaxAge\x3D[^\x26\x3F\x3B\x0D\x0A]{300}	2	0	0	1
+78	78	Oid\x3D[^\x0D\x0A]{1000}	2	0	0	1
+79	79	OvAcceptLang\s*\x3d\s*[^\x3b\n]{300}	2	0	0	1
+80	80	OvOSLocale\s*\x3d\s*[^\x3b\s]{249}	2	0	0	1
+81	81	Referer\x3a[^\x0d\x0a]*\/world\/	2	0	0	1
+82	82	Referer\x3a\s*?http\x3a\x2f{2}[a-z0-9\x2e\x2d]+\x2fs\x2f\x3fk\x3d	2	0	0	1
+83	83	RegExp?\x23.{0,5}\x28\x3f[^\x29]{0,4}i.*?\x28\x3f\x2d[^\x29]{0,4}i.{0,50}\x7c\x7c	2	0	0	1
+84	84	SET_(SENDFROM|MAILHOST)\x28\x27[^\x27]{256}	2	0	0	1
+85	85	SOAPAction\x3A\s*?\x22[^\x22\x23]+?\x23([^\x22]{2048}|[^\x22]+$)	2	0	0	1
+86	86	SYS\.LT\.FINDRICSET\([^,\)]*\'\'\|\|	2	0	0	1
+87	87	SYS\x2eDBMS\x5fAQADM\x5fSYS\x2eGRANT\x5fTYPE\x5fACCESS\s*\x28\s*\x27[^\x2c\x20\x27]*[\x2c\x20]	2	0	0	1
+88	88	SelectedSubTabId=[^>]*?([\x22\x27]|%22|%27)\s*?>\s*?<[^>]*?script	2	0	0	1
+89	89	SignUrl=[^\x26\s]*[\x22\x27\x28\x29\x3C\x3E]	2	0	0	1
+90	90	SoftwareRegistration\.do.*?updateRegn=[^\x26\r\n]+(script|onclick|onload|onmouseover|html)	2	0	0	1
+91	91	TMlogonEncrypted=(\!|\%21)CRYPT(\!|\%21)[A-Z0-9]{512}	2	0	0	1
+92	92	Template\x3D[^\x0D\x0A]{1000}	2	0	0	1
+93	93	TimerMethod\x3D[^\x26]*[\x3C\x28\x22\x27]	2	0	0	1
+94	94	USER\s*[^\x0d]+\x25\x27	2	0	0	1
+95	95	User-Agent\:[^\x0a\x0d]+?Havij	2	0	0	1
+96	96	User-Agent\x3A\s+?mus[\x0d\x0a]	2	0	0	1
+97	97	User-Agent\x3a[^\x0d\x0a]*Java\/1\.	2	0	0	1
+98	98	User-Agent\x3a\x20Agent\d{5,9}	2	0	0	1
+99	99	User-Agent\x3a\x20[^\n]*?WinHttp\x2eWinHttpRequest.*?\n	2	0	0	1
+100	100	Visio \x28TM\x29 Drawing\r\n\x00{4}([^\x00]|\x00[^\x00]|\x00\x00[^\x01-\x06\x0b]|\x00\x00[\x01-\x06\x0b][^\x00])	2	0	0	1
+101	101	[1-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}	2	0	0	1
+102	102	[?&](CallbackParam|CallbackFn)=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|eval|script|onload|src)	2	0	0	1
+103	103	[?&](k|u|cs)=[^&]+?<	2	0	0	1
+104	104	[?&](path|file)Name=[^&]*?\x2e\x2e\x2f	2	0	0	1
+105	105	[?&](search|topic)=[^&]*?(\x27|%27)(\s*|(%20)*)(\x3b|%3b)	2	0	0	1
+106	106	[?&]SelectedSubTabId=[^&]*?([\x22\x27\x3c\x3e\x28\x29]|onload|src)	2	0	0	1
+107	107	[?&]Using=_layouts/query.iqy.*?&List=[^&]+(script|src|location|document|onlick|onload)	2	0	0	1
+108	108	[?&]appName=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+109	109	[?&]arg=[^-][^+&$]{189}	2	0	0	1
+110	110	[?&]configName=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+111	111	[?&]filename=[^&]*?[\x22\x27][^&]*?\x3B	2	0	0	1
+112	112	[?&]iprange=[^&]{68}	2	0	0	1
+113	113	[?&]key=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+114	114	[?&]name=(\x5c\x5c|%5c%5c)	2	0	0	1
+115	115	[?&]name=[^&]*\x2e\x2e\x2f[^&]*\x2e\x2e\x2f[^&]*\x2e\x2e\x2f	2	0	0	1
+116	116	[?&]name=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+117	117	[?&]site2pstoretoken=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+118	118	[\x35\x36\x41\x42\x44-\x49]\x00\x00	2	0	0	1
+119	119	[\x37-\x40\x43]\x00\x00	2	0	0	1
+120	120	[\x3f\x26]id=\d*[\x28\x29\x22\x27]	2	0	0	1
+121	121	[^&]+&[a-z]=[a-f0-9]{16}&[a-z]=[a-f0-9]{16}$	2	0	0	1
+122	122	[^R]CHAR\(.*?[^R]CHAR\(.*?[^R]CHAR\(.*?[^R]CHAR\(.*?[^R]CHAR\(	2	0	0	1
+123	123	[^\x3E]*?text\s*\x3D\s*(\x27[^\x27]{500}|\x22[^\x22]{500}|\S{500})	2	0	0	1
+124	124	[^\x3a\s]{309}\sPRIVMSG	2	0	0	1
+125	125	[^\x3e]{0,300}\x2fURI \x28data	2	0	0	1
+126	126	[^\x5C\x2F\x3A\x2A\x3F\x22\x3C\x3E\x7C\x3D\s]{256}\x2Eppt($|\x3f)	2	0	0	1
+127	127	[a-z0-9]{32}\.jar	2	0	0	1
+128	128	\%5b\%5f[0-9]{16}	2	0	0	1
+129	129	\&h=\d{5}$	2	0	0	1
+130	130	\.(jsp|html)\?[^\r\n]*PG=SPEEDBAR	2	0	0	1
+131	131	\.dashstyle\.array\.length\s*?=[^\x3b]*?-\s*?\d	2	0	0	1
+132	132	\.jpg\x20HTTP\/1\.[01]\r\nUser\x2dAgent\x3a\x20[a-z]+\r\nHost\x3a\x20[a-z0-9\x2d\x2e]+\.com\.br\r\n\r\n$	2	0	0	1
+133	133	\.js\/\?[a-z]+\=[a-z]{1,4}	2	0	0	1
+134	134	\.location(\.href)?\s*=\s*new\s+String\s*\x28\s*\x22\s*javascript\x3A	2	0	0	1
+135	135	\.onpropertychange\s*=\s*function[^{]*?\{[^}]*?\w+\.swapNode\x28	2	0	0	1
+136	136	\.php\?[a-z]{2,12}=[a-f0-9]{10,64}&[a-z]{2,12}=.*?&[a-z]{2,12}=	2	0	0	1
+137	137	\.php\?[a-z]{2,8}=[a-z0-9]{2}\x3a[a-z0-9]{2}\x3a[a-z0-9]{2}\x3a[a-z0-9]{2}\x3a[a-z0-9]{2}\&[a-z]{2,8}=	2	0	0	1
+138	138	\.php\?action=jv\&h=\d+	2	0	0	1
+139	139	\.php\?b=[A-F0-9]+&v=1\.	2	0	0	1
+140	140	\.php\?j=1&k=[0-9](i=[0-9])?$	2	0	0	1
+141	141	\.php\?mac\x3d([a-f0-9]{2}\x3a){5}[a-f0-9]{2}$	2	0	0	1
+142	142	\.php\?setup=d\&s=\d+\&r=\d+	2	0	0	1
+143	143	\.php\x3fw\x3d\d+\x26n\x3d\d+	2	0	0	1
+144	144	\.png$	2	0	0	1
+145	145	\.replace\x28\x2F[^\x2F]+\x2F[A-Z]*\x2C(\x22\x22|\x27\x27)	2	0	0	1
+146	146	\/$	2	0	0	1
+147	147	\/%2E%2E(\\|%5C)\/	2	0	0	1
+148	148	\/([0-9][0-9a-z]{2}|[0-9a-z][0-9][0-9a-z]|[0-9a-z]{2}[0-9])\.jar$	2	0	0	1
+149	149	\/(\\|%5C)%2E%2E\/	2	0	0	1
+150	150	\/AES\d+O\d+\.jsp\?[a-z0-9=\x2b\x2f]{20}	2	0	0	1
+151	151	\/AES\d{9}O\d{4,5}\x2ejsp	2	0	0	1
+152	152	\/CreationDate\x28[^\x3c\x29]{500}	2	0	0	1
+153	153	\/DES\d+O\d+\.jsp\?[a-z0-9=\x2b\x2f]{20}	2	0	0	1
+154	154	\/DES\d{9}O\d{4,5}\x2ejsp	2	0	0	1
+155	155	\/F[^\/>]+\.(exe|dll|swf)	2	0	0	1
+156	156	\/Java([0-9]{1,2})?\.jar\?java=[0-9]{2}	2	0	0	1
+157	157	\/La(.)*?\s*?\/F[^\/>]+\.(exe|dll|swf)	2	0	0	1
+158	158	\/MacApp\/\d{2}(-\d{2}){3}(:\d{2}){2}\.png\r\n[^\x89]+?\x89PNG	2	0	0	1
+159	159	\/OvCgi\/(jovgraph|webappmon)\.exe	2	0	0	1
+160	160	\/OvCgi\/(jovgraph|webappmon)\.exe.*?-textFile+[^+]{201}	2	0	0	1
+161	161	\/SUS\d+O\d+\.jsp\?[a-z0-9=\x2b\x2f]{20}	2	0	0	1
+162	162	\/VertexNet\/adduser\.php\?uid=\x7B[^\r\n]+\x7D\x26la[^\r\n]+\x26cmpname=	2	0	0	1
+163	163	\/VertexNet\/tasks\.php\?uid=\x7B[^\r\n]+\x7D\x26la[^\r\n]+\x26cmpname=	2	0	0	1
+164	164	\/ZES\d+O\d+\.jsp\?[a-z0-9=\x2b\x2f]{20}	2	0	0	1
+165	165	\/[a-f0-9]{16}([a-f0-9]{16})?\/ff\.php	2	0	0	1
+166	166	\/[a-f0-9]{16}\/a\.php	2	0	0	1
+167	167	\/[a-f0-9]{16}\/q\.php	2	0	0	1
+168	168	\/[a-f0-9]{32}\/a\.php	2	0	0	1
+169	169	\/[a-f0-9]{32}\/q\.php	2	0	0	1
+170	170	\/[a-z0-9]{12}\.txt$	2	0	0	1
+171	171	\/[a-zA-Z0-9]{150,}\/getmyfile\.exe\?o=1\&h=11$	2	0	0	1
+172	172	\/[a-z]{4}\.html\?h\=\d{6,7}$	2	0	0	1
+173	173	\/[a-z]{4}\.html\?i\=\d{6,7}$	2	0	0	1
+174	174	\/[a-z]{4}\.html\?j\=\d{6,7}$	2	0	0	1
+175	175	\/\?[0-9a-f]{60,66}[\;\d]*$	2	0	0	1
+176	176	\/\?id=\d+\x26AnSSip=	2	0	0	1
+177	177	\/\?java\=[0-9]{2,4}	2	0	0	1
+178	178	\/\[fx]\.jar$	2	0	0	1
+179	179	\/\d{2}\.html$	2	0	0	1
+180	180	\/api\/urls\/\?ts=[a-z0-9]+&affid=\d{5}	2	0	0	1
+181	181	\/app\/\?prj=\d\x26pid=[^\r\n]+\x26mac=	2	0	0	1
+182	182	\/blog/images/3521\.jpg\?v\d{2}=\d{2}\x26tq=	2	0	0	1
+183	183	\/count\d{2}\.php$	2	0	0	1
+184	184	\/elections\.php\?([a-z0-9]+\x3d\d{1,3}\&){9}[a-z0-9]+\x3d\d{1,3}$	2	0	0	1
+185	185	\/f\.php\?k=\d	2	0	0	1
+186	186	\/html\/license_[0-9A-F]{550,}\.html$	2	0	0	1
+187	187	\/images\/[a-zA-Z]\.php\?id\=[0-9]{2,3}(\.\d)?$	2	0	0	1
+188	188	\/index\d{9}\.asp	2	0	0	1
+189	189	\/install\.asp\?mac=[A-F\d]{12}\x26mode	2	0	0	1
+190	190	\/jdb\/inf\.php\?id=[a-f0-9]{32}$	2	0	0	1
+191	191	\/jlnp\.html$	2	0	0	1
+192	192	\/jorg\.html$	2	0	0	1
+193	193	\/jovf\.html$	2	0	0	1
+194	194	\/loader\.cpl$	2	0	0	1
+195	195	\/pdfx\.html$	2	0	0	1
+196	196	\/pte\.aspx\?ver=\d\.\d\.\d+\.\d\x26rnd=\d{5}	2	0	0	1
+197	197	\/r_autoidcnt\.asp\?mer_seq=\d[^\r\n]*\x26mac=	2	0	0	1
+198	198	\/se\/[a-f0-9]{100,200}\/[a-f0-9]{6,9}\/[A-Z0-9_]{4,200}\.com	2	0	0	1
+199	199	\/setup_b\.asp\?prj=\d\x26pid=[^\r\n]*\x26mac=	2	0	0	1
+200	200	\/stat_d\/$	2	0	0	1
+201	201	\/stat_n\/$	2	0	0	1
+202	202	\/stat_svc\/$	2	0	0	1
+203	203	\/stat_u\/$	2	0	0	1
+204	204	\/vic\.aspx\?ver=\d\.\d\.\d+\.\d\x26rnd=\d{5}	2	0	0	1
+205	205	\/world\/[^\x2f]*\.pdf	2	0	0	1
+206	206	\<a\s+[^\>]*href\s*\x3D\s*[\x22\x27]?[^\>\x22\x27]*\x23\x3A\x2F\x2F[^\>]+\>	2	0	0	1
+207	207	\?[a-f0-9]{4}$	2	0	0	1
+208	208	\?id=[A-Z0-9]{20}&cmd=img	2	0	0	1
+209	209	\?inf\=[0-9a-f]{8}\x2Ex\d{2}\x2E\d{8}\x2E	2	0	0	1
+210	210	\?page\=[a-f0-9]{16}	2	0	0	1
+211	211	\?spl=\d&br=[^&]+&vers=[^&]+&s=	2	0	0	1
+212	212	\bcmd\x2eexe\b	2	0	0	1
+213	213	\d+&	2	0	0	1
+214	214	\r\nHost\x3A\s+[^\r\n]*?[bcdfghjklmnpqrstvwxyz]{5,}[^\r\n]*?\x2Einfo\r\n	2	0	0	1
+215	215	\r\nHost\x3a\x20[a-z0-9\x2d\x2e]+\.com\x2d[a-z0-9\x2d\x2e]+(\x3a\d{1,5})?\r\n	2	0	0	1
+216	216	\r\nReferer\x3A\x20http\x3A\x2F\x2f[a-z0-9\x2d\x2e]+\x2F\x3Fdo\x3Dpayment\x26ver\x3D\d+\x26sid\x3D\d+\x26sn\x3D\d+\r\n	2	0	0	1
+217	217	\s*\x28(\x27[^\x27]{64}|\x27[^\x27]*\x27\s*,\s*\x27[^\x27]{64})	2	0	0	1
+218	218	\sAUTHENTICATE\s[^\n]{100}	2	0	0	1
+219	219	\sEXAMINE\s[^\n]*?\s\{	2	0	0	1
+220	220	\sFETCH\s[^\n]*?\s\{	2	0	0	1
+221	221	\sLOGIN\s\w+\s\{\d+\}[\r]?\n[^\n]*?%	2	0	0	1
+222	222	\x00[\x3b\x7c\x26\x60][^\x00]+\x00airappinstaller\x00ASnative\x00	2	0	0	1
+223	223	\x00[\x70-\x74]\x00[\x00-\x09]	2	0	0	1
+224	224	\x00\.\x00\.\x00[\x2f\x5c]	2	0	0	1
+225	225	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01espia_(video_get_dev_image|audio_get_dev_audio|image_get_dev_screen)	2	0	0	1
+226	226	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01incognito_(list_tokens|impersonate_token|add_user|add_group_user|add_localgroup_user|snarf_hashes)	2	0	0	1
+227	227	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01lanattacks_(start_dhcp|reset_dhcp|set_dhcp_option|stop_dhcp|dhcp_log|start_tftp|reset_tftp|add_tftp_file|stop_tftp)	2	0	0	1
+228	228	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01networkpug_(start|stop)	2	0	0	1
+229	229	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01priv_(elevate_getsystem|passwd_get_sam_hashes|fs_get_file_mace|fs_set_file_mace)	2	0	0	1
+230	230	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01sniffer_(interfaces|capture_start|capture_stop|capture_stats|capture_dump|capture_dump_read)	2	0	0	1
+231	231	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_fs_(separator|search|file_expand_path|md5|sha1|delete_file|stat|ls|chdir|mkdir|getwd|delete_dir)	2	0	0	1
+232	232	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_net_(config_get_interfaces|config_get_routes|config_add_route|udp_client|tcp_server|tcp_client|socket_tcp_shutdown)	2	0	0	1
+233	233	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_railgun_(memread|memwrite|api_multi|api)	2	0	0	1
+234	234	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_registry_(load_key|unload_key|open_key|open_remote_key|create_key|delete_key|close_key|enum_key)	2	0	0	1
+235	235	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_sys_config_(getuid|sysinfo|rev2self|steal_token|drop_token|getprivs)	2	0	0	1
+236	236	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_sys_eventlog_(open|numrecords|read|oldest|clear|close)	2	0	0	1
+237	237	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_sys_process_(thread_open|thread_create|thread_get_threads)	2	0	0	1
+238	238	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_ui_(enable_keyboard|enable_mouse|get_idle_time|desktop_enum|desktop_get|desktop_set|desktop_screenshot)	2	0	0	1
+239	239	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01webcam_(list|start|get_frame|stop|audio_record)	2	0	0	1
+240	240	\x0a\x0d?\x0a[A-Z0-9\x2b\x2f\s]*[^A-Z0-9\x2b\x2f\s\x3d]	2	0	0	1
+241	241	\x23\d{2}\x3a\d{2}\x3a\d\d$	2	0	0	1
+242	242	\x25USERPROFILE\x25\x5C[^\x2e]{1,255}\x2eexe	2	0	0	1
+243	243	\x26?arg\d+\s*=\s*[^\x26]*?(import|http)	2	0	0	1
+244	244	\x26TARGET\x3d\x5f(blank|parent|top)	2	0	0	1
+245	245	\x26arg\d+\s*=\s*[^\r\n\x26]*import	2	0	0	1
+246	246	\x26r\d\x3d[^\x26\s]*\x27	2	0	0	1
+247	247	\x26r\d\x3d\d*[^\x26\s\d]	2	0	0	1
+248	248	\x26tv\x3d\d\.\d\.\d{4}\.\d{4}	2	0	0	1
+249	249	\x26uid\x3d[a-f0-9]{16}($|\x26)	2	0	0	1
+250	250	\x28\s*\x22\s*\x25([2-9][6-9][5-9]|[1-9][0-9]{3,})f	2	0	0	1
+251	251	\x28compatible\x3b[A-Z]*\x3b\x29\x0d\x0a	2	0	0	1
+252	252	\x2A\x02.{4}\x00\x04\x00\x07.*\x3C\x3E[^\x00]{1023,}	2	0	0	1
+253	253	\x2E[A-Z\d_]+\s*\x7b\s*text-decoration[^\x3A]*?\x7d	2	0	0	1
+254	254	\x2E\x00?d\x00?l\x00?l\x00?	2	0	0	1
+255	255	\x2Ebin([\?\x5c\x2f]|$)	2	0	0	1
+256	256	\x2Emaplet([\?\x5c\x2f]|$)	2	0	0	1
+257	257	\x2Ermf([\?\x5c\x2f]|$)	2	0	0	1
+258	258	\x2Eview\x2Eselection.*?\x2Etree\s*\x3D\s*null.*?\x2Einvalidate	2	0	0	1
+259	259	\x2FCSuserCGI\x2Eexe\x3F.*?Logout.[^&]{96}	2	0	0	1
+260	260	\x2F[a-z]+\x2epng	2	0	0	1
+261	261	\x2Faws\d{1,5}\.jsp\x3F	2	0	0	1
+262	262	\x2Fdesktop\x2F\d+\x2Ftoolbar\x2Fsupremetb\d+\.cfg	2	0	0	1
+263	263	\x2Fevil\x2Fservices\x2Fbid_register\x2Ephp\x3FBID\x3D[A-Za-z]{6}\x26IP\x3D\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x26cipher\x3D[A-Za-z]{9}	2	0	0	1
+264	264	\x2Fgumblar\x2Ecn\x2Frss\x2F\x3Fid\x3D\d+	2	0	0	1
+265	265	\x2Fin\.cgi\?\d{1,2}$	2	0	0	1
+266	266	\x2Flogo\.gif\x3F[0-9a-f]{5,7}=\d{5,7}	2	0	0	1
+267	267	\x2Flogos\.gif\x3F[0-9a-f]+=\x2d?\d+	2	0	0	1
+268	268	\x2Fmartuz\x2Ecn\x2Fvid\x2F\x3Fid\x3D\d+	2	0	0	1
+269	269	\x2Fmrow\x5Fpin\x2F\x3Fid\d+[a-z]{5,}\d{5}\x26rnd\x3D\d+	2	0	0	1
+270	270	\x2FphpThumb\.php\x3F[^\r\n]*fltr\[\]=[^\r\n\x26]+\x3B	2	0	0	1
+271	271	\x2Fupdate\w\x2Ephp\x3Fp\x3D\d+.*User\x2DAgent\x3A\s+Mozilla\x2F4\x2E75\s\x5Ben\x5D\s\x28X11\x3B\sU\x3B\sLinux\s2\x2E2\x2E16\x2D3\si686\x29	2	0	0	1
+272	272	\x2e(jpg|png|gif)\x3fs?v.*?&tq=g[A-Z0-9]{2}	2	0	0	1
+273	273	\x2e3g2([\?\x5c\x2f]|$)	2	0	0	1
+274	274	\x2e3gp([\?\x5c\x2f]|$)	2	0	0	1
+275	275	\x2e4xm([\?\x5c\x2f]|$)	2	0	0	1
+276	276	\x2eExecWB\s*\x28(IDM_PRINTPREVIEW|7)\x2c\s+(0|2)\x2C\s+\x22http	2	0	0	1
+277	277	\x2eafm([\?\x5c\x2f]|$)	2	0	0	1
+278	278	\x2eani([\?\x5c\x2f]|$)	2	0	0	1
+279	279	\x2eapk([\?\x5c\x2f]|$)	2	0	0	1
+280	280	\x2easx([\?\x5c\x2f]|$)	2	0	0	1
+281	281	\x2eavi([\?\x5c\x2f]|$)	2	0	0	1
+282	282	\x2ecdr([\?\x5c\x2f]|$)	2	0	0	1
+283	283	\x2ecgm([\?\x5c\x2f]|$)	2	0	0	1
+284	284	\x2echm([\?\x5c\x2f]|$)	2	0	0	1
+285	285	\x2eclass([\?\x5c\x2f]|$)	2	0	0	1
+286	286	\x2ecov([\?\x5c\x2f]|$)	2	0	0	1
+287	287	\x2ecpe([\?\x5c\x2f]|$)	2	0	0	1
+288	288	\x2ecsd([\?\x5c\x2f]|$)	2	0	0	1
+289	289	\x2edcr([\?\x5c\x2f]|$)	2	0	0	1
+290	290	\x2edefinition\s*\x28	2	0	0	1
+291	291	\x2edir([\?\x5c\x2f]|$)	2	0	0	1
+292	292	\x2edisco([\?\x5c\x2f]|$)	2	0	0	1
+293	293	\x2edmg([\?\x5c\x2f]|$)	2	0	0	1
+294	294	\x2edoc([\?\x5c\x2f]|$)	2	0	0	1
+295	295	\x2edxf([\?\x5c\x2f]|$)	2	0	0	1
+296	296	\x2eeot([\?\x5c\x2f]|$)	2	0	0	1
+297	297	\x2eeps([\?\x5c\x2f]|$)	2	0	0	1
+298	298	\x2eexe([\?\x5c\x2f]|$)	2	0	0	1
+299	299	\x2eexport(AsFDF|AsText|AsXFDF|DataObject|XFAData)\x28[^\x2c\x29]*\x2c[^\x2c\x29]*\x2c[^\x29]+\x2eexe	2	0	0	1
+300	300	\x2ef4a([\?\x5c\x2f]|$)	2	0	0	1
\ No newline at end of file
diff --git a/test/benchmark/regex_rules/REGEX_3K b/test/benchmark/regex_rules/REGEX_3K
new file mode 100644
index 0000000..909e1cd
--- /dev/null
+++ b/test/benchmark/regex_rules/REGEX_3K
@@ -0,0 +1,3001 @@
+3000
+1	1	User-Agent:\s.*.abc.net	2	0	0	1
+2	2	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5	2	0	0	1
+3	3	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980	2	0	0	1
+4	4	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E	2	0	0	1
+5	5	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333	2	0	0	1
+6	6	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C	2	0	0	1
+7	7	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E	2	0	0	1
+8	8	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+9	9	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+10	10	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+11	11	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08	2	0	0	1
+12	12	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42	2	0	0	1
+13	13	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4	2	0	0	1
+14	14	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980	2	0	0	1
+15	15	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3	2	0	0	1
+16	16	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980	2	0	0	1
+17	17	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB	2	0	0	1
+18	18	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+19	19	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+20	20	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664	2	0	0	1
+21	21	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C	2	0	0	1
+22	22	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980	2	0	0	1
+23	23	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+24	24	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+25	25	(EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters)	2	0	0	1
+26	26	(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+27	27	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+28	28	(ReadMolFile|SaveasMolFile)	2	0	0	1
+29	29	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+30	30	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+31	31	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C	2	0	0	1
+32	32	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+33	33	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+34	34	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000	2	0	0	1
+35	35	file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+36	36	[0-9]{3,}	2	0	0	1
+37	37	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194	2	0	0	1
+38	38	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2	2	0	0	1
+39	39	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510	2	0	0	1
+40	40	(setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch)	2	0	0	1
+41	41	param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20}	2	0	0	1
+42	42	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C	2	0	0	1
+43	43	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+44	44	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79	2	0	0	1
+45	45	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD	2	0	0	1
+46	46	(Text|EditSelText|EditText|CellFontName|Archive)	2	0	0	1
+47	47	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+48	48	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c	2	0	0	1
+49	49	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B	2	0	0	1
+50	50	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA	2	0	0	1
+51	51	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted)	2	0	0	1
+52	52	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam)	2	0	0	1
+53	53	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+54	54	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8	2	0	0	1
+55	55	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E	2	0	0	1
+56	56	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726	2	0	0	1
+57	57	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598	2	0	0	1
+58	58	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E	2	0	0	1
+59	59	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E	2	0	0	1
+60	60	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E	2	0	0	1
+61	61	(exe|bat|com|dll|ini)	2	0	0	1
+62	62	(exe|bat|com|dll|ini)	2	0	0	1
+63	63	(exe|bat|com|dll|ini)	2	0	0	1
+64	64	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E	2	0	0	1
+65	65	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7	2	0	0	1
+66	66	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91	2	0	0	1
+67	67	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980	2	0	0	1
+68	68	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02	2	0	0	1
+69	69	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3	2	0	0	1
+70	70	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90	2	0	0	1
+71	71	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E	2	0	0	1
+72	72	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E	2	0	0	1
+73	73	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112	2	0	0	1
+74	74	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1	2	0	0	1
+75	75	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6	2	0	0	1
+76	76	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F	2	0	0	1
+77	77	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+78	78	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA	2	0	0	1
+79	79	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258	2	0	0	1
+80	80	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B	2	0	0	1
+81	81	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1	2	0	0	1
+82	82	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7	2	0	0	1
+83	83	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D	2	0	0	1
+84	84	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61	2	0	0	1
+85	85	(Src|Background|PackageXml)	2	0	0	1
+86	86	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters)	2	0	0	1
+87	87	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+88	88	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+89	89	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+90	90	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+91	91	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755	2	0	0	1
+92	92	(Save|SaveLayoutChanges|SaveMenuUsageData)	2	0	0	1
+93	93	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61	2	0	0	1
+94	94	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+95	95	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+96	96	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+97	97	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+98	98	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0	2	0	0	1
+99	99	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3	2	0	0	1
+100	100	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679	2	0	0	1
+101	101	(SaveFile|ExportToXML)	2	0	0	1
+102	102	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE	2	0	0	1
+103	103	(SnapShotToFile|SnapShotX)	2	0	0	1
+104	104	(SnapShotToFile|SnapShotX)	2	0	0	1
+105	105	(SnapShotToFile|SnapShotX)	2	0	0	1
+106	106	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+107	107	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28	2	0	0	1
+108	108	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003	2	0	0	1
+109	109	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+110	110	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+111	111	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+112	112	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+113	113	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE	2	0	0	1
+114	114	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB	2	0	0	1
+115	115	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile)	2	0	0	1
+116	116	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD	2	0	0	1
+117	117	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA	2	0	0	1
+118	118	(Run|SetRegistryValueAsString|PerformUpdateAsync)	2	0	0	1
+119	119	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+120	120	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+121	121	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084	2	0	0	1
+122	122	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6	2	0	0	1
+123	123	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF	2	0	0	1
+124	124	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5	2	0	0	1
+125	125	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C	2	0	0	1
+126	126	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA	2	0	0	1
+127	127	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020	2	0	0	1
+128	128	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020	2	0	0	1
+129	129	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B	2	0	0	1
+130	130	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356	2	0	0	1
+131	131	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520	2	0	0	1
+132	132	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C	2	0	0	1
+133	133	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26	2	0	0	1
+134	134	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0	2	0	0	1
+135	135	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF	2	0	0	1
+136	136	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142	2	0	0	1
+137	137	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB	2	0	0	1
+138	138	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7	2	0	0	1
+139	139	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747	2	0	0	1
+140	140	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456	2	0	0	1
+141	141	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0	2	0	0	1
+142	142	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999	2	0	0	1
+143	143	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899	2	0	0	1
+144	144	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5	2	0	0	1
+145	145	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E	2	0	0	1
+146	146	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F	2	0	0	1
+147	147	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9	2	0	0	1
+148	148	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F	2	0	0	1
+149	149	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448	2	0	0	1
+150	150	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92	2	0	0	1
+151	151	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F	2	0	0	1
+152	152	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED	2	0	0	1
+153	153	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB	2	0	0	1
+154	154	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305	2	0	0	1
+155	155	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7	2	0	0	1
+156	156	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B	2	0	0	1
+157	157	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C	2	0	0	1
+158	158	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627	2	0	0	1
+159	159	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E	2	0	0	1
+160	160	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE	2	0	0	1
+161	161	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496	2	0	0	1
+162	162	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0	2	0	0	1
+163	163	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E	2	0	0	1
+164	164	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C	2	0	0	1
+165	165	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53	2	0	0	1
+166	166	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014	2	0	0	1
+167	167	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+168	168	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+169	169	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741	2	0	0	1
+170	170	(SaveToBMP|SaveToFile)	2	0	0	1
+171	171	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2	2	0	0	1
+172	172	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667	2	0	0	1
+173	173	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+174	174	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+175	175	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+176	176	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D	2	0	0	1
+177	177	(SaveBarCode|SaveEnhWMF)	2	0	0	1
+178	178	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B	2	0	0	1
+179	179	<object\s*[^>]*\s*classid\s*=\s*(.+<q1>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>)	2	0	0	1
+180	180	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000	2	0	0	1
+181	181	(exe|bat|com|dll|ini)	2	0	0	1
+182	182	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E	2	0	0	1
+183	183	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E	2	0	0	1
+184	184	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87	2	0	0	1
+185	185	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+186	186	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+187	187	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+188	188	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+189	189	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+190	190	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E	2	0	0	1
+191	191	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344	2	0	0	1
+192	192	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C	2	0	0	1
+193	193	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30	2	0	0	1
+194	194	(Packagefiles|SaveDna|SetIdentity|AddFile)	2	0	0	1
+195	195	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9	2	0	0	1
+196	196	(_DOWText)|(_MonthText)	2	0	0	1
+197	197	(SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour)	2	0	0	1
+198	198	classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE	2	0	0	1
+199	199	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+200	200	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+201	201	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F	2	0	0	1
+202	202	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5	2	0	0	1
+203	203	[\w\W]{2500,}	2	0	0	1
+204	204	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3	2	0	0	1
+205	205	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8	2	0	0	1
+206	206	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04	2	0	0	1
+207	207	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue)	2	0	0	1
+208	208	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356	2	0	0	1
+209	209	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E	2	0	0	1
+210	210	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574	2	0	0	1
+211	211	(WriteIniFileString|ShellExecute)	2	0	0	1
+212	212	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906	2	0	0	1
+213	213	(txt|ini|com|exe|bat|dll|dat)	2	0	0	1
+214	214	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8	2	0	0	1
+215	215	42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733	2	0	0	1
+216	216	(Save|ExportImage)	2	0	0	1
+217	217	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790	2	0	0	1
+218	218	(DeleteFile|write)	2	0	0	1
+219	219	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+220	220	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+221	221	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+222	222	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+223	223	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967	2	0	0	1
+224	224	WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext)	2	0	0	1
+225	225	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9	2	0	0	1
+226	226	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5	2	0	0	1
+227	227	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6	2	0	0	1
+228	228	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+229	229	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+230	230	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24	2	0	0	1
+231	231	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9	2	0	0	1
+232	232	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA	2	0	0	1
+233	233	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec)	2	0	0	1
+234	234	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5	2	0	0	1
+235	235	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+236	236	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+237	237	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+238	238	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83	2	0	0	1
+239	239	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA	2	0	0	1
+240	240	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566	2	0	0	1
+241	241	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+242	242	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+243	243	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B	2	0	0	1
+244	244	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F	2	0	0	1
+245	245	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+246	246	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+247	247	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED	2	0	0	1
+248	248	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619	2	0	0	1
+249	249	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E	2	0	0	1
+250	250	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258	2	0	0	1
+251	251	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196	2	0	0	1
+252	252	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E	2	0	0	1
+253	253	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD	2	0	0	1
+254	254	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4	2	0	0	1
+255	255	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118	2	0	0	1
+256	256	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616	2	0	0	1
+257	257	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+258	258	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+259	259	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+260	260	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11	2	0	0	1
+261	261	(ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1	2	0	0	1
+262	262	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020	2	0	0	1
+263	263	(PostURL|AddSeperator|AddString|Post)	2	0	0	1
+264	264	(SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF)	2	0	0	1
+265	265	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>)	2	0	0	1
+266	266	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\>	2	0	0	1
+267	267	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\>	2	0	0	1
+268	268	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\>	2	0	0	1
+269	269	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\>	2	0	0	1
+270	270	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+271	271	(Buildpath|GetDriveName|DriveExists|DeleteFile)	2	0	0	1
+272	272	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+273	273	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+274	274	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+275	275	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>)	2	0	0	1
+276	276	\x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission]	2	0	0	1
+277	277	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\>	2	0	0	1
+278	278	000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F	2	0	0	1
+279	279	(javascript|http|ftp|vbscript)	2	0	0	1
+280	280	(SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen)	2	0	0	1
+281	281	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000	2	0	0	1
+282	282	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407	2	0	0	1
+283	283	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414	2	0	0	1
+284	284	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+285	285	(AddAttachment|SubmitToExpress)	2	0	0	1
+286	286	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6	2	0	0	1
+287	287	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0	2	0	0	1
+288	288	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D	2	0	0	1
+289	289	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile)	2	0	0	1
+290	290	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\>	2	0	0	1
+291	291	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\>	2	0	0	1
+292	292	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC	2	0	0	1
+293	293	src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape	2	0	0	1
+294	294	(LogFile|ClearLogFile|SaveToFile)	2	0	0	1
+295	295	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)	2	0	0	1
+296	296	^User-Agent\x3a Downloader \d\.\d\r?$/Hm	2	0	0	1
+297	297	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P	2	0	0	1
+298	298	^((\r?\n\r?\n).)*?\r?\n\r?\nMZ	2	0	0	1
+299	299	instructions\/\d{2}\.xml	2	0	0	1
+300	300	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp	2	0	0	1
+301	301	\/updatestats\/update\d+?\.xml$	2	0	0	1
+302	302	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab	2	0	0	1
+303	303	ctxad-\d+\.sig	2	0	0	1
+304	304	/user\d+/counter\.htm	2	0	0	1
+305	305	(cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr	2	0	0	1
+306	306	(discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe	2	0	0	1
+307	307	loaderadv\d+\.jar	2	0	0	1
+308	308	\/adv\/\d+\/win32\.exe	2	0	0	1
+309	309	\/Message\/\S+\/\S+\.xml	2	0	0	1
+310	310	\/abt\?data=\S{150}	2	0	0	1
+311	311	^User-Agent\x3a.+ZangoToolbar.+\r$/Hmi	2	0	0	1
+312	312	User-Agent\:[^\n]+wbi_v\d/iH	2	0	0	1
+313	313	User-Agent\x3a[^\n]+AskBar/iH	2	0	0	1
+314	314	\/tbrequest\d+\.php	2	0	0	1
+315	315	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+316	316	sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+317	317	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+318	318	cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+319	319	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+320	320	UID=\d	2	0	0	1
+321	321	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+322	322	REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P	2	0	0	1
+323	323	victim\.php\?\d\d\d\d\d	2	0	0	1
+324	324	\/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d	2	0	0	1
+325	325	\/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+	2	0	0	1
+326	326	&ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d	2	0	0	1
+327	327	\/sd\?s=\d+&f=\d&C=\d	2	0	0	1
+328	328	\.txt$	2	0	0	1
+329	329	\.cfg$	2	0	0	1
+330	330	User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H	2	0	0	1
+331	331	^Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r?$/Hi	2	0	0	1
+332	332	\x00[\x02-\x1E][0-9]{2,30}\x02cn\x00	2	0	0	1
+333	333	\x00[\x02-\x1E][0-9]{2,30}\x02ru\x00	2	0	0	1
+334	334	^[A-F0-9]+$	2	0	0	1
+335	335	\/sd\?s=\d+&f=\d	2	0	0	1
+336	336	loadadv\d+\.exe	2	0	0	1
+337	337	\/ms\d\d\dcfg\.jsp	2	0	0	1
+338	338	^0x[0-9a-f]+$	2	0	0	1
+339	339	^[^a-z]*?[0-9]{2,30}\.ru$	2	0	0	1
+340	340	filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe	2	0	0	1
+341	341	^MM \d\.\d+$	2	0	0	1
+342	342	^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4}	2	0	0	1
+343	343	^\w+pcsetup_\w+	2	0	0	1
+344	344	\x2Fv[0-9]{3,4}[\x2F\x3F]	2	0	0	1
+345	345	[a-f0-9]{32}\?v=	2	0	0	1
+346	346	^\/[a-z]{2}\x3Fv\x3D[0-9]$	2	0	0	1
+347	347	^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$	2	0	0	1
+348	348	^\/entrance\?s1=[a-f0-9]{100,}$	2	0	0	1
+349	349	^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=	2	0	0	1
+350	350	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+351	351	^[0-9][a-z]+	2	0	0	1
+352	352	\.php$	2	0	0	1
+353	353	^\/([^\x2f]+\/)*log\/\?[bc]=	2	0	0	1
+354	354	^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/))	2	0	0	1
+355	355	^\/\?pcrc=\d+&v=[\d.]+$	2	0	0	1
+356	356	^\/\?v=[\d.]+&pcrc=\d+$	2	0	0	1
+357	357	\/v\d\/[^.]+\.asp$	2	0	0	1
+358	358	\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$	2	0	0	1
+359	359	\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$	2	0	0	1
+360	360	^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$	2	0	0	1
+361	361	^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$	2	0	0	1
+362	362	\?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})	2	0	0	1
+363	363	^Downloader\s\d+\.\d+$	2	0	0	1
+364	364	^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100}	2	0	0	1
+365	365	\/get_xml\?(file_id|stb)=	2	0	0	1
+366	366	(_[a-z]{2}){1,3}_[a-z]{3}_install\.exe	2	0	0	1
+367	367	\d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows	2	0	0	1
+368	368	^[a-zA-Z0-9_-]+$	2	0	0	1
+369	369	^\/([a-zA-Z0-9]|%2[fb]){400,}$	2	0	0	1
+370	370	User-Agent\:[^\n]+searchengine	2	0	0	1
+371	371	User-Agent\:[^\n]+SurferPlugin	2	0	0	1
+372	372	User-Agent\:[^\n]+THNALL[^\n]+\.EXE	2	0	0	1
+373	373	User-Agent\:[^\n]+XupiterToolbar	2	0	0	1
+374	374	User-Agent\:[^\n]+spywareaxe	2	0	0	1
+375	375	User-Agent\:[^\n]+iMeshBar	2	0	0	1
+376	376	User-Agent\:[^\n]+Oemji	2	0	0	1
+377	377	^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$	2	0	0	1
+378	378	^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$	2	0	0	1
+379	379	^\/(get|install)\/\?q=	2	0	0	1
+380	380	^\/[a-f0-9]{50,}$	2	0	0	1
+381	381	^\/[\w-]{50,}$	2	0	0	1
+382	382	^\/\?pcrc=[0-9]{7,10}$	2	0	0	1
+383	383	^Downloader \d\.\d$	2	0	0	1
+384	384	\/Socks[45]\.txt$	2	0	0	1
+385	385	^Feat[^\r\n]+(Install|Updat)er	2	0	0	1
+386	386	User-Agent\:[^\n]+host(ie|oe|oi|ol)	2	0	0	1
+387	387	User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}	2	0	0	1
+388	388	^BWL(\sToplist|\d_UPDATE)	2	0	0	1
+389	389	^\x2F[A-F0-9]{25,40}$	2	0	0	1
+390	390	^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$	2	0	0	1
+391	391	^\d+\sHTTP/1.1$	2	0	0	1
+392	392	^[a-zA-Z0-9_-]+	2	0	0	1
+393	393	[a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12}	2	0	0	1
+394	394	\/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id=	2	0	0	1
+395	395	\{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\}	2	0	0	1
+396	396	CN=([^\r\n]+?\.)?showmypc\.com(\.)	2	0	0	1
+397	397	^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$	2	0	0	1
+398	398	(SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk)	2	0	0	1
+399	399	(DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog)	2	0	0	1
+400	400	\d{13}$	2	0	0	1
+401	401	^[a-f0-9]{32}	2	0	0	1
+402	402	^[a-f0-9]{32}\"	2	0	0	1
+403	403	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+404	404	^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}	2	0	0	1
+405	405	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+406	406	^[A-F0-9]{12}	2	0	0	1
+407	407	^[A-Z0-9]{9}	2	0	0	1
+408	408	^\d+[^\r\n\s]+	2	0	0	1
+409	409	^ SQL[-_ ]Server	2	0	0	1
+410	410	^ \d+ Driver	2	0	0	1
+411	411	ORA-\d{4}	2	0	0	1
+412	412	Warning.*\Woci_	2	0	0	1
+413	413	Warning.*\Wora_	2	0	0	1
+414	414	CLI Driver.*DB2	2	0	0	1
+415	415	bdb2_\w+\(	2	0	0	1
+416	416	Exception.*Informix	2	0	0	1
+417	417	Warning.*SQLite3::	2	0	0	1
+418	418	SQL error.*POS\([0-9]+\)	2	0	0	1
+419	419	Warning.*maxdb	2	0	0	1
+420	420	i?Warning.*sybase	2	0	0	1
+421	421	Warning.*ingres_	2	0	0	1
+422	422	Warning.*sqlite_	2	0	0	1
+423	423	Ingres\W.*Driver	2	0	0	1
+424	424	Exception (condition )\d+\. Transaction rollback\.	2	0	0	1
+425	425	SQL Server.*?error \x27[0-9a-f]{8}	2	0	0	1
+426	426	^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$	2	0	0	1
+427	427	^(<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll	2	0	0	1
+428	428	^...\x30\x82..\x02\x82...{256,257}	2	0	0	1
+429	429	\/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php	2	0	0	1
+430	430	\/notify\/(single|mass)$	2	0	0	1
+431	431	a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php)	2	0	0	1
+432	432	Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a	2	0	0	1
+433	433	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+434	434	[-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10}	2	0	0	1
+435	435	^\d+(\+|\-|\\|\*)\d+	2	0	0	1
+436	436	^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9	2	0	0	1
+437	437	^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u	2	0	0	1
+438	438	ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b	2	0	0	1
+439	439	^\d{4}[01]	2	0	0	1
+440	440	^\d{4}[01]	2	0	0	1
+441	441	^\d{4}[01]	2	0	0	1
+442	442	^\d{4}[01]	2	0	0	1
+443	443	^\d{4}[01]	2	0	0	1
+444	444	^\d{4}[01]	2	0	0	1
+445	445	^\d{4}[01]	2	0	0	1
+446	446	^\d{4}[01]	2	0	0	1
+447	447	^\d{4}[01]	2	0	0	1
+448	448	^\d{4}[01]	2	0	0	1
+449	449	^\d{4}[01]	2	0	0	1
+450	450	^\d{4}[01]	2	0	0	1
+451	451	^\d{4}[01]	2	0	0	1
+452	452	^\d{4}[01]	2	0	0	1
+453	453	^\d{4}[01]	2	0	0	1
+454	454	^\d{4}[01]	2	0	0	1
+455	455	^\d{4}[01]	2	0	0	1
+456	456	^\d{4}[01]	2	0	0	1
+457	457	^\d{4}[01]	2	0	0	1
+458	458	^\d{4}[01]	2	0	0	1
+459	459	^\d{4}[01]	2	0	0	1
+460	460	^\d{4}[01]	2	0	0	1
+461	461	^\d{4}[01]	2	0	0	1
+462	462	^\d{4}[01]	2	0	0	1
+463	463	^\d{4}[01]	2	0	0	1
+464	464	^\d{4}[01]	2	0	0	1
+465	465	^\d{4}[01]	2	0	0	1
+466	466	^\d{4}[01]	2	0	0	1
+467	467	^\d{4}[01]	2	0	0	1
+468	468	^\d{4}[01]	2	0	0	1
+469	469	^\d{4}[01]	2	0	0	1
+470	470	^\d{4}[01]	2	0	0	1
+471	471	^\d{4}[01]	2	0	0	1
+472	472	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+473	473	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+474	474	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+475	475	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+476	476	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+477	477	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+478	478	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+479	479	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+480	480	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+481	481	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+482	482	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+483	483	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+484	484	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+485	485	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+486	486	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+487	487	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+488	488	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+489	489	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+490	490	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+491	491	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+492	492	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+493	493	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+494	494	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+495	495	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+496	496	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+497	497	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+498	498	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+499	499	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+500	500	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+501	501	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+502	502	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+503	503	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+504	504	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+505	505	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+506	506	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+507	507	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+508	508	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+509	509	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+510	510	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+511	511	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+512	512	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+513	513	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+514	514	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+515	515	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+516	516	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+517	517	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+518	518	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+519	519	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+520	520	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+521	521	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+522	522	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+523	523	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+524	524	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+525	525	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+526	526	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+527	527	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+528	528	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+529	529	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+530	530	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+531	531	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+532	532	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+533	533	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+534	534	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+535	535	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+536	536	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+537	537	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+538	538	^\d{4}[01]	2	0	0	1
+539	539	^\d{4}[01]	2	0	0	1
+540	540	^\d{4}[01]	2	0	0	1
+541	541	^\d{4}[01]	2	0	0	1
+542	542	^\d{4}[01]	2	0	0	1
+543	543	^\d{4}[01]	2	0	0	1
+544	544	^\d{4}[01]	2	0	0	1
+545	545	^\d{4}[01]	2	0	0	1
+546	546	^\d{4}[01]	2	0	0	1
+547	547	^\d{4}[01]	2	0	0	1
+548	548	^\d{4}[01]	2	0	0	1
+549	549	^\d{4}[01]	2	0	0	1
+550	550	^\d{4}[01]	2	0	0	1
+551	551	^\d{4}[01]	2	0	0	1
+552	552	^\d{4}[01]	2	0	0	1
+553	553	^\d{4}[01]	2	0	0	1
+554	554	^\d{4}[01]	2	0	0	1
+555	555	^\d{4}[01]	2	0	0	1
+556	556	^\d{4}[01]	2	0	0	1
+557	557	^\d{4}[01]	2	0	0	1
+558	558	^\d{4}[01]	2	0	0	1
+559	559	^\d{4}[01]	2	0	0	1
+560	560	^\d{4}[01]	2	0	0	1
+561	561	^\d{4}[01]	2	0	0	1
+562	562	^\d{4}[01]	2	0	0	1
+563	563	^\d{4}[01]	2	0	0	1
+564	564	^\d{4}[01]	2	0	0	1
+565	565	^\d{4}[01]	2	0	0	1
+566	566	^\d{4}[01]	2	0	0	1
+567	567	^\d{4}[01]	2	0	0	1
+568	568	^\d{4}[01]	2	0	0	1
+569	569	^\d{4}[01]	2	0	0	1
+570	570	^\d{4}[01]	2	0	0	1
+571	571	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+572	572	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+573	573	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+574	574	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+575	575	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+576	576	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+577	577	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+578	578	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+579	579	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+580	580	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+581	581	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+582	582	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+583	583	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+584	584	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+585	585	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+586	586	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+587	587	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+588	588	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+589	589	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+590	590	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+591	591	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+592	592	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+593	593	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+594	594	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+595	595	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+596	596	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+597	597	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+598	598	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+599	599	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+600	600	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+601	601	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+602	602	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+603	603	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+604	604	^\d{4}[01]	2	0	0	1
+605	605	^\d{4}[01]	2	0	0	1
+606	606	^\d{4}[01]	2	0	0	1
+607	607	^\d{4}[01]	2	0	0	1
+608	608	^\d{4}[01]	2	0	0	1
+609	609	^\d{4}[01]	2	0	0	1
+610	610	^\d{4}[01]	2	0	0	1
+611	611	^\d{4}[01]	2	0	0	1
+612	612	^\d{4}[01]	2	0	0	1
+613	613	^\d{4}[01]	2	0	0	1
+614	614	^\d{4}[01]	2	0	0	1
+615	615	^\d{4}[01]	2	0	0	1
+616	616	^\d{4}[01]	2	0	0	1
+617	617	^\d{4}[01]	2	0	0	1
+618	618	^\d{4}[01]	2	0	0	1
+619	619	^\d{4}[01]	2	0	0	1
+620	620	^\d{4}[01]	2	0	0	1
+621	621	^\d{4}[01]	2	0	0	1
+622	622	^\d{4}[01]	2	0	0	1
+623	623	^\d{4}[01]	2	0	0	1
+624	624	^\d{4}[01]	2	0	0	1
+625	625	^\d{4}[01]	2	0	0	1
+626	626	^\d{4}[01]	2	0	0	1
+627	627	^\d{4}[01]	2	0	0	1
+628	628	^\d{4}[01]	2	0	0	1
+629	629	^\d{4}[01]	2	0	0	1
+630	630	^\d{4}[01]	2	0	0	1
+631	631	^\d{4}[01]	2	0	0	1
+632	632	^\d{4}[01]	2	0	0	1
+633	633	^\d{4}[01]	2	0	0	1
+634	634	^\d{4}[01]	2	0	0	1
+635	635	^\d{4}[01]	2	0	0	1
+636	636	^\d{4}[01]	2	0	0	1
+637	637	^\d{4}[01]	2	0	0	1
+638	638	^\d{4}[01]	2	0	0	1
+639	639	^\d{4}[01]	2	0	0	1
+640	640	^\d{4}[01]	2	0	0	1
+641	641	^\d{4}[01]	2	0	0	1
+642	642	^\d{4}[01]	2	0	0	1
+643	643	^\d{4}[01]	2	0	0	1
+644	644	^\d{4}[01]	2	0	0	1
+645	645	^\d{4}[01]	2	0	0	1
+646	646	^\d{4}[01]	2	0	0	1
+647	647	^\d{4}[01]	2	0	0	1
+648	648	^\d{4}[01]	2	0	0	1
+649	649	^\d{4}[01]	2	0	0	1
+650	650	^\d{4}[01]	2	0	0	1
+651	651	^\d{4}[01]	2	0	0	1
+652	652	^\d{4}[01]	2	0	0	1
+653	653	^\d{4}[01]	2	0	0	1
+654	654	^\d{4}[01]	2	0	0	1
+655	655	^\d{4}[01]	2	0	0	1
+656	656	^\d{4}[01]	2	0	0	1
+657	657	^\d{4}[01]	2	0	0	1
+658	658	^\d{4}[01]	2	0	0	1
+659	659	^\d{4}[01]	2	0	0	1
+660	660	^\d{4}[01]	2	0	0	1
+661	661	^\d{4}[01]	2	0	0	1
+662	662	^\d{4}[01]	2	0	0	1
+663	663	^\d{4}[01]	2	0	0	1
+664	664	^\d{4}[01]	2	0	0	1
+665	665	^\d{4}[01]	2	0	0	1
+666	666	^\d{4}[01]	2	0	0	1
+667	667	^\d{4}[01]	2	0	0	1
+668	668	^\d{4}[01]	2	0	0	1
+669	669	^\d{4}[01]	2	0	0	1
+670	670	^\d{4}[01]	2	0	0	1
+671	671	^\d{4}[01]	2	0	0	1
+672	672	^\d{4}[01]	2	0	0	1
+673	673	^\d{4}[01]	2	0	0	1
+674	674	^\d{4}[01]	2	0	0	1
+675	675	^\d{4}[01]	2	0	0	1
+676	676	^\d{4}[01]	2	0	0	1
+677	677	^\d{4}[01]	2	0	0	1
+678	678	^\d{4}[01]	2	0	0	1
+679	679	^\d{4}[01]	2	0	0	1
+680	680	^\d{4}[01]	2	0	0	1
+681	681	^\d{4}[01]	2	0	0	1
+682	682	^\d{4}[01]	2	0	0	1
+683	683	^\d{4}[01]	2	0	0	1
+684	684	^\d{4}[01]	2	0	0	1
+685	685	^\d{4}[01]	2	0	0	1
+686	686	^\d{4}[01]	2	0	0	1
+687	687	^\d{4}[01]	2	0	0	1
+688	688	^\d{4}[01]	2	0	0	1
+689	689	^\d{4}[01]	2	0	0	1
+690	690	^\d{4}[01]	2	0	0	1
+691	691	^\d{4}[01]	2	0	0	1
+692	692	^\d{4}[01]	2	0	0	1
+693	693	^\d{4}[01]	2	0	0	1
+694	694	^\d{4}[01]	2	0	0	1
+695	695	^\d{4}[01]	2	0	0	1
+696	696	^\d{4}[01]	2	0	0	1
+697	697	^\d{4}[01]	2	0	0	1
+698	698	^\d{4}[01]	2	0	0	1
+699	699	^\d{4}[01]	2	0	0	1
+700	700	^\d{4}[01]	2	0	0	1
+701	701	^\d{4}[01]	2	0	0	1
+702	702	^\d{4}[01]	2	0	0	1
+703	703	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+704	704	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+705	705	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+706	706	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+707	707	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+708	708	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+709	709	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+710	710	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+711	711	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+712	712	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+713	713	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+714	714	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+715	715	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+716	716	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+717	717	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+718	718	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+719	719	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+720	720	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+721	721	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+722	722	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+723	723	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+724	724	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+725	725	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+726	726	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+727	727	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+728	728	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+729	729	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+730	730	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+731	731	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+732	732	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+733	733	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+734	734	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+735	735	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+736	736	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+737	737	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+738	738	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+739	739	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+740	740	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+741	741	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+742	742	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+743	743	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+744	744	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+745	745	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+746	746	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+747	747	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+748	748	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+749	749	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+750	750	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+751	751	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+752	752	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+753	753	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+754	754	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+755	755	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+756	756	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+757	757	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+758	758	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+759	759	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+760	760	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+761	761	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+762	762	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+763	763	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+764	764	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+765	765	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+766	766	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+767	767	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+768	768	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+769	769	^\d{4}[01]	2	0	0	1
+770	770	^\d{4}[01]	2	0	0	1
+771	771	^\d{4}[01]	2	0	0	1
+772	772	^\d{4}[01]	2	0	0	1
+773	773	^\d{4}[01]	2	0	0	1
+774	774	^\d{4}[01]	2	0	0	1
+775	775	^\d{4}[01]	2	0	0	1
+776	776	^\d{4}[01]	2	0	0	1
+777	777	^\d{4}[01]	2	0	0	1
+778	778	^\d{4}[01]	2	0	0	1
+779	779	^\d{4}[01]	2	0	0	1
+780	780	^\d{4}[01]	2	0	0	1
+781	781	^\d{4}[01]	2	0	0	1
+782	782	^\d{4}[01]	2	0	0	1
+783	783	^\d{4}[01]	2	0	0	1
+784	784	^\d{4}[01]	2	0	0	1
+785	785	^\d{4}[01]	2	0	0	1
+786	786	^\d{4}[01]	2	0	0	1
+787	787	^\d{4}[01]	2	0	0	1
+788	788	^\d{4}[01]	2	0	0	1
+789	789	^\d{4}[01]	2	0	0	1
+790	790	^\d{4}[01]	2	0	0	1
+791	791	^\d{4}[01]	2	0	0	1
+792	792	^\d{4}[01]	2	0	0	1
+793	793	^\d{4}[01]	2	0	0	1
+794	794	^\d{4}[01]	2	0	0	1
+795	795	^\d{4}[01]	2	0	0	1
+796	796	^\d{4}[01]	2	0	0	1
+797	797	^\d{4}[01]	2	0	0	1
+798	798	^\d{4}[01]	2	0	0	1
+799	799	^\d{4}[01]	2	0	0	1
+800	800	^\d{4}[01]	2	0	0	1
+801	801	^\d{4}[01]	2	0	0	1
+802	802	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+803	803	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+804	804	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+805	805	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+806	806	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+807	807	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+808	808	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+809	809	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+810	810	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+811	811	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+812	812	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+813	813	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+814	814	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+815	815	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+816	816	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+817	817	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+818	818	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+819	819	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+820	820	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+821	821	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+822	822	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+823	823	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+824	824	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+825	825	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+826	826	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+827	827	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+828	828	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+829	829	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+830	830	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+831	831	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+832	832	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+833	833	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+834	834	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+835	835	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+836	836	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+837	837	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+838	838	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+839	839	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+840	840	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+841	841	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+842	842	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+843	843	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+844	844	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+845	845	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+846	846	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+847	847	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+848	848	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+849	849	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+850	850	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+851	851	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+852	852	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+853	853	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+854	854	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+855	855	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+856	856	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+857	857	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+858	858	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+859	859	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+860	860	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+861	861	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+862	862	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+863	863	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+864	864	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+865	865	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+866	866	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+867	867	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+868	868	^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+869	869	^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+870	870	\x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,}	2	0	0	1
+871	871	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+872	872	appid\x3a\s+2	2	0	0	1
+873	873	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+874	874	\x22mining\x2E(subscribe|authorize)\x22	2	0	0	1
+875	875	^\s*(<var>[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start	2	0	0	1
+876	876	^\/api\/(bit|lite)coin\/balance\/	2	0	0	1
+877	877	miner[^a-z]	2	0	0	1
+878	878	(\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22)	2	0	0	1
+879	879	(\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22)	2	0	0	1
+880	880	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+881	881	\/tmp\/[^\/]+\.swf$	2	0	0	1
+882	882	name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22	2	0	0	1
+883	883	name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22	2	0	0	1
+884	884	=[0-9a-f]{8}\.jar/H	2	0	0	1
+885	885	^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\?	2	0	0	1
+886	886	^\/[a-z0-9]{32}\?s=1$	2	0	0	1
+887	887	^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))	2	0	0	1
+888	888	^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>]	2	0	0	1
+889	889	^(mous)?\.class	2	0	0	1
+890	890	\/chrome\/google_chrome_(update|installer)\.exe$	2	0	0	1
+891	891	^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+892	892	^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P	2	0	0	1
+893	893	findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$	2	0	0	1
+894	894	^[^=]+[^\x22\x27\x3b]*?(<q>[\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m	2	0	0	1
+895	895	\.php\?cashe=\d+$	2	0	0	1
+896	896	\.jar\?m=[1-2]$	2	0	0	1
+897	897	\.pdf\?p=1&s=[1-2]$	2	0	0	1
+898	898	^Host\x3a [^\r\n]+?\.bit\r\n$/Hmi	2	0	0	1
+899	899	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[^\/\.]+$	2	0	0	1
+900	900	\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$	2	0	0	1
+901	901	\/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+902	902	\/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+903	903	\/tds\/[a-f0-9]{32}$	2	0	0	1
+904	904	^[a-f0-9]{32}[\x22\x27]	2	0	0	1
+905	905	Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi	2	0	0	1
+906	906	(\.\.\/)+kboxwww\/tmp\/	2	0	0	1
+907	907	^(<var>.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22	2	0	0	1
+908	908	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+909	909	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+910	910	\/\?[0-9a-f]{60,66}[\;\d\x2c]*$	2	0	0	1
+911	911	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15}	2	0	0	1
+912	912	\/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php	2	0	0	1
+913	913	debugenableplugins=[a-zA-Z0-9]+?\x3b	2	0	0	1
+914	914	^\/[a-z0-9]+\/load\.php$	2	0	0	1
+915	915	^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H	2	0	0	1
+916	916	^\/xteas\/code$	2	0	0	1
+917	917	\/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash=	2	0	0	1
+918	918	=\w{8}\.pdf/Hi	2	0	0	1
+919	919	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[A-Za-z0-9]+$	2	0	0	1
+920	920	^User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$/H	2	0	0	1
+921	921	^Host\x3a\s.+\.in\r?$/Hmi	2	0	0	1
+922	922	name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22	2	0	0	1
+923	923	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+924	924	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+925	925	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+926	926	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+927	927	^Location\x3a\x20[a-f0-9]{32}\/e\.html\r$/Hm	2	0	0	1
+928	928	^\/(v(1\/buckets\/default\/ext-5dkJ19tFufpMZjVJbsWCiqDcclDw\/records|4\/links\/activity-stream|3\/links\/ping-centre)|gp\/(aj\/private\/reviewsGallery\/get-(application-resource|image-gallery-asset)s|cerberus\/gv)|en-us\/(p\/(onerf\/MeSilentPassport|book-2\/8MCPZJJCC98C)|store\/api\/checkproductinwishlist)|wp-(content\/themes\/am43-6\/dist\/records|includes\/js\/script\/indigo-migrate)|api2\/json\/(cluster\/(resource|task)s|access\/ticket))	2	0	0	1
+929	929	^(\/updates|\/license\/eula|\/docs\/office|\/software-activation)	2	0	0	1
+930	930	^GET\s(\/((v(i-assets\/static-asset|[12]\/preference)|idcta\/translation)s|ads\/google))	2	0	0	1
+931	931	^([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9_\/\+\-]{2}==|[a-zA-Z0-9_\/\+\-]{3}=|[a-zA-Z0-9_\/\+\-]{4})\x3b	2	0	0	1
+932	932	^(\/track|\/api\/v1\/survey\/embed|\/svc\/weather\/v2)	2	0	0	1
+933	933	\/api\/v1\/user\/(512|124)\/avatar	2	0	0	1
+934	934	^GET [^\r\n]{0,256}&parent_request_id=([A-Za-z0-9_\/\+\-%]{128,1024})={0,2}[^\r\n]{0,256} HTTP\/1\.[01]	2	0	0	1
+935	935	^\/v1\/(queue|profile|docs\/wsdl|pull)	2	0	0	1
+936	936	^GET\s(\/USAT-GUP\/user\/|\/entertainment\/|\/entertainment\/navdd-q1a2z3Z6TET4gv2PNfXpaJAniOzOajK7M\.min\.json|\/global-q1a2z3C4M2nNlQYzWhCC0oMSEFjQbW1KA\.min\.json|\/life\/|\/news\/weather\/|\/opinion\/|\/sports\/|\/sports\/navdd-q1a2z3JHa8KzCRLOQAnDoVywVWF7UwxJs\.min\.json|\/tangstatic\/js\/main-q1a2z3b37df2b1\.min\.js|\/tangstatic\/js\/pbjsandwich-q1a2z300ab4198\.min\.js|\/tangstatic\/js\/pg-q1a2z3bbc110a4\.min\.js|\/tangsvc\/pg\/3221104001\/|\/tangsvc\/pg\/5059005002\/|\/tangsvc\/pg\/5066496002\/|\/tech\/|\/travel\/)	2	0	0	1
+937	937	^POST\s(\/v4\/links\/check-activity\/check|\/v1\/stats|\/gql|\/api2\/json\/check\/ticket|\/1.5\/95648064\/storage\/history|\/1.5\/95648064\/storage\/tabs|\/u\/0\/_\/og\/botguard\/get|\/ev\/prd001001|\/ev\/ext001001|\/gp\/aw\/ybh\/handlers|\/v3\/links\/ping-beat\/check)	2	0	0	1
+938	938	^[^\n]*[\x00-\x08\x0e-\x1f]	2	0	0	1
+939	939	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+940	940	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+941	941	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+942	942	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+943	943	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+944	944	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(IMCON|IMC)[\s\w,/-]*(//(X1|MR))	2	0	0	1
+945	945	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+946	946	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+947	947	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+948	948	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+949	949	(TOP\s|T)(SECRET|S)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+950	950	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+951	951	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+952	952	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+953	953	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+954	954	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+955	955	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+956	956	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+957	957	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+958	958	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+959	959	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+960	960	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+961	961	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+962	962	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+963	963	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+964	964	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+965	965	\[\[\d{1,3}\,\[\\\"\w\\\"\,\\\"[email protected].+\\\"\,\\\"	2	0	0	1
+966	966	User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER	2	0	0	1
+967	967	\x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20)	2	0	0	1
+968	968	PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20)	2	0	0	1
+969	969	\x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\s*\x29\x3Aend\s+function\x3A	2	0	0	1
+970	970	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000	2	0	0	1
+971	971	filename\s*=\s*"WU_Details_.....\.zip	2	0	0	1
+972	972	filename\s*=\s*MySpace_document_[0-9]{5}\.zip	2	0	0	1
+973	973	filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22	2	0	0	1
+974	974	filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22	2	0	0	1
+975	975	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E	2	0	0	1
+976	976	MyValue=[a-f0-9]{32}	2	0	0	1
+977	977	\x0d\x0aUser-Agent\: 0\:0\:[^\n]{120}	2	0	0	1
+978	978	User-Agent\: 0\:0\:[^\x0a|\x0d]{128}	2	0	0	1
+979	979	01E04581-4EEE-11D0-BFE9-00AA005B4383|AF604EFE-8897-11D1-B944-00A0C90312E1|7849596A-48EA-486E-8937-A2A3009F31A9|FBEB8A05-BEEE-4442-804E-409D6C4515E9|3050F391-98B5-11CF-BB82-00AA00BDCE0B|8EE42293-C315-11D0-8D6F-00A0C9A06E1F|2A6EB050-7F1C-11CE-BE57-00AA0051FE20|510A4910-7F1C-11CE-BE57-00AA0051FE20|6D36CE10-7F1C-11CE-BE57-00AA0051FE20|860D28D0-8BF4-11CE-BE59-00AA0051FE20|9478F640-7F1C-11CE-BE57-00AA0051FE20|B0516FF0-7F1C-11CE-BE57-00AA0051FE20|D99F7670-7F1A-11CE-BE57-00AA0051FE20	2	0	0	1
+980	980	(\.\.\/){1,}	2	0	0	1
+981	981	\/cgi-bin\/pr2\.cgi\?[a-zA-Z0-9]{172}	2	0	0	1
+982	982	03D9F3F2-B0E3-11D2-B081-006008039BF0|860BB310-5D01-11D0-BD3B-00A0C911CE86|E0F158E1-CB04-11D0-BD4E-00A0C911CE86|33D9A761-90C8-11D0-BD43-00A0C911CE86|4EFE2452-168A-11D1-BC76-00C04FB9453B|33D9A760-90C8-11D0-BD43-00A0C911CE86|33D9A762-90C8-11D0-BD43-00A0C911CE86|083863F1-70DE-11D0-BD40-00A0C911CE86|18AB439E-FCF4-40D4-90DA-F79BAA3B0655|31087270-D348-432C-899E-2D2F38FF29A0|D2923B86-15F1-46FF-A19A-DE825F919576|FD78D554-4C6E-11D0-970D-00A0C9191601|52CA3BCF-3B9B-419E-A3D6-5D28C0B0B50C	2	0	0	1
+983	983	4FAAB301-CEF6-477C-9F58-F601039E9B78|6CBE0382-A879-4D2A-8EC3-1F2A43611BA8|F117831B-C052-11D1-B1C0-00C04FC2F3EF|3050F667-98B5-11CF-BB82-00AA00BDCE0B|1AA06BA1-0E88-11D1-8391-00C04FBD7C09|F28D867A-DDB1-11D3-B8E8-00A0C981AEEB|6B7F1602-D44C-11D0-A7D9-AE3D17000000|7007ACCF-3202-11D1-AAD2-00805FC1270E|992CFFA0-F557-101A-88EC-00DD010CCC48|00020420-0000-0000-C000-000000000046|0006F02A-0000-0000-C000-000000000046|ABBA001B-3075-11D6-88A4-00B0D0200F88|CE292861-FC88-11D0-9E69-00C04FD7C15B	2	0	0	1
+984	984	php\?r=\d+&p=	2	0	0	1
+985	985	\/socks\.php\?name=[^&]+&port=\d{1,5}$	2	0	0	1
+986	986	SELECT.+FROM	2	0	0	1
+987	987	UNION\s+SELECT	2	0	0	1
+988	988	INSERT.+INTO	2	0	0	1
+989	989	DELETE.+FROM	2	0	0	1
+990	990	ASCII\(.+SELECT	2	0	0	1
+991	991	UPDATE.+SET	2	0	0	1
+992	992	EEED4C20-7F1B-11CE-BE57-00AA0051FE20|C7B6C04A-CBB5-11D0-BB4C-00C04FC2F410|85BBD920-42A0-1069-A2E4-08002B30309D|E846F0A0-D367-11D1-8286-00A0C9231C29|B4B3AECB-DFD6-11D1-9DAA-00805F85CFE3|ECABB0BF-7F19-11D2-978E-0000F8757E2A|466D66FA-9616-11D2-9342-0000F875AE17|67DCC487-AA48-11D1-8F4F-00C04FB611C7|00022613-0000-0000-C000-000000000046|D2D588B5-D081-11D0-99E0-00C04FC2F8EC|5D08B586-343A-11D0-AD46-00C04FD8FDFF|CC7BFB42-F175-11D1-A392-00E0291F3959|CC7BFB43-F175-11D1-A392-00E0291F3959|3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5	2	0	0	1
+993	993	BC5F1E51-5110-11D1-AFF5-006097C9A284|F27CE930-4CA3-11D1-AFF2-006097C9A284|3BC4F3A7-652A-11D1-B4D4-00C04FC2DB8D|ECABAFC2-7F19-11D2-978E-0000F8757E2A|283807B8-2C60-11D0-A31D-00AA00B92C03|250770F3-6AF2-11CF-A915-008029E31FCD|D24D4453-1F01-11D1-8E63-006097D2DF48|03CB9467-FD9D-42A8-82F9-8615B4223E6E|598EBA02-B49A-11D2-A1C1-00609778EA66|8FE7E181-BB96-11D2-A1CB-00609778EA66|4CFB5280-800B-4367-848F-5A13EBF27F1D|B3E0E785-BD78-4366-9560-B7DABE2723BE|208DD6A3-E12B-4755-9607-2E39EF84CFC5	2	0	0	1
+994	994	6E227101-F799-11CF-9227-00AA00A1EB95|7057E952-BD1B-11D1-8919-00C04FC2C836|7007ACC7-3202-11D1-AAD2-00805FC1270E|4622AD11-FF23-11D0-8D34-00A0C90F2719|98CB4060-D3E7-42A1-8D65-949D34EBFE14|47C6C527-6204-4F91-849D-66E234DEE015|35CEC8A3-2BE6-11D2-8773-92E220524153|730F6CDC-2C86-11D2-8773-92E220524153|2C10A98F-D64F-43B4-BED6-DD0E1BF2074C|6F9F3481-84DD-4B14-B09C-6B4288ECCDE8|8E26BFC1-AFD6-11CF-BFFC-00AA003CFDFC|F0975AFE-5C7F-11D2-8B74-00104B2AFB41	2	0	0	1
+995	995	index\.php\?q=(uggc|jjj|http|www|aHR0c|d3d3)	2	0	0	1
+996	996	(file=\|.+\|)	2	0	0	1
+997	997	SELECT.+FROM	2	0	0	1
+998	998	UNION\s+SELECT	2	0	0	1
+999	999	INSERT.+INTO	2	0	0	1
+1000	1000	DELETE.+FROM	2	0	0	1
+1001	1001	ASCII\(.+SELECT	2	0	0	1
+1002	1002	UPDATE.+SET	2	0	0	1
+1003	1003	SELECT.+FROM	2	0	0	1
+1004	1004	UNION\s+SELECT	2	0	0	1
+1005	1005	INSERT.+INTO	2	0	0	1
+1006	1006	DELETE.+FROM	2	0	0	1
+1007	1007	ASCII\(.+SELECT	2	0	0	1
+1008	1008	UPDATE.+SET	2	0	0	1
+1009	1009	SELECT.+FROM	2	0	0	1
+1010	1010	UNION\s+SELECT	2	0	0	1
+1011	1011	INSERT.+INTO	2	0	0	1
+1012	1012	DELETE.+FROM	2	0	0	1
+1013	1013	ASCII\(.+SELECT	2	0	0	1
+1014	1014	UPDATE.+SET	2	0	0	1
+1015	1015	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+1016	1016	filename=\x22Facebook_(Password|Support|Document)_[A-Z0-9]{4,7}\.zip\x22	2	0	0	1
+1017	1017	\x2FU3D\x2FLength\x20172[0-5][0-9]{2}	2	0	0	1
+1018	1018	\/000[a-z][0-9]{3}\x2Eso	2	0	0	1
+1019	1019	\/000[a-z][0-9]{3}\x2Eexe	2	0	0	1
+1020	1020	UPDATE.+SET	2	0	0	1
+1021	1021	PDF-.+[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F]	2	0	0	1
+1022	1022	^FOLD\s[^\n]{256}	2	0	0	1
+1023	1023	^FOLD\s+\/	2	0	0	1
+1024	1024	^Username\:[^\n]{100}	2	0	0	1
+1025	1025	^http\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1026	1026	^http\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1027	1027	^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\}	2	0	0	1
+1028	1028	^file\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1029	1029	\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JBIG2Decode](J|#4A)(B|#42)(I|#49)(G|#47)(2|#32)(D|#44)(e|#65)(c|#63)(o|#6F)(d|#64)(e|#65)	2	0	0	1
+1030	1030	OS 4_[0-3]_[1-4] like/H	2	0	0	1
+1031	1031	[a-f0-9]{16}$	2	0	0	1
+1032	1032	mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+1033	1033	(/joomla/admin|/joomla/administrator|/joomla/manage|/joomla/administration)	2	0	0	1
+1034	1034	\x3A\x02\x5B(Atk33|Exploiting|Finished|GOOGLE.*|HTTP.{0,8}|PKS-SCAN.{0,20}|Results|RSH|SCAN|TCP.{0,8}|UDP.{0,8}|v6.{0,12}|VERSION)\x5D\x02	2	0	0	1
+1035	1035	\x3A\x02(Alvo dos Pacotes|Conectando-se em|M.dia de envio|Tempo.*|Total .*)\x02	2	0	0	1
+1036	1036	NICK\x20\S+\x0AUSER\x20\S+localhost\x20localhost\x20\x3A	2	0	0	1
+1037	1037	\x3a.4\x7c.12.\x3a.4	2	0	0	1
+1038	1038	(cheguei gazelas|meh que tao|Status|Tempo|Total pacotes|Total bytes|M?dia de envio|portas? aberta)	2	0	0	1
+1039	1039	keepalive([0-9]{4}|\x7c[0-9]{4})	2	0	0	1
+1040	1040	User-Agent\x3a[^\n]+sbu-hb-	2	0	0	1
+1041	1041	User-Agent\:[^\n]+Peer Points/iH	2	0	0	1
+1042	1042	User-Agent\:[^\n]+zbu-hb-/Hi	2	0	0	1
+1043	1043	User-Agent\:[^\n]+HSN/iH	2	0	0	1
+1044	1044	User-Agent\:[^\n]+Wildtangent/iH	2	0	0	1
+1045	1045	^RMD\s+\x2f$	2	0	0	1
+1046	1046	User-Agent\x3A[^\n]+TheWorld/H	2	0	0	1
+1047	1047	^Max-dotdot[\s\r\n]*\d{3,}	2	0	0	1
+1048	1048	^Authorization\x3a Basic\s+=	2	0	0	1
+1049	1049	^Authorization\x3a Basic\s+=	2	0	0	1
+1050	1050	Host\x3a\s[a-z]{16}\.ru/H	2	0	0	1
+1051	1051	CREATE.+ENDPOINT	2	0	0	1
+1052	1052	\/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir=	2	0	0	1
+1053	1053	MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w	2	0	0	1
+1054	1054	MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w	2	0	0	1
+1055	1055	\x00[0-9]{4,7}\x02co\x00	2	0	0	1
+1056	1056	\x2fsogou(config)?\x2f	2	0	0	1
+1057	1057	\/\d{8,}\/\d{4,}\/\d{4,}\.jsp	2	0	0	1
+1058	1058	adv\d+\.php	2	0	0	1
+1059	1059	a=\%[0-9a-fA-F]{2}\&b	2	0	0	1
+1060	1060	\Wcustomer\slist(s)?\W	2	0	0	1
+1061	1061	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1062	1062	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1063	1063	\Wannual\sincome(s)?\W	2	0	0	1
+1064	1064	\Wpayment\shistory\W	2	0	0	1
+1065	1065	\Waccount\sbalance(s)?\W	2	0	0	1
+1066	1066	\Wappraisal(s)?\W	2	0	0	1
+1067	1067	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1068	1068	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1069	1069	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1070	1070	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1071	1071	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1072	1072	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1073	1073	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1074	1074	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1075	1075	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1076	1076	\Winternal\suse\sonly\W	2	0	0	1
+1077	1077	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1078	1078	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1079	1079	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1080	1080	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1081	1081	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1082	1082	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1083	1083	(//)\Wconfidential[^\w/]	2	0	0	1
+1084	1084	(//)\Wrestricted[^\w/]	2	0	0	1
+1085	1085	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1086	1086	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1087	1087	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1088	1088	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1089	1089	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1090	1090	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1091	1091	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1092	1092	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1093	1093	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1094	1094	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1095	1095	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1096	1096	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1097	1097	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1098	1098	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1099	1099	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1100	1100	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1101	1101	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1102	1102	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1103	1103	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1104	1104	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1105	1105	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1106	1106	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1107	1107	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1108	1108	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1109	1109	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1110	1110	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1111	1111	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1112	1112	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1113	1113	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1114	1114	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1115	1115	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1116	1116	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1117	1117	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1118	1118	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1119	1119	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1120	1120	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1121	1121	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1122	1122	(//)\Wrestricted[^\w/]	2	0	0	1
+1123	1123	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1124	1124	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1125	1125	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1126	1126	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1127	1127	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1128	1128	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1129	1129	\Winternal\suse\sonly\W	2	0	0	1
+1130	1130	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1131	1131	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1132	1132	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1133	1133	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1134	1134	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1135	1135	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1136	1136	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1137	1137	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1138	1138	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1139	1139	\Wappraisal(s)?\W	2	0	0	1
+1140	1140	\Waccount\sbalance(s)?\W	2	0	0	1
+1141	1141	\Wannual\sincome(s)?\W	2	0	0	1
+1142	1142	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1143	1143	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1144	1144	\Wcustomer\slist(s)?\W	2	0	0	1
+1145	1145	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1146	1146	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1147	1147	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1148	1148	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1149	1149	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1150	1150	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1151	1151	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1152	1152	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1153	1153	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1154	1154	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1155	1155	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1156	1156	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1157	1157	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1158	1158	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1159	1159	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1160	1160	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1161	1161	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1162	1162	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1163	1163	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1164	1164	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1165	1165	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1166	1166	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1167	1167	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1168	1168	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1169	1169	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1170	1170	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1171	1171	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1172	1172	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1173	1173	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1174	1174	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1175	1175	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1176	1176	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1177	1177	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1178	1178	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1179	1179	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1180	1180	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1181	1181	(//)\Wrestricted[^\w/]	2	0	0	1
+1182	1182	(//)\Wconfidential[^\w/]	2	0	0	1
+1183	1183	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1184	1184	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1185	1185	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1186	1186	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1187	1187	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1188	1188	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1189	1189	\Winternal\suse\sonly\W	2	0	0	1
+1190	1190	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1191	1191	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1192	1192	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1193	1193	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1194	1194	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1195	1195	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1196	1196	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1197	1197	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1198	1198	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1199	1199	\Wappraisal(s)?\W	2	0	0	1
+1200	1200	\Waccount\sbalance(s)?\W	2	0	0	1
+1201	1201	\Wpayment\shistory\W	2	0	0	1
+1202	1202	\Wannual\sincome(s)?\W	2	0	0	1
+1203	1203	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1204	1204	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1205	1205	\Wcustomer\slist(s)?\W	2	0	0	1
+1206	1206	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1207	1207	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1208	1208	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1209	1209	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1210	1210	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1211	1211	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1212	1212	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1213	1213	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1214	1214	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1215	1215	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1216	1216	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1217	1217	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1218	1218	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1219	1219	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1220	1220	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1221	1221	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1222	1222	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1223	1223	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1224	1224	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1225	1225	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1226	1226	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1227	1227	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1228	1228	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1229	1229	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1230	1230	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1231	1231	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1232	1232	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1233	1233	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1234	1234	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1235	1235	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1236	1236	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1237	1237	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1238	1238	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1239	1239	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1240	1240	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1241	1241	User-Agent\x3a \d{6}\x0d\x0a/H	2	0	0	1
+1242	1242	(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/s\/l\/firstping	2	0	0	1
+1243	1243	\.dyndns\.((biz|info|org|tv))\x0d\x0a/iH	2	0	0	1
+1244	1244	\.dyndns-((at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work))\.com\x0d\x0a/iH	2	0	0	1
+1245	1245	\.jpg\?t\x3d\d\.\d	2	0	0	1
+1246	1246	[0-9]{1,16}[a-f]{1,16}[0-9]{1,16}$	2	0	0	1
+1247	1247	^Content-Length\x3a\s*-\d+	2	0	0	1
+1248	1248	\W[0-9]{5}\.jar	2	0	0	1
+1249	1249	machine_id={[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+}	2	0	0	1
+1250	1250	[0-9]{1,8}[a-f]{1,8}[0-9]{1,8}$	2	0	0	1
+1251	1251	^[a-z0-9]{6}..\x00\x00	2	0	0	1
+1252	1252	^[a-z0-9]{7}..\x00\x00	2	0	0	1
+1253	1253	\sLOGIN\s[^\n]*?%	2	0	0	1
+1254	1254	({(\d+}[^\n]*?\sAUTH)|AUTH\s[^\n]*?{(\d+}))	2	0	0	1
+1255	1255	^\/\?[a-f0-9]{32}$	2	0	0	1
+1256	1256	[a-z]{9}[0-9]\.exe/H	2	0	0	1
+1257	1257	\.php\?inst_result=.+&hwid=	2	0	0	1
+1258	1258	^.{1,5}[a-f0-9]{100}	2	0	0	1
+1259	1259	\/scr5\.php\?p=\d+&id=\d	2	0	0	1
+1260	1260	^User-Agent\: App\d/Hmi	2	0	0	1
+1261	1261	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$	2	0	0	1
+1262	1262	\x00\x07[a-z]{7}\x02eu\x00	2	0	0	1
+1263	1263	REGISTER.{400}	2	0	0	1
+1264	1264	\/content\/jav\d?\.jar$	2	0	0	1
+1265	1265	^\/\?[a-f0-9]{32}$	2	0	0	1
+1266	1266	\.php\?[a-z]+=[a-f0-9]{64}&[^\?]+=[a-f0-9]{20}&	2	0	0	1
+1267	1267	^HTTP\x2f1\.[01] 200	2	0	0	1
+1268	1268	\.php\?[a-z]+=(([1-2][a-z]|3[0-9])\x3a){3,}([1-2][a-z]|3[0-9])&	2	0	0	1
+1269	1269	IP\:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+1270	1270	^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$	2	0	0	1
+1271	1271	\.(jpg|png|gif|cgi)\?pr=	2	0	0	1
+1272	1272	^\/\?affid=\d+&promo_type=\d+&promo_opt=\d+$	2	0	0	1
+1273	1273	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1274	1274	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1275	1275	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1276	1276	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1277	1277	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1278	1278	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1279	1279	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1280	1280	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1281	1281	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1282	1282	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1283	1283	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1284	1284	(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/.*perl\/fr\.pl	2	0	0	1
+1285	1285	\x2F[a-z\x2D]{60,120}.+\x2D\x2Ephp$	2	0	0	1
+1286	1286	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1287	1287	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1288	1288	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1289	1289	^\/[a-z0-9A-Z]{25,35}\/(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+(_[e7uxMhp1Kt]+)?|a2\.\.)Z(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+|a2\.\.)\/	2	0	0	1
+1290	1290	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$	2	0	0	1
+1291	1291	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$	2	0	0	1
+1292	1292	applet\/code=[\x22\x27](<val1>[a-zA-Z0-9]+)[a-z]\.(=val1)[a-z][\x22\x27][^\x3e]+\.jar[\x22\x27]	2	0	0	1
+1293	1293	code\x3D\x22[a-z]{4}\x2E[a-z]{4}\x22	2	0	0	1
+1294	1294	\x7B\x22e(v|x22\x2B\x22)(v|x22\x2B\x22|a)(a|v|x22\x2B\x22)[^\x5D]*?l\x22\x5D	2	0	0	1
+1295	1295	\x2Fgo\x2Ephp\x3Dd\x3D[a-f0-9]{16}$	2	0	0	1
+1296	1296	^[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}=	2	0	0	1
+1297	1297	\.php\?\w{2,9}\=(0[0-9a-b]|3[0-9]){5}\&\w{3,9}\=(3[0-9a-f]|4[0-9a-f])\&\w{3,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{3,9}\=(0[0-9a-b]{1,8})00020002$	2	0	0	1
+1298	1298	^\d+?.\x00\x00\x00	2	0	0	1
+1299	1299	\/[0-9a-f]{32}\.jar$	2	0	0	1
+1300	1300	\/[a-f0-9]{5,}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1301	1301	^[^OGHPDTCMLUVRBAS]	2	0	0	1
+1302	1302	&s=\{[A-Z0-9]{8}-([A-Z0-9]{4}-){3}[A-Z0-9]{12}\}&w=(\d{1,2}\.){2}\d{1,2}&b=(32|64)$/Pi	2	0	0	1
+1303	1303	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$	2	0	0	1
+1304	1304	AjaxHandler\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+1305	1305	DELETE.+FROM	2	0	0	1
+1306	1306	UNION.+SELECT	2	0	0	1
+1307	1307	UPDATE.+SET	2	0	0	1
+1308	1308	ASCII\(.+SELECT	2	0	0	1
+1309	1309	DELETE.+FROM	2	0	0	1
+1310	1310	INSERT.+INTO	2	0	0	1
+1311	1311	UNION\s+SELECT	2	0	0	1
+1312	1312	SELECT.+FROM	2	0	0	1
+1313	1313	UPDATE.+SET	2	0	0	1
+1314	1314	ASCII\(.+SELECT	2	0	0	1
+1315	1315	DELETE.+FROM	2	0	0	1
+1316	1316	INSERT.+INTO	2	0	0	1
+1317	1317	SELECT.+FROM	2	0	0	1
+1318	1318	\/\S+\.cab	2	0	0	1
+1319	1319	User-Agent\x3a[^\n]+AskTB/iH	2	0	0	1
+1320	1320	(<p>[0-7]{3})(<d>[0-7]{3})(=p)(=d)([0-7]{3}){10}(<q>[0-7]{3})[0-7]{3}(<dot>[0-7]{3})[0-7]{3}(=dot)[0-7]{3}(=q)	2	0	0	1
+1321	1321	(<p>[0-7]{2,4})(<sep>[^0-7])(<d>((=p))[0-7]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-7]{2,4}(=sep)){10}(<q>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(<dot>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(=dot)(=sep)[0-7]{2,4}(=sep)(=q)	2	0	0	1
+1322	1322	^\/(p(a(rs|g)e|rocess)|(securit|quer)y|(defaul|abou)t|index|login|user)\.jsp\?[a-z]{2}\x3d[a-z0-9]{9}[A-F0-9]{9}$	2	0	0	1
+1323	1323	\/gate\.php\?cmd=urls$	2	0	0	1
+1324	1324	\/gate\.php\?cmd=getexe$	2	0	0	1
+1325	1325	^User-Agent\x3a[^\r\n]*?\sMSIE\s/H	2	0	0	1
+1326	1326	^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email)	2	0	0	1
+1327	1327	[^a-z0-9\-\.][a-z0-9]{32,48}\x02ru\x00\x00	2	0	0	1
+1328	1328	[^a-z0-9\-\.][a-z0-9]{32,48}\x04info\x00\x00	2	0	0	1
+1329	1329	[^a-z0-9\-\.][a-z0-9]{32,48}\x03biz\x00\x00	2	0	0	1
+1330	1330	\x2flogo\x2egif\x3f([0-9a-z]){5}\x3d\d{6,7}	2	0	0	1
+1331	1331	\.php\?label=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1332	1332	\.php\?id=[A-F0-9]+\-[A-F0-9]+&v1=[A-F0-9]+&v2=[A-F0-9]+&q=[A-F0-9]+$	2	0	0	1
+1333	1333	^\/[A-Za-z0-9]{7,8}\/index\.html?$	2	0	0	1
+1334	1334	^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/js\.js$	2	0	0	1
+1335	1335	^Host\x3a\x20www\d+?\.[^\.]+?\.[^\.]+?\.([^\.]+\.)*?[a-z]{2,4}(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1336	1336	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1337	1337	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1338	1338	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1339	1339	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1340	1340	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(refresh_template_name|user_name)[\r\n\s]*=>[\r\n\s]*|(refresh_template_name|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1341	1341	^\/b\/(eve|opt|req)\/[\-f0-9A-F]{24}$	2	0	0	1
+1342	1342	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+1343	1343	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+1344	1344	\/[a-z]{1,6}\.html\?0\.[0-9]+[a-z]?$	2	0	0	1
+1345	1345	^[^\r\n]{15}\x5f[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}	2	0	0	1
+1346	1346	^Host\x3a[^\r\n]+\.passinggas\.net(\x3a\d{1,5})?\r?$/Hmi	2	0	0	1
+1347	1347	Server\: nginx/[a-zA-Z]	2	0	0	1
+1348	1348	^\x23\d\d\d\x2f\x21	2	0	0	1
+1349	1349	XPantivirus20\d{2}_v\d{6}\.exe	2	0	0	1
+1350	1350	\d\d\d\d\d\d\x0a	2	0	0	1
+1351	1351	PASS\s.*?\x0d\x0aNICK\s.*?\x0d\x0aUSER\s.*?\s\d\s\d\s\:\S	2	0	0	1
+1352	1352	[0-9A-Z]{240,}	2	0	0	1
+1353	1353	\x26[\x00-\xff]\x09\x00	2	0	0	1
+1354	1354	\x26[\x00-\xff]\x09\x00	2	0	0	1
+1355	1355	\.php\?id=\d+_[0-9a-f]{8}-[0-9a-f]+-[0-9a-f]{8}&cnt=	2	0	0	1
+1356	1356	OS 4_[0-3]_[1-4] like/H	2	0	0	1
+1357	1357	\.php\?f=\d+$	2	0	0	1
+1358	1358	Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H	2	0	0	1
+1359	1359	User-Agent\x3a We[a-z0-9]{4}\x0d\x0a/H	2	0	0	1
+1360	1360	\.php\?t=\d{2,7}$	2	0	0	1
+1361	1361	filename=.*facebook.*\.(rar|exe|zip)	2	0	0	1
+1362	1362	filename\s*[^\n]*?(UPS|United Parcel Service)[^\n]*?\.(rar|exe|zip)	2	0	0	1
+1363	1363	flash-[A-Z0-9]+-plugin\.[A-Z0-9]+\.exe	2	0	0	1
+1364	1364	\x2Fget\x5Fdr\x2Ephp\x3F(e|ini)\x3D	2	0	0	1
+1365	1365	MalvRem_\d{3,4}\.exe	2	0	0	1
+1366	1366	avdistr_\d{3,4}\.exe	2	0	0	1
+1367	1367	RunAV_\d{3,4}\.exe	2	0	0	1
+1368	1368	installer\.\d{4}\.exe	2	0	0	1
+1369	1369	\/stetement_id\.\d+\/	2	0	0	1
+1370	1370	^\/stream\?\d$	2	0	0	1
+1371	1371	loads2\.php\?r=[0-9]{2}\.[0-9]	2	0	0	1
+1372	1372	^[\x20-\x7e]{5}.{4}\x7c\x01	2	0	0	1
+1373	1373	(\/[a-z-]+)+\.php\?[a-z]+=[0-9]+[^\r\n]+HTTP\/1\.1	2	0	0	1
+1374	1374	&cid=\d+$	2	0	0	1
+1375	1375	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+1376	1376	^Content-Disposition\x3a\x20attachment\x3b\x20filename=[^\r\n]+?\.[a-z]{2,4}\.exe\r?$/Hmi	2	0	0	1
+1377	1377	^\/[a-z0-9A-Z]{15,35}\/((\d+[A-Z]){3}\d+|null)\/	2	0	0	1
+1378	1378	^Content-Length\x3a 2\d{2}\r?$/Hmi	2	0	0	1
+1379	1379	\/[a-z]{2,9}\.php\?([a-z0-9]{2,4}|[cktw])=[a-zA-Z0-9\x2b\x2f\x5c]{43,56}=?$	2	0	0	1
+1380	1380	\.((testdlls|threads|netstatp|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|stats|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\x|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r])	2	0	0	1
+1381	1381	\x2B\x22l\x22(\x3B|\x5D)	2	0	0	1
+1382	1382	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1383	1383	^Referer\x3a[^\r\n]+\.swf/Hmi	2	0	0	1
+1384	1384	\.jpg\?id=\d+$	2	0	0	1
+1385	1385	^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){3,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$	2	0	0	1
+1386	1386	^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$	2	0	0	1
+1387	1387	^\/[a-z]{4}\.html?(\?[h-j]=\d+)?$	2	0	0	1
+1388	1388	^\/h[a-z]{3}\.html?$	2	0	0	1
+1389	1389	^\/[0-9]{8}\.html$	2	0	0	1
+1390	1390	^\/lists\/\d{15}(\d{5})?$	2	0	0	1
+1391	1391	^\/[a-z0-9]{2}\.jar$	2	0	0	1
+1392	1392	^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$	2	0	0	1
+1393	1393	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+1394	1394	^([a-zA-Z]{0,119}[0-9])(<var>[a-zA-Z0-9]{9,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+1395	1395	^\/0[a-z0-9]{13}$	2	0	0	1
+1396	1396	^\/[-a-zA-Z0-9_]{70,75}==?$	2	0	0	1
+1397	1397	^User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)/Hmi	2	0	0	1
+1398	1398	\/[a-f0-9]{32}\.eot$	2	0	0	1
+1399	1399	^\/0[a-z0-9]{13}$	2	0	0	1
+1400	1400	^\/([a-z0-9_-]{0,47}?[A-Z][a-z0-9_-]{0,46}?[A-Z])([A-Z0-9_-]{0,47}?[a-z][A-Z0-9_-]{0,46}?[a-z])([A-Za-z_-]{0,47}?[0-9][A-Za-z_-]{0,46}?[0-9])[A-Za-z0-9_-]{48}\.[a-z]{2,25}\d?\??	2	0	0	1
+1401	1401	^[\x00-\x0c]\x00\x00\x00[a-z0-9]{6,12}\x00	2	0	0	1
+1402	1402	^(\x62|\x1b)	2	0	0	1
+1403	1403	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])3((=sep)|\d)*?$	2	0	0	1
+1404	1404	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])4((=sep)|\d)*?$	2	0	0	1
+1405	1405	^(\x8b|\xf2)	2	0	0	1
+1406	1406	^[a-z0-9\x02-\x50]{100,}\x00\x00\x01\x00\x01$	2	0	0	1
+1407	1407	^Host\x3a\x20[^\r\n]+\.pw\r?$/Hmi	2	0	0	1
+1408	1408	GRANT.{1,5}TO	2	0	0	1
+1409	1409	^\/\?[a-f0-9]{32}$	2	0	0	1
+1410	1410	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])0((=sep)|\d)*?$	2	0	0	1
+1411	1411	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])1((=sep)|\d)*?$	2	0	0	1
+1412	1412	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])2((=sep)|\d)*?$	2	0	0	1
+1413	1413	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])5((=sep)|\d)*?$	2	0	0	1
+1414	1414	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])6((=sep)|\d)*?$	2	0	0	1
+1415	1415	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])7((=sep)|\d)*?$	2	0	0	1
+1416	1416	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])8((=sep)|\d)*?$	2	0	0	1
+1417	1417	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])9((=sep)|\d)*?$	2	0	0	1
+1418	1418	\/\w{1,2}\/\w{1,2}\.class$	2	0	0	1
+1419	1419	User-Agent\:[^\n]+zb-hb-/Hi	2	0	0	1
+1420	1420	^[^\r\n]*\/[0-9a-f]{78}\sHTTP	2	0	0	1
+1421	1421	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20((=refhost))/Hsi	2	0	0	1
+1422	1422	Host\x3a\x20(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1423	1423	^\/index\.php\?[a-z]{8,80}=(\d{10,13}|\d{15,20})$	2	0	0	1
+1424	1424	Host\x3a\x20([0-9]{0,22}[a-z])([a-z]*?[0-9][a-z]{0,22}[0-9])[a-z0-9]{23}\x2e[^\x2e\r\n]+\x2e[^\x2e\r\n]/H	2	0	0	1
+1425	1425	&id=\d+(\x3a([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{10,}\.{0,2})?&catid=\d+&itemid=\d+$	2	0	0	1
+1426	1426	\/pd\.php\?id=[a-f0-9]+$	2	0	0	1
+1427	1427	^\x2Fsearch\x2F\x3F[a-z]{2,5}\x3D	2	0	0	1
+1428	1428	^Referer\x3a\x20http\x3a\/\/[^\x2f]+\/[a-z0-9]{6}\/[a-z0-9]{5}\.html\r?$/Hm	2	0	0	1
+1429	1429	^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text\/vbscript[\x22\x27])	2	0	0	1
+1430	1430	filename=\x22\d+?\x22/P	2	0	0	1
+1431	1431	^\/log\.php\?f=[0-1](\.[a-z]+)?$	2	0	0	1
+1432	1432	(<p>[0-9a-f]{2,4})(<sep>[\x2e\x2c\x3b\x3a])(<d>((=p))[0-9a-f]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-9a-f]{2,4}(=sep)){10}(<q>(((=p)|(=d)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(<dot>(((=p)|(=d)|(=q)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(=dot)(=sep)[0-9a-f]{2,4}(=sep)(=q)	2	0	0	1
+1433	1433	^Host\x3a[^\r\n]+craigslist\.org[^\r\n]{20,}\r\n/Hmi	2	0	0	1
+1434	1434	^Host\x3a[^\r\n]+\r\nConnection\x3a\x20Keep-Alive\r\n(\r\n)?$/H	2	0	0	1
+1435	1435	^Content-Length\x3a[^\r\n]*?\{([^\r\n]*java\.)[^\r\n]*\.ognl[^\r\n]*\}	2	0	0	1
+1436	1436	\/j[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1437	1437	\/j[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1438	1438	\/j[a-z]+?\?f[a-z]+[a-z]+$	2	0	0	1
+1439	1439	\/f[a-z]+?\?f[a-z]+[a-z]+$	2	0	0	1
+1440	1440	\.php$	2	0	0	1
+1441	1441	\.php$	2	0	0	1
+1442	1442	GET\s[^\r\n]*?(<name>\/[^\.\/]+\.html)\?id\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(:?\d{1,5})?\r\n	2	0	0	1
+1443	1443	^\d{4}\r$	2	0	0	1
+1444	1444	^Host\x3a\x20[^\r\n]+\-login\.id\-107sbtd9cbhsbt[^\r]+$/Hmi	2	0	0	1
+1445	1445	\/form\/submit\/$	2	0	0	1
+1446	1446	pch\.php\?f=\d+$	2	0	0	1
+1447	1447	hcp_vbs\.php\?f=\d+&d=\d+$	2	0	0	1
+1448	1448	\.php\?e=\w+&f=\w+$	2	0	0	1
+1449	1449	pch2.php?c=\d+$	2	0	0	1
+1450	1450	\.jar\?t=\d+&h=[^&]+$	2	0	0	1
+1451	1451	\/adp\d\.php\[0-9a-z]{2,6}	2	0	0	1
+1452	1452	attachment\x3b[^\r\n]*?info\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1453	1453	attachment\x3b[^\r\n]*?contacts\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1454	1454	attachment\x3b[^\r\n]*?calc\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1455	1455	attachment\x3b[^\r\n]*?about\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1456	1456	hhcp.php?c=[a-f0-9]{5}$	2	0	0	1
+1457	1457	attachment\x3b[^\r\n]*?readme\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1458	1458	\/content\/jav\d?\.jar$	2	0	0	1
+1459	1459	\.php\?[^&]{1,8}=[a-f0-9]{16}[\x22\x27\x3b\x20\x0a\x0d]	2	0	0	1
+1460	1460	=.*[a-f].*$	2	0	0	1
+1461	1461	<title>[a-f0-9]{10}<\/title>	2	0	0	1
+1462	1462	=[0-9a-f]{8}\.jar/H	2	0	0	1
+1463	1463	\x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}$	2	0	0	1
+1464	1464	\x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}\x3A\x3A[0-9]{1,5}$	2	0	0	1
+1465	1465	display\x3Anone\x3B\x22\x3E[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}[^\r\n]*\x3C\x2Fpre\x3E\x3Cscript\x3E	2	0	0	1
+1466	1466	(\x3D|\x5B\x22])e\x22\x2B\x22va	2	0	0	1
+1467	1467	(\x3D|\x5B\x22])e\x22\x2B\x22v\x22\x2B\x22a	2	0	0	1
+1468	1468	(\x3D|\x5B\x22])ev\x22\x2B\x22a	2	0	0	1
+1469	1469	\x2B\x22al\x22(\x3B|\x5D)	2	0	0	1
+1470	1470	\x2B\x22val\x22(\x3B|\x5D)	2	0	0	1
+1471	1471	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jnlp(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1472	1472	\.php\?[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}=	2	0	0	1
+1473	1473	^.{1,5}[a-f0-9]{100}	2	0	0	1
+1474	1474	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.eot(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1475	1475	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jar(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1476	1476	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.exe(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1477	1477	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.php(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1478	1478	\.php\?\w{2,8}\=(0[0-9a-b]|3[0-9]){5,32}\&\w{2,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{1,8}\=\d{2}\&\w{1,8}\=\w{1,8}\&\w{1,8}\=\w{1,8}$	2	0	0	1
+1479	1479	\/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php$	2	0	0	1
+1480	1480	\/news\/enter\/2012-1[0-2]-([0-2][0-9]|3[0-1])\.php	2	0	0	1
+1481	1481	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.txt(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1482	1482	\/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php	2	0	0	1
+1483	1483	^\/[0-9a-f]{16}\/q\.php$	2	0	0	1
+1484	1484	^\/[0-9a-f]{16}\/q\.php	2	0	0	1
+1485	1485	^\/[0-9a-f]{32}\/ff\.php$	2	0	0	1
+1486	1486	^\/[0-9a-f]{32}\/ff\.php	2	0	0	1
+1487	1487	^\/[0-9a-f]{16}\/ff\.php$	2	0	0	1
+1488	1488	^\/[0-9a-f]{16}\/ff\.php	2	0	0	1
+1489	1489	^\/closest\/(([a-z]{1,16}[-_]){1,4}[a-z]{1,16}|[a-z0-9]{20,})\.php	2	0	0	1
+1490	1490	&jopa=\d+$	2	0	0	1
+1491	1491	\.php\?jnlp=[a-f0-9]{10}(,|$)	2	0	0	1
+1492	1492	\/[0-9a-f]{32}\/a\.php$	2	0	0	1
+1493	1493	\/[0-9a-f]{32}\/a\.php	2	0	0	1
+1494	1494	\/[0-9a-f]{16}\/a\.php$	2	0	0	1
+1495	1495	\/[0-9a-f]{16}\/a\.php	2	0	0	1
+1496	1496	\.php\?[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){5}&[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){10}&	2	0	0	1
+1497	1497	\/([^\/]+?\/[a-z]{2,16}[_-][a-z]{2,16}([_-][a-z]{2,16})*?|[a-z]{16,20}\/[a-z]{16,20}|closest\/[a-z0-9]+)\.php\?[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+&[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+$	2	0	0	1
+1498	1498	^([0-9a-z]{8})?(<p>[0-9a-z]{2})(<d>((=p))[0-9a-z]{2})(=p)(=d)([0-9a-z]{2}){10}(<q>[0-9a-z]{2})[0-9a-z]{2}(<dot>[0-9a-z]{2})[0-9a-z]{2}(=dot)[0-9a-z]{2}(=q)	2	0	0	1
+1499	1499	\.php\?[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){5}&[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){10}&	2	0	0	1
+1500	1500	\.php\?[^=]+=([^&](5[5-9a-e]|8[9a-e])){5}[^=]+=[^&]+&[^=]+=([^&](5[5-9a-f]|8[9a-e])){10}([^&]60[^&]60([^&](5[5-9a-f]|8[9a-e])){10})*?&	2	0	0	1
+1501	1501	\.php\?[^=]+=[^&]{10}&[^=]+=[^&]+&[^=]+=[^&]{20}((<sep>[^&]{2})(=sep)[^&]{20})*?&	2	0	0	1
+1502	1502	^\/[a-z0-9]{6,10}\/\?[0-9]{1,2}$	2	0	0	1
+1503	1503	@\x00i\x00m\x00p\x00o\x00r\x00t\x00\x20.{4,20}[^\x00\w\s.]	2	0	0	1
+1504	1504	^\s*?\(\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27]	2	0	0	1
+1505	1505	^\s*?\(\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27]	2	0	0	1
+1506	1506	^Referer\x3a[^\r\n]+\x3a\d+\/([a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,3}|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3})/Hm	2	0	0	1
+1507	1507	^\s*?value\s*\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27]	2	0	0	1
+1508	1508	^\s*?value\s*\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27]	2	0	0	1
+1509	1509	^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$	2	0	0	1
+1510	1510	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1511	1511	Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=refhost)/Hsi	2	0	0	1
+1512	1512	^Host\x3a[^\r\n]*?\x3a((80(80)|312[89]))\d+\r$/Hm	2	0	0	1
+1513	1513	^(((<\/object>).)*?<param([^>]*?name\s*\s*?\x22bgcolor\x22)[^>]*?value\s*\s*?\x22#ffffff\x22)((<\/object>).)*?<param([^>]*?name\s*\s*?\x22movie\x22)[^>]*?value\s*\s*?\x22([^\x22]+\.[Ss][Ww][Ff])[^\x22]*?\x22	2	0	0	1
+1514	1514	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1515	1515	Host\x3a\x20(<host>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?Referer\x3a\x20http\x3a\x2f\x2f(=host)\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n/Hsi	2	0	0	1
+1516	1516	Referer\x3a\x20http\x3a\x2f\x2f(<host>[^\r\n\x3a\x2f]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=host)(\x3a\d{1,5})?\r\n/Hsi	2	0	0	1
+1517	1517	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1518	1518	^\s*=\s*(<var1>[\x22\x27][a-z]+[\x22\x27]).+?\sid\s*=\s*(=var1)	2	0	0	1
+1519	1519	^([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$	2	0	0	1
+1520	1520	^(\s*var\s[a-z]+\s*=\s*\d+\x3b\s*\n)*\s*<\/script>\s*<object([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$	2	0	0	1
+1521	1521	^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27]	2	0	0	1
+1522	1522	^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|([a-z]*\d+[a-z]+\d)(\d*[a-z]+\d+[a-z])[a-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27]	2	0	0	1
+1523	1523	^\s*=\s*[\x22\x27][a-z]+[\x22\x27]	2	0	0	1
+1524	1524	^\s*=\s*[\x22\x27][a-z]+[\x22\x27]	2	0	0	1
+1525	1525	^\s*=\s*[\x22\x27]\/[^\x22\x27]*\.html\.swf[\x22\x27]	2	0	0	1
+1526	1526	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1527	1527	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1528	1528	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)	2	0	0	1
+1529	1529	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1530	1530	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)	2	0	0	1
+1531	1531	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27]	2	0	0	1
+1532	1532	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)	2	0	0	1
+1533	1533	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)	2	0	0	1
+1534	1534	\/m[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1535	1535	^h[a-z0-9]{0,10}\x3d[a-f0-9]{24}&p[a-z0-9]{0,10}\x3d[a-z0-9]{1,11}&i/P	2	0	0	1
+1536	1536	^p[a-z0-9]{0,20}\x3d[a-z0-9]{1,20}&i[a-z0-9]{0,20}\x3d%[0-9A-F]{2}/P	2	0	0	1
+1537	1537	\x28[\r\n\s]*?(<qa1>[\x22\x27]?)[a-f0-9]{24}(=qa1)[\r\n\s]*?,[\r\n\s]*?(<qa2>[\x22\x27]?)[a-z0-9]{1,20}(=qa2)[\r\n\s]*?	2	0	0	1
+1538	1538	=%25[0-9A-F]{2}%25[0-9A-F]{2}/P	2	0	0	1
+1539	1539	^\/a[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?q[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1540	1540	^\/s[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?d[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1541	1541	^\/k[a-z]{4,13}\?e[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1542	1542	^\/g[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?t[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1543	1543	\/r[a-z]+?\?j[a-z]+[a-z]+$	2	0	0	1
+1544	1544	\/f[a-z]+?\?j[a-z]+[a-z]+$	2	0	0	1
+1545	1545	^\/o[a-z]{4,13}\?h[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1546	1546	\/b[a-z]+?\?n[a-z]+[a-z]+$	2	0	0	1
+1547	1547	\/v[a-z]+?\?n[a-z]+[a-z]+$	2	0	0	1
+1548	1548	^\/[a-z]{5,14}\?[a-z]{5,12}=\d{6,7}$	2	0	0	1
+1549	1549	^\/[a-z]{5,14}\?[a-z]{5,12}=[a-z]{6,11}$	2	0	0	1
+1550	1550	^[\r\n\s]*?\,	2	0	0	1
+1551	1551	\bdig\.dll\b	2	0	0	1
+1552	1552	^\/[a-z]+?\?[a-z]+[a-z]+$	2	0	0	1
+1553	1553	^Host\x3a\x20[^\r\n]+\.(d(yndns\.[a-z]{2,3}|esi)|c(ricket|a?fe?)|(lin|wor)k|s(u|pace)|accountant|t(k|op)|g[aq]|xyz|ml|pw)(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1554	1554	^\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)$	2	0	0	1
+1555	1555	^(<windname>[a-z0-9]+)(<plug1>([sj]|f1))=true.+?window\.(=windname)(<plug2>(((=plug1))([sj]|f1)))=true.+?window\.(=windname)(((=plug1)|(=plug2)))([sj]|f1)=true	2	0	0	1
+1556	1556	^\/1[a-z0-9]{13}$	2	0	0	1
+1557	1557	^GET \/0(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n	2	0	0	1
+1558	1558	^\/1[a-z0-9]{13}$	2	0	0	1
+1559	1559	^GET \/4(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n	2	0	0	1
+1560	1560	^\/3[a-z0-9]{13}$	2	0	0	1
+1561	1561	\/4[a-z0-9]{13}\?&xkey=	2	0	0	1
+1562	1562	^[a-zA-Z0-9\/\+]+?ODAvM[a-zA-Z0-9\/\+]{18}(=|%3D)[\x22\x27]	2	0	0	1
+1563	1563	^[a-zA-Z0-9\/\+]+?4MC8x[a-zA-Z0-9\/\+]{18}(=|%3D){2}[\x22\x27]	2	0	0	1
+1564	1564	^[a-zA-Z0-9\/\+]+?OjgwL[a-zA-Z0-9\/\+]{19}[\x22\x27]	2	0	0	1
+1565	1565	^(\s*?|\/\*((\*\/).)*?\*\/)*?\((\s*?|\/\*((\*\/).)*?\*\/)*?(<vname>[^\s>=]+)(\s*?|\/\*((\*\/).)*?\*\/)*?<(\s*?|\/\*((\*\/).)*?\*\/)*?32\b.{0,200}(=vname)(\s*?|\/\*((\*\/).)*?\*\/)*?\x3d(\s*?|\/\*((\*\/).)*?\*\/)*?63\b.{1,200}\+=.{0,200}\((\s*?|\/\*((\*\/).)*?\*\/)*?(=vname)	2	0	0	1
+1566	1566	^[a-zA-Z0-9]+\*\/	2	0	0	1
+1567	1567	[a-z0-9]+?\*\/	2	0	0	1
+1568	1568	^\s*?<script>\s*?(<func>[A-Za-z0-9]+)\s*?\(\s*?[\x22\x27](<var>[^1\x22\x27]+)1[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)2[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)3[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>	2	0	0	1
+1569	1569	^\s*?\n\s*?(<func>[^\x28\r\n\s]+)\s*?\(\s*?(<var>[^\+\x29]+)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+	2	0	0	1
+1570	1570	^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$	2	0	0	1
+1571	1571	^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$	2	0	0	1
+1572	1572	^Referer\x3a[^\r\n]+\/([a-z0-9]+\.php|\d+)\r$/Hm	2	0	0	1
+1573	1573	Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2039/H	2	0	0	1
+1574	1574	Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2040/H	2	0	0	1
+1575	1575	^\W	2	0	0	1
+1576	1576	^\W	2	0	0	1
+1577	1577	^\/[a-z]{3}\?[A-F0-9]{8}$	2	0	0	1
+1578	1578	^Referer\x3a\x20http\x3a\x2f\x2f?[^\x2f]+\/[a-z]{3,20}((<sep>[_-]?)[a-z]{3,20}(=sep)([a-z]{3,20}(=sep))?)?[a-z]{3,20}\/\d{10,20}(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+1579	1579	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi	2	0	0	1
+1580	1580	Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1581	1581	^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}\r$/Hmi	2	0	0	1
+1582	1582	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi	2	0	0	1
+1583	1583	Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1584	1584	^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1585	1585	^((<\/body).)+?Content\s*?loading.*lease wait.*?<iframe	2	0	0	1
+1586	1586	^(\x4c|\x35)	2	0	0	1
+1587	1587	^(\x76|\x0f)	2	0	0	1
+1588	1588	\/wp-(content|admin|includes)\/	2	0	0	1
+1589	1589	^\d\x00\d	2	0	0	1
+1590	1590	\.php\?$	2	0	0	1
+1591	1591	\?showforum=$	2	0	0	1
+1592	1592	^\s*5a\s*90\s*00\s*03\s*00\s*00\s*00	2	0	0	1
+1593	1593	\x2Fphp-calendar-1.1\x2Fupdate(08|10)\x2Ephp(\x3F|.*(\x26|\x3B))configfile=[^\x26\x3B]*[^a-zA-Z0-9_]	2	0	0	1
+1594	1594	(\.\.\/){1,}	2	0	0	1
+1595	1595	(\.\.\/){1,}	2	0	0	1
+1596	1596	=(https?|ftps?|php)\:\/.{0,100}cmd=	2	0	0	1
+1597	1597	MEAS\.TYPE=((link|class)&)	2	0	0	1
+1598	1598	url=.{8000}	2	0	0	1
+1599	1599	\/ssp\/files\/annonce\.pdf$	2	0	0	1
+1600	1600	\/ssp\/loadjavad\.php$	2	0	0	1
+1601	1601	\/wywg\/[a-z0-9]{2,5}\/[a-z0-9]+\.exe$	2	0	0	1
+1602	1602	\/xml\/p\.php\?id=\d{2,}	2	0	0	1
+1603	1603	ts\/in\.cgi\?pepsi\d+	2	0	0	1
+1604	1604	cs_base_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+1605	1605	\x0d\x0aHost\: (www\.)?nacha\.org\.	2	0	0	1
+1606	1606	\x26n\x3d[a-z]{5}\d{4}	2	0	0	1
+1607	1607	name=(https?|ftps?|php)	2	0	0	1
+1608	1608	\/script\.php?\d{8}	2	0	0	1
+1609	1609	Host\: \d+\.\d+\.\d+\.\d+\x0d\x0a	2	0	0	1
+1610	1610	\/[a-z]+\/[a-z0-9]{120,}\/[a-z0-9]+\/.+\.com$	2	0	0	1
+1611	1611	UPDATE.+SET	2	0	0	1
+1612	1612	ASCII\(.+SELECT	2	0	0	1
+1613	1613	DELETE.+FROM	2	0	0	1
+1614	1614	INSERT.+INTO	2	0	0	1
+1615	1615	UNION\s+SELECT	2	0	0	1
+1616	1616	SELECT.+FROM	2	0	0	1
+1617	1617	UPDATE.+SET	2	0	0	1
+1618	1618	ASCII\(.+SELECT	2	0	0	1
+1619	1619	DELETE.+FROM	2	0	0	1
+1620	1620	INSERT.+INTO	2	0	0	1
+1621	1621	UNION\s+SELECT	2	0	0	1
+1622	1622	SELECT.+FROM	2	0	0	1
+1623	1623	ver=[v\d]+	2	0	0	1
+1624	1624	\/Setup_[0-9]{3}([A-Z][0-9])?\.exe$	2	0	0	1
+1625	1625	\/\d+\/installer\/Installer(Clean)?\.exe$	2	0	0	1
+1626	1626	\/(nte|ld)\/[0-9A-Z]*trest1[0-9](\.php|\s\.asp|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$	2	0	0	1
+1627	1627	^[a-z0-9\x40\x2d\x5f]{5,12}..\x00\x00..\x00\x00\x78\x9c	2	0	0	1
+1628	1628	=sent$	2	0	0	1
+1629	1629	\.php\?get[^=]*=\d_\d{5,}$	2	0	0	1
+1630	1630	\.php\?[a-z]_info=[a-z0-9]{1,4}_\d+?$	2	0	0	1
+1631	1631	Host\x3A\x20[^\r\n]*.rr.nu/H	2	0	0	1
+1632	1632	^(.{0,63}\x00.{0,62}\x00.{0,61}\x00.{0,60}\x00)(.{0,62}\x00{2})(.{0,59}[A-Za-z0-9]{5})((<b1>.).{0,63}(=b1).{0,62}(=b1).{0,61}(=b1).{0,60}(=b1))(.(<b2>.).{0,62}(=b2).{0,61}(=b2).{0,60}(=b2).{0,59}(=b2))(..(<b3>.).{0,61}(=b3).{0,60}(=b3).{0,59}(=b3).{0,58}(=b3))(...(<b4>.).{0,60}(=b4).{0,59}(=b4).{0,58}(=b4).{0,57}(=b4))(....(<b5>.).{0,59}(=b5).{0,58}(=b5).{0,57}(=b5).{0,56}(=b5))(.....(<b6>.).{0,58}(=b6).{0,57}(=b6).{0,56}(=b6).{0,55}(=b6))(......(<b7>.).{0,57}(=b7).{0,56}(=b7).{0,55}(=b7).{0,54}(=b7))(.......(<b8>.).{0,56}(=b8).{0,55}(=b8).{0,54}(=b8).{0,53}(=b8))(........(<b9>.).{0,55}(=b9).{0,54}(=b9).{0,53}(=b9).{0,52}(=b9))(.........(<b10>.).{0,54}(=b10).{0,53}(=b10).{0,52}(=b10).{0,51}(=b10))	2	0	0	1
+1633	1633	\.tar$	2	0	0	1
+1634	1634	\x2Fjs\x2F[\r\n]*\x2Eexe$	2	0	0	1
+1635	1635	^(<mac_addr>[\x00-\xff]{6})(=mac_addr){2,}$	2	0	0	1
+1636	1636	^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED)	2	0	0	1
+1637	1637	^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED)	2	0	0	1
+1638	1638	^(\\r\\n|\x0d\x0a)C	2	0	0	1
+1639	1639	\/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+1640	1640	<iframe.*?src.*.*?<\/iframe>	2	0	0	1
+1641	1641	[a-z]{4,10}\x08velodrivve\x03biz\x00	2	0	0	1
+1642	1642	PRIVMSG.*@(portscan|nmap|back|udpflood|tcpflood|httpflood|linuxhelp|rfi|system|milw0rm|logcleaner|sendmail|join|part|help)	2	0	0	1
+1643	1643	\/[A-Z]Setup_[0-9]{4}\.exe$	2	0	0	1
+1644	1644	\.php.+?(c((onfi|f)g|alendar)|p(a(ge|th)|rog)|l(ang(uage)?|ib)|f(older|ile|ad)|d(omain|ir|f)|s(ettings|bp)|a(genda|uth)|i(con|ncl|d)|n(ame|ews)|r(oot|f)|gallery|type|ext|mod|[a-z](\[.*\])+?)\s*=\s*https?	2	0	0	1
+1645	1645	\/[a-f0-9]{16}\/.+?\.(exe|zip)$	2	0	0	1
+1646	1646	^\s?\+x=[0-9]*\;\ +y=[0-9]	2	0	0	1
+1647	1647	User-Agent\:[^\n]+\; UA\d\d\d\d\d\;/H	2	0	0	1
+1648	1648	^\/load.php\?showforum=(ato|obe|rhino|lib)$	2	0	0	1
+1649	1649	^[a-z]{5}\d=\x5f\d\x5f	2	0	0	1
+1650	1650	index.php\?[0-9a-f]{32}$	2	0	0	1
+1651	1651	o/\d{9}\/[0-9a-f]{32}\/[0-9]$	2	0	0	1
+1652	1652	\/out.php\?id=\d$	2	0	0	1
+1653	1653	\/\?[a-z0-9]{5,}=[a-zA-Z0-9\x25]{40,}\x253D$	2	0	0	1
+1654	1654	^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$	2	0	0	1
+1655	1655	\/((article|contact|new)s|read|(fo|tu)r)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.eot|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.EOT)$	2	0	0	1
+1656	1656	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})1\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}1\.PDF)$	2	0	0	1
+1657	1657	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})2\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}2\.PDF)$	2	0	0	1
+1658	1658	^(\/[a-z]{3,20})?\/([a-z]{3,20}[-_])+[a-z]{3,20}\.jar$	2	0	0	1
+1659	1659	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})3\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}3\.PDF)$	2	0	0	1
+1660	1660	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/foto\.png$	2	0	0	1
+1661	1661	\.png$	2	0	0	1
+1662	1662	^\/[a-zA-Z0-9_\x2f-]{300,}\.html?$	2	0	0	1
+1663	1663	\/\d+\.mp3\x3frnd\x3d\d+$	2	0	0	1
+1664	1664	(Is|CheckRemote)DebuggerPresent	2	0	0	1
+1665	1665	(Create|Connect|Peek)NamedPipe	2	0	0	1
+1666	1666	ftp(open|get)file	2	0	0	1
+1667	1667	^\/r\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1668	1668	^\/t\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1669	1669	^\/[a-f0-9]{32}\.eot$	2	0	0	1
+1670	1670	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/new\.png$	2	0	0	1
+1671	1671	\.gif$	2	0	0	1
+1672	1672	\/(w(hite|orld)|step)\/\d+$	2	0	0	1
+1673	1673	\.psd$	2	0	0	1
+1674	1674	\.jpeg$	2	0	0	1
+1675	1675	\/(w(hite|orld)|step)\/mypic\.dll$	2	0	0	1
+1676	1676	getqq\.jpg$	2	0	0	1
+1677	1677	^[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(((=q)).)+?\.txt\?e=\d+(&[fh]=\d+)?(=q)	2	0	0	1
+1678	1678	\.php\?t[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1679	1679	([a-z+-]{0,4}[0-9.*]+[a-z$+-]{0,4},){24}	2	0	0	1
+1680	1680	[\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]+	2	0	0	1
+1681	1681	\.php\?spl=[A-Z]{3}	2	0	0	1
+1682	1682	\.php\?b[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1683	1683	\.php\?n[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1684	1684	^[^?#]+?\.php\?page[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1685	1685	\.php\?v[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1686	1686	\.php\?doit[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1687	1687	^[^?#]+?\.php\?id[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1688	1688	(-?\d+\x3a-?\d+\x3a){100}	2	0	0	1
+1689	1689	\x2Fsrc\x2Ephp\x3Fcase\x3D[a-f0-9]{16}$	2	0	0	1
+1690	1690	[\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]	2	0	0	1
+1691	1691	value\x3D\x22\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23	2	0	0	1
+1692	1692	\x2Fredirect\x2Ephp\x3Fd\x3D[0-9a-f]{8}$	2	0	0	1
+1693	1693	\/\d+\.js\?\d+&[a-f0-9]{16}$	2	0	0	1
+1694	1694	^\/[a-z0-9_\-]{48}$	2	0	0	1
+1695	1695	\.php\?e=[^&]+?$	2	0	0	1
+1696	1696	\/[a-z]\/[0-9]\/[0-9a-f]{32}$	2	0	0	1
+1697	1697	archive=[^\x3e]+?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+1698	1698	^\/[a-z]+\/$	2	0	0	1
+1699	1699	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/image\.gif$	2	0	0	1
+1700	1700	\/w(hite|orld|step)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.PDF)$	2	0	0	1
+1701	1701	\/(w(hite|orld)|step)\/get(a+|n+)\.jpg	2	0	0	1
+1702	1702	\.php\?usernms=[^@]+@[^\r\n]+$	2	0	0	1
+1703	1703	^(\x3a\d{1,5})?$	2	0	0	1
+1704	1704	^[^\r\n]+?\.(c(o(l(leg(e((confidential|-station|prowler)\.net|s?explained\.com)|iate(explained|info)\.com)|(o(rado-springs-jobs|nexplained)|umnexplore)\.com)|m(p(uter(explained\.com|themes\.net)|assiondefinition\.com)|m(oditylingerie|unesinfo|ercekid)\.com)|n(ce(rtparis\.net|ptsets\.com)|trolwedding\.com)|((rnell|upon)explained|peguide)\.com|7\.us)|a(((mpaign|talog|det)explained|n(cersexplained|adadaycore)|p(itali[sz]eguide|ricornhi)|b(leexplained|indynamic))\.com|r((tograph(yanalysis|erwhat)|cinomas?explained|scratch-remover|eblack)\.com|insurance-compare\.net)|ce\.us)|h((a(r(med-episodes|les-proxy|tpixel)|p(elsinfo|terball)|nnelexplained)|ristmas(gift-ideas|motion)|inesenewyearboom|eckingwatch)\.com|(orizo|urros)\.es)|(e(l(lularexplained|iac-diet)|ntigrade(explained|info))|(li(nical|ck)|ustomized)explained|r(uiseshipdating|iticsmart)|pu-benchmark|nc-cs)\.com|8\.biz|z\.cc)|a((ll(about(((collegi|gradu)at|yal)e|s(eminary|tudent)|(facul|varsi)ty|bestsellers|academic|teaching|harvard|ucla|pro)|babyours)|n((tip	2	0	0	1
+1705	1705	desbi|alyzelan)d|onymous-film)|(mericas-nexttopmode|gentsbal)l|r(chitectureice|lingtonwriter)|c(ademicexplaine|tionmo)d|ero(flotinfo|bicfund))\.com|u((toma(tedexplained|kers24)|stralia-airlines|xiliaryverb)\.com|di(t(jewellery\.com|report\.net)|o-planet\.com))|p((rilfools(hotel|spin)|ple-airport)\.com|[fh]i\.biz)|ir((bnb-coupon|waysinfo)\.com|portshuttleseattle\.net)|v(enue(domain|hello)\.com|li\.biz)|\.e\.gy)|b((a(c(helorexplained|kpackscope)|by(online-shop|revision)|(rcelonarea|ggagecoo)l|s(icexplained|escope)|ttle-field-3)|e((st-hoteldeal|er-calorie|t-award)s|nefitexplained)|u(y-invite|dgetyep)|logger-com)\.com|r((o(adbandinternet-providers|king(explained|guide))|unomarsalbum|yan-college)\.com|ea(st(cancertattoos\.net|explained\.com)|dmachine-recipes\.com))|o(((om(ing|s)|nd)explained|tany(explained|info)|dybuildingdomains|rrowings?24)\.com|stoncolleges\.net)|irthcertificatetemplate\.net|3g\.biz)|d(e((((benture|posit)explaine|alershipislan)d|n(guefevertreatment|verhowto)|ductguide|veloptea)\.com|(xterstre	2	0	0	1
+1706	1706	ming|ciduoustrees)\.net)|o((ctorate(s?explained|info)|llar-converter|gwalking-jobs|texplained|mainsknow)\.com|wnload(starcraft|-films|ubuntu)\.net)|(a(ncecentralsonglist|rtmouthexplained)|na-replication|hcp-server|vd-codec|rivewww)\.com|i((s(count|ease)explained|nnerparty-recipes|walifile)\.com|rect-golf\.net))|e((a(r(fulexplained|th-clinic)|sy(-costumes|repayment))|conomic(save|24))\.com|\.gy)|4((4qs|h5)\.com|[jp]\.org|ql\.biz)|3(vt\.info|gb\.biz|q\.org)|2(eat\.com|sf\.biz|u\.se)|8(c1\.net|x\.biz)|7(c\.org|p\.biz)|11r\.(biz|us))(\x3a\d{1,5})?$	2	0	0	1
+1707	1707	^[^\r\n]+?\.(f((a(c(ultyexplained|e-bok)|(ncy-font|ke-nail)s|ir(explained|fuse)|shion-wallpaper|lterguide)|i(nanc(i(al|ng)explained|epets)|rm(explained|s24)|lter-coffee)|o(r(umexplained|ecastbooks|ceestate)|x-drama)|udaninfo)\.com|re(e(-(((foodcoupon|angrybird)s|s(oundclips|tock)|photoeditor)\.com|music-download\.net)|(p(owerpointthem|roduct-sampl)es|dom-ofspeech)\.com|fileconverter\.net)|snoever\.com)|l(a(shplayerdownload\.net|tbelly-diet\.com)|oridaunemploymentclaim\.com|v-downloader\.net)|e(rtility-calculator\.net|stivalexplained\.com)|b(-smileys\.com|skins\.net))|l((i(n(k(explained|master)|colnsbirthdaytea)|(ability|ver)explained|(berty-saf|ftmov)e|stings(biz|red)|teraturemulti)|u(ng(explained|abscess)|ggageboom)|o(cationssecure|ndon-riots|gback))\.com|e((a(singexplained|ther-trousers)|(edsunited-new|d-candle)s|cturer(explained|info)|nd(ing|er)explained|isure-diving)\.com|u(kemiaexplained\.com|e\.biz)|tup\.org)|a(guay\.(com|es)|-gazzetta\.com)|6\.org)|i(n(s((ur(er(s(explained|24)|explained)|ancesexplain	2	0	0	1
+1708	1708	d)|ide-film)\.com|(pection-camera|taflex)\.net)|d(e(pendenceday(portal|realty)|mnityexplained)\.com|ividual-healthinsurance\.net)|t(er(estexplained\.com|trigo\.net)|ranet(explained|pm)\.com)|((vestment|centive)explained|expensivehyper)\.com|f(ections?explained\.com|o\.se))|((mmersio|sd)nexplained|ronmancom|pone-5)\.com|i(nkai|lg)\.biz)|m((e(tropolis((cruis|fac|mov)e|pixel)|(lanoma|dical)explained|r(idiantotal|cedes-cls)|ntal-healthjobs|morialdaycon|ssenger-mac|ansgift)|i(ami(-holidays|what)|di-editor)|baexplained)\.com|a(r((tial-empires|ket-hq)\.com|iogames-online\.net)|n((agejoin|ualzap)\.com|ipal-university\.net)|(lignanthypertension|gazinedownload)\.net|s(on(wave|car)|tersexplained)\.com|c2\.org))|e((s(ta(tes(mob|fx)|blishstyle)|lexplained)|mploy(e(eexplained|r24)|mentexplained))\.com|n(((gagement-photo|able-cookie)s|rollexplained)\.com|trepreneur-ideas\.net)|x(((hibition|po)explained|ecutive-decision)\.com|tremedeal\.net)|l(ect(ronicexplained|orate123)\.com|guay\.(com|es))|q(uityexplained\.com|8\.biz))|	2	0	0	1
+1709	1709	((o(a(d(minister|vertize|just)|cademic|llocate)|(thic-literatur|handl)e|(bailou|conduc)t|govern)|r(a(duate(explained|sinfo)|ndparentsdayplan)|oceryexplained|4)|ym(glas|car)s|m[69])\.com|a(((llaudet|te)explained|mevelocity|rnerguide)\.com|511\.net)|cwsa\.org)|h(o((me(made-biscuits|pageexplained)|(nours|tline|using)explained|6)\.com|stel-barcelona\.net)|a(r(dback(city|yoga)|vardexplained)|n(dlechange|ukkahbio)|lloweenorange)\.com|y(perthyroidsymptoms\.net|d\.me)|ellokittypictures\.net)|j((o(urnalism(explained|info)|hn-grisham|ker-tattoo)|query-examples)\.com|a(cksonvillepath\.com|vacollection\.net)|(vvg|6)\.org)|k(ilometersreach|udosexplained|jyg)\.com)(\x3a\d{1,5})?$	2	0	0	1
+1710	1710	^[^\r\n]+?\.(p(r(o(pert(ies(-forsale\.net|winters\.com)|y-(singapore|rental)\.net)|(fessors|state)explained\.com)|e(miums(e(xplained|ek)|guide)|(acher|cinct|late)sinfo|pexplained)\.com|i(va(te(car-sales|explained)\.com|do\.info)|nceton\.me))|e((n(sionexplained|thousepal|cetruck)|diatricsexplained)\.com|rsonal(trainer-certification\.net|-injuryclaims\.com)|tardo\.es)|o((wer(borrowings?|repayment|debts)|rt(land-holidays|alexplained)|intexplained|litical24)\.com|kertexas-holdem\.net)|a((ss(engersinfo|agepix)|ge(explained|as)|cemaker-surgery|ttinson-robert|rk-edu)\.com|loaltocollege\.net)|(u(blicationgift|pils?info)|ickups(articles|gen)|neumoniaexplained|sychologyquotes|lus-sign)\.com|h(o(toedit(orfreedownload\.net|ingsite\.com)|neexplained\.com)|pbb-themes\.com|yscology\.net)|cbp\.net|9\.org)|o(n(line(((f(o(ster|rce)|irstborn|raternal|ulltime)|b(r(idegroom|owse)|oxoffice)|e((valuat|xpress)e|fficient)|-(collegecourse|radiostation)|d(escendant|aughter|iscusse)|v(illage|acant)|re(sidence|al))s|c((r(iti(c(ize|al)|	2	0	0	1
+1711	1711	ue)|ew)|o(nsider|usin)|a(pture|meo)|elluloid)s|ha(racters|teau))|a(((vailabl|doptiv|llianc|pprais)e|ss(esse|ay)|unt)s|n((cestor|alyze)s|imated)|way)|per(sonal-trainer|manents))\.com|mediaconverter\.net)|e-lyrics\.com|amia\.biz)|(ver(seasexplained|drawnreal)|(wnership|ffline)explained|cean(ic-cable|you)|rphanagesinfo|klahomafuse)\.com|a(klandour\.com|pg\.org))|r(e((s(idenc(e(attorney|dating|cook|food)|yexplained)|erves(development|core))|(c(o(ver(ing|ed)|up)|laim)guid|laxationhyp|bateventur)e|g(i(on(private|mentor)|stercommunity)|ainguide)|t(r(ainingexplained|ieveguide)|ailexplained)|motecontrol-helicopter|viewwinters|payment24)\.com|alestate-perth\.net)|(a(cetracksinfo|veexplained|iserepair|tetask)|ising-antivirus|bnnetwork)\.com|o((o(m(sfootball|mateco)|fcute)|admodern)\.com|yallondonhospital\.net))|s((o((lventsourc|ftenguid)e|urceexplained|cietiesinfo|ng-india)|a(n(antoniosource|diegodiscover)|l(aryexplaine|euploa)d)|ta(nford(explained|info)|(bilis|v)eguide|r-treck)|p(ecialtyexplained|iralwatch|orts-tab)|	2	0	0	1
+1712	1712	h(oolexplained|eduleedu)|ites?explained)\.com|e((minar(y(explained|info)|explained)|c((urities|tor)explained|what)|aworld-coupons)\.com|rvertransfer\.net)|m(ier\.org|oz\.us)|hellgascard\.net|gba\.biz)|m(o((t(oristsinfo|iveshare)|ntre-breitling|dernexplained|squesinfo)\.com|hamed\.me)|(y(borrowings|-husband)|ultimediaexplained|inistriesinfo)\.com|mcd\.us)|n((a(ming(mac|our)|uticalfit|vigateadd)|e(tworkexplained|w-college))\.com|8\.biz))(\x3a\d{1,5})?$	2	0	0	1
+1713	1713	^[^\r\n]+?\.(t(e((l(e(phoneexplained|comsguide)|learth)|n(ured(explained|info)|nis-ranking))\.com|mp(l(ates-gratis\.com|ecollege\.net)|converter\.net)|a(ching(-certificate\.net|explained\.com)|m\.pro))|r(a(((nsferbyt|de-)e|in(eesinf|ge)o|mray)\.com|vel(insurance-comparison\.net|agentnerd\.com))|e(k-bicycles|nd-online)\.net|uckstool\.com|onco\.es)|(o(wn(housepic|study|euro|meta)|(tal-tool|memap)s|pgamebook|olboxsol)|u(mors?explained|lsatrain|rn-ons)|attoo-websites|ype-racer|wainfo)\.com|h((anksgivinggaming|riftexplained)\.com|e(sis-examples\.com|atreparis\.net))|i(mezonevendor\.com|dl\.net)|cmn\.biz)|w(e(b((b(estseller|ailout)|administer)\.com|site(downloader\.net|explained\.com)|developertoolbar\.net)|(l(lesley|fare)explained|akenguide)\.com)|or(th(voice|war)\.com|ld-records\.net)|ater(front-property\.net|-plants\.com)|(riterpics|hoiscan)\.com|pbh\.org|sse\.us)|s((t(ud(ent(financecontact|s?explained)|yexplained)|r(eetmaphub|ongat)|patricksweightloss|onewhat)|wissairinfo)\.com|u((mmertimelyrics|nset-wallpape	2	0	0	1
+1714	1714	|per-committee|itegraphic)\.com|b\.(name|cat|es)))|v((i(llage((in|na)no|crystal)|deo(-mediaset|explained)|ta(minssms|lwow)|rtualexplained)|o(lumesynergy|ucheragent|ters24)|a(rsityexplained|lentinesproxy)|entureexplained)\.com|qtel\.net|f1\.us)|u(n(i(versityexplained\.com|nstalltool\.net|\.me)|((secured|am)explained|ravelguide)\.com|limited-web-hosting\.net)|(cla(explained|info)|s-inflation|alinfo|zdom)\.com|[04]\.org)|y((o(u(ngstersinfo|rbroking)|mkippursocial)|(eshiva|ale)explained|vxs)\.com|nna\.biz)|zwr\.org)(\x3a\d{1,5})?$	2	0	0	1
+1715	1715	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+1716	1716	[a-z]{8}.(:?tif|gif)	2	0	0	1
+1717	1717	^.{2}[a-zA-Z0-9]+\x2e[01]	2	0	0	1
+1718	1718	(\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(	2	0	0	1
+1719	1719	^\w+?\[[^\]]+?\]\.src[\r\n\s]*=	2	0	0	1
+1720	1720	(\/(php)?|\.php)\?[\s\+]*\-[A-Za-z]	2	0	0	1
+1721	1721	^[A-Z]=[A-Za-z/+0-9=]{200,400}$	2	0	0	1
+1722	1722	^\{?[a-fA-F0-9]{4}\}?(\x5cu\{?[a-fA-F0-9]{4}\}?){20}	2	0	0	1
+1723	1723	^\{?[a-fA-F0-9]{4}\}?(\x25u\{?[a-fA-F0-9]{4}\}?){20}	2	0	0	1
+1724	1724	[^a-zA-Z0-9_\-\.][a-zA-Z]{7}\.class	2	0	0	1
+1725	1725	^[\r\n\s]*?\\?\(.+?\\?\)\.keep\.previous[\r\n\s]*[\r\n\s]*?[\x22\x27]contentArea	2	0	0	1
+1726	1726	\/vw\.php\?i=[a-fA-F0-9]+?\-[a-fA-F0-9]+?$	2	0	0	1
+1727	1727	^[\x11\x21-\x26\x41\x45\x70-\x79]	2	0	0	1
+1728	1728	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1729	1729	^.{0,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.jsp\x22	2	0	0	1
+1730	1730	^..[\x81\x82\x83\x84\x85\x86\x87]\x81	2	0	0	1
+1731	1731	^..[\x81\x82\x83\x84\x85\x86\x87]\x83	2	0	0	1
+1732	1732	^..[\x81\x82\x83\x84\x85\x86\x87]\x84	2	0	0	1
+1733	1733	^..[\x81\x82\x83\x84\x85\x86\x87]\x85	2	0	0	1
+1734	1734	REGISTER.{400}	2	0	0	1
+1735	1735	SELECT.+geometrycollectionfromwkb	2	0	0	1
+1736	1736	SELECT.+WHERE.+SELECT.+\x60	2	0	0	1
+1737	1737	ALTER.+DATABASE.+\x22\x2E(\x22|\x2E\x22|\x2E\x2E\x2F\x22).+UPGRADE.+DATA	2	0	0	1
+1738	1738	^Authorization\x3A Basic.{120}/Hmi	2	0	0	1
+1739	1739	^Host\x3a[^\x3a\r\n]+?\x3a[^\r\n]{6}/Hmi	2	0	0	1
+1740	1740	^[^\x00]+?\x00	2	0	0	1
+1741	1741	^[^\x00]+?\x00	2	0	0	1
+1742	1742	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*22C83263-E4B8-4233-82CD-FB047C6BF13E	2	0	0	1
+1743	1743	^Cache-Control\x3a\x20(max-age=0|no-cache)\r?$	2	0	0	1
+1744	1744	^\/\?id=[0-9]{13}&msg=	2	0	0	1
+1745	1745	^13\d{11}	2	0	0	1
+1746	1746	^Callback\x3a\x20<http[^>]+><http	2	0	0	1
+1747	1747	^[^\r\n]*uuid\x3a[^\r\n\x3a]{181}	2	0	0	1
+1748	1748	^[^\r\n]+#[^\x22\r\n]{2049}	2	0	0	1
+1749	1749	^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1750	1750	^[^\r\n]*urn\x3aservice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1751	1751	^[^\r\n]*urn\x3adevice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1752	1752	^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{1,180}\x3a[^\r\n\x3a]{181}	2	0	0	1
+1753	1753	M-SEARCH\s+[^\n]{500}	2	0	0	1
+1754	1754	(\/\.){70,}	2	0	0	1
+1755	1755	[\w]{70,}	2	0	0	1
+1756	1756	\xB6\x29\x8C\x23\xFF\xFF\xFF[\xF8-\xFF]	2	0	0	1
+1757	1757	^.{27}	2	0	0	1
+1758	1758	[0-9a-zA-Z]{200,}	2	0	0	1
+1759	1759	(GET).\/%.{1586,}	2	0	0	1
+1760	1760	ctxsys\x2Edrvxtabc\x2Ecreate\x5Ftables.+(SELECT|DELETE|CREATE|INSERT|UPDATE|OUTFILE)	2	0	0	1
+1761	1761	[^a-zA-Z0-9]+\.message	2	0	0	1
+1762	1762	\x3d[^\x26]{720}	2	0	0	1
+1763	1763	ENTER\x20LANGUAGE\x20\x3D.{55}	2	0	0	1
+1764	1764	[a-zA-Z0-9]{1000,}	2	0	0	1
+1765	1765	\xbc[\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4]	2	0	0	1
+1766	1766	\xae[\xef\xcf][\xf0\xd0][\xe5\xc5][\xee\xce]\xa0\xa2[\xe7\xc7][\xe5\xc5][\xf4\xd4]\xa2	2	0	0	1
+1767	1767	[\xf3\xd3][\xe8\xc8][\xe5\xc5][\xec\xcc][\xec\xcc][\xe5\xc5][\xf8\xd8][\xe5\xc5][\xe3\xc3][\xf5\xd5][\xf4\xd4][\xe5\xc5]	2	0	0	1
+1768	1768	[\xf6\xd6][\xe2\xc2][\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4]	2	0	0	1
+1769	1769	Cookie\:\ +REMOTE_ADDR=	2	0	0	1
+1770	1770	Authorization\x3a\s*Basic\s*[a-zA-Z0-9]{255,}==	2	0	0	1
+1771	1771	\x2findex\x2etmpl(\x3a\x3a\x24DATA|\x2f|\x2e)\x0d\x0a	2	0	0	1
+1772	1772	\/[a-z0-9]{30,}\.php\?height=\d+&sid=\d+&width=[a-z0-9]+&	2	0	0	1
+1773	1773	\.php\?sex=\d+&children=\d+&userid=	2	0	0	1
+1774	1774	^SSH-\s[^\n]{200}	2	0	0	1
+1775	1775	value\x22[^\x22]*\x2Eswf\x3finfo\x3D	2	0	0	1
+1776	1776	^(CLIENT|MACHINE)_INFO	2	0	0	1
+1777	1777	Host\x3a \d{8,10}(\x0d\x0a|\x3a\d{1,5}\x0d\x0a)/H	2	0	0	1
+1778	1778	\/tmp\/[^\/]+\.pdf$	2	0	0	1
+1779	1779	\/tmp\/[^\/]+\.jar$	2	0	0	1
+1780	1780	^Directory	2	0	0	1
+1781	1781	^HEAD[^s]{432}	2	0	0	1
+1782	1782	^PUT[^s]{432}	2	0	0	1
+1783	1783	^POST[^s]{432}	2	0	0	1
+1784	1784	^TRACE[^s]{432}	2	0	0	1
+1785	1785	^DELETE[^s]{432}	2	0	0	1
+1786	1786	^LOCK[^s]{432}	2	0	0	1
+1787	1787	^MKCOL[^s]{432}	2	0	0	1
+1788	1788	^COPY[^s]{432}	2	0	0	1
+1789	1789	^MOVE[^s]{432}	2	0	0	1
+1790	1790	\x2Frequests\x2Fstatus\x2Exml\x3F[^\x0A\x0D]*input\x3D[^\x0A\x0D\x26\x3B]{1000}	2	0	0	1
+1791	1791	^\/[0-9]{5}\.jar$	2	0	0	1
+1792	1792	Host\x3a \d{4,}[^A-Za-z\.]	2	0	0	1
+1793	1793	^\/[0-9]$	2	0	0	1
+1794	1794	^\/[a-z]{13,14}\.jar$	2	0	0	1
+1795	1795	^\s*?STOR\s+[^\r\n]*?nsswitch\.conf\r$	2	0	0	1
+1796	1796	^\s*?STOR\s+[^\r\n]*?\x2f(tgt|trace|rbp(c|p))\.conf\r$	2	0	0	1
+1797	1797	T.*?T.*?Y.*.*?R.*?O.*?M.*.*?T	2	0	0	1
+1798	1798	[0-9a-zA-Z]{10}	2	0	0	1
+1799	1799	[0-9a-zA-Z]{10}	2	0	0	1
+1800	1800	Host\x3a \d{4,}[^A-Za-z\.]	2	0	0	1
+1801	1801	^\/m[a-zA-Z0-9-_]{3,14}\/[a-zA-Z0-9-_]{3,17}$	2	0	0	1
+1802	1802	SELECT data FROM [^\x20]+?\x20INTO DUMPFILE [\x27\x22]c\x3a\/windows\/system32\/[a-z0-9_-]+?\.exe[\x27\x22]	2	0	0	1
+1803	1803	[a-zA-Z0-9]{5}	2	0	0	1
+1804	1804	[0-9a-zA-Z]{50}	2	0	0	1
+1805	1805	\x90{200}	2	0	0	1
+1806	1806	^\s+A{500}	2	0	0	1
+1807	1807	^[\r\n\s]*?\x28[^\x29]*?shellcode	2	0	0	1
+1808	1808	^[\r\n\s]*?\x28[^\x29]*?shellcode	2	0	0	1
+1809	1809	\.(php|asp|py|exe|htm|html)\/[joewxy](U[0-9a-f]{8})?H[0-9a-f]{8}V[0-9a-f]{8}\d{3}R[0-9a-f]{8}\d{3}T[0-9a-f]{8,}	2	0	0	1
+1810	1810	[\r\n\s]+(<var1>([a-z]([a-z0-9_])*|_+([a-z0-9])([a-z0-9_])*))[\r\n\s]*\x3d[\r\n\s]*CreateObject\(\s*[\x22\x27]Wscript\.Shell[\x27\x22]\s*\).+?(=var1)\.run	2	0	0	1
+1811	1811	^((>>).)+?#([46][1-9a-fA-F]|[57][\daA])	2	0	0	1
+1812	1812	^\s*?fun\s*?\(	2	0	0	1
+1813	1813	[\?&]mail=[^&]+?[\x3b\x2c\x7c\x27]	2	0	0	1
+1814	1814	WSH\.run\x28\x5c+?[\x22\x27][a-z0-9_-]+?\.exe	2	0	0	1
+1815	1815	^(90|0x5a|0+?132)\s*?,\s*?(71|0x47|0+?107)\s*?,\s*?(70|0x46|0+?106)\s*?,\s*?(48|0x30|0+?60)\s*?,\s*?(89|0x59|0+?131)\s*?,\s*?(84|0x54|0+?124)\s*?,\s*?(112|0x70|0+?160)	2	0	0	1
+1816	1816	\/\??[a-f0-9]{60,}(\x3b\d+){1,4}$	2	0	0	1
+1817	1817	\/\??[a-f0-9]{60,}\x3b4[0-1]\d{5}$	2	0	0	1
+1818	1818	^\/([a-z0-9]{3,7}\/)?[a-z]{3,7}\.swf$	2	0	0	1
+1819	1819	^(25)?282176\x25(25)?29\x25(25)?26chrw\x25(25)?2801	2	0	0	1
+1820	1820	^Referer\x3a[^\r\n]+\/gate.php\r$/Hm	2	0	0	1
+1821	1821	Host\x3a\x20(\.*[a-f0-9]\.*){32}\./Hm	2	0	0	1
+1822	1822	^( Systems|\.com\/techsupport)	2	0	0	1
+1823	1823	^\s*?(<v1>[^\x29\s]+)\s*?\x29\s*?To Ubound\x28(=v1)\s*?\x29\s*?(dim\s*?)?(<v2>[^\s\x3d]+)\s*?\x3d\s*?(=v2)\+Cstr\x28\s*?Chr\x28(=v1)\x28i\x29[\+\-]\d+\x29\x29.+?Execute\s*?(=v2)	2	0	0	1
+1824	1824	^[0-9][^=]	2	0	0	1
+1825	1825	^\s*?\d[\d\x2e]{255}	2	0	0	1
+1826	1826	^\s*?\d[\d\x2e]{255}	2	0	0	1
+1827	1827	\s+?trigger\s+?[^\x20]+?\s+?after\s+?insert\s+?on\s+?	2	0	0	1
+1828	1828	^..[^\x00]+\x00	2	0	0	1
+1829	1829	^..[^\x00]+\x00	2	0	0	1
+1830	1830	^..[^\x00]+\x00	2	0	0	1
+1831	1831	^..[^\x00]+\x00	2	0	0	1
+1832	1832	^([^>]*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]*?\.swf[\x22\x27])([^>]*?\swidth\s*\s*?[\x22\x27]0[\x22\x27])[^>]*?\sheight\s*\s*?[\x22\x27]0[\x22\x27]	2	0	0	1
+1833	1833	^(<addr1>.{4})(<addr2>.{4})(=addr2)(=addr1)	2	0	0	1
+1834	1834	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1835	1835	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1836	1836	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1837	1837	Type\x2FAction.+Launch.+\x28\x2F[a-z]\x2F[a-z].+NewWindow\x20true	2	0	0	1
+1838	1838	^=\s*\x22\s*[^\s\x22\x28]{1000}	2	0	0	1
+1839	1839	^(USE|PASS|SELECT|UPDATE|INSERT|ASCII|SHOW|CREATE|DESCRIBE|DROP|ALTER)\s+?(.{1}){300}	2	0	0	1
+1840	1840	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d+?&){3,}[a-z\_\-]{4,10}=-?[a-z0-9]+$	2	0	0	1
+1841	1841	^\s*\[\s*[\x22\x27]\\u[a-f0-9]{4}\\u[a-f0-9]{4}	2	0	0	1
+1842	1842	^[^\x00]+\x00\x00\x01	2	0	0	1
+1843	1843	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1844	1844	^.{6}[^\x00]+	2	0	0	1
+1845	1845	^.{6}[^\x00]+	2	0	0	1
+1846	1846	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1847	1847	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1848	1848	^\x20+\x3a\x20([0-9A-F]{2}\x3a){5}[0-9A-F]{2}\x0d\x00\x0a	2	0	0	1
+1849	1849	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1850	1850	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1851	1851	^(\x01((\x01((\x04((\x03(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x04(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?|\x02(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?))?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|\x02([\x01\x02\x03\x04])?|\x03([\x01\x02])?))?|\x03((\x03(\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e])?)?)?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13])?|\x02([\x01\x02])?))?|\x05((\x02(\x01([\x01\x02\x03\x04\x05\x06\x07])?)?|\x01([\x01\x02\x03])?))?|\x02(([\x01\x02]|\x03(\x01([\x01\x02\x03])?)?))?|\x06(\x01([\x01\x02\x03\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x07([\x01\x02])?|\x04))?|\x02((\x02([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|(\x01)?\x01))?)	2	0	0	1
+1852	1852	^(\x41\xd8\x41\xd8\x41\xdc){2,}\x41\x00	2	0	0	1
+1853	1853	^\s*\x28\s*retPtrAddr\.add\s*\x28\s*i\s*\*\s*8\s*\x29\s*,\s*rop\s*\x5b	2	0	0	1
+1854	1854	^\S+?drivestoredirect	2	0	0	1
+1855	1855	^\s*(f0VMR|9FTE|\/RUxG)	2	0	0	1
+1856	1856	^\s*=\s*[\x27\x22]\s*POST	2	0	0	1
+1857	1857	^.*?[\x24\x60]	2	0	0	1
+1858	1858	^\s*=\s*[^>]*file\x3a[^>]*\/\x24MFT\/	2	0	0	1
+1859	1859	^\s*(\x28|\%28)s	2	0	0	1
+1860	1860	^\s*\d*[^\x20-\x7e\r\n\t]	2	0	0	1
+1861	1861	^[\x30-\x3f\x7D]	2	0	0	1
+1862	1862	^[\x30-\x3f\x7D]	2	0	0	1
+1863	1863	AUTH\s+\S+\s+([a-zA-Z0-9\+\/=]{4})*[a-zA-Z0-9\+\/=]{3}\s	2	0	0	1
+1864	1864	^\s*((>).)+?\s*src\s*=\s*[\x22\x27]\s*[^\x27\x28]+?[\x22\x27]\s*onError\s*=\s*prompt\s*\x28\s*[^)]*?(document|s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+1865	1865	legal[^x7B]*\x7B[^\x7D]*restore	2	0	0	1
+1866	1866	legal[^x7B]*\x7B[^\x7D]*restore	2	0	0	1
+1867	1867	errordict\s+\x2Finvalidfileaccess	2	0	0	1
+1868	1868	errordict\s+\x2Finvalidfileaccess	2	0	0	1
+1869	1869	\x2Ebindnow[^\x7D]*\x7D\s*stopped	2	0	0	1
+1870	1870	\x2Ebindnow[^\x7D]+\x7D\s*stopped	2	0	0	1
+1871	1871	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1872	1872	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1873	1873	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1874	1874	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1875	1875	^\s*	2	0	0	1
+1876	1876	^\s*	2	0	0	1
+1877	1877	^\s*	2	0	0	1
+1878	1878	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){5}	2	0	0	1
+1879	1879	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7}	2	0	0	1
+1880	1880	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7}	2	0	0	1
+1881	1881	Template=.*\.\.	2	0	0	1
+1882	1882	act\x3D[^\x26\s\r\n]{257}	2	0	0	1
+1883	1883	app\x3D[^\x26\s\r\n]{257}	2	0	0	1
+1884	1884	[\x20-\x7e]{5,}\x5c\x00[\x20-\x7e]{5,}	2	0	0	1
+1885	1885	^[\x50-\x59]	2	0	0	1
+1886	1886	^[^\r\n]*?\x60[^\x60]*?\$\{IFS\}	2	0	0	1
+1887	1887	\bsolusvmc-node\b	2	0	0	1
+1888	1888	^\s*?\(\s*?[^,\s]*?\s*?,\s*?[\x22\x27][a-f0-9]{100}	2	0	0	1
+1889	1889	^mail\s*?from\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b	2	0	0	1
+1890	1890	^(\x25(25)*?20|\s)*?runmumaa\W	2	0	0	1
+1891	1891	^\s*?(<var>[^=\s\x3b]+)\s*\s*?getBits\(\s*?\)\x3b.+?flashvars\s*\s*?\x5c\x22(=var)\s*\s*?\x22\s*?\+\s*?(=var)\s*?\+\s*?\x22\x5c\x22	2	0	0	1
+1892	1892	^[a-z-]+\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b.*\x3b.*\x7d\s*\x3b(=[\r\n])	2	0	0	1
+1893	1893	^\s*\x28\s*[\x22\x27]\s*message	2	0	0	1
+1894	1894	^(\.|\[\s*?[\x22\x27])defineProperties\s*?\x28	2	0	0	1
+1895	1895	^[^\r\n]+\.hta\r?\n	2	0	0	1
+1896	1896	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1897	1897	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1898	1898	^(<num_value>\d+)\x7d,\x22id\x22\x3a(=num_value)	2	0	0	1
+1899	1899	^[(\x60|%60)(\x27|%27)]	2	0	0	1
+1900	1900	^\/(home\/a3user|root)\/agile3\/patches\/	2	0	0	1
+1901	1901	^.*?\x26	2	0	0	1
+1902	1902	(\x0a|\\n)\/s1Caa6	2	0	0	1
+1903	1903	^(\\r\\n|\x0d\x0a)C	2	0	0	1
+1904	1904	^\d{3}	2	0	0	1
+1905	1905	^(https\/\/|(\d{1,3}\.){3}\d{1,3}|([a-z0-9-]+\.)+[a-z]{1,8})	2	0	0	1
+1906	1906	^(==[A-Z0-9+/]{2}|=[A-Z0-9+/]{3}|[A-Z0-9+/]{4})([A-Z0-9+/]{4})*$	2	0	0	1
+1907	1907	^[A-Za-z0-9+/]{2}([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1908	1908	[\?\&]cmd_param=[^\&\r\n]{500}	2	0	0	1
+1909	1909	(%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))	2	0	0	1
+1910	1910	^.{11}([\xC0-\xC1]|[\xF5-\xFF]|\xE0[\x80-\x9F]|\xF0[\x80-\x8F]|[\xC2-\xDF]([\x80-\xBF])|[\xE0-\xEF]([\x80-\xBF]{2})|[\xF0-\xF4]([\x80-\xBF]{3})|([\x00-\x7F\xF5-\xFF])[\x80-\xBF]|([\xC2-\xDF]|[\xE0-\xEF]|[\xE0-\xEF][\x80-\xBF]|[\xF0-\xF4]|[\xF0-\xF4][\x80-\xBF]|[\xF0-\xF4][\x80-\xBF]{2})[\x80-\xBF]|([\xE0-\xEF])[\x80-\xBF]([\x80-\xBF])|([\xF0-\xF4])[\x80-\xBF]([\x80-\xBF]{2})|([\xF0-\xF4][\x80-\xBF])[\x80-\xBF]([\x80-\xBF]))	2	0	0	1
+1911	1911	^[^\x22]*[\x24\x60]+	2	0	0	1
+1912	1912	^[^\x22]*[\x24\x60]+	2	0	0	1
+1913	1913	^[a-z0-9\-_\.\/]+\x00	2	0	0	1
+1914	1914	^SOAPAction\x3a\s+?[^\r\n]*?http\x3a\/\/purenetworks\.com\/HNAP1\/([^\x2f]+?[\x2f])?[^\x2f]	2	0	0	1
+1915	1915	\/dev-report-overview\.html[^\"]*?\x3b	2	0	0	1
+1916	1916	^\s*\x22{2}	2	0	0	1
+1917	1917	^[\x22\x27]t(eamviewer(\d+|api)|v(c(hat|ontrol)|filetransfer|joinv|present|s(endfile|q(customer|support))|v(ideocall|pn))\d)	2	0	0	1
+1918	1918	^Host\x3a[^\n]{0,50}?\x3b	2	0	0	1
+1919	1919	^[\s>]	2	0	0	1
+1920	1920	^[\s>]	2	0	0	1
+1921	1921	^((\x0d\x0a).)+\x22(https?|file):\x2f\x2f	2	0	0	1
+1922	1922	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1923	1923	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1924	1924	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1925	1925	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1926	1926	^\s*?\x29	2	0	0	1
+1927	1927	^\s*?\(x\s*,\s*1,\s*24000\s*\x29	2	0	0	1
+1928	1928	^\s*[\x22\x27][^\x22\x27]{0,128}\x2e\x2e	2	0	0	1
+1929	1929	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1930	1930	=\s*\x25\s*\{\s*.+?\bProcessBuilder\b	2	0	0	1
+1931	1931	^[ a-zA-Z0-9+_]*[\x27\x3b]	2	0	0	1
+1932	1932	destination=[^&]*\x24\x28	2	0	0	1
+1933	1933	name=[^&]*\x24\x28	2	0	0	1
+1934	1934	^[^&]+\x2527(UNION|SELECT)	2	0	0	1
+1935	1935	[^&]*(\x60|\x24)	2	0	0	1
+1936	1936	(\x60|\x24)	2	0	0	1
+1937	1937	(\/GponForm\/diag_FORM\?images\/|\.html\?images\/)	2	0	0	1
+1938	1938	^((\S\:\\){2,}|\S\:\\\S\:\S\:|S\:\\\\\\([0-9]{1,3}\.){3}[0-9]{1,3}|\S\:\\\\\\([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+1939	1939	^(www\.)?(cisco|linksys)\.com\/jnap\/	2	0	0	1
+1940	1940	^.{1,10}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)	2	0	0	1
+1941	1941	(\%3C){1000}	2	0	0	1
+1942	1942	A{1000}	2	0	0	1
+1943	1943	id\=[^\r\n]*?(select|delete|union|update|insert)	2	0	0	1
+1944	1944	^\d{2,5}(\&|\d)	2	0	0	1
+1945	1945	^(8=|9BQQ==)\r?\n?	2	0	0	1
+1946	1946	=\s*\x25\s*\{\s*(.+?\bgetRunTime\b).+?\bexec\b	2	0	0	1
+1947	1947	^[0-9]+	2	0	0	1
+1948	1948	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\[[^\x5d]*?\W	2	0	0	1
+1949	1949	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\%5b[^\x5d]*?\W	2	0	0	1
+1950	1950	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\[[^\x5d]*?\W	2	0	0	1
+1951	1951	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\%5b[^\x5d]*?\W	2	0	0	1
+1952	1952	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\[[^\x5d]*?\W	2	0	0	1
+1953	1953	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1954	1954	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1955	1955	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1956	1956	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\[[^\x5d]*?\W	2	0	0	1
+1957	1957	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\%5b[^\x5d]*?\W	2	0	0	1
+1958	1958	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\[[^\x5d]*?\W	2	0	0	1
+1959	1959	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\%5b[^\x5d]*?\W	2	0	0	1
+1960	1960	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\[[^\x5d]*?\W	2	0	0	1
+1961	1961	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1962	1962	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1963	1963	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1964	1964	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\[[^\x5d]*?\W	2	0	0	1
+1965	1965	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\%5b[^\x5d]*?\W	2	0	0	1
+1966	1966	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\[[^\x5d]*?\W	2	0	0	1
+1967	1967	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\%5b[^\x5d]*?\W	2	0	0	1
+1968	1968	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\[[^\x5d]*?\W	2	0	0	1
+1969	1969	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1970	1970	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1971	1971	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1972	1972	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\[[^\x5d]*?\W	2	0	0	1
+1973	1973	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\%5b[^\x5d]*?\W	2	0	0	1
+1974	1974	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\[[^\x5d]*?\W	2	0	0	1
+1975	1975	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\%5b[^\x5d]*?\W	2	0	0	1
+1976	1976	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\[[^\x5d]*?\W	2	0	0	1
+1977	1977	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1978	1978	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1979	1979	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1980	1980	ping_addr=[\d.]*[^\d.]	2	0	0	1
+1981	1981	\?write_(m(ac|sn)|hdv|pid|tan)&[^&]*\x3b	2	0	0	1
+1982	1982	^User-Agent\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}	2	0	0	1
+1983	1983	^X-Forwarded-For\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}	2	0	0	1
+1984	1984	pjl\x5Fready\x5Fmessage\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+1985	1985	^[^=]{1,}$	2	0	0	1
+1986	1986	^\x22[^\x22]*\x3b[^\x22]*\x22/P	2	0	0	1
+1987	1987	^\s*[\x22\x27]	2	0	0	1
+1988	1988	\.hta([?&]|$)	2	0	0	1
+1989	1989	^[A-Za-z0-9+/]{0,4}?[^\x20-\x7e]	2	0	0	1
+1990	1990	\%(25)?temp\%	2	0	0	1
+1991	1991	^[a-zA-Z0-9]+$	2	0	0	1
+1992	1992	[^&]*(\x60|\x24)	2	0	0	1
+1993	1993	^User-Agent\x3a[^\r\n]*JDatabaseDriverMysqli/Hmi	2	0	0	1
+1994	1994	(localhost|127\.0\.0\.1)/W	2	0	0	1
+1995	1995	^[^\r\n]{128,}\r\n	2	0	0	1
+1996	1996	^[^\+]+\+0A	2	0	0	1
+1997	1997	^[^\+]+(\+[A-F0-9]{2}){4,}	2	0	0	1
+1998	1998	^.{0,100}\+0A.{0,100}\x40	2	0	0	1
+1999	1999	^[^\r\n]{50,}	2	0	0	1
+2000	2000	^\S{0,7}\/(meeting|fb\/smb|namedusers|metric)	2	0	0	1
+2001	2001	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+2002	2002	^(((:?0x[a-f0-9]{2}|0+?\d{1,3})\s*?,\s*?)*?\d{1,3})(((:?0x[a-f0-9]{2}|\d{1,3})\s*?,\s*?)*?0+?\d{1,3})(((:?0+?\d{1,3}|\d{1,3})\s*?,\s*?)*?0x[a-f0-9]{2})((:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?,\s*?)+(:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?\)	2	0	0	1
+2003	2003	^form(Ping|Tracert)$	2	0	0	1
+2004	2004	^form(Ping|Tracert)$	2	0	0	1
+2005	2005	^.{1,50}\/uapi-cgi\/	2	0	0	1
+2006	2006	^.{1,50}\/uapi-cgi\/	2	0	0	1
+2007	2007	^[^&]{150,}	2	0	0	1
+2008	2008	^[^&]{150,}	2	0	0	1
+2009	2009	\bexec\b	2	0	0	1
+2010	2010	parent=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2011	2011	oId=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2012	2012	[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2013	2013	^\s+?[^\s\>]+?\s+?SYSTEM\s	2	0	0	1
+2014	2014	^[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2015	2015	^[A-Z]{8}\x3a	2	0	0	1
+2016	2016	^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5bnull\x5d	2	0	0	1
+2017	2017	^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5b\x5d	2	0	0	1
+2018	2018	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2019	2019	^.{0,5}(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2020	2020	^\s*(<worker>[A-Za-z0-9_-]{1,20})\s*=\s*null\x3b.{1,300}(=worker)\s*=\s*document\.getElementById\([\x22\x27](=worker)[\x22\x27]\)\x3b.{1,300}\.addEventListener\([\x22\x27]DOMNodeInserted[\x22\x27]\s*,\s*(<callback0>[A-Za-z0-9_-]{1,20}).{0,300}(=worker)(<worker_ext>(\.\w{1,20})+)\s*=\s*\d+\x3b.{1,300}function\s*(=callback0)\([^\)]+\)\s*\{\s*.{1,300}\.requestAnimationFrame\((<callback>[A-Za-z0-9_-]{1,20})\)\x3b.{1,300}function\s*(<garbagecollector>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*.{0,100}for\s*\(let\s*(<gc_counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=gc_counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=gc_counter)(\+{2}|-{2})\s*\)\s*.{1,300}function\s*(=callback)\([^\)]+\)\s*\{\s*.{1,300}(=garbagecollector)\(\)\s*\x3b\s*.{1,300}\((=worker)(=worker_ext)\)	2	0	0	1
+2021	2021	^\s*(<opt>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*let\s*(<o_var>[A-Za-z0-9_-]{1,20})\s*=\s*\{\}\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=o_var)\.(<x_prop>[A-Za-z0-9_-]{1,20}).{1,300}for\s*\(\s*let\s*(<counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)(\+{2}|-{2})\).{1,100}(=opt)\(\).{1,300}let\s*(<leaked_stack_obj>[A-Za-z0-9_-]{1,20})\s*=\s*null.{1,100}let\s*(<obj_proto>[A-Za-z0-9_-]{1,20})\s*=\s*\(\{\}\)\.__proto__\x3b.{1,300}(=obj_proto)\.__defineGetter__\([\x22\x27](=x_prop)[\x22\x27],\s*Error\.prototype\.toString\)\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=obj_proto)\.__defineGetter__\([\x22\x27](<message_proto>[A-Za-z0-9_-]{1,20})[\x22\x27].{1,300}delete\s*(=obj_proto)\.(=message_proto)\x3b.{1,300}(=obj_proto)\.\w+\s*=\s*Array\.prototype.{1,300}(=opt)	2	0	0	1
+2022	2022	^\s*(<func_opt>[\w-]{1,20})\((<var_a>[\w-]{1,20})\s*,\s*(<var_b>[\w-]{1,20}).{1,300}((=var_a)\.(=var_b)|(=var_b)\.(=var_a))\s*=\s*\d+\x3b\s*((=var_a)|(=var_b))\.push\(\d+\)\x3b\s*((=var_a)\.(=var_a)|(=var_b)\.(=var_b))\s*=\s*0x.{1,300}Object\.prototype\.push\s*=\s*Array\.prototype\.push\x3b\s*for\s*\(\s*let\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\).{1,300}let\s*((=var_a)|(=var_b))\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}\x3b.{1,300}(=func_opt)\(((=var_a)|(=var_b)),\s*\{\}.{1,300}let\s*(<var_o>[\w-]{1,20})\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}.{1,300}(=func_opt)\((=var_o)	2	0	0	1
+2023	2023	^\s*(<func_a>[\w-]{1,20})\((<obj1>[\w-]{1,20})\s*,\s*(<tmp_obj>[\w-]{1,20})\s*,\s*(<value>[\w-]{1,20})\).{1,300}(=obj1)\.\w+\s*=\s*\d+\.\d+\x3b\s*var\s*\w+\s*=\s*\{__proto__:\s*(=tmp_obj)\}\x3b\s*(=obj1)\.\w+\s*=\s*(=value)\x3b.{1,300}var\s*(=obj1)\s*=\s*\{\w+:\s*\d+\.\d+\s*,\s*\w+:\s*\d+\.\d+\}\x3b\s*for\s*\(\s*var\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\)\s*\{\s*(=func_a)\((=obj1)\s*,\s*(\x22{2}|\x27{2})\s*,\s*(\x22{2}|\x27{2})\)\x3b.{1,300}(=func_a)\((=obj1)\s*,\s*(=obj1)\s*,\s*\d+\.\d{8,}.{1,300}eval\((=obj1)\.	2	0	0	1
+2024	2024	^form(RebootCheck|Wsc)$	2	0	0	1
+2025	2025	^[^&]{42,}	2	0	0	1
+2026	2026	^[^&]{512,}	2	0	0	1
+2027	2027	^Callback\x3a\x20\x3chttp[^\x3a]+\x3a\d{1,5}[^\/]/Hmi	2	0	0	1
+2028	2028	^[^&]{90,}	2	0	0	1
+2029	2029	^\d[012345]	2	0	0	1
+2030	2030	^\d[012345]	2	0	0	1
+2031	2031	^\d[012345]	2	0	0	1
+2032	2032	^\d[012345]	2	0	0	1
+2033	2033	^\d[012345]	2	0	0	1
+2034	2034	^\d[012345]	2	0	0	1
+2035	2035	^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e)	2	0	0	1
+2036	2036	^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e)	2	0	0	1
+2037	2037	^[^&\x0d\r]+[\n\x0a]	2	0	0	1
+2038	2038	^\s*(<func_a>[\w\-]{1,20})\((<obj_1>[\w\-]{1,20})\s*,\s*(<obj_2>[\w\-]{1,20}).{1,300}(=obj_1)\.(<prop_2>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,300}?(=obj_2)\.pop\(\).{1,300}?(=obj_1)\.(<prop_1>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,500}Object\.prototype\.p(op|ush)\s*=\s*Array\.prototype\.p(op|ush)\x3b.{1,500}var\s*(<obj_3>[\w\-]{1,20})\s*=\s*\{\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)?\s*,\s*((=prop_2)\s*\x3a\s*\d+(\.\d+)?|(=prop_2)\s*\x3a\s*\d+(\.\d+)?\s*,\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)).{1,500}(=func_a)\(\s*((=obj_3)\s*,\s*new\s*Object\(\)|\s*new\s*Object\(\)\s*,\s*(=obj_3)\s*).{1,500}?(=func_a)\((=obj_3)	2	0	0	1
+2039	2039	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2040	2040	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2041	2041	^[^&\r\n]+(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2042	2042	^(%[a-f0-9]{2}){5,}	2	0	0	1
+2043	2043	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2044	2044	^%(3b|0a|26|60|7C|24)	2	0	0	1
+2045	2045	^\/(icons|cgi-bin)	2	0	0	1
+2046	2046	^\/(icons|cgi-bin)	2	0	0	1
+2047	2047	^\/(icons|cgi-bin)	2	0	0	1
+2048	2048	[^\r\n]*true	2	0	0	1
+2049	2049	\x2f(FURUKAWA|APROS)\x2f	2	0	0	1
+2050	2050	[^\r\n]*(\x60|\x24|\x7c|\bsh\b)	2	0	0	1
+2051	2051	^[^\r\n=]*(union|select)	2	0	0	1
+2052	2052	^[^&=]*(union|select)	2	0	0	1
+2053	2053	^(<class>[A-Z0-9_-]{1,20})\s*.*?(<var>[A-Z0-9_-]{1,15})\s*=\s*(&amp\x3b|0x|\\x|&?h)*\d{8}\s*.*?(ReDim|Dim)\s*(=var)\(\d{4,20}\).*?set\s*(=var)\(\d+\)\s*=\s*new\s*(=class).*?Erase\s*(=var).*?Erase\s*(=var)	2	0	0	1
+2054	2054	^[^\x22]+\.jsp\x22	2	0	0	1
+2055	2055	([\x60\x3b\x7c]|%60|%3b|%7c|%26|(\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2056	2056	^[\s\x22\x27]*check_ping\b	2	0	0	1
+2057	2057	^\s*(<obj>[\w\-]{1,20})\s*=\s*document\.getElementById\(.{1,500}Class\s*(<class>[\w\-]{1,20}).{1,500}End\s*Class.{1,500}set\s*(=obj)\.scroll((Left|Top)(Max)?|Height|Width)\s*=\s*New\s*(=class)	2	0	0	1
+2058	2058	[^\r\n]*\x5c(n|c)[^\r\n]{0,100}[\x60\x24]	2	0	0	1
+2059	2059	([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2060	2060	^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2061	2061	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2062	2062	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2063	2063	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2064	2064	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2065	2065	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2066	2066	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2067	2067	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2068	2068	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2069	2069	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2070	2070	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2071	2071	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2072	2072	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2073	2073	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2074	2074	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2075	2075	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2076	2076	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2077	2077	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2078	2078	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2079	2079	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2080	2080	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2081	2081	\.((php\d{0,}|phps|pht|phtm|phtml|shtml|htaccess|phar|inc))	2	0	0	1
+2082	2082	^[^&]{100,}	2	0	0	1
+2083	2083	^[a-zA-Z0-9]+\.(zip|7z|gz)	2	0	0	1
+2084	2084	^(\x28|\x29|\x3c|\x3e|\x26|\x2a|\xe2|\x80|\x98|\x7c|\x3f|\x3b|\x5b|\x5d|\x5e|\x7e|\x21|\x2e|\xe2|\x80|\x9d|\x25|\x40|\x2f|\x5c|\x3a|\x2b|\x2c|\x60)	2	0	0	1
+2085	2085	^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr)	2	0	0	1
+2086	2086	^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr)	2	0	0	1
+2087	2087	^[0-9]{1,10}\x3b	2	0	0	1
+2088	2088	^(%2e|\.)exec	2	0	0	1
+2089	2089	^[a-zA-Z0-9]{5,40}	2	0	0	1
+2090	2090	^[a-zA-Z0-9]{7,200}	2	0	0	1
+2091	2091	^\d+..([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))-XX:OnOutOfMemoryError=	2	0	0	1
+2092	2092	^[^&=]*(union|select|update|insert|delete)	2	0	0	1
+2093	2093	^[^&=]*(union|select|update|insert|delete)	2	0	0	1
+2094	2094	((%2F|\/)(\.|%2E){2}(%2F|\/))	2	0	0	1
+2095	2095	((%2F|\/)(\.|%2E){2}(%2F|\/))	2	0	0	1
+2096	2096	^(%2E%2E%2F|\.\.\/)	2	0	0	1
+2097	2097	^[a-zA-Z0-9]{5,45}	2	0	0	1
+2098	2098	^([A-Z]\x00){20}\x00\x00	2	0	0	1
+2099	2099	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+2100	2100	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+2101	2101	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+2102	2102	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2103	2103	^SOAPAction\x3a\x20\x22?urn\x3aNETGEAR-ROUTER\x3aservice\x3a.{128,}(:\d#)/Hm	2	0	0	1
+2104	2104	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2105	2105	^[a-zA-Z0-9+/]{1000,}	2	0	0	1
+2106	2106	\We[\s\x22\x27,+]*?v[\s\x22\x27,+]*?a[\s\x22\x27,+]*?l\W	2	0	0	1
+2107	2107	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2108	2108	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2109	2109	^[^<]{30,}<\/NewMACAddress>	2	0	0	1
+2110	2110	^0+(&|$)	2	0	0	1
+2111	2111	^0+(&|$)	2	0	0	1
+2112	2112	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2113	2113	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2114	2114	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2115	2115	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2116	2116	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2117	2117	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2118	2118	^\/(icons|cgi-bin)	2	0	0	1
+2119	2119	^\/(icons|cgi-bin)	2	0	0	1
+2120	2120	^\/(icons|cgi-bin)	2	0	0	1
+2121	2121	^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2122	2122	(yJ0eXAiOiJKV1Qi|InR5cCI6IkpXVCJ)/H	2	0	0	1
+2123	2123	^(CREATE|SELECT|INSERT|UPDATE|EXEC)	2	0	0	1
+2124	2124	^["']\s*:\s*["']\s*[^0-9]+	2	0	0	1
+2125	2125	^\s?([\x3b\x0a\x26\x60\x7c\x24]|%(3b|0a|26|60|7c|24))	2	0	0	1
+2126	2126	^\s*=\s*[\x22\x27]\s*ms-msdt\x3a	2	0	0	1
+2127	2127	(\x2e|%2e)(\x2e|%2e)(\x2f|%2f)	2	0	0	1
+2128	2128	myname=[^&]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2129	2129	^\x2fdefault\x2fen_US\x2fframe(\x2eA100)?\x2ehtml\?(content|sidebar)=.*\x2e\x2e\x2f	2	0	0	1
+2130	2130	^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2131	2131	^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2132	2132	[^a-zA-Z0-9_\-\.][a-zA-Z]{8}\.jar	2	0	0	1
+2133	2133	^\s?(file|https?)\x3a	2	0	0	1
+2134	2134	^(\/?\.\.?\/){2}	2	0	0	1
+2135	2135	\b(<xps>[a-zA-Z]{7})\.classPK.+?\b(=xps)\[a-zA-Z]{12}\.classPK.+?\b(=xps)\$[a-zA-Z]{12}\.classPK	2	0	0	1
+2136	2136	^[\r\n\s\+]*.+?\}[\r\n\s]*?catch	2	0	0	1
+2137	2137	^(application\/(x-)?|text\/)xml	2	0	0	1
+2138	2138	^(application\/(x-)?|text\/)xml	2	0	0	1
+2139	2139	\/((index|toc)\.html?)?\?\/\/	2	0	0	1
+2140	2140	^.{0,10}[\x3b\x0a\x26\x60\x7c\x24]	2	0	0	1
+2141	2141	[?&]ap=	2	0	0	1
+2142	2142	^\d+\s*[^\r\n]{50,}	2	0	0	1
+2143	2143	(web|decorators|seraph-config)\x2exml$	2	0	0	1
+2144	2144	com.atlassian.jira\x2f(jira\x2dwebapp\x2ddist|atlassian\x2djira\x2dwebapp)\x2fpom\x2e(properties|xml)$	2	0	0	1
+2145	2145	^[^\x3c]{,100}\x27	2	0	0	1
+2146	2146	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+2147	2147	^(Begin|End)\=/P	2	0	0	1
+2148	2148	\/\?[a-f0-9]{64}\;\d\;\d	2	0	0	1
+2149	2149	\x7b?(visibility\x3ahidden|display\x3anone)\x3b?\x7d?\x22><div>\d{16}	2	0	0	1
+2150	2150	\/[a-z]\/[0-9a-f]{32}$	2	0	0	1
+2151	2151	\/dl\/\w{1,4}\.php\?[0-9]$	2	0	0	1
+2152	2152	\/[a-f0-9]{60,}_js\?	2	0	0	1
+2153	2153	\/[a-f0-9]{60,}_jar$	2	0	0	1
+2154	2154	\/[a-f0-9]{60,}_exe$	2	0	0	1
+2155	2155	,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,	2	0	0	1
+2156	2156	^\/showthread\.php\?t=\d+$	2	0	0	1
+2157	2157	function\x20booom[1-3]{1}\x28\x29	2	0	0	1
+2158	2158	var\x20Cute(Money|Power|Shine)	2	0	0	1
+2159	2159	iframe[^\r\n]*\x2FCUTE-IE\x2Ehtml	2	0	0	1
+2160	2160	^\/[a-z][0-9a-z_+=-]{10,30}\?\w=[0-9.]+\&\w=1.6.0_\d\d$	2	0	0	1
+2161	2161	\.php\?(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+$	2	0	0	1
+2162	2162	\/[a-z0-9]+\.[a-z0-9]{2,4}\/eH[a-z0-9]{60,}$	2	0	0	1
+2163	2163	\/[a-z0-9]+\.[a-z0-9]{2,4}\/oH[a-z0-9]{60,}$	2	0	0	1
+2164	2164	\/indigo\?\d+	2	0	0	1
+2165	2165	^\/\?[a-f0-9]{32}$	2	0	0	1
+2166	2166	=[.\"]\w{8}\.jar/Hi	2	0	0	1
+2167	2167	\.php\?showtopic=[0-9]{6}$	2	0	0	1
+2168	2168	\/[0-9]\.html$	2	0	0	1
+2169	2169	^\?[a-f0-9]{32}\" 	2	0	0	1
+2170	2170	^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$	2	0	0	1
+2171	2171	^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$	2	0	0	1
+2172	2172	^\/t\/[a-f0-9]{32}	2	0	0	1
+2173	2173	\/[A-Z]{20,}\?[A-Z]=\d$	2	0	0	1
+2174	2174	^\/q[a-zA-Z0-9+-]{3,14}\/[a-zA-Z0-9+-]{3,16}\?[a-z]{1,6}=[a-zA-Z0-9+-\._]{7,18}$	2	0	0	1
+2175	2175	^\/Applet\.jar$	2	0	0	1
+2176	2176	\/beacon\/[a-f0-9]{8}\.htm$	2	0	0	1
+2177	2177	\/t\/[a-f0-9]{32}$	2	0	0	1
+2178	2178	^\/[0-9]{3}\.jar$	2	0	0	1
+2179	2179	^[\r\n\s]*[\d\x5b]	2	0	0	1
+2180	2180	^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.jar$	2	0	0	1
+2181	2181	^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.pdf$	2	0	0	1
+2182	2182	\/[0-9]{3}\.pdf	2	0	0	1
+2183	2183	\(\x22[0-9\x3a\x3b\x3c\x3d\x3e\x3fa-k]{50,100}\x22\).{0,200}\)\x3b<\/script><\/body>	2	0	0	1
+2184	2184	^[a-f0-9]{32}	2	0	0	1
+2185	2185	^((<\/applet>).)+?\/.{1,12}\/.{1,12}\x3a.{1,12}p.{1,12}t.{1,12}t.{1,12}h	2	0	0	1
+2186	2186	^(\s*=\s*|[\x22\x27]\s*,\s*)[\x22\x27]	2	0	0	1
+2187	2187	^[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])(((=q)).)+?\.(gif|jpe?g|p(ng|sd))(=q)	2	0	0	1
+2188	2188	^((<\/applet>).)+[\r\n\s]value[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])[a-f0-9]{32}(=q1)	2	0	0	1
+2189	2189	^\/[a-z0-9A-Z]{25,35}\/(([tZFBeDauxR]+q){3}[tZFBeDauxR]+(_[tZFBeDauxR]+)?|O7dd)k(([tZFBeDauxR]+q){3}[tZFBeDauxR]+|O7dd)\/	2	0	0	1
+2190	2190	EGYPACK_CRYPT\d	2	0	0	1
+2191	2191	\/\?[0-9a-f]{60,66}\x3b(1(0[0-3]|1\d)|90)\d{1,3}\x3b\d{1,3}$	2	0	0	1
+2192	2192	^(ckwm)*?(Exp|cc)\.class	2	0	0	1
+2193	2193	^\/command\/[a-zA-Z]{6}$	2	0	0	1
+2194	2194	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+2195	2195	^(a(ttack|dEx[xp])|([a-z]))\.class	2	0	0	1
+2196	2196	^(a(ttack|dEx[xp])|([a-z]))\.class	2	0	0	1
+2197	2197	^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27]((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){10}|(=ascii){10})	2	0	0	1
+2198	2198	^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27][^\x22\x27]+?[\x22\x27][^>]*((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){9,20}|(=ascii){9,20})%3C	2	0	0	1
+2199	2199	^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$	2	0	0	1
+2200	2200	^\/[0-9]{1,2}\/red[0-9]{1,4}\.php[0-9]{0,1}$	2	0	0	1
+2201	2201	\.php\?(b=[a-fA-F0-9]{6}&)?v=1\.((4\.[0-2]\.[0-3]|5\.0\.[0-2]|6.0\.[0-4])\d?|[7-8]\.0\.\d{1,2})$	2	0	0	1
+2202	2202	&k=\d{16}(&|$)	2	0	0	1
+2203	2203	^(((?i:<\/applet>)).)+?[\r\n\s]value[\r\n\s]*[\r\n\s]*?[\x22\x27]?(\d{2,3})?(<sep>([^a-zA-Z0-9]{1,100}|[a-zA-Z0-9]{1,100}))\d{2,3}((=sep)\d{2,3}){20}	2	0	0	1
+2204	2204	^(((?i:<\/applet>)).)+?[\r\n\s]archive[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27]	2	0	0	1
+2205	2205	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+2206	2206	if.{1,10}[<>]=?\s*(<quot>[\x22\x27])1(<sep>[^0-9a-zA-Z])7((=sep)\d+)?(=quot).{1,10}[<>]=?\s*(=quot)1(=sep)7((=sep)\d+)?(=quot)	2	0	0	1
+2207	2207	^[\r\n\s]*[\r\n\s]*?[\x22\x27]http\x3a\/\/[^\/]+?\/\?[A-Za-z0-9]+=[A-Za-z0-9%]{60,}[\x22\x27]	2	0	0	1
+2208	2208	^[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\x22\x27]\.replace\([\r\n\s]*?(<q1>[\x22\x27]?)\/.+?\/g[\r\n\s]*?,[\r\n\s]*?(<q2>[\x22\x27]?)%(=q2)[\r\n\s]*?\)	2	0	0	1
+2209	2209	(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{12,16}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a)	2	0	0	1
+2210	2210	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27]	2	0	0	1
+2211	2211	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(<dot>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<p>((=dot))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<h>(((=p)|(=dot)))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=p).+?value[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(=dot)([^a-f0-9]{2}){1,20}(<e>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<x>((=e))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=e)(([^a-f0-9]{2}){1,20})?[\x22\x27]	2	0	0	1
+2212	2212	\/[a-f0-9]{32}\/[a-z]+?\-[a-z]+?\.php	2	0	0	1
+2213	2213	\.php\?e=\d+(&|$)	2	0	0	1
+2214	2214	^[\r\n\s]*?[\x22\x27][a-f0-9]{2}(<sep>[^a-f0-9]{1,10})(<a>[a-f0-9]{2})(=sep)(<p>[a-f0-9]{2})(=sep)(=p)(=sep)(<l>[a-f0-9]{2})(=sep)(<e>[a-f0-9]{2})[^\x22\x27]+?(=sep)(=p)(=sep)(=a)(=sep)[a-f0-9]{2}(=sep)(=a)(=sep)[^\x22\x27]+?(=sep)(=a)(=sep)(=l)(=sep)[a-f0-9]{2}(=sep)(=e)	2	0	0	1
+2215	2215	\/cod\/[^\x2f]+\.vbs$	2	0	0	1
+2216	2216	[a-f0-9]{32}\.jar	2	0	0	1
+2217	2217	^[^a-z0-9]	2	0	0	1
+2218	2218	\.php\?dwl=[a-z]+$	2	0	0	1
+2219	2219	^[\r\n\s]*[\r\n\s]*?[\x22\x27]h(<sep>\d{2})t(=sep)t(=sep)p(=sep)\x3a	2	0	0	1
+2220	2220	^[\r\n\s]*?[\x22\x27]<([\x27\x22]\s*?\+\s*?[\x22\x27])?a([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?l([\x27\x22]\s*?\+\s*?[\x22\x27])?e([\x27\x22]\s*?\+\s*?[\x27\x22])?t	2	0	0	1
+2221	2221	^\/ep\/cl\.php$	2	0	0	1
+2222	2222	^[\r\n\s]*?[\x22\x27]<applet	2	0	0	1
+2223	2223	=\d+&e=\d+$	2	0	0	1
+2224	2224	\/\d+\/\d\.zip$	2	0	0	1
+2225	2225	(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{10,20}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a)	2	0	0	1
+2226	2226	(<a>[0-9a-z]{2})(<s>((=a))[0-9a-z]{2})[0-9a-z]{2}(=s)[0-9a-z]{2}(<y>[0-9a-z]{2})[0-9a-z]{4}(<dot>[0-9a-z]{2})(=a)(<r>[0-9a-z]{2})(=r)(=a)(=y)(=dot)	2	0	0	1
+2227	2227	^[\r\n\s]*?\(	2	0	0	1
+2228	2228	\/[a-z0-9]{32}\.jar$	2	0	0	1
+2229	2229	^[^\s]*?\s*?\/[^\r\n\s]*?\?src=	2	0	0	1
+2230	2230	^\/([\/_]*?[a-f0-9][\/_]*?){32}\/\d+?$	2	0	0	1
+2231	2231	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?\/([\/_]*?[a-f0-9][\/_]*?){64}[\x22\x27]	2	0	0	1
+2232	2232	^\/([\/_]*?[a-f0-9][\/_]*?){32}$	2	0	0	1
+2233	2233	^\/[a-zA-Z0-9_\x2f-]{300,}\.jar$	2	0	0	1
+2234	2234	^\/[a-zA-Z0-9_\x2f-]{300,}\.eot$	2	0	0	1
+2235	2235	^((<\/applet>).)+?[\x22\x27]687474703a2f2f	2	0	0	1
+2236	2236	\.html\?sv=[1-5](\,\d+?){1,3}$	2	0	0	1
+2237	2237	\/(d|xie|fla)\.php\?[a-z]+687474703a2f2f	2	0	0	1
+2238	2238	\.html\?jar$	2	0	0	1
+2239	2239	^\/\d{4,5}\/\d{7}$	2	0	0	1
+2240	2240	\/\{0,2}[A-Za-z0-9\+\/]+?LvoDc0RHa8NnZ$	2	0	0	1
+2241	2241	^[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*?\.charCodeAt[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*[\r\n\s]*?\)[\r\n\s]*?\^[\r\n\s]*?[a-zA-Z_$][^\r\n\s]*\.charCodeAt[\r\n\s]*?\(	2	0	0	1
+2242	2242	^(<sep>[^\x22\x27]{1,10})100(=sep)97(=sep)115(=sep)104(=sep)115(=sep)116(=sep)121(=sep)108(=sep)101(=sep)46(=sep)97(=sep)114(=sep)114(=sep)97(=sep)121(=sep)	2	0	0	1
+2243	2243	^[a-z0-9]{1,500}?(<s>[a-z0-9]{2})(<t>((=s))[a-z0-9]{2})(<r>(((=s)|(=t)))[a-z0-9]{2})(=t)(<o>(((=s)|(=t)|(=r)))[a-z0-9]{2})(<b>(((=s)|(=t)|(=r)|(=o)))[a-z0-9]{2})(<y>(((=s)|(=t)|(=r)|(=o)|(=b)))[a-z0-9]{2})(=t)((((=s)|(=t)|(=r)))[a-z0-9]{4})(=s)(=t)(=r)	2	0	0	1
+2244	2244	^\/[a-z0-9]+?\?thread=\d+?&x?key=[A-F0-9]{32}$	2	0	0	1
+2245	2245	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+2246	2246	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+2247	2247	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+2248	2248	\/[A-Z]\.xml$	2	0	0	1
+2249	2249	^(<sep>((100).){1,20})100(=sep)101(=sep)102(=sep)97(=sep)117(=sep)108(=sep)116(=sep)35(=sep)86(=sep)77(=sep)76(=sep)	2	0	0	1
+2250	2250	\.php\?a=[^&]+&f=[a-f0-9]{32}&u=[^&]+$	2	0	0	1
+2251	2251	\.php\?a=(dw[a-z0-9]|[hr][2-7])$	2	0	0	1
+2252	2252	(PK\x01\x02.{24}\x0a\x00.{16}[a-z]{4}.class){4}	2	0	0	1
+2253	2253	^(((?i:<\/applet>)).)+?(?i:value)[\r\n\s]*=[\r\n\s]*\x5c?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]+(=slash)	2	0	0	1
+2254	2254	^\d+u\d+s\d+h\d	2	0	0	1
+2255	2255	^((<\/applet>).)+?&#(0*?(1([0-1]\d|2[0-2])|[78][0-9]|9[07-9]|4[8-9]|5[0-7]|6[5-9])|x0*?([46][1-9A-F]|[57][0-9A]|3[0-9]))(\x3b|&#)	2	0	0	1
+2256	2256	^\s*?\d	2	0	0	1
+2257	2257	^\s*\s*?[\x22\x27][^\x22\x27\x3d]{1,20}=[a-f0-9]{20}	2	0	0	1
+2258	2258	^[^\d]{1,20}100[^\d]{1,20}101[^\d]{1,20}102[^\d]{1,20}97[^\d]{1,20}117[^\d]{1,20}108[^\d]{1,20}116[^\d]{1,20}35[^\d]{1,20}86[^\d]{1,20}77[^\d]{1,20}76	2	0	0	1
+2259	2259	^\s*?<<\s*?\/[A-Z0-9a-z]+\([A-Z0-9a-z]+\)\s*?	2	0	0	1
+2260	2260	^\/[a-f0-9]{32}\.php\?q=[a-f0-9]{32}$	2	0	0	1
+2261	2261	\.php\?req=(swf(IE)?|x(ap|ml)|jar|mp3)&	2	0	0	1
+2262	2262	(\0[a-z]{3}\.classPK.{43}){4}	2	0	0	1
+2263	2263	^[\x22\x27]	2	0	0	1
+2264	2264	^\s*\s*?window\.document\.createElement	2	0	0	1
+2265	2265	^(<sep>[^\x22\x27]{0,10})6f(=sep)6c(=sep)6c(=sep)65(=sep)63(=sep)74(=sep)47(=sep)61(=sep)72(=sep)62(=sep)61(=sep)67(=sep)65(=sep)	2	0	0	1
+2266	2266	\/3\/[a-f0-9]{32}\/http\x3a\x2f	2	0	0	1
+2267	2267	\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+)?$	2	0	0	1
+2268	2268	^\x2Fload\x5Fmodule\x2Ephp\x3Fuser\x3D(n1|11?|2)$	2	0	0	1
+2269	2269	^\x2Fmodules\x2F(n[u3]|1|2)\x2Eswf$	2	0	0	1
+2270	2270	^\x2Fmodules\x2F(1|2)\x2Ejar$	2	0	0	1
+2271	2271	^\s*?\(\s*?[\x22\x27]Flash[\x22\x27]	2	0	0	1
+2272	2272	^\s*?[\x22\x27][A-Za-z0-9\s]{500}	2	0	0	1
+2273	2273	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}<script>var	2	0	0	1
+2274	2274	^[\r\n\s]*?<script>[\r\n\s]*?[A-Za-z]+[\r\n\s]*[\r\n\s]*?[\x22\x27][A-Za-z]{9}\x20[A-Za-z\x20]{300}	2	0	0	1
+2275	2275	^\/[a-z]\?[a-z]=[0-9]{5,}$	2	0	0	1
+2276	2276	[^0-9a-f]{1,3}68[^0-9a-f]{1,3}74[^0-9a-f]{1,3}74[^0-9a-f]{1,3}70[0-9a-f]{1,3}3a	2	0	0	1
+2277	2277	^[\x22\x27]	2	0	0	1
+2278	2278	^(e(vtmgr|ext)|actmon|nciesc|EBC32|comm|tdi)\.sys[\x22\x27]	2	0	0	1
+2279	2279	^([\x22\x27]\s*?\])?\(\s*?(\[[\x22\x27])?rc4([\x22\x27]\s*?\])?\(\s*?[\x22\x27][^\x22\x27]+?[\x22\x27]\s*?,\s*?(\[[\x22\x27])?hex2bin([\x22\x27]\s*?\])?\(	2	0	0	1
+2280	2280	^[\x22\x27]	2	0	0	1
+2281	2281	^[\x22\x27]	2	0	0	1
+2282	2282	^[\x22\x27]	2	0	0	1
+2283	2283	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\?\&]e=\d+[\x22\x27]	2	0	0	1
+2284	2284	^[\r\n\s]*?\,[\r\n\s]*?[\x22\x27][\%\\]u"	2	0	0	1
+2285	2285	^(((<\/object>).)+?codebase\s*\s*?[\x22\x27]spl[\x22\x27])(((<\/object>).)+?\/x-java-applet)	2	0	0	1
+2286	2286	^[\w.]*?\.class	2	0	0	1
+2287	2287	^\s*\s*?[\x22\x27]\-	2	0	0	1
+2288	2288	^\s*\s*?[\x22\x27]\-	2	0	0	1
+2289	2289	\/Fqxzdh\.jar$	2	0	0	1
+2290	2290	^\s*?\(\s*?[\x22\x27](AgControl\.AgControl)[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?\.[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?[\x22\x27]\s*?\.\s*?replace\s*?\(	2	0	0	1
+2291	2291	^id=[^&]+&dom=687474703a2f2f[a-f0-9]+2e706870\s*?$/Ps	2	0	0	1
+2292	2292	[^=]+(([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+?2e)+([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+\s*?/P	2	0	0	1
+2293	2293	\.php\?spl=[\w_]+$	2	0	0	1
+2294	2294	^Content-Disposition\x3a[^\r\n]+\.swf/Hm	2	0	0	1
+2295	2295	Referer\x3a[^\r\n]+\.php\/\[\[DYNAMIC\]\]\/\d/Hm	2	0	0	1
+2296	2296	^\s*?[\x3a\x3d]\s*?[\x22\x27]?\-	2	0	0	1
+2297	2297	^\/f(\/[^\x2f]+)?\/14\d{8}(\/\d{9,10})?(\/\d)+(\/x[a-f0-9]+(\x3b\d)+?)?$	2	0	0	1
+2298	2298	^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{14,}\.html(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+2299	2299	^(<sep>.{1,50})u(=sep)n(=sep)c(=sep)t(=sep)i(=sep)o(=sep)n(=sep)\s	2	0	0	1
+2300	2300	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}(\r\n)*?<script>[^\r\n]+?\We[\x22\x27\+]*?v[\x22\x27\+]*?a[\x22\x27\+]*?l\W	2	0	0	1
+2301	2301	^(<sep>.{1,20})\.___\+(=sep)\._\\\+(=sep)\._\\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+(=sep)\.\\\_\+(=sep)\.\\__\+(=sep)\.__\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.___\+(=sep)\.\\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\\_\+(=sep)\._\_\+(=sep)\.\_\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\__\+(=sep)\.\\\\+(=sep)\.\\\$_\+	2	0	0	1
+2302	2302	^\/(pruncd)?flashhigh\.swf$	2	0	0	1
+2303	2303	^\/(pruncd)?flashlow\.swf$	2	0	0	1
+2304	2304	^\/(pruncd)?silverapp1\.xap$	2	0	0	1
+2305	2305	\?action=lnd$	2	0	0	1
+2306	2306	\?action=(pld|exp)&exp=	2	0	0	1
+2307	2307	^Referer\x3a[^\r\n]+\x3a\d{1,5}\/[^\r\n]*?[a-z]+?\.php\?[a-z]+\d/Hm	2	0	0	1
+2308	2308	\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Z-a-z]{18}\.jnlp$	2	0	0	1
+2309	2309	\/k\?t[a-z]*=\d{5,}$	2	0	0	1
+2310	2310	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+2311	2311	^\/[^\x2f]*?flashhigh\.swf$	2	0	0	1
+2312	2312	^\/[^\x2f]*?flashlow\.swf$	2	0	0	1
+2313	2313	^\/[^\x2f]*?iebasic\.html$	2	0	0	1
+2314	2314	^\/[^\x2f]*?silverapp1\.xap$	2	0	0	1
+2315	2315	\/[a-z]{3,7}\.php$	2	0	0	1
+2316	2316	\/([a-z0-9]{1,7}\.php)?\?zho=	2	0	0	1
+2317	2317	^\/[a-f0-9]{32}\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Za-z]+\.(html|jar|swf)$	2	0	0	1
+2318	2318	^\/Drop2(-\d+)\.swf$	2	0	0	1
+2319	2319	^[^\r\n]*?(<name>\/[^\.\/]+\.html)\?[a-z]+?\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(\d{1,5})?\r\n	2	0	0	1
+2320	2320	^Content-Disposition\x3a[^\r\n]+\.swf/Hm	2	0	0	1
+2321	2321	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi	2	0	0	1
+2322	2322	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi	2	0	0	1
+2323	2323	^\s*?\x28\s*?[a-z0-9]{4,6}\s*?\x28\s*?[a-z0-9]{1,3}\s*?,\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x29\s*?\x3b\s*?(<var>[a-z0-9]{1,3})\s*?\x3d\s*?\x28\s*?(=var)\s*?\x2b\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x25\s*?[a-z0-9]{1,3}\.length\x3b	2	0	0	1
+2324	2324	^[A-Za-z0-9]+\x27\s*?src=\x27http\x3a[^\x27]+[\x27]\s*width=1\d\s+height=1\d\s+	2	0	0	1
+2325	2325	^Last-Modified\x3a\x20[^A-Za-z]{2}/Hm	2	0	0	1
+2326	2326	^\/ABs[A-Za-z0-9_]+(\/x?[a-f0-9]+(\x3b\d+)+)?$	2	0	0	1
+2327	2327	^\/AwoVG[A-Za-z0-9_]+$	2	0	0	1
+2328	2328	^[a-z0-9]+\x2A\x2F\x22\x6F\x66\x74\x2E	2	0	0	1
+2329	2329	^Referer\x3a[^\r\n]+?rowedmedia\.com\/search\.php\r?$/Hmi	2	0	0	1
+2330	2330	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r\n)/Hmi	2	0	0	1
+2331	2331	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+2332	2332	^[a-zA-Z0-9]{9}<\/[^>]+>\s+?<[^\s]+\sid=\x22[a-zA-Z]{3,5}\x22\sstyle=\x22display\x3anone\x22>[A-Za-z0-9]{500}	2	0	0	1
+2333	2333	^[a-z]{7}(\s*?[a-z]+\s*?)*?[a-z]{7,}\x2a\x2f	2	0	0	1
+2334	2334	nb[\d+]=Yes	2	0	0	1
+2335	2335	^(<vname>[A-Za-z0-9]+)\s*\s*?navigator.userAgent.toLowerCase\x28\x29\x3b.+?if\(document.cookie[^\r\n]+\([^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]b[\x22\x27+\s]*o[\x22\x27+\s]*t[\x22\x27+\s]*[\x22\x27][^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]s[\x22\x27+\s]*p[\x22\x27+\s]*i[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*r[\x22\x27+\s]*[\x22\x27]	2	0	0	1
+2336	2336	^Referer\x3a[^\r\n]+?\x3a\d+[^\r\n]*?\/[a-z0-9]+\.php\?[a-z0-9]+=\d+(\r\n|&)/Hm	2	0	0	1
+2337	2337	^GET \/(<name>a[a-z]{9,})\/.+?\r\nHost\x3a\x20(=name)\.	2	0	0	1
+2338	2338	^\s*?[\x22\x27][^\x22\x27]+\.php\?id=\d+[\x22\x27]	2	0	0	1
+2339	2339	^\W	2	0	0	1
+2340	2340	^[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(<arg>[a-z0-9]{3,})(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28[^\x29]+\x29\x3b\x2f\x2a[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(=arg)(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28	2	0	0	1
+2341	2341	^\s*?\d+,\s*?\d	2	0	0	1
+2342	2342	^\s*?\d+,\s*?\d	2	0	0	1
+2343	2343	\/14\d{8}(\.jar)?$	2	0	0	1
+2344	2344	^[a-z0-9]*\r\n/H	2	0	0	1
+2345	2345	^[a-z0-9]*\r\n/H	2	0	0	1
+2346	2346	filename=[a-z0-9]*\r\n/H	2	0	0	1
+2347	2347	\/\??4c2H($|[&?]utm_source=)	2	0	0	1
+2348	2348	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+2349	2349	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+2350	2350	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+2351	2351	\/([A-Za-z]{0,3}\d)(\d{0,3}[A-Za-z])[A-Za-z0-9]{4,5}\.swf$	2	0	0	1
+2352	2352	^\s*[^>]*?[a-zA-Z]+\s*\s*?[\x22\x27]([a-z]{0,20}[A-Z])([A-Z]{0,20}[a-z])[A-Za-z]{15,21}[\x22\x27][^>]*([A-Za-z_]{0,200}[0-9])([0-9a-z_]{0,200}[A-Z])([0-9A-Z_]{0,200}[a-z])[A-Za-z0-9_]{200}	2	0	0	1
+2353	2353	\/5\/[a-f0-9]{32}\/\x20*http\x3a\x2f	2	0	0	1
+2354	2354	^\x2f+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x2f\??[a-f0-9]+\x7chttp\x3a\x2f	2	0	0	1
+2355	2355	^Refresh\x3a\x20\d+\x3b\x20url[^\r\n]+\/999\/00000\/\r?$/Hm	2	0	0	1
+2356	2356	^\s*?[\x22\x27][^\x22\x27a-f0-9]68[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]70[^\x22\x27a-f0-9]3a[^\x22\x27a-f0-9]2f[^\x22\x27a-f0-9]2f[^\x22\x27]+?[^\x22\x27a-f0-9]00[\x22\x27]	2	0	0	1
+2357	2357	^\/[a-f0-9]{32}\/e\.html$	2	0	0	1
+2358	2358	Host\x3a\x20a[a-z]{10}\.[a-z]{5}\./H	2	0	0	1
+2359	2359	\.js\?ver=[0-9]\.[0-9]{2}\.[0-9]{4}$	2	0	0	1
+2360	2360	\/\d\/?[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.html&[a-z]+=[^&]+&[a-z]+=\d{3}\.\d{3}\.\d{3,}(\.\d{3,})?$	2	0	0	1
+2361	2361	\/\d\/?[A-Z]+\/[a-f0-9]{40}\/$	2	0	0	1
+2362	2362	\/([a-z0-9]{0,10}[A-Z])([A-Z0-9]{0,10}[a-z])[A-Z-a-z0-9]{5,20}\.jar$	2	0	0	1
+2363	2363	\?([a-z\d\x3d&\x2e]*?[A-Z])([A-Z\d=&\x2e]*?[a-z])([A-Za-z=&\x2e]*?\d)[A-Za-z\d=&\x2e]{50,}$	2	0	0	1
+2364	2364	^\/([a-z0-9]+\/)?[^\x2f]+\?[a-z]{1,40}_id=\d{2,5}?&[a-z]{1,40}_id=\d{2,5}&[^&\x3d]+(_id)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$	2	0	0	1
+2365	2365	&cat_no=\d{2,5}?&no=\d{2,5}&[^&\x3d]+(_no)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$	2	0	0	1
+2366	2366	\x3capplet[^\x3e]+visibility[^\x3e]+hidden[^\x3e]	2	0	0	1
+2367	2367	^\s*?[a-z]+\s*\s*?\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b]	2	0	0	1
+2368	2368	^\s*?	2	0	0	1
+2369	2369	^\/[0-9a-f]{32}\.html$	2	0	0	1
+2370	2370	^\/[a-z\_\-]{4,20}\.php\?([a-z\_\-]{4,20}=\d+?&){3,}[a-z\_\-]{4,20}=-?\d+$	2	0	0	1
+2371	2371	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{4,10}=\d{1,3}&){7,}[a-z\_\-]{4,10}=-?\d+$	2	0	0	1
+2372	2372	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d{1,3}&){3,}[a-z\_\-]{4,10}=-?\d+$	2	0	0	1
+2373	2373	\.jpg$	2	0	0	1
+2374	2374	^\s+\d+\x3b\s*\}	2	0	0	1
+2375	2375	^\/([a-z][a-z\x2f]*\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d)[a-z0-9\x2f]+\/$	2	0	0	1
+2376	2376	^\/([a-z][a-z\x2f]*-[a-z\x2f]+-)[a-z\x2f-]+\/$	2	0	0	1
+2377	2377	^http\x3a\/\/[^\x2f]+\/[A-Z]([a-z0-9]+[A-Z])([A-Z0-9]+[a-z])[A-Za-z0-9]{9,}\.html?\r?$/Hmi	2	0	0	1
+2378	2378	\.js\?chebstr=0\.\d+$	2	0	0	1
+2379	2379	\.js\?chbstr=0\.\d+$	2	0	0	1
+2380	2380	^[^\r\n\x22\?]+[&?][^=\r\n\x22]+=[a-f0-9]+[^\r\n\x22\?]*[&?][^=\r\n\x22]+=[a-f0-9]+\x22\s*\x3b\s*head\.appendChild\(\s*script\s*\)\x3b	2	0	0	1
+2381	2381	^\/([a-z\d]+[+-][a-z\d]+[+-][a-z\d]+[+-])[a-z\d+-]*\/$	2	0	0	1
+2382	2382	^\s*\(\s*[\x22\x27][\x00-\x09\x80-\xff][\x22\x27]\s*\)\s*\x3b\s*[A-Za-z0-9]+\s*=\s*[\x22\x27]	2	0	0	1
+2383	2383	^\s*\x27[^\x27]+\x27width=\x27250\x27\sheight=\x27250\x27>\s*<\/iframe>\s*<\/div>	2	0	0	1
+2384	2384	^[\x3b\x2c]postRequest\x28cfg\.urlSoftDetectorCallback	2	0	0	1
+2385	2385	^[\r\n\s]*?Base64\.decode[\r\n\s]*?\x28[\r\n\s]*?[\x22\x27]	2	0	0	1
+2386	2386	Referer\x3a\x20http\x3a\x2f\x2f[^\r\n\x2f]+\/index\.php\?[^\x3d&]+=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=)?\r\n/H	2	0	0	1
+2387	2387	^[^\n]*\x29\x3b$	2	0	0	1
+2388	2388	^\s*(<var>[^\r\n\s\x3d\x2c\x3b]+)\s*=[^\n]*<iframe([^\n>]*top\x3a-\d+px\x3b)[^\n>]+src\s*=\s*\x5c?[\x22\x27]http[^\n>]+>\s*<\/iframe>\x22\x3bdocument\.write\((=var)\)\x3b\s*$	2	0	0	1
+2389	2389	^[^\x2f\x22\x27]+\/\?[^=&\x22\x27]+=l3S	2	0	0	1
+2390	2390	^.{16}[a-z]{3}\.dll	2	0	0	1
+2391	2391	^.{16}[a-z]{4}\.dll	2	0	0	1
+2392	2392	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{7,8}\d{2,3}\.pdf\r\n/Hm	2	0	0	1
+2393	2393	\.php\?setup=d&s=\d+&r=\d+$	2	0	0	1
+2394	2394	\/\?[a-z0-9]{65,}\x3b \d\x3b \d	2	0	0	1
+2395	2395	^\/wordpress\/\?[A-Za-z0-9]{4}(&utm_source=le)?$	2	0	0	1
+2396	2396	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+2397	2397	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+2398	2398	\/\?nbVykj$	2	0	0	1
+2399	2399	^s?\x3a\x2f\x2f[^\x22\x27]+\/\?[A-Za-z0-9]{5,6}(=[^&\x22\x27]+)?[\x22\x27]\x29\x3bsetCookie\(\x22popundr\x22,1,864e5\)\}	2	0	0	1
+2400	2400	^(<var>[A-Z0-9a-z]{1,20})\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29	2	0	0	1
+2401	2401	^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.[a-z]+\?time=[^&]+&stamp=[a-z]*\d+(\.[a-z]*\d+)+$	2	0	0	1
+2402	2402	^[^\r\n]+\/%(3A|20)http%3A%2F%2F/Hmi	2	0	0	1
+2403	2403	^\/\?3b[A-Z0-9a-z]{2}(&subid=[^&]*)?$	2	0	0	1
+2404	2404	^\/[a-z]+\/$	2	0	0	1
+2405	2405	^\s*\([\x22\x27][A-F0-9a-f]{32}[\x22\x27]\s*\)\s*\x3b\s*}\s*catch\s*\(e\)\s*\{\s*\}\s*\}\s*<\/script>\s*<\/body>	2	0	0	1
+2406	2406	^([^>]*? name\s*=\s*[\x22\x27]flashvars)[^>]*? value\s*=\s*[\x22\x27]url=https?\x3a[^\x22\x27]*?\.wasm	2	0	0	1
+2407	2407	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22(\!(\x22\s*?\+\s*?\x22)?)?Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+2408	2408	^(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{2}(<J>[0-9a-z]{2})[0-9a-z]{4}(=v)[0-9a-z]{6}(=space)[0-9a-z]{2}(=space)[0-9a-z]{64}(=J)(=a)(=v)(=a)	2	0	0	1
+2409	2409	^\d{3}px\x3b\swidth\x3a3\d{2}px\x3b\sheight\x3a3\d{2}px\x3b\x22>[^<>]*?<iframe src=[\x22\x27][^\x22\x27]+[\x22\x27]\swidth=[\x22\x27]2\d{2}[\x22\x27]\sheight=[\x22\x27]2\d{2}[\x22\x27]><\/iframe>[^<>]*?\n[^<>]*?<\/span>	2	0	0	1
+2410	2410	\/[a-z]{4,20}-a\.[a-z]{4,20}\.jar$	2	0	0	1
+2411	2411	\/view.php\?i=\d&key=[0-9a-f]{32}$	2	0	0	1
+2412	2412	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.jar$	2	0	0	1
+2413	2413	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$	2	0	0	1
+2414	2414	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$	2	0	0	1
+2415	2415	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$	2	0	0	1
+2416	2416	^\/[a-z]\/f\.php\?k=\d(&e=\d&f=\d)?$	2	0	0	1
+2417	2417	^\/[a-z]+\/$	2	0	0	1
+2418	2418	\.php\?j=1&k=[0-9](i=[0-9])?$	2	0	0	1
+2419	2419	^\/[a-zA-Z]{7}\.jar$	2	0	0	1
+2420	2420	\/lpdf\.php\?i=[a-zA-Z0-9]+&?$	2	0	0	1
+2421	2421	[a-z0-9]{32}\.jar	2	0	0	1
+2422	2422	\/inf\.php\?id=[a-f0-9]{32}$	2	0	0	1
+2423	2423	^\s*=\s*[\x22\x27]	2	0	0	1
+2424	2424	\/vd\/\d+\x3b[a-f0-9]{32}	2	0	0	1
+2425	2425	\.php\?pprec$	2	0	0	1
+2426	2426	\.php\?c002$	2	0	0	1
+2427	2427	[a-f0-9]{32}\.jar	2	0	0	1
+2428	2428	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1)	2	0	0	1
+2429	2429	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1)	2	0	0	1
+2430	2430	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1)	2	0	0	1
+2431	2431	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1)	2	0	0	1
+2432	2432	[a-f0-9]{32,64}\/[a-f0-9]{32,64}/\w$	2	0	0	1
+2433	2433	\?(s|page|id)=\d+$	2	0	0	1
+2434	2434	^[\r\n\s\+]*[\r\n\s\+]*?(<func>[_a-zA-Z][a-zA-Z0-9_-]+)\([\r\n\s]*?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]*?[\x22\x27][\r\n\s]*?,[\r\n\s]*?[\x22\x27][^\x22\x27]+[\x22\x27][\r\n\s]*?\)\+(=func)	2	0	0	1
+2435	2435	\/FlashPlayer\.cpl$	2	0	0	1
+2436	2436	^((<\/applet>).)+?[\x22\x27]1337\.exe	2	0	0	1
+2437	2437	filename=[a-z]{4}\.txt\x0D\x0A/H	2	0	0	1
+2438	2438	&p=\d+\.\d+\.\d+\.\d+&j=\d+\.\d+\.\d+\.\d+&f=\d+\.\d+\.\d+\.\d+$	2	0	0	1
+2439	2439	^[\r\n\s]*[\r\n\s]*?(<q>[\x22\x27])[a-f0-9]{9,16}\.(jar|zip)(=q)	2	0	0	1
+2440	2440	^\x2Fclicker\x2Ephp$	2	0	0	1
+2441	2441	^(<var>.{1,10})\.\\_\\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\(\!\[\]\+\x22\x22\)\[(=var)\.\_\\_\]\+(=var)\.\\\$\_\+(=var)\.\_\_\+	2	0	0	1
+2442	2442	\?(s|page|id)=\d+&text=\d+$	2	0	0	1
+2443	2443	^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)j51[a-f0-9]{21}\.jar(=q)\r?$/Hm	2	0	0	1
+2444	2444	^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)e51[a-f0-9]{21}\.exe(=q)\r?$/Hm	2	0	0	1
+2445	2445	\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$	2	0	0	1
+2446	2446	\/\{0,2}[A-Za-z0-9\+\/]+?voDc0RHa8NnZ$	2	0	0	1
+2447	2447	^[^\x3b\r\n\x22\x27]+?[A-Za-z0-9\/\_\-]{60,}\.exe\?	2	0	0	1
+2448	2448	^[^\x3b\r\n\x22\x27]+?\.txt\?e=\d+(&[fh]=\d)?	2	0	0	1
+2449	2449	^[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)	2	0	0	1
+2450	2450	[a-z]	2	0	0	1
+2451	2451	\.exe\?(e=)?\d+$	2	0	0	1
+2452	2452	\/j\d{2}\.php\?i=	2	0	0	1
+2453	2453	\/\?whole=\d+$	2	0	0	1
+2454	2454	^\/search\/[0-9]{64}	2	0	0	1
+2455	2455	\/m1[1-6]\.jar$	2	0	0	1
+2456	2456	\/[0-9]{4}\.html$	2	0	0	1
+2457	2457	\/\d+\.pkg$	2	0	0	1
+2458	2458	\/j_[a-z0-9]+_(0422|1723|3544|5076)\.jar$	2	0	0	1
+2459	2459	\/[a-z0-9]{3}\.php\?[a-z]=[a-zA-Z0-9]{10}$	2	0	0	1
+2460	2460	amor\d{0,2}\.jar	2	0	0	1
+2461	2461	[a-f]	2	0	0	1
+2462	2462	=(3[0-9a]|2e)+3a313[3-9](3[0-9]){8}$	2	0	0	1
+2463	2463	(<m>[0-9a-f]{2})(<sep>[^0-9a-f])(<e>((=m))[0-9a-f]{2})(=sep)([0-9a-f]{2}(=sep)){7}(=e)(=sep)(=m)(=sep)[0-9a-f]{2}(=sep)(=e)(=sep)(<d>((=e))[0-9a-f]{2})(=sep)(=d)(=sep)(=e)(=sep)(=d)	2	0	0	1
+2464	2464	^[\r\n\s]*?\([\r\n\s]*?(<q>[\x22\x27])(<m>(((=q)).)+)(=q).+?<(=m)?a(=m)?p(=m)?p(=m)l(=m)?e(=m)?t	2	0	0	1
+2465	2465	\/[a-f0-9]{32}\/[a-f0-9]{32}\.jar$	2	0	0	1
+2466	2466	^\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$	2	0	0	1
+2467	2467	\.jar\?java=\d+$	2	0	0	1
+2468	2468	^((<\/applet>).)+?\.jar\?java=\d+	2	0	0	1
+2469	2469	^((<\/applet>).)+?[\x22\x27]aHR0cDov	2	0	0	1
+2470	2470	^[a-f0-9]{32}=\d{1,10}\r\n/H	2	0	0	1
+2471	2471	\/1[34]\d{8}\.tpl$	2	0	0	1
+2472	2472	^[\r\n\s]*?\([\r\n\s]*?[\x22\x27]f([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?m([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?C([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?h([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?a([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?c([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?d([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?e[\x22\x27]	2	0	0	1
+2473	2473	^\/\d{1,2}(<l>[A-Z])\d{1,2}(=l)\d{1,2}(=l)\d{1,2}\.pdf$	2	0	0	1
+2474	2474	\/java\.php\?eid=[a-f0-9]{32}&	2	0	0	1
+2475	2475	\/pdf\.php\?pdf=[a-f0-9]{32}&	2	0	0	1
+2476	2476	[&?]type=\d+($|&)	2	0	0	1
+2477	2477	^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{32,}\.html(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+2478	2478	^\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?m\d+([\x22\x27]\s*?,\s*[\x22\x27])?C\d+([\x22\x27]\s*?,\s*[\x22\x27])?h\d+([\x22\x27]\s*?,\s*[\x22\x27])?a\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?c\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?d\d+([\x22\x27]\s*?,\s*[\x22\x27])?e\d+[\x22\x27]	2	0	0	1
+2479	2479	\/13[89]\d{7}.swf$	2	0	0	1
+2480	2480	\/[a-z]+\.php\?[a-z]+\d{7}&[a-z]+\d{7,8}$	2	0	0	1
+2481	2481	^(<sep>[^\x22\x27]{0,10})75(=sep)6e(=sep)63(=sep)74(=sep)69(=sep)6f(=sep)6e(=sep)20	2	0	0	1
+2482	2482	^\d+?\*\/\s*?(<vname>[^\s\(\x3b]{1,20})\s*?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)\s*?(\/\*\d+?\*\/\s*?)?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)	2	0	0	1
+2483	2483	[&?]v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=	2	0	0	1
+2484	2484	\/1(3[89]\d{7}|4\d{8})\.xap$	2	0	0	1
+2485	2485	&dr=\d+$	2	0	0	1
+2486	2486	&nrk=\d+$	2	0	0	1
+2487	2487	^Content-Disposition\x3a[^\r\n]+(\W14\d{8})\.pdf\r?$/Hm	2	0	0	1
+2488	2488	^(((<\/iframe>).)+?src\s*\s*?\x22http\x3a[^\x22]+16\.html\x22)(((<\/iframe>).)+?left\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)(((<\/iframe>).)+?top\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)((<\/iframe>).)+?<\/iframe>\x27\x29	2	0	0	1
+2489	2489	^\s*?[A-Z0-9a-z\+]+?\s*?\x7d	2	0	0	1
+2490	2490	^((\/[a-z]+?)*?\/\d+\/)((\/\d+?)*?\/[a-z]+?\/)(\/([a-z]+|\d+)){4,}\/[a-z]+\.pack\.gz$	2	0	0	1
+2491	2491	^\s*?\x28\s*?(<q>[\x22\x27])(((=q)).)+?(=q)\s*?\,\s*?[\x22\x27]container[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27],\s*?[\x22\x27]9\.0\.0[\x22\x27]\s*?,\s*?false\s*?,\s*?flashvars,\s*?params\s*?,\s*?attributes\s*?\x29\s*?\x3b\s*?<\/script>\s*?<\/head>	2	0	0	1
+2492	2492	\/14\d{8}(\.swf)?$	2	0	0	1
+2493	2493	\/14\d{8}(\.pdf)?$	2	0	0	1
+2494	2494	^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.exe/Hm	2	0	0	1
+2495	2495	^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.dll/Hm	2	0	0	1
+2496	2496	\/14\d{8}(\/\d+)*?(\/x[a-f0-9]+[\x3b0-9]*)?$	2	0	0	1
+2497	2497	^\s[^\r\n]*?[\x28\x5b]\s*?[\x22\x27][^\x22\x27]?s[^\x22\x27]?u[^\x22\x27]?b[^\x22\x27]?s[^\x22\x27]?t[^\x22\x27]?r[^\x22\x27]?[\x22\x27]\s*?[\x29\x5d]\s*?(\x5d\s*?)?\x28	2	0	0	1
+2498	2498	\/video.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2499	2499	\/player.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2500	2500	\/search.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2501	2501	^\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28(=var1)\s*\!\s*=\s*[\x27\x22][\x22\x27]\s*?\x29\s*?\{\s*?(<var2>[^\s\x3d]+)\s*\s*?(=var1)\s*?\[	2	0	0	1
+2502	2502	\/1\.php\?r$	2	0	0	1
+2503	2503	^[^a-z]?\x65[^a-z]?\x6e[^a-z]?\x67[^a-z]?\x74[^a-z]?\x68	2	0	0	1
+2504	2504	^\s*?[\x22\x27](<char>[^\x22\x27]+)[\x22\x27]\.replace\x28\s*?[\x22\x27](=char)[\x22\x27]\s*?,	2	0	0	1
+2505	2505	\/banner.php\?sid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2506	2506	\/blog.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2507	2507	\/main\.html$	2	0	0	1
+2508	2508	\.php\?id=[0-9A-F]{44,54}&rnd=[0-9]{3,7}$	2	0	0	1
+2509	2509	^\/tdstest\/[a-f0-9]{32,}\/?$	2	0	0	1
+2510	2510	\/content\/dl\.php\?sl=vbs[a-z0-9]{32}$	2	0	0	1
+2511	2511	\/content\/getvbslink\.php\?d=[a-z0-9]{32}$	2	0	0	1
+2512	2512	Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H	2	0	0	1
+2513	2513	^[a-z0-9]*\r\n/H	2	0	0	1
+2514	2514	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+2515	2515	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+2516	2516	\/street[1-5]\.php$	2	0	0	1
+2517	2517	\/XV-\d+\.exe$	2	0	0	1
+2518	2518	\/bad\/[A-Z0-9]+\.swf$	2	0	0	1
+2519	2519	\/\d\/[A-Z]+\/[a-f0-9]{32}\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?$	2	0	0	1
+2520	2520	^\s*?[^\x28\s]*?\x28\s*?(<a1>[^\s,\x29]+)\s*?,\s*?(<a2>[^\s,\x29]+)\s*?\x29\{[^\r\n]*?[\+=]String.fromCharCode\((=a2)\)[^\r\n]*?\}	2	0	0	1
+2521	2521	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.jar\r\n/Hm	2	0	0	1
+2522	2522	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+2523	2523	\b[a-z]{2}\d+\s*\s*?Yes	2	0	0	1
+2524	2524	^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x20http\x3a\x2f	2	0	0	1
+2525	2525	^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?(\.[a-z]+)?$	2	0	0	1
+2526	2526	^[^\r\n]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?/H	2	0	0	1
+2527	2527	^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x3ahttp\x3a\x2f	2	0	0	1
+2528	2528	^Referer\x3a[^\r\n]+\/4\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?$/Hm	2	0	0	1
+2529	2529	^\s*\s*?[\x22\x27]8\.8\.8\.8[\x22\x27]	2	0	0	1
+2530	2530	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+2531	2531	Host\x3a\x20([\x2eg-z]*[a-f0-9][\x2eg-z]*){32}\./H	2	0	0	1
+2532	2532	\/e\.html$	2	0	0	1
+2533	2533	^(<var>[a-f0-9]{6})-->\s*?<script\s*?type=[\x22\x27]text\/javascript[\x22\x27]\s*?src=[\x22\x27]http\x3a\x2f[^\x22\x27]*?\/[a-z\d]{8}\.php\?id=\d+[\x22\x27]\s*<\/script><!--\/(=var)-->	2	0	0	1
+2534	2534	[&?]t=[a-f0-9]{32}(&|$)	2	0	0	1
+2535	2535	\/5\/[A-Z]{3,}\/[a-f0-9]{32}(\.[^\x2f]+|\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?|\/\d+\/?)?$	2	0	0	1
+2536	2536	^\s*?[_$]+\x28\x29	2	0	0	1
+2537	2537	^\s*?[_$]+\x28\x29	2	0	0	1
+2538	2538	Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)[^\r\n]*?\/search\?q=([A-Z&=\d]*?[a-z])([a-zA-Z\d&=]*?[A-Za-z=&]\d[A-Za-z])([a-zA-Z\d&=]*?[a-z\d][A-Z][A-Za-z\d])[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+[&=A-Za-z0-9]*?\r\n.*?Host\x3a\x20(=refhost)/Hsi	2	0	0	1
+2539	2539	^\s*?\w+\s*?\.\s*?charCodeAt	2	0	0	1
+2540	2540	^\/\?[a-f0-9]{32,64}$	2	0	0	1
+2541	2541	^[^>]*?id\s*[\x22\x27][a-z0-9]+[\x22\x27][^>]*\s*?[\x2a\d]{100}	2	0	0	1
+2542	2542	Referer\x3a\x20http\x3a\x2f+(<dl1>[^\x2e\r\n]+)\x2e[^\x2f\r\n]*?(<dl2>\x2e[^\x2e\r\n\x2f]+\x2e[^\x2e\x2f\r\n]+)\x2f(\??[a-f0-9]{32,64}\/?)?\r\n.*?Host\x3a\x20((=dl1))[^\r\n]*?(=dl2)\r\n/Hsm	2	0	0	1
+2543	2543	Referer\x3a\x20[^\r\n]*?\/[a-f0-9]{32,64}\.swf/H	2	0	0	1
+2544	2544	\.php\?id=[0-9A-F]{32,}&rnd=\d+$	2	0	0	1
+2545	2545	^((<\/div).)+?top\x3a\s*?\x2d[0-9]+px\x3b.+left\x3a\s*?\x2d[0-9]+px\x3b.+<iframe\x20.+?stack=\d+	2	0	0	1
+2546	2546	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)str2long(=sep)).+?(=sep)long2str(=sep)	2	0	0	1
+2547	2547	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)str2long(=sep)	2	0	0	1
+2548	2548	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)long2str(=sep)	2	0	0	1
+2549	2549	^([^>]*?\sname\s*?\x3d\s*?[\x22\x27]?movie[\x22\x27]?)[^>]*?\svalue\s*?\x3d\s*?[\x22\x27][^\x22\x27]+\/(\??[a-f0-9]+)?[\x22\x27]	2	0	0	1
+2550	2550	^Host\x3a[^\r\n]*?\.pw\r$/Hmi	2	0	0	1
+2551	2551	^Host\x3a\x20[a-z0-9]+\.(g[aq]|cf|ml|tk|xyz|info|space)(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+2552	2552	^\s*[a-z]+\s*\s*?(<q1>[\x22\x27])(((=q1)).)+?(=q1)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr\(\s*?\d+\s*?,\s*?\d+\s*?\)\s*?\x3b\s*?[a-z]+\s*\s*?(<q2>[\x22\x27])(((=q2)).)+?(=q2)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr	2	0	0	1
+2553	2553	^(<ccode>[a-f0-9]{6})-->.*?<script.+?<\/script>.*--/(=ccode)-->	2	0	0	1
+2554	2554	^\/[a-z]{2,20}\/[a-z]{2,20}\/(((featur|quot)e|ip)s|d(ropdown|etect)|co(mpiled|re)|header|jquery|lang|min|ga)\.js$	2	0	0	1
+2555	2555	^\s*?<script>\s*?([A-Za-z][A-Za-z\d+]+\s*?\+\s*([A-Za-z][A-Za-z\d]+|[\x22\x27]\\x[2-7][0-9a-fA-F](\\x[2-7][0-9a-fA-F]){0,4}[\x22\x27])\s*?\x3b){20}	2	0	0	1
+2556	2556	^\/js\/analytic\.php\?id=\d+&tz=\-?\d+&rs=\d+x\d+$	2	0	0	1
+2557	2557	^[\x22\x27](<script)[\x22\x27+\s]*<[\x22\x27+\s]*s[\x22\x27+\s]*c[\x22\x27+\s]*r[\x22\x27+\s]*i[\x22\x27+\s]*p[\x22\x27+\s]*t[^\r\n]+\.php\?id=\d+&tz=\x27\+tzSignature\x28\x29\+\x27&rs=	2	0	0	1
+2558	2558	^\/promo\d+(x\d+)?\/promo\.swf\?t=\d+$	2	0	0	1
+2559	2559	Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H	2	0	0	1
+2560	2560	^\s*\x28\s*[\x22\x27]<div\s*style\s*=\s*[\x22\x27]([^\x22\x27\r\n]*position\x3aabsolute\x3b)([^\x22\x27\r\n]*top\x3a\s\-\d+px\x3b)([^\x22\x27\r\n]*left\x3a\s0px\x3b)[^\r\n]*?<iframe[^\r\n>]*\s><\/i[\x22\x27]\+[\x22\x27]frame>[^\r\n]*<\/div>[\x22\x27]\s*\x29\x3b$	2	0	0	1
+2561	2561	^#?\d+	2	0	0	1
+2562	2562	^#?\d+	2	0	0	1
+2563	2563	^\s*var\s*(<var>[^\s=]+)\s*=\s*document.createElement\(\s*[\x22\x27]iframe[\x22\x27](.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b	2	0	0	1
+2564	2564	^\s*\([^\x29]*(\%2F|\/)(\%5B|\[)(\%5E|)([^\x29]*(%3C|\<))([^\x29]*(%3E|\>))([^\x29]*(\%5C|\\)(\%6E|n))	2	0	0	1
+2565	2565	^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27]	2	0	0	1
+2566	2566	^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Chrome_Font\.exe/Hmi	2	0	0	1
+2567	2567	^[^\x2f\x22\x27]+\/([^\x22\x27]*?[?&]oq=[A-Za-z0-9+\x2f_-]+([\x22\x27]|&))([^\x22\x27]*?[&?][a-z]+_[a-z]+=\d+)([^\x22\x27]*?[&?]q=)	2	0	0	1
+2568	2568	^\s*=\s*[\x27\x22](sh(ell(32)?)?|exec)=6wLrBej5\x2f\x2f	2	0	0	1
+2569	2569	(value=[\x22\x27](sh(ell(32)?)?|exec)=|unescape\(EscapeHexString\(.)EB02EB05E8F9FFFFFF	2	0	0	1
+2570	2570	^\s*=\s*[\x22\x27][Hh][Tt][Tt][Pp][Ss]?\x3a\x2f\x2f[^\x2f]+\x2f([^\x2f\x22\x27]+=[^\x2f\x22\x27&]{0,5}QMvXcJ)[^\x2f\x22\x27]{90}	2	0	0	1
+2571	2571	^(rocket|java)script\x22>\s*var\s*(<ifr>[^\s=]+)\s*=\s*[\x22\x27]iframe[\x22\x27].*?\s*var\s*(<var>[^\s=]+)\s*=\s*document\.createElement\(\s*(=ifr)(.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b	2	0	0	1
+2572	2572	^[a-z]\d{3}\(new Array\(	2	0	0	1
+2573	2573	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27]iddqd?\s*=	2	0	0	1
+2574	2574	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=]*\s*=EB02EB05E8F9FFFFFF	2	0	0	1
+2575	2575	^[a-zA-Z0-9]{4}NzgzNDI[a-zA-Z0-9]{8}=\x22	2	0	0	1
+2576	2576	^\d{1,2}\.php$	2	0	0	1
+2577	2577	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+2578	2578	^\/[a-z]+\/$	2	0	0	1
+2579	2579	^\/[a-z]+\/$	2	0	0	1
+2580	2580	^GET\s*?\/stat\/load((?-i)[a-z0-9]*?[A-Z])((?-i)[A-Z0-9]*?[a-z])(<hname>[a-z0-9]+)\.php\s.+?Host\x3a\x20(=hname)\.	2	0	0	1
+2581	2581	^[0-9a-fA-F]{25}$	2	0	0	1
+2582	2582	^[-_\w]+$	2	0	0	1
+2583	2583	\/[a-z]{2}[0-9]{3}[a-z]{2}\/LoginFacebook\.php$	2	0	0	1
+2584	2584	^\d+$	2	0	0	1
+2585	2585	\x2Fgetfile\x2Ephp\x3Fi\x3D[0-9]\x26key\x3D[a-f0-9]{32}$	2	0	0	1
+2586	2586	^\/[a-z]{15}[0-9]\.php$	2	0	0	1
+2587	2587	^\d$	2	0	0	1
+2588	2588	\/\?[a-f0-9]{32}=[^&]+&[a-f0-9]{32}=[^&]+$	2	0	0	1
+2589	2589	^\/\d{5}$	2	0	0	1
+2590	2590	\/[0-9]{2}\.html$	2	0	0	1
+2591	2591	\.php\?[a-z]=.{2}KAhFXlx9.{2}Oj[^&]+$	2	0	0	1
+2592	2592	\x2F[0-9]{3}\.pdf$	2	0	0	1
+2593	2593	^\d{1,2}=[a-zA-Z0-9+=]{100}	2	0	0	1
+2594	2594	^\/[a-z]\.jar$	2	0	0	1
+2595	2595	\/[a-f0-9]+\.zip$	2	0	0	1
+2596	2596	^\/\d{2,}\.[a-z0-9]+$	2	0	0	1
+2597	2597	^\/\?[a-f0-9]{32}$	2	0	0	1
+2598	2598	\/(java(db|im|rh)|silver|flash|msie)\.php\?id=	2	0	0	1
+2599	2599	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}\r\n<script>(var [a-zA-Z0-9]{1,20}\x3b){1,20}[a-zA-Z0-9]{1,20}\s*	2	0	0	1
+2600	2600	^Host\x3a\x20[^\.\r\n]+?\.[a-z]{2,4}\r\n	2	0	0	1
+2601	2601	\/\??[a-f0-9]{60,}\x3b1\d{5}\x3b\d{1,3}$	2	0	0	1
+2602	2602	\/\??[a-f0-9]{60,}\x3b5[0-1]\d{5}$	2	0	0	1
+2603	2603	^\/[^\x2f]+?\/\??[a-f0-9]{60,66}(\x3b\d+){1,4}$	2	0	0	1
+2604	2604	(\/[A-Z][a-z][A-Z][a-z][A-Z][a-z]|(b(m(nw|wn)|n(mw|wm)|w(mn|nm))|m(b(nw|wn)|n(bw|wb)|w(bn|nb))|n(b(mw|wm)|m(bw|wb)|w(bm|mb))|w(b(mn|nm)|m(bn|nb)|n(bm|mb))))\.jar$	2	0	0	1
+2605	2605	^\/index\.php\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+2606	2606	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.swf\r\n	2	0	0	1
+2607	2607	^\/\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+2608	2608	\x20filename=\r\n(\r\n)?$	2	0	0	1
+2609	2609	PK\x01\x02.{42}(<dir>[a-z]{7,}\/)([a-z]+\.class)?(\xfe\xca\x00\x00)?(PK\x01\x02.{42}(=dir)[a-z]+\.class){6,}(PK\x01\x02.{42}[0-9a-z]{5,}(\.[a-z]{3})?)K\x05\x06.{18}$	2	0	0	1
+2610	2610	^\/index\.php\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+2611	2611	\w_\.jar\?[a-f0-9]{8}$	2	0	0	1
+2612	2612	^\d+[\r\n\x2f]	2	0	0	1
+2613	2613	^\d+[\r\n\x2f]	2	0	0	1
+2614	2614	^\d+[\r\n\x2f]	2	0	0	1
+2615	2615	^\d+[\r\n\x2f]	2	0	0	1
+2616	2616	^\d+[\r\n\x2f]	2	0	0	1
+2617	2617	^\d+[\r\n\x2f]	2	0	0	1
+2618	2618	^\d+[\r\n\x2f]	2	0	0	1
+2619	2619	^\d+[\r\n\x2f]	2	0	0	1
+2620	2620	^\d+[\r\n\x2f]	2	0	0	1
+2621	2621	^\d+[\r\n\x2f]	2	0	0	1
+2622	2622	Content-Disposition\x3a[^\r\n]+\.exe-rc4\.exe\r\n	2	0	0	1
+2623	2623	^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/[a-zA-Z0-9]{12}\.php(\?[^&=]+=([a-zA-Z0-9]{8}|0(189|037)|flash|2(551|419)|6332))?$	2	0	0	1
+2624	2624	^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/test\.mp3$	2	0	0	1
+2625	2625	^\/\d{9,10}\/\d{4,5}$	2	0	0	1
+2626	2626	\/index\.html\?p=\d+$	2	0	0	1
+2627	2627	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?[a-f0-9]	2	0	0	1
+2628	2628	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a/Hmi	2	0	0	1
+2629	2629	^(<split>.{1,10})2f(=split)64(=split)69(=split)76(=split)3e(=split)?[^\x22\x27]*[\x22\x27]\.replace\s*\(\s*[\x22\x27]?\/(=split)\/g[\x22\x27]?\s*,\s*[\x22\x27]\x25[\x22\x27]\s*\x29\s*\x3b	2	0	0	1
+2630	2630	^\s*=\s*[\x22\x27]?(10|127|172\.(1[6-9]|2[0-9]|3[01])|192\.168)\.	2	0	0	1
+2631	2631	\.php\?hash=I3QxW[A-Za-z0-9\+\/]+={0,2}$	2	0	0	1
+2632	2632	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\/[a-zA-Z0-9\/\-\_]{60,}\/[a-zA-Z0-9]+\.exe\?[a-zA-Z0-9]+=[a-zA-Z0-9]+(&h=\d+)?[\x22\x27]	2	0	0	1
+2633	2633	^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27]	2	0	0	1
+2634	2634	^\s*type\s*=\s*[\x22\x27]\s*text\/javascript\s*[\x22\x27]\s*>\s+var\s*(<timestamp>[A-Za-z0-9]{1,25})\s*=\s*\(new\sDate\(\)\)\.getTime\(\)\;\s+(<url>[A-Za-z0-9]{1,25})\s*=\s*[\x22\x27]\s*[^\r\n]+\.php\?JBOSSESSION=\s*[\x22\x27]\s+(<urlvar2>[A-Za-z0-9]{1,25})\s*=\s*(=url)\s*\+\s*(=timestamp)\s+window\.location\.href\s*=\s*(=urlvar2)\s+	2	0	0	1
+2635	2635	^\s*[\x22\x27][^\r\n]+\/[a-z0-9]{20,40}\.js[\x22\x27]\s*>\s*<\/script>\s*<\/body>	2	0	0	1
+2636	2636	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+2637	2637	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+2638	2638	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+2639	2639	^http\:\/\/[^\r\n\x2f]+\/\?s=[a-f0-9]{32}[a-z]{2}$	2	0	0	1
+2640	2640	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+2641	2641	^(<vars>[a-z0-9]{1,20})\s*=\s*new\s*Array\x3b\r\n((=vars)\[\d{1,3}\]\s*=\s*\d{4,12}\x3b\r\n){5,40}	2	0	0	1
+2642	2642	^\/([\/_]*?[a-f0-9][\/_]*?){64}$	2	0	0	1
+2643	2643	src\s*=\s*https?\x3A\x2f+[^\x2f]*?((((static)?flick|blogge)r|p(hotobucket|icasa)|wordpress|tinypic)\.com|im(g(\.youtube|ur)\.com|ageshack\.us)|upload\.wikimedia\.org)[^\x2f]	2	0	0	1
+2644	2644	^[a-f0-9]{32}$	2	0	0	1
+2645	2645	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/	2	0	0	1
+2646	2646	[=\"]\w{8}\.jar	2	0	0	1
+2647	2647	^[a-z]{2}\.	2	0	0	1
+2648	2648	\/jdb\/[^\/]+\.class$	2	0	0	1
+2649	2649	\/lib\/adobe\.php\?id=[a-f0-9]{32}$	2	0	0	1
+2650	2650	\/i.php?token=[a-z0-9]+$	2	0	0	1
+2651	2651	\x2Fjerk\x2Ecgi\x3F[0-9]$	2	0	0	1
+2652	2652	^(\?[^=]{1,10}=[^&\r\n]{100,})?$	2	0	0	1
+2653	2653	\.php\?e=[^&]+?$	2	0	0	1
+2654	2654	\.txt\?e=\d+(&[fh]=\d+)?$	2	0	0	1
+2655	2655	^\x2F\x3Fwps\x3D[0-9]$	2	0	0	1
+2656	2656	^[^\r\n]+\/[A-Fa-f0-9]+\.js\?cp=	2	0	0	1
+2657	2657	^\/[a-z0-9]{1,4}\.jnlp$	2	0	0	1
+2658	2658	\.php\?id=[a-f0-9]{32}$	2	0	0	1
+2659	2659	^\/[a-f0-9]{32}\/[a-f0-9]{32}\.swf$	2	0	0	1
+2660	2660	\.php\?[^=]+=([^&]?[a-z0-9]{2}){5}&[^=]+=([^&]?[a-z0-9]{2}){10}&	2	0	0	1
+2661	2661	\/[A-F0-9]{8}\.js\?cp=	2	0	0	1
+2662	2662	^\/[a-z0-9]+[0-9][a-z0-9]+\/\?\d$	2	0	0	1
+2663	2663	\.exe(\?[a-zA-Z0-9]+=[a-zA-Z0-9]+)?&h=\d+$	2	0	0	1
+2664	2664	^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$	2	0	0	1
+2665	2665	^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$	2	0	0	1
+2666	2666	\/\d{6}\.mp3$	2	0	0	1
+2667	2667	\/14\d{8}(\.xap)?$	2	0	0	1
+2668	2668	\.swf\?myid=[a-zA-Z0-9]+$	2	0	0	1
+2669	2669	\.php\?rnd=[0-9]{3,7}&id=[0-9A-F]{44,54}$	2	0	0	1
+2670	2670	\/(Flash[23]?|Ink|New|One|HQ).exe$	2	0	0	1
+2671	2671	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.xap\r\n	2	0	0	1
+2672	2672	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?[^\r\n]*?\/(index.html)?\r\n.*?\r\nHost\x3a\x20(=refhost)[\x3a\r]	2	0	0	1
+2673	2673	\/\d{2,}\.xap$	2	0	0	1
+2674	2674	\.php\?rnd=\d+&id=[0-9A-F]{32,}$	2	0	0	1
+2675	2675	\/\?keyword=(([a-f]{0,31}[0-9])([0-9]{0,31}[a-f])[a-f0-9]{32}|\d{5})$	2	0	0	1
+2676	2676	^\/(.*?[&?][a-z]{2}_[a-z]{2}=\d+(&))(.*?[&?]q=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&))(.*?[&?]oq=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&)).*?[&?][a-z]{3}=[A-Za-z_]{3,20}([a-z\d]*\x2e)([a-z\x2e]*\d)[a-z\d\x2e]+(&|$)	2	0	0	1
+2677	2677	^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Font_Update\.exe	2	0	0	1
+2678	2678	^\s*[\x22\x27]\s*http[^\x22\x27]+\.php\s*[\x22\x27]\s*\x2c\s*[\x22\x27]\s*uylzJB3mWrFjellI9iDFGQjO	2	0	0	1
+2679	2679	=[a-f0-9]{32,}(&|$)	2	0	0	1
+2680	2680	\&e=(cve|flash)	2	0	0	1
+2681	2681	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.htm$	2	0	0	1
+2682	2682	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.swf$	2	0	0	1
+2683	2683	^(0x[a-f0-9]{1,2}, ){500}	2	0	0	1
+2684	2684	^[0-9_,{AbZwP&-]{2000}	2	0	0	1
+2685	2685	^[A-F0-9]+	2	0	0	1
+2686	2686	^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_	2	0	0	1
+2687	2687	^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_	2	0	0	1
+2688	2688	^[a-z0-9]{13}\.[a-z]{3}$	2	0	0	1
+2689	2689	^\d+$	2	0	0	1
+2690	2690	Host\x3a\x20(<refhost>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f(=refhost)(\x3a\d{1,5})?\/?	2	0	0	1
+2691	2691	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\r$|\x3a)	2	0	0	1
+2692	2692	^\/[a-z]{3,20}\.php\?sid=[A-F0-9]{40,200}$	2	0	0	1
+2693	2693	^\/[a-z]{3,20}\.php\?id=4[A-F0-9]{39,200}$	2	0	0	1
+2694	2694	^\/\?o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+$	2	0	0	1
+2695	2695	(.*?[?&]oq=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&)).*?[?&]q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$)	2	0	0	1
+2696	2696	(.*[^&]{3,4}QMvXcJ).*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&.*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$)	2	0	0	1
+2697	2697	^[HX3][^&]Q[cdM][^&]{3}[ab]R	2	0	0	1
+2698	2698	^\/\?[a-f0-9]{114}$	2	0	0	1
+2699	2699	Date\x3a\x20(<dstring>[^\r\n]+)\r\n.*?Last-Modified\x3a\x20(=dstring)\r\n	2	0	0	1
+2700	2700	^\/[a-f0-9]{16}$	2	0	0	1
+2701	2701	^GET (<uri>(\/[A-Za-z0-9]+)?\/\d+\/\d+)\sHTTP\/1\.1\r\nUser-Agent\x3a\x20http\x3a\/\/(<host>[^\r\n]+)(=uri)\r\nHost\x3a\x20(=host)\r\n(\r\n)?$	2	0	0	1
+2702	2702	^Referer\x3a[^\r\n]+?\/[a-z0-9A-Z\_\-]{26,}\.html(\x3a\d{1,5})?\r$	2	0	0	1
+2703	2703	\/3\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+|\/\d+\.\d+\.\d+\.\d+\/?)?$	2	0	0	1
+2704	2704	^\/([A-Za-z_-]*?\d)([a-z0-9_-]*?[A-Z])([A-Za-z0-9_-]{4}){15,}([[A-Za-z0-9_-]{2}\x2e?\x2e|[A-Za-z0-9_-]{3}\x2e)$	2	0	0	1
+2705	2705	^\d$	2	0	0	1
+2706	2706	^[A-F0-9]{16}\x22>	2	0	0	1
+2707	2707	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-zA-Z0-9]{16}\/[a-f0-9]{40}\/[a-zA-Z0-9]+\.jpg$	2	0	0	1
+2708	2708	^[A-F0-9]{16}(&|&amp\x3b)id=\d+(&|&amp\x3b)gid=[A-F0-9\-]+\x22>	2	0	0	1
+2709	2709	^[^>]*?\>	2	0	0	1
+2710	2710	^-?\d+=([a-zA-Z0-9]|%[A-F0-9]{2}){2}(<var1>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){6}(<var2>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){2}(=var2)([a-zA-Z0-9]|%[A-F0-9]{2}){4}(=var1)/P	2	0	0	1
+2711	2711	^\s*?[\x22\x27]([A-Z]{0,19}[a-z]{1,19}[A-Z])[a-zA-Z]{14,20}[\x22\x27][^<>]*([A-Za-z]{0,99}\d)[A-Za-z0-9\x20]{100}	2	0	0	1
+2712	2712	^\s*?(<var1>[^\x29]+)\x29[^\n]*\s*?(=var1)\s*?\x7c{2}\s*?\d+?\s*?\x2c	2	0	0	1
+2713	2713	^\s+\d{1,2}\x3b\s+else\s+(<var>[a-z]+)\s+\-=\s+\d{1,2}\x3b\s+return\s+[a-z]+\.charAt\x28(=var)\/\d{1,2}\x29\x7d	2	0	0	1
+2714	2714	^[a-z0-9_-]+\.([0-9_-]*[A-Z])[A-Z0-9_-]+\.[^\x22]+\x22\s	2	0	0	1
+2715	2715	^[a-z]{10}\.[a-z]{3}\r?$/Hm	2	0	0	1
+2716	2716	Last-Modified\x3a Mon, ((0[29]|16|23|30))\d{2} Jul 2001/H	2	0	0	1
+2717	2717	^\d+\x3b	2	0	0	1
+2718	2718	^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500}	2	0	0	1
+2719	2719	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+2720	2720	^[^\x27]+[\x27]\s*	2	0	0	1
+2721	2721	^\d+\x3b	2	0	0	1
+2722	2722	^([A-Z0-9]*?[a-z])([a-z0-9]*?[A-Z])[A-Za-z0-9]+\x2a\x2f[^\n]*?Function\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28\s*?(=var1)\s*[=!]{2}\s*?[\x27\x22][\x22\x27]\s*?\x29\s*?\{	2	0	0	1
+2723	2723	^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500}	2	0	0	1
+2724	2724	^\s*\x27[^\x27\x3b\r\n]+\x27width=\x27250\x27\sheight=\x27250\x27\>	2	0	0	1
+2725	2725	^[^A-Za-z0-9]	2	0	0	1
+2726	2726	^http\x3a\x2f[^\x27]+[\x27](\swidth=\d{1,2}\sheight=\d{1,2}\s|\sheight=\d{1,2}\swidth=\d{1,2}\s)	2	0	0	1
+2727	2727	^\s*\(\s*[\x22\x27]id[\x22\x27]\s*,\s*?(<var>[^,\x29\s\x3b]+)\s*\x29.*?\.appendChild\s*\(\s*(=var)	2	0	0	1
+2728	2728	^[^<]+\x0d\x0a<\/script>	2	0	0	1
+2729	2729	\?src=[a-z]+snet$	2	0	0	1
+2730	2730	^[0-9a-f]{6}	2	0	0	1
+2731	2731	^(\x20id=\x22\d+\x22)?\x20style=\x22([^\x22\r\n]*top\x3a\x20-\d{3}px\x3b)([^\x22\r\n]*left\x3a-\d{3}px\x3b)([^\x22\r\n]*position\x3a\x20absolute\x3b)[^\x22\r\n]*\x22>\x20<iframe[^\r\n>]*><\x2f	2	0	0	1
+2732	2732	^(\s+style=\x27hidden\x27)?\s+src=\x27https?\x3a[^>\x22\x27]+[\x22\x27]\s*width=\x270\x27\s+	2	0	0	1
+2733	2733	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+2734	2734	^[^\d](.{0,20}[^\d])?100[^\d](.{0,20}[^\d])?101[^\d](.{0,20}[^\d])?102[^\d](.{0,20}[^\d])?97[^\d](.{0,20}[^\d])?117[^\d](.{1,20}[^\d])?108[^\d](.{0,20}[^\d])?116[^\d](.{0,20}[^\d])?35[^\d]([^\d].{0,20}[^\d])?86[^\d](.{0,20}[^\d])?77[^\d](.{0,20}[^\d])?76[^\d]	2	0	0	1
+2735	2735	^(<sep>((\.\\_\\+).){1,10})\.\\_\\+(=sep)\.___\+(=sep)\.\\\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\_\\_\+(=sep)\.\_\\\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\\+(=sep)\.\_\_\$	2	0	0	1
+2736	2736	^[\r\n\s]*[\r\n\s]*?(-[\r\n\s]*?\d|0[\r\n\s]*?-)	2	0	0	1
+2737	2737	SELECT.+FROM	2	0	0	1
+2738	2738	DELETE.+FROM	2	0	0	1
+2739	2739	INSERT.+INTO	2	0	0	1
+2740	2740	UPDATE.+SET	2	0	0	1
+2741	2741	UNION.+SELECT	2	0	0	1
+2742	2742	INTO.+OUTFILE	2	0	0	1
+2743	2743	^SITE\s+EXEC\s[^\n]*?%[^\n]*?%	2	0	0	1
+2744	2744	^PASS\s[^\n]{100}	2	0	0	1
+2745	2745	^MKD\s[^\n]{100}	2	0	0	1
+2746	2746	^REST\s[^\n]{100}	2	0	0	1
+2747	2747	^DELE\s[^\n]{100}	2	0	0	1
+2748	2748	^RMD\s[^\n]{100}	2	0	0	1
+2749	2749	^RMDIR\s[^\n]{100}	2	0	0	1
+2750	2750	^SITE\s+NEWER\s[^\n]{100}	2	0	0	1
+2751	2751	^SITE\s+ZIPCHK\s[^\n]{100}	2	0	0	1
+2752	2752	^USER\s+w0rm	2	0	0	1
+2753	2753	^ALLO\s[^\n]{100}	2	0	0	1
+2754	2754	^CEL\s[^\n]{100}	2	0	0	1
+2755	2755	^CMD\s[^\n]{100}	2	0	0	1
+2756	2756	^CWD\s[^\n]{100}	2	0	0	1
+2757	2757	^SITE\s+CPWD\s[^\n]{100}	2	0	0	1
+2758	2758	^SITE\s+NEWER	2	0	0	1
+2759	2759	^STAT\s+[^\n]*\x3f	2	0	0	1
+2760	2760	^APPE\s[^\n]{100}	2	0	0	1
+2761	2761	^CWD\s+~	2	0	0	1
+2762	2762	^MODE\s+[^ABSC]{1}	2	0	0	1
+2763	2763	^SITE\s[^\n]{100}	2	0	0	1
+2764	2764	^SITE\s+CHOWN\s[^\n]{100}	2	0	0	1
+2765	2765	^SITE\s+EXEC	2	0	0	1
+2766	2766	^XCWD\s[^\n]{100}	2	0	0	1
+2767	2767	^STOR\s[^\n]{100}	2	0	0	1
+2768	2768	^SITE\s+CHMOD\s[^\n]{100}	2	0	0	1
+2769	2769	^LIST\s[^\n]{100,}	2	0	0	1
+2770	2770	^RENAME\s[^\n]*?%[^\n]*?%	2	0	0	1
+2771	2771	^MKDIR\s[^\n]*?%[^\n]*?%	2	0	0	1
+2772	2772	^PASS\s[^\n]*?%[^\n]*?%	2	0	0	1
+2773	2773	^USER\s[^\n]*?%[^\n]*?%	2	0	0	1
+2774	2774	^MDTM\s[^\n]{100}	2	0	0	1
+2775	2775	^RETR\s[^\n]*?%[^\n]*?%	2	0	0	1
+2776	2776	^CWD\s[^\n]*?\.\.\.	2	0	0	1
+2777	2777	^CWD\s+~root	2	0	0	1
+2778	2778	^NLST\s[^\n]{100}	2	0	0	1
+2779	2779	^PORT	2	0	0	1
+2780	2780	REST\s+[0-9]+\n	2	0	0	1
+2781	2781	^RETR\s[^\n]{100}	2	0	0	1
+2782	2782	^RNFR\s[^\n]{100}	2	0	0	1
+2783	2783	^RNTO\s[^\n]{100}	2	0	0	1
+2784	2784	^STAT\s[^\n]{100}	2	0	0	1
+2785	2785	^STOU\s[^\n]{100}	2	0	0	1
+2786	2786	^XMKD\s[^\n]{100}	2	0	0	1
+2787	2787	\s+.*?%.*?%	2	0	0	1
+2788	2788	^530\s+(Login|User)	2	0	0	1
+2789	2789	^PASS\s*\n	2	0	0	1
+2790	2790	^LIST\s+\x22-W\s+\d	2	0	0	1
+2791	2791	^USER\x20[^\x00\x20\x0a\x0d]{100}	2	0	0	1
+2792	2792	^STAT\s+[^\n]*\x2a	2	0	0	1
+2793	2793	^MDTM \d+[-+]\D	2	0	0	1
+2794	2794	^[^\r\n]+\.jar	2	0	0	1
+2795	2795	^\d\.\d(_\d+)?\@\r\n	2	0	0	1
+2796	2796	\x5csecure\x5c[^\x00]{50}	2	0	0	1
+2797	2797	\x5C[^\x5C\x00]{257}	2	0	0	1
+2798	2798	^\s*=\s*.*?\.([abcdehijlmnoprsvwx])(a(d[ep]|s[x])|c(rt|[ho]m|li|pl|md|pp)|d(iz|ll)|e(m[fl]|xe|bs)|h(lp|sq|ta)|jse?|m(d[abzew]|s[tcgip]|htm|ht)|p(cd|if|l[xsc]|[lm]|ot)|r(eg|ar)|s(cr|ct|[hy]s|wf)|v(b[es]?|xd)|w(m[dfsz]|p[msz]|s[cfh])|xl[tw]|folder|fol|ba[st]|i(sp|n[sif])|lnk|nws|ocx|zip|url)[\x27\x22\n\r\s]	2	0	0	1
+2799	2799	(a|#61)(p|#70)(p|#70)(l|#6C)(i|#69)(c|#63)(a|#61)(t|#74)(i|#69)(o|#6F)(n|#6E)(\x2F|#2F)x-shockwave-flash	2	0	0	1
+2800	2800	^[^\r\n]*[\[\|\{][A-Z]{3}[\]\|\}]	2	0	0	1
+2801	2801	^[^\r\n]*win	2	0	0	1
+2802	2802	^[^\r\n]*-PC	2	0	0	1
+2803	2803	^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl)	2	0	0	1
+2804	2804	^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl)	2	0	0	1
+2805	2805	^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb)	2	0	0	1
+2806	2806	^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb)	2	0	0	1
+2807	2807	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3)	2	0	0	1
+2808	2808	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3)	2	0	0	1
+2809	2809	User-Agent\x3a.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi	2	0	0	1
+2810	2810	User-Agent\:.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi	2	0	0	1
+2811	2811	^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}B[\x0d\x0a]{0,2}0[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}t[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}u[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}3[\x0d\x0a]{0,2}M[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}x[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}T[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}q[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}N[\x0d\x0a]{0,2}0	2	0	0	1
+2812	2812	^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}Q[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}1[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}5[\x0d\x0a]{0,2}n[\x0d\x0a]{0,2}c[\x0d\x0a]{0,2}y[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}P[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}3	2	0	0	1
+2813	2813	^[A-Za-z0-9\/\+\x0D\x0A]+?B[\x0d\x0a]{0,2}w[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}C[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}z[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}s[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}U[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}j[\x0d\x0a]{0,2}d	2	0	0	1
+2814	2814	\d*?\.bin	2	0	0	1
+2815	2815	^[^\r\n]*(W(in(dows)?)?[^a-z0-9]?(XP|[7-8])|Vista)	2	0	0	1
+2816	2816	^\d+/V	2	0	0	1
+2817	2817	^\s*,\s*[a-zA-Z]\x3a[\x2f\x5c]	2	0	0	1
+2818	2818	^((PK).)*?\x50\x4b\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00	2	0	0	1
+2819	2819	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+2820	2820	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+2821	2821	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+2822	2822	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+2823	2823	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+2824	2824	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+2825	2825	\bshell\b	2	0	0	1
+2826	2826	\benable\b	2	0	0	1
+2827	2827	^[^\r\n]+\.(t(ar|gz)|exe|zip)	2	0	0	1
+2828	2828	^([\x7f-\xff]){100}/Hi	2	0	0	1
+2829	2829	^((<\/script>).)*?src\s*=\s*\x5c?[\x22\x27]https?\x3a\/\/(www\.)?pastebin\.com\/raw(\/|\.php\?i=)[A-Z-a-z0-9]{8}[\x22\x27]	2	0	0	1
+2830	2830	^.{42}[\x20-\x7f]{1,500}\.jsPK\x05\x06.{4}\x01\x00\x01\x00	2	0	0	1
+2831	2831	\/[0-9]{1,2}\.dat$	2	0	0	1
+2832	2832	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+2833	2833	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+2834	2834	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+2835	2835	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+2836	2836	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+2837	2837	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+2838	2838	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+2839	2839	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+2840	2840	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+2841	2841	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+2842	2842	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+2843	2843	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+2844	2844	Content-Disposition\x3a[^\r\n]*?\.xla[\s\x22\x27]	2	0	0	1
+2845	2845	\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)(\x3a\d{1,5})?$	2	0	0	1
+2846	2846	^[\d\s]	2	0	0	1
+2847	2847	^USER [^\r\n]*?\x22	2	0	0	1
+2848	2848	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+2849	2849	^(\x3a\d{1,5})?$	2	0	0	1
+2850	2850	\.(gif|jpe?g|png)$	2	0	0	1
+2851	2851	^((jp|pn)g|bmp)	2	0	0	1
+2852	2852	^(logins|c(cdata|ookie))	2	0	0	1
+2853	2853	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+2854	2854	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+2855	2855	\/winhost(32|64)\.(exe|pack)$	2	0	0	1
+2856	2856	\/pony\.(exe|pack)$	2	0	0	1
+2857	2857	^[^>]+url=sms\x3a	2	0	0	1
+2858	2858	\/[^\x2f]+\.[^\x2f]+\.wsf$	2	0	0	1
+2859	2859	^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4})	2	0	0	1
+2860	2860	^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4})	2	0	0	1
+2861	2861	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+2862	2862	^[^\r\n]+\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)	2	0	0	1
+2863	2863	^((jp|pn)g|bmp)	2	0	0	1
+2864	2864	^(logins|c(cdata|ookie))	2	0	0	1
+2865	2865	^(m(ultipart|essage|odel)|a(pplication|udio|ccept)|(exampl|imag)e|video|text|\*)	2	0	0	1
+2866	2866	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+2867	2867	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+2868	2868	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+2869	2869	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+2870	2870	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+2871	2871	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+2872	2872	^[a-f0-9]{8,}\.duckdns\.org$	2	0	0	1
+2873	2873	^[^\x3b\x2f\x28]+$	2	0	0	1
+2874	2874	^[^\r\n]{100,}	2	0	0	1
+2875	2875	^[^\r\n]{100,}	2	0	0	1
+2876	2876	^[^\r\n]{100,}	2	0	0	1
+2877	2877	^[^\r\n]{100,}	2	0	0	1
+2878	2878	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+2879	2879	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2880	2880	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2881	2881	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2882	2882	[a-z]{8}.[a-z]{3}	2	0	0	1
+2883	2883	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.zip$	2	0	0	1
+2884	2884	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.vbs$	2	0	0	1
+2885	2885	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.pif$	2	0	0	1
+2886	2886	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.exe$	2	0	0	1
+2887	2887	CN=ssl\d{1,2}.ovh.net($|,)	2	0	0	1
+2888	2888	(\.[a-z]{2}|$)	2	0	0	1
+2889	2889	[a-f0-9]{32}$	2	0	0	1
+2890	2890	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P	2	0	0	1
+2891	2891	^(\x3b|\r\n)	2	0	0	1
+2892	2892	CN=([^\r\n]+?\.)?\.gov\.procurement\.(\.)	2	0	0	1
+2893	2893	^[a-f0-9]+	2	0	0	1
+2894	2894	^[a-f0-9]+	2	0	0	1
+2895	2895	^[a-f0-9]+	2	0	0	1
+2896	2896	^Agent\d{5,6}$	2	0	0	1
+2897	2897	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2898	2898	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2899	2899	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2900	2900	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2901	2901	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2902	2902	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2903	2903	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2904	2904	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2905	2905	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2906	2906	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2907	2907	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2908	2908	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2909	2909	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2910	2910	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2911	2911	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2912	2912	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2913	2913	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2914	2914	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2915	2915	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2916	2916	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2917	2917	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2918	2918	.*[^A-Za-z0-9]edu\.rf\.gd$	2	0	0	1
+2919	2919	\x2edoc[xm]?$	2	0	0	1
+2920	2920	\x2exls[xm]?$	2	0	0	1
+2921	2921	\/\d+$	2	0	0	1
+2922	2922	function(\s_0x[0-9a-f]{4})?\(_0x[0-9a-f]{6},_0x[0-9a-f]{6}\){var _0x[0-9a-f]{6}=/Qi	2	0	0	1
+2923	2923	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2924	2924	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2925	2925	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2926	2926	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2927	2927	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2928	2928	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2929	2929	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2930	2930	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2931	2931	\sLOGIN\s[^\n]*?\s\{	2	0	0	1
+2932	2932	\sLSUB\s[^\n]*?\s\{	2	0	0	1
+2933	2933	\sRENAME\s[^\n]{100}	2	0	0	1
+2934	2934	\sFIND\s[^\n]{100}	2	0	0	1
+2935	2935	\sFETCH\s[^\n]{500}	2	0	0	1
+2936	2936	\sLOGIN\s[^\n]{100}	2	0	0	1
+2937	2937	\sAUTHENTICATE\s[^\n]{100}	2	0	0	1
+2938	2938	\sLIST\s[^\n]*?\s\{	2	0	0	1
+2939	2939	\sPARTIAL.*BODY\[[^\]]{1024}	2	0	0	1
+2940	2940	AUTH\s[^\n]{100}	2	0	0	1
+2941	2941	\sCREATE\s*\{	2	0	0	1
+2942	2942	\sRENAME\s[^\n]*?\s\{	2	0	0	1
+2943	2943	\sLIST\s[^\n]{100}	2	0	0	1
+2944	2944	\sCREATE\s[^\n]{1024}	2	0	0	1
+2945	2945	\sLSUB\s[^\n]{100}	2	0	0	1
+2946	2946	\sAUTHENTICATE\s[^\n]*?\{	2	0	0	1
+2947	2947	\sPARTIAL.*BODY\.PEEK\[[^\]]{1024}	2	0	0	1
+2948	2948	\sUNSUBSCRIBE\s[^\n]{100}	2	0	0	1
+2949	2949	\sUNSUBSCRIBE\s[^\n]*?\s\{	2	0	0	1
+2950	2950	\sSUBSCRIBE\s[^\n]{100}	2	0	0	1
+2951	2951	\sSUBSCRIBE\s[^\n]*?\s\{	2	0	0	1
+2952	2952	\sSTATUS\s[^\n]{100}	2	0	0	1
+2953	2953	\sSTATUS\s[^\n]*?\s\{	2	0	0	1
+2954	2954	\sFETCH\s[^\n]*?\s\{	2	0	0	1
+2955	2955	\sEXAMINE\s[^\n]{100}	2	0	0	1
+2956	2956	\sEXAMINE\s[^\n]*?\s\{	2	0	0	1
+2957	2957	\sAPPEND\s[^\n]{256}	2	0	0	1
+2958	2958	\sCOPY\s[^\n]*?\{	2	0	0	1
+2959	2959	\sDELETE\s[^\n]*?\{	2	0	0	1
+2960	2960	\sDELETE\s[^\n]{100}	2	0	0	1
+2961	2961	\sLOGIN\s\w+\s\{\d+\}[\r]?\n[^\n]*?%	2	0	0	1
+2962	2962	 (FREE XXX|dildo|masturbat|oral sex|ejaculat|up skirt|tits|bondage|lolita|clitoris|cock suck|hardcore (teen|anal|sex|porn)|raw sex|((fuck|sex|porn|xxx) (movies|dvd))|((naked|nude) (celeb|lesbian)))\b	2	0	0	1
+2963	2963	^RETR\s+[^\r\n]+?\x2eexe\r?$	2	0	0	1
+2964	2964	\<xdp\x3axdp(\s+[^\>]*)?\>((\<\/xdp[^\>]*\>).)*?\<pdf	2	0	0	1
+2965	2965	SELECT @@version_compile_os\s*?\x3b	2	0	0	1
+2966	2966	^Server\x3a[^\r\n]*Portable SDK for UPnP devices(\/?\s*$|\/1\.([0-5]\..|8\.0.|(6\.[0-9]|6\.1[0-7])))	2	0	0	1
+2967	2967	^Server\x3a[^\r\n]*Intel SDK for UPnP devices	2	0	0	1
+2968	2968	^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27]	2	0	0	1
+2969	2969	^[8-9]\.0	2	0	0	1
+2970	2970	^(<global_var>(((\]\,__\\x3a\+\+)).)+)]\,__\$\x3a\+\+(=global_var)	2	0	0	1
+2971	2971	^Host\x3a\x20[^\r\n]+\.((b(bsindex|0ne)|chatnook|gotgeeks|3d-game|4irc)\.com|s((cieron|uroot)\.com|lyip\.(com|net))|d(arktech\.org|eaftone\.com|tdns\.net)|e(towns\.(net|org)|ffers\.com)|flnet\.org)(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+2972	2972	^Host\x3a\x20[^\r\n]+\.cd\.am(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+2973	2973	^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}[^\r\n]*\x3C\x2Fiframe\x3E	2	0	0	1
+2974	2974	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2975	2975	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2976	2976	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2977	2977	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2978	2978	^(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?m(\x22\s*?\+\s*?\x22)?C(\x22\s*?\+\s*?\x22)?h(\x22\s*?\+\s*?\x22)?a(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?c(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?d(\x22\s*?\+\s*?\x22)?e	2	0	0	1
+2979	2979	^(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?m(\x27\s*?\+\s*?\x27)?C(\x27\s*?\+\s*?\x27)?h(\x27\s*?\+\s*?\x27)?a(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?c(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?d(\x27\s*?\+\s*?\x27)?e	2	0	0	1
+2980	2980	for\x28[^\x3D\r\n]*[0-9]{1,6}\x2D[0-9]{1,5}\x3B[^\x3D\r\n]\x3E\x3D0\x3B[^\x29\r\n]\x2D\x2D\x29	2	0	0	1
+2981	2981	^User-Agent\x3a[^\r\n]*?Googlebot/Hmi	2	0	0	1
+2982	2982	^\s*?\([^\)]*?(<var>[^\.]+)\s*?\.\s*?length\s*<\s*(0?[0-9]{5,}|0x[a-z0-9]{3,})[^)]+\)\s*?\{\s*?(=var)\s*\s*?(=var)\s*?\+\s*?(=var)\s*?\}	2	0	0	1
+2983	2983	^(nc)?\s*([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=)	2	0	0	1
+2984	2984	\x00[0-9]{4,7}\x02in\x00	2	0	0	1
+2985	2985	^Server\x3a[^\r\n]*miniupnpd\/1\.[0-3]	2	0	0	1
+2986	2986	^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27]	2	0	0	1
+2987	2987	^\s+?(<vname>[^\s\x3d]+)\s*\s*?(0x((6[4-9a-f]|[7-9a-f])|\d{3,})|\d{3,}).+?[\s\x3b]for\s*?\([^\x3b\)]*?\x3b[^\x3b\)]+?\s*?(=vname)[^\)]+?\)\s*?(\{[^}]*?|[^\r\n]*?)document\s*\.\s*createElement	2	0	0	1
+2988	2988	^((<\/title).)*\x26\x23x1F512	2	0	0	1
+2989	2989	^\/tmp\/.+\.exe$	2	0	0	1
+2990	2990	^(&).	2	0	0	1
+2991	2991	((\?|&))pasa=(&).	2	0	0	1
+2992	2992	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp)\.com|m(inecraft\.net|p3\.com)|b(eer\.com|log\.net))|curity(exploit|tactic)s\.com)|tufftoread\.com|ytes\.net)|m(y(((dissen|effec)t|mediapc|psx)\.net|securitycamera\.(com|net|org)|(activedirectory|vnc)\.com|ftp\.(biz|org))|lbfan\.org|mafan\.biz)|d((itchyourip|amnserver|ynns)\.com|dns(\.(net|me)|king\.com)|ns(iskinky\.com|for\.me)|vrcam\.info)|n(o(-ip\.(c(o\.uk|a)|info|biz|net|org)|ip\.(me|us))|et-freaks\.com|flfan\.org|hlfan\.net)|h(o(mesecurity(ma|p)c\.com|pto\.(org|me))|ealth-carereform\.com)|p((rivatizehealthinsurance|gafan)\.net|oint(2this\.com|to\.us))|c((o(uchpotatofries|llegefan)|able-modem)\.org|iscofreak\.com)|g(o(lffan\.us|tdns\.ch)|eekgalaxy\.com)|b(logsyte\.com|ounceme\.net|rasilia\.me)|re(ad-books\.org|directme\.net)|u(nusualperson\.com|fcfan\.org)|w(orkisboring\.com|ebhop\.me)|(3utiliti|quicksyt)es\.com|eating-organic\.net|ilovecollege\.info|fantasyleague\.cc|loginto\.me|zapto\.org)(\x3a\d{1,5})?$	2	0	0	1
+2993	2993	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+2994	2994	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+2995	2995	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+2996	2996	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+2997	2997	^(\d{1,3}\.){3}\d{1,3}(\x3a\d+)?$	2	0	0	1
+2998	2998	\.jpg(\?\d+)?$	2	0	0	1
+2999	2999	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3000	3000	^[^0-9]	2	0	0	1
\ No newline at end of file
diff --git a/test/benchmark/regex_rules/REGEX_500 b/test/benchmark/regex_rules/REGEX_500
new file mode 100644
index 0000000..b3a566d
--- /dev/null
+++ b/test/benchmark/regex_rules/REGEX_500
@@ -0,0 +1,501 @@
+500
+1	1	User-Agent:\s.*.abc.net	2	0	0	1
+2	2	(#\d{1,2}){20}	2	0	0	1
+3	3	(((DestFile|encryptPass)\x3D[^\x26]{50})|((BaseDN|SearchFilter)\x3D[^\x26]{128}))	2	0	0	1
+4	4	(((c|l)pi\x00.{1}(-\d|0)\x21)|(columns\x00.{1}(-\d|0)\x21)|(page-(right|left|top|bottom)\x00.{1}(-\d|0|([3-9]\d{5}|24\d{4}|236\d{3}|23593\d{1}|23592[2-9])\x21)))	2	0	0	1
+5	5	(,\d{1,3}){20}	2	0	0	1
+6	6	(3BFFE033-BF43-11d5-A271-00A024A51325|iNotes6\.iNotes6|E008A543-CEFB-4559-912F-C27C2B89F13B|dwa7\.dwa7)	2	0	0	1
+7	7	(?P<obj>[A-Z\d_]+)\.DataURL\s*=\s*(\x22[^\x22]{128}|\x27[^\x27]{128})	2	0	0	1
+8	8	(Context|Action)\x3D[^\x26\x3b]{1024}	2	0	0	1
+9	9	(DisableSandboxAndDrop|ConfusedClass|FieldAccessVerifierExpl)\.class	2	0	0	1
+10	10	(INSERT|UPDATE)\s*[\s\w]*((mysql\.)?func)[^\r\n]+values\s*\([^\)]+\x2c[\x22\x27][^\x22\x27]*\x2f	2	0	0	1
+11	11	(Image|Doc)	2	0	0	1
+12	12	(OvAcceptLang|Accept-Language)\s*[\x3D\x3A]\s*[^\n]{69}	2	0	0	1
+13	13	(OvJavaScript|OvTitleFrame|OvHelpWindow|OvMap|OvSession|OvJavaLocale|OvOSLocale|OvWebSession)\s*\x3D[^\x3B\x2C]{1024}	2	0	0	1
+14	14	(Set|Check)\x10Properties	2	0	0	1
+15	15	(USER|PASS)[^\x80-\xff]*[\x80-\xff]	2	0	0	1
+16	16	([sp]key|csk)=[^\r\n\x26]+(script|onclick|onload|onmouseover|html|[\x22\x27\x3c\x3e\x28\x29])	2	0	0	1
+17	17	(\x22|\x27)daap\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+18	18	(\x22|\x27)itms\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+19	19	(\x22|\x27)itmss\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+20	20	(\x22|\x27)itpc\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+21	21	(\x22|\x27)pcast\x3a\x2f\x2f[^\x22\x27]*\x3a[^\x22\x27\x2f]{256}	2	0	0	1
+22	22	(\x25(n|t|d)\x20){85}	2	0	0	1
+23	23	(\x3F|\x26)[^\x3D]*(\x27|%27)[^\x3D]*(\x3C|%3c)script(\x3E|%3e)	2	0	0	1
+24	24	(\x40\x09.{19}|\x41\x0b.{23})[\xf0-\xff].{8}\x01\x00[\x00\x01\x02\x04\x08\x10\x18\x20]\x00	2	0	0	1
+25	25	(^|&)SelectedID=[^&]+?(\x3B|%3B)	2	0	0	1
+26	26	(^|&)paths(%5b|\x5b)(%5d|\x5d)=[^&]*?(%2e|\x2e){2}(%2f|\x2f)	2	0	0	1
+27	27	(^|&)selectedLocale=[^&]+?([\x22\x27]|%22|%27)	2	0	0	1
+28	28	(^|[\x3b\x7b\x7d]|%3b|%7b|%7d)O(%3a|\x3a)(\x2b|%2b)?[0-9]+?(%3a|\x3a)(%22|\x22)	2	0	0	1
+29	29	(action|setup)=[a-z]{1,4}	2	0	0	1
+30	30	(arg=[^\x26]*?OVwSelection[^\x26]*?\x26.*?sel=[^\s\x26]{1023}|sel=[^\x26]{1023,}\x26.*?arg=[^\s\x26]*?OVwSelection)	2	0	0	1
+31	31	(caption,\x22\x5c\x5c\x5c|\x22\x5cn\x5cn\x5cn\x22\x20\x2b\x20str)	2	0	0	1
+32	32	(data_select1|nameParams|schdParams|text1|schd_select1)=[^\x26]{512}	2	0	0	1
+33	33	(displayWidth[\x2b\x20]\d[^\x2b\s\n]{128})	2	0	0	1
+34	34	(filename|type)=[^\x26]*?\x2E\x2E	2	0	0	1
+35	35	(ora_osb_bgcookie|rbtool)=[^\x20\x26\x3b]{1}	2	0	0	1
+36	36	(sIda\/sId|urua\/uru)[abcd]\.classPK	2	0	0	1
+37	37	.{20}[\x01\x02]\x00\x03\x00.*?\x5c\x00\x5c\x00	2	0	0	1
+38	38	5FDC81917DE08A41A6AC(E9B8ECA1EE.8|.98ECB1EEA8E)	2	0	0	1
+39	39	<FILE>(\x2e\x2e\x5c|%2E%2E%5C){2}[^<]+?</FILE>	2	0	0	1
+40	40	<SelectedID>[^<]+?(\x3B|%3B)	2	0	0	1
+41	41	<[^>]*?style\s*[>=].{1,1024}margin\s*\x3a\s*[^\x3b\x7d]*?-(\d{4}|1[0-9][1-9]|[2-9]\d\d)[ce][mx].*?[\x7b\x3b]	2	0	0	1
+42	42	<\?(php)?.{1,256}define\s*\x28\s*str_repeat\s*\x28\s*[\x22\x27][^\x22\x27]+[\x22\x27]\s*\x2c\s*\x24argv	2	0	0	1
+43	43	<\s*object[^>]*?data\s*\x3A[^,>]*?base64	2	0	0	1
+44	44	<\s*valitem[^>]*\s(value|name)\s*=\s*([\x22\x27])[^\x22\x27]{104}	2	0	0	1
+45	45	<\x21DOCTYPE\s+[^>]*?SYSTEM[^>]*?>.*?\x2EparseError	2	0	0	1
+46	46	<\x21ENTITY[^>]+SYSTEM[^>]+http\x3A\x2F\x2F[^>\s]+http\x3A\x2F\x2F	2	0	0	1
+47	47	<applet[^>]+(archive|src)\s*?=\s*?(\x22|\x27|)\s*?(\d{5}\.jar|[^>]+\/\d{5}\.jar)	2	0	0	1
+48	48	<figure[^>]+?dir\s*?=\s*?[\x22\x27]\s*?rtl\s*?[\x22\x27].*?(&#?x?[a-z\d]{2,4}\x3b){100}	2	0	0	1
+49	49	<iframe[^>]*?height\x3d\s*[\x22\x27]?\s*[0-9]{6}	2	0	0	1
+50	50	<script[^>]*?for\s*=\s*[\x22\x27]?.*?event\s*=\s*[\x22\x27]?onpropertychange[\x22\x27]?[^>]*?>	2	0	0	1
+51	51	<script[^>]*src\s*=\s*[\x22\x27][^\x22\x27]*\.json[\x22\x27][^>]*language=vbs	2	0	0	1
+52	52	<title>CRiMEPACK [\d\.]+</title>	2	0	0	1
+53	53	<treechildren.*?ordinal=.*?<treechildren	2	0	0	1
+54	54	<zombis>\s*<JUNIPER-M3>.*?</JUNIPER-M3>\s*</zombis>	2	0	0	1
+55	55	AdminServlet.*(userid|adminurl)[^\x26\x20\x0a]*<script	2	0	0	1
+56	56	Authorization\s*\x3A\s*Basic\s*[^\n]{437}	2	0	0	1
+57	57	Collab\x2EaddStateModel\s*\x28\s*\x7B.*cName\s*\x3A\s*\x22(\x22|\x5Cx00)	2	0	0	1
+58	58	ComputerName\s*\x3d\s*\x22[^\x22]{256}	2	0	0	1
+59	59	Content-Type\x3A\s*misc/ultravox.+?(\r?\n){2}\x5A.9\x01	2	0	0	1
+60	60	CreationDate\x28[^\x3c\x29]{500}	2	0	0	1
+61	61	DBMS_ASSERT\x2Esimple_sql_name\x28[^\x29\x22]*?\x22	2	0	0	1
+62	62	EnteredAttrName=[^&]{32}	2	0	0	1
+63	63	Entry\x20\x2f[^\x2f]*\x2f[^\x2f]{68}	2	0	0	1
+64	64	ExecWB\s*\x28\s*[^\x2c\x29]*(7|IDM_PRINTPREVIEW)[^\x29]+http\x3a\x2f\x2f	2	0	0	1
+65	65	FILECODE=[^&]{96}	2	0	0	1
+66	66	HEADER[\x20\r]*\n[\x20]*9[\x20\r]*\n\x24[^\n]{92}	2	0	0	1
+67	67	HTTP\/1.[01]\r\nUser\x2dAgent\x3a\x20[ -~]+\r\nHost\x3a\x20[a-z0-9\x2d\x2e]+\.info\r\n	2	0	0	1
+68	68	HostList=([^\r\n\x3B]{,296}\x3B)*[^\r\n\x3B]{297}	2	0	0	1
+69	69	Host\x3A\s*[^\x0D\x0A]{121}	2	0	0	1
+70	70	Hostname\x3D[^\x26\x3F\x3B\x0D\x0A\s]{300}	2	0	0	1
+71	71	ICount\x3D\x2D[^\x26\x3F\x3B\x0D\x0A\s]{300}	2	0	0	1
+72	72	IP=(https?|ftps?)	2	0	0	1
+73	73	InformixServerList=([^\r\n\x3B]{,293}\x3B)*[^\r\n\x3B]{294}	2	0	0	1
+74	74	Libs\/Starter(CmdExec|NetUtils|Rec|ScreenShots|Settings)\.py	2	0	0	1
+75	75	Math\x2efloor([^\x7d]{1,3})?\x7dcatch\x28	2	0	0	1
+76	76	Math\x2eround([^\x7d]{1,3})?\x7dcatch\x28	2	0	0	1
+77	77	MaxAge\x3D[^\x26\x3F\x3B\x0D\x0A]{300}	2	0	0	1
+78	78	Oid\x3D[^\x0D\x0A]{1000}	2	0	0	1
+79	79	OvAcceptLang\s*\x3d\s*[^\x3b\n]{300}	2	0	0	1
+80	80	OvOSLocale\s*\x3d\s*[^\x3b\s]{249}	2	0	0	1
+81	81	Referer\x3a[^\x0d\x0a]*\/world\/	2	0	0	1
+82	82	Referer\x3a\s*?http\x3a\x2f{2}[a-z0-9\x2e\x2d]+\x2fs\x2f\x3fk\x3d	2	0	0	1
+83	83	RegExp?\x23.{0,5}\x28\x3f[^\x29]{0,4}i.*?\x28\x3f\x2d[^\x29]{0,4}i.{0,50}\x7c\x7c	2	0	0	1
+84	84	SET_(SENDFROM|MAILHOST)\x28\x27[^\x27]{256}	2	0	0	1
+85	85	SOAPAction\x3A\s*?\x22[^\x22\x23]+?\x23([^\x22]{2048}|[^\x22]+$)	2	0	0	1
+86	86	SYS\.LT\.FINDRICSET\([^,\)]*\'\'\|\|	2	0	0	1
+87	87	SYS\x2eDBMS\x5fAQADM\x5fSYS\x2eGRANT\x5fTYPE\x5fACCESS\s*\x28\s*\x27[^\x2c\x20\x27]*[\x2c\x20]	2	0	0	1
+88	88	SelectedSubTabId=[^>]*?([\x22\x27]|%22|%27)\s*?>\s*?<[^>]*?script	2	0	0	1
+89	89	SignUrl=[^\x26\s]*[\x22\x27\x28\x29\x3C\x3E]	2	0	0	1
+90	90	SoftwareRegistration\.do.*?updateRegn=[^\x26\r\n]+(script|onclick|onload|onmouseover|html)	2	0	0	1
+91	91	TMlogonEncrypted=(\!|\%21)CRYPT(\!|\%21)[A-Z0-9]{512}	2	0	0	1
+92	92	Template\x3D[^\x0D\x0A]{1000}	2	0	0	1
+93	93	TimerMethod\x3D[^\x26]*[\x3C\x28\x22\x27]	2	0	0	1
+94	94	USER\s*[^\x0d]+\x25\x27	2	0	0	1
+95	95	User-Agent\:[^\x0a\x0d]+?Havij	2	0	0	1
+96	96	User-Agent\x3A\s+?mus[\x0d\x0a]	2	0	0	1
+97	97	User-Agent\x3a[^\x0d\x0a]*Java\/1\.	2	0	0	1
+98	98	User-Agent\x3a\x20Agent\d{5,9}	2	0	0	1
+99	99	User-Agent\x3a\x20[^\n]*?WinHttp\x2eWinHttpRequest.*?\n	2	0	0	1
+100	100	Visio \x28TM\x29 Drawing\r\n\x00{4}([^\x00]|\x00[^\x00]|\x00\x00[^\x01-\x06\x0b]|\x00\x00[\x01-\x06\x0b][^\x00])	2	0	0	1
+101	101	[1-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}	2	0	0	1
+102	102	[?&](CallbackParam|CallbackFn)=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|eval|script|onload|src)	2	0	0	1
+103	103	[?&](k|u|cs)=[^&]+?<	2	0	0	1
+104	104	[?&](path|file)Name=[^&]*?\x2e\x2e\x2f	2	0	0	1
+105	105	[?&](search|topic)=[^&]*?(\x27|%27)(\s*|(%20)*)(\x3b|%3b)	2	0	0	1
+106	106	[?&]SelectedSubTabId=[^&]*?([\x22\x27\x3c\x3e\x28\x29]|onload|src)	2	0	0	1
+107	107	[?&]Using=_layouts/query.iqy.*?&List=[^&]+(script|src|location|document|onlick|onload)	2	0	0	1
+108	108	[?&]appName=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+109	109	[?&]arg=[^-][^+&$]{189}	2	0	0	1
+110	110	[?&]configName=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+111	111	[?&]filename=[^&]*?[\x22\x27][^&]*?\x3B	2	0	0	1
+112	112	[?&]iprange=[^&]{68}	2	0	0	1
+113	113	[?&]key=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+114	114	[?&]name=(\x5c\x5c|%5c%5c)	2	0	0	1
+115	115	[?&]name=[^&]*\x2e\x2e\x2f[^&]*\x2e\x2e\x2f[^&]*\x2e\x2e\x2f	2	0	0	1
+116	116	[?&]name=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+117	117	[?&]site2pstoretoken=[^&]+?([\x22\x27\x3c\x3e\x28\x29]|script|onload|src)	2	0	0	1
+118	118	[\x35\x36\x41\x42\x44-\x49]\x00\x00	2	0	0	1
+119	119	[\x37-\x40\x43]\x00\x00	2	0	0	1
+120	120	[\x3f\x26]id=\d*[\x28\x29\x22\x27]	2	0	0	1
+121	121	[^&]+&[a-z]=[a-f0-9]{16}&[a-z]=[a-f0-9]{16}$	2	0	0	1
+122	122	[^R]CHAR\(.*?[^R]CHAR\(.*?[^R]CHAR\(.*?[^R]CHAR\(.*?[^R]CHAR\(	2	0	0	1
+123	123	[^\x3E]*?text\s*\x3D\s*(\x27[^\x27]{500}|\x22[^\x22]{500}|\S{500})	2	0	0	1
+124	124	[^\x3a\s]{309}\sPRIVMSG	2	0	0	1
+125	125	[^\x3e]{0,300}\x2fURI \x28data	2	0	0	1
+126	126	[^\x5C\x2F\x3A\x2A\x3F\x22\x3C\x3E\x7C\x3D\s]{256}\x2Eppt($|\x3f)	2	0	0	1
+127	127	[a-z0-9]{32}\.jar	2	0	0	1
+128	128	\%5b\%5f[0-9]{16}	2	0	0	1
+129	129	\&h=\d{5}$	2	0	0	1
+130	130	\.(jsp|html)\?[^\r\n]*PG=SPEEDBAR	2	0	0	1
+131	131	\.dashstyle\.array\.length\s*?=[^\x3b]*?-\s*?\d	2	0	0	1
+132	132	\.jpg\x20HTTP\/1\.[01]\r\nUser\x2dAgent\x3a\x20[a-z]+\r\nHost\x3a\x20[a-z0-9\x2d\x2e]+\.com\.br\r\n\r\n$	2	0	0	1
+133	133	\.js\/\?[a-z]+\=[a-z]{1,4}	2	0	0	1
+134	134	\.location(\.href)?\s*=\s*new\s+String\s*\x28\s*\x22\s*javascript\x3A	2	0	0	1
+135	135	\.onpropertychange\s*=\s*function[^{]*?\{[^}]*?\w+\.swapNode\x28	2	0	0	1
+136	136	\.php\?[a-z]{2,12}=[a-f0-9]{10,64}&[a-z]{2,12}=.*?&[a-z]{2,12}=	2	0	0	1
+137	137	\.php\?[a-z]{2,8}=[a-z0-9]{2}\x3a[a-z0-9]{2}\x3a[a-z0-9]{2}\x3a[a-z0-9]{2}\x3a[a-z0-9]{2}\&[a-z]{2,8}=	2	0	0	1
+138	138	\.php\?action=jv\&h=\d+	2	0	0	1
+139	139	\.php\?b=[A-F0-9]+&v=1\.	2	0	0	1
+140	140	\.php\?j=1&k=[0-9](i=[0-9])?$	2	0	0	1
+141	141	\.php\?mac\x3d([a-f0-9]{2}\x3a){5}[a-f0-9]{2}$	2	0	0	1
+142	142	\.php\?setup=d\&s=\d+\&r=\d+	2	0	0	1
+143	143	\.php\x3fw\x3d\d+\x26n\x3d\d+	2	0	0	1
+144	144	\.png$	2	0	0	1
+145	145	\.replace\x28\x2F[^\x2F]+\x2F[A-Z]*\x2C(\x22\x22|\x27\x27)	2	0	0	1
+146	146	\/$	2	0	0	1
+147	147	\/%2E%2E(\\|%5C)\/	2	0	0	1
+148	148	\/([0-9][0-9a-z]{2}|[0-9a-z][0-9][0-9a-z]|[0-9a-z]{2}[0-9])\.jar$	2	0	0	1
+149	149	\/(\\|%5C)%2E%2E\/	2	0	0	1
+150	150	\/AES\d+O\d+\.jsp\?[a-z0-9=\x2b\x2f]{20}	2	0	0	1
+151	151	\/AES\d{9}O\d{4,5}\x2ejsp	2	0	0	1
+152	152	\/CreationDate\x28[^\x3c\x29]{500}	2	0	0	1
+153	153	\/DES\d+O\d+\.jsp\?[a-z0-9=\x2b\x2f]{20}	2	0	0	1
+154	154	\/DES\d{9}O\d{4,5}\x2ejsp	2	0	0	1
+155	155	\/F[^\/>]+\.(exe|dll|swf)	2	0	0	1
+156	156	\/Java([0-9]{1,2})?\.jar\?java=[0-9]{2}	2	0	0	1
+157	157	\/La(.)*?\s*?\/F[^\/>]+\.(exe|dll|swf)	2	0	0	1
+158	158	\/MacApp\/\d{2}(-\d{2}){3}(:\d{2}){2}\.png\r\n[^\x89]+?\x89PNG	2	0	0	1
+159	159	\/OvCgi\/(jovgraph|webappmon)\.exe	2	0	0	1
+160	160	\/OvCgi\/(jovgraph|webappmon)\.exe.*?-textFile+[^+]{201}	2	0	0	1
+161	161	\/SUS\d+O\d+\.jsp\?[a-z0-9=\x2b\x2f]{20}	2	0	0	1
+162	162	\/VertexNet\/adduser\.php\?uid=\x7B[^\r\n]+\x7D\x26la[^\r\n]+\x26cmpname=	2	0	0	1
+163	163	\/VertexNet\/tasks\.php\?uid=\x7B[^\r\n]+\x7D\x26la[^\r\n]+\x26cmpname=	2	0	0	1
+164	164	\/ZES\d+O\d+\.jsp\?[a-z0-9=\x2b\x2f]{20}	2	0	0	1
+165	165	\/[a-f0-9]{16}([a-f0-9]{16})?\/ff\.php	2	0	0	1
+166	166	\/[a-f0-9]{16}\/a\.php	2	0	0	1
+167	167	\/[a-f0-9]{16}\/q\.php	2	0	0	1
+168	168	\/[a-f0-9]{32}\/a\.php	2	0	0	1
+169	169	\/[a-f0-9]{32}\/q\.php	2	0	0	1
+170	170	\/[a-z0-9]{12}\.txt$	2	0	0	1
+171	171	\/[a-zA-Z0-9]{150,}\/getmyfile\.exe\?o=1\&h=11$	2	0	0	1
+172	172	\/[a-z]{4}\.html\?h\=\d{6,7}$	2	0	0	1
+173	173	\/[a-z]{4}\.html\?i\=\d{6,7}$	2	0	0	1
+174	174	\/[a-z]{4}\.html\?j\=\d{6,7}$	2	0	0	1
+175	175	\/\?[0-9a-f]{60,66}[\;\d]*$	2	0	0	1
+176	176	\/\?id=\d+\x26AnSSip=	2	0	0	1
+177	177	\/\?java\=[0-9]{2,4}	2	0	0	1
+178	178	\/\[fx]\.jar$	2	0	0	1
+179	179	\/\d{2}\.html$	2	0	0	1
+180	180	\/api\/urls\/\?ts=[a-z0-9]+&affid=\d{5}	2	0	0	1
+181	181	\/app\/\?prj=\d\x26pid=[^\r\n]+\x26mac=	2	0	0	1
+182	182	\/blog/images/3521\.jpg\?v\d{2}=\d{2}\x26tq=	2	0	0	1
+183	183	\/count\d{2}\.php$	2	0	0	1
+184	184	\/elections\.php\?([a-z0-9]+\x3d\d{1,3}\&){9}[a-z0-9]+\x3d\d{1,3}$	2	0	0	1
+185	185	\/f\.php\?k=\d	2	0	0	1
+186	186	\/html\/license_[0-9A-F]{550,}\.html$	2	0	0	1
+187	187	\/images\/[a-zA-Z]\.php\?id\=[0-9]{2,3}(\.\d)?$	2	0	0	1
+188	188	\/index\d{9}\.asp	2	0	0	1
+189	189	\/install\.asp\?mac=[A-F\d]{12}\x26mode	2	0	0	1
+190	190	\/jdb\/inf\.php\?id=[a-f0-9]{32}$	2	0	0	1
+191	191	\/jlnp\.html$	2	0	0	1
+192	192	\/jorg\.html$	2	0	0	1
+193	193	\/jovf\.html$	2	0	0	1
+194	194	\/loader\.cpl$	2	0	0	1
+195	195	\/pdfx\.html$	2	0	0	1
+196	196	\/pte\.aspx\?ver=\d\.\d\.\d+\.\d\x26rnd=\d{5}	2	0	0	1
+197	197	\/r_autoidcnt\.asp\?mer_seq=\d[^\r\n]*\x26mac=	2	0	0	1
+198	198	\/se\/[a-f0-9]{100,200}\/[a-f0-9]{6,9}\/[A-Z0-9_]{4,200}\.com	2	0	0	1
+199	199	\/setup_b\.asp\?prj=\d\x26pid=[^\r\n]*\x26mac=	2	0	0	1
+200	200	\/stat_d\/$	2	0	0	1
+201	201	\/stat_n\/$	2	0	0	1
+202	202	\/stat_svc\/$	2	0	0	1
+203	203	\/stat_u\/$	2	0	0	1
+204	204	\/vic\.aspx\?ver=\d\.\d\.\d+\.\d\x26rnd=\d{5}	2	0	0	1
+205	205	\/world\/[^\x2f]*\.pdf	2	0	0	1
+206	206	\<a\s+[^\>]*href\s*\x3D\s*[\x22\x27]?[^\>\x22\x27]*\x23\x3A\x2F\x2F[^\>]+\>	2	0	0	1
+207	207	\?[a-f0-9]{4}$	2	0	0	1
+208	208	\?id=[A-Z0-9]{20}&cmd=img	2	0	0	1
+209	209	\?inf\=[0-9a-f]{8}\x2Ex\d{2}\x2E\d{8}\x2E	2	0	0	1
+210	210	\?page\=[a-f0-9]{16}	2	0	0	1
+211	211	\?spl=\d&br=[^&]+&vers=[^&]+&s=	2	0	0	1
+212	212	\bcmd\x2eexe\b	2	0	0	1
+213	213	\d+&	2	0	0	1
+214	214	\r\nHost\x3A\s+[^\r\n]*?[bcdfghjklmnpqrstvwxyz]{5,}[^\r\n]*?\x2Einfo\r\n	2	0	0	1
+215	215	\r\nHost\x3a\x20[a-z0-9\x2d\x2e]+\.com\x2d[a-z0-9\x2d\x2e]+(\x3a\d{1,5})?\r\n	2	0	0	1
+216	216	\r\nReferer\x3A\x20http\x3A\x2F\x2f[a-z0-9\x2d\x2e]+\x2F\x3Fdo\x3Dpayment\x26ver\x3D\d+\x26sid\x3D\d+\x26sn\x3D\d+\r\n	2	0	0	1
+217	217	\s*\x28(\x27[^\x27]{64}|\x27[^\x27]*\x27\s*,\s*\x27[^\x27]{64})	2	0	0	1
+218	218	\sAUTHENTICATE\s[^\n]{100}	2	0	0	1
+219	219	\sEXAMINE\s[^\n]*?\s\{	2	0	0	1
+220	220	\sFETCH\s[^\n]*?\s\{	2	0	0	1
+221	221	\sLOGIN\s\w+\s\{\d+\}[\r]?\n[^\n]*?%	2	0	0	1
+222	222	\x00[\x3b\x7c\x26\x60][^\x00]+\x00airappinstaller\x00ASnative\x00	2	0	0	1
+223	223	\x00[\x70-\x74]\x00[\x00-\x09]	2	0	0	1
+224	224	\x00\.\x00\.\x00[\x2f\x5c]	2	0	0	1
+225	225	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01espia_(video_get_dev_image|audio_get_dev_audio|image_get_dev_screen)	2	0	0	1
+226	226	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01incognito_(list_tokens|impersonate_token|add_user|add_group_user|add_localgroup_user|snarf_hashes)	2	0	0	1
+227	227	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01lanattacks_(start_dhcp|reset_dhcp|set_dhcp_option|stop_dhcp|dhcp_log|start_tftp|reset_tftp|add_tftp_file|stop_tftp)	2	0	0	1
+228	228	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01networkpug_(start|stop)	2	0	0	1
+229	229	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01priv_(elevate_getsystem|passwd_get_sam_hashes|fs_get_file_mace|fs_set_file_mace)	2	0	0	1
+230	230	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01sniffer_(interfaces|capture_start|capture_stop|capture_stats|capture_dump|capture_dump_read)	2	0	0	1
+231	231	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_fs_(separator|search|file_expand_path|md5|sha1|delete_file|stat|ls|chdir|mkdir|getwd|delete_dir)	2	0	0	1
+232	232	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_net_(config_get_interfaces|config_get_routes|config_add_route|udp_client|tcp_server|tcp_client|socket_tcp_shutdown)	2	0	0	1
+233	233	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_railgun_(memread|memwrite|api_multi|api)	2	0	0	1
+234	234	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_registry_(load_key|unload_key|open_key|open_remote_key|create_key|delete_key|close_key|enum_key)	2	0	0	1
+235	235	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_sys_config_(getuid|sysinfo|rev2self|steal_token|drop_token|getprivs)	2	0	0	1
+236	236	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_sys_eventlog_(open|numrecords|read|oldest|clear|close)	2	0	0	1
+237	237	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_sys_process_(thread_open|thread_create|thread_get_threads)	2	0	0	1
+238	238	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01stdapi_ui_(enable_keyboard|enable_mouse|get_idle_time|desktop_enum|desktop_get|desktop_set|desktop_screenshot)	2	0	0	1
+239	239	\x00\x00\x00[\x00\x01].{4}\x00\x01\x00\x01webcam_(list|start|get_frame|stop|audio_record)	2	0	0	1
+240	240	\x0a\x0d?\x0a[A-Z0-9\x2b\x2f\s]*[^A-Z0-9\x2b\x2f\s\x3d]	2	0	0	1
+241	241	\x23\d{2}\x3a\d{2}\x3a\d\d$	2	0	0	1
+242	242	\x25USERPROFILE\x25\x5C[^\x2e]{1,255}\x2eexe	2	0	0	1
+243	243	\x26?arg\d+\s*=\s*[^\x26]*?(import|http)	2	0	0	1
+244	244	\x26TARGET\x3d\x5f(blank|parent|top)	2	0	0	1
+245	245	\x26arg\d+\s*=\s*[^\r\n\x26]*import	2	0	0	1
+246	246	\x26r\d\x3d[^\x26\s]*\x27	2	0	0	1
+247	247	\x26r\d\x3d\d*[^\x26\s\d]	2	0	0	1
+248	248	\x26tv\x3d\d\.\d\.\d{4}\.\d{4}	2	0	0	1
+249	249	\x26uid\x3d[a-f0-9]{16}($|\x26)	2	0	0	1
+250	250	\x28\s*\x22\s*\x25([2-9][6-9][5-9]|[1-9][0-9]{3,})f	2	0	0	1
+251	251	\x28compatible\x3b[A-Z]*\x3b\x29\x0d\x0a	2	0	0	1
+252	252	\x2A\x02.{4}\x00\x04\x00\x07.*\x3C\x3E[^\x00]{1023,}	2	0	0	1
+253	253	\x2E[A-Z\d_]+\s*\x7b\s*text-decoration[^\x3A]*?\x7d	2	0	0	1
+254	254	\x2E\x00?d\x00?l\x00?l\x00?	2	0	0	1
+255	255	\x2Ebin([\?\x5c\x2f]|$)	2	0	0	1
+256	256	\x2Emaplet([\?\x5c\x2f]|$)	2	0	0	1
+257	257	\x2Ermf([\?\x5c\x2f]|$)	2	0	0	1
+258	258	\x2Eview\x2Eselection.*?\x2Etree\s*\x3D\s*null.*?\x2Einvalidate	2	0	0	1
+259	259	\x2FCSuserCGI\x2Eexe\x3F.*?Logout.[^&]{96}	2	0	0	1
+260	260	\x2F[a-z]+\x2epng	2	0	0	1
+261	261	\x2Faws\d{1,5}\.jsp\x3F	2	0	0	1
+262	262	\x2Fdesktop\x2F\d+\x2Ftoolbar\x2Fsupremetb\d+\.cfg	2	0	0	1
+263	263	\x2Fevil\x2Fservices\x2Fbid_register\x2Ephp\x3FBID\x3D[A-Za-z]{6}\x26IP\x3D\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x26cipher\x3D[A-Za-z]{9}	2	0	0	1
+264	264	\x2Fgumblar\x2Ecn\x2Frss\x2F\x3Fid\x3D\d+	2	0	0	1
+265	265	\x2Fin\.cgi\?\d{1,2}$	2	0	0	1
+266	266	\x2Flogo\.gif\x3F[0-9a-f]{5,7}=\d{5,7}	2	0	0	1
+267	267	\x2Flogos\.gif\x3F[0-9a-f]+=\x2d?\d+	2	0	0	1
+268	268	\x2Fmartuz\x2Ecn\x2Fvid\x2F\x3Fid\x3D\d+	2	0	0	1
+269	269	\x2Fmrow\x5Fpin\x2F\x3Fid\d+[a-z]{5,}\d{5}\x26rnd\x3D\d+	2	0	0	1
+270	270	\x2FphpThumb\.php\x3F[^\r\n]*fltr\[\]=[^\r\n\x26]+\x3B	2	0	0	1
+271	271	\x2Fupdate\w\x2Ephp\x3Fp\x3D\d+.*User\x2DAgent\x3A\s+Mozilla\x2F4\x2E75\s\x5Ben\x5D\s\x28X11\x3B\sU\x3B\sLinux\s2\x2E2\x2E16\x2D3\si686\x29	2	0	0	1
+272	272	\x2e(jpg|png|gif)\x3fs?v.*?&tq=g[A-Z0-9]{2}	2	0	0	1
+273	273	\x2e3g2([\?\x5c\x2f]|$)	2	0	0	1
+274	274	\x2e3gp([\?\x5c\x2f]|$)	2	0	0	1
+275	275	\x2e4xm([\?\x5c\x2f]|$)	2	0	0	1
+276	276	\x2eExecWB\s*\x28(IDM_PRINTPREVIEW|7)\x2c\s+(0|2)\x2C\s+\x22http	2	0	0	1
+277	277	\x2eafm([\?\x5c\x2f]|$)	2	0	0	1
+278	278	\x2eani([\?\x5c\x2f]|$)	2	0	0	1
+279	279	\x2eapk([\?\x5c\x2f]|$)	2	0	0	1
+280	280	\x2easx([\?\x5c\x2f]|$)	2	0	0	1
+281	281	\x2eavi([\?\x5c\x2f]|$)	2	0	0	1
+282	282	\x2ecdr([\?\x5c\x2f]|$)	2	0	0	1
+283	283	\x2ecgm([\?\x5c\x2f]|$)	2	0	0	1
+284	284	\x2echm([\?\x5c\x2f]|$)	2	0	0	1
+285	285	\x2eclass([\?\x5c\x2f]|$)	2	0	0	1
+286	286	\x2ecov([\?\x5c\x2f]|$)	2	0	0	1
+287	287	\x2ecpe([\?\x5c\x2f]|$)	2	0	0	1
+288	288	\x2ecsd([\?\x5c\x2f]|$)	2	0	0	1
+289	289	\x2edcr([\?\x5c\x2f]|$)	2	0	0	1
+290	290	\x2edefinition\s*\x28	2	0	0	1
+291	291	\x2edir([\?\x5c\x2f]|$)	2	0	0	1
+292	292	\x2edisco([\?\x5c\x2f]|$)	2	0	0	1
+293	293	\x2edmg([\?\x5c\x2f]|$)	2	0	0	1
+294	294	\x2edoc([\?\x5c\x2f]|$)	2	0	0	1
+295	295	\x2edxf([\?\x5c\x2f]|$)	2	0	0	1
+296	296	\x2eeot([\?\x5c\x2f]|$)	2	0	0	1
+297	297	\x2eeps([\?\x5c\x2f]|$)	2	0	0	1
+298	298	\x2eexe([\?\x5c\x2f]|$)	2	0	0	1
+299	299	\x2eexport(AsFDF|AsText|AsXFDF|DataObject|XFAData)\x28[^\x2c\x29]*\x2c[^\x2c\x29]*\x2c[^\x29]+\x2eexe	2	0	0	1
+300	300	\x2ef4a([\?\x5c\x2f]|$)	2	0	0	1
+301	301	\x2ef4b([\?\x5c\x2f]|$)	2	0	0	1
+302	302	\x2ef4p([\?\x5c\x2f]|$)	2	0	0	1
+303	303	\x2ef4v([\?\x5c\x2f]|$)	2	0	0	1
+304	304	\x2eflv([\?\x5c\x2f]|$)	2	0	0	1
+305	305	\x2efpx([\?\x5c\x2f]|$)	2	0	0	1
+306	306	\x2egif([\?\x5c\x2f]|$)	2	0	0	1
+307	307	\x2ehpj([\?\x5c\x2f]|$)	2	0	0	1
+308	308	\x2ehtc([\?\x5c\x2f]|$)	2	0	0	1
+309	309	\x2eimg([\?\x5c\x2f]|$)	2	0	0	1
+310	310	\x2ejar([\?\x5c\x2f]|$)	2	0	0	1
+311	311	\x2ejfif?([\?\x5c\x2f]|$)	2	0	0	1
+312	312	\x2ejif([\?\x5c\x2f]|$)	2	0	0	1
+313	313	\x2ejnlp([\?\x5c\x2f]|$)	2	0	0	1
+314	314	\x2ejpe([\?\x5c\x2f]|$)	2	0	0	1
+315	315	\x2ejpeg([\?\x5c\x2f]|$)	2	0	0	1
+316	316	\x2ejpg([\?\x5c\x2f]|$)	2	0	0	1
+317	317	\x2ek3g([\?\x5c\x2f]|$)	2	0	0	1
+318	318	\x2elnk([\?\x5c\x2f]|$)	2	0	0	1
+319	319	\x2em3u([\?\x5c\x2f]|$)	2	0	0	1
+320	320	\x2em4a([\?\x5c\x2f]|$)	2	0	0	1
+321	321	\x2em4b([\?\x5c\x2f]|$)	2	0	0	1
+322	322	\x2em4p([\?\x5c\x2f]|$)	2	0	0	1
+323	323	\x2em4r([\?\x5c\x2f]|$)	2	0	0	1
+324	324	\x2em4v([\?\x5c\x2f]|$)	2	0	0	1
+325	325	\x2emanifest([\?\x5c\x2f]|$)	2	0	0	1
+326	326	\x2emetalink([\?\x5c\x2f]|$)	2	0	0	1
+327	327	\x2emov([\?\x5c\x2f]|$)	2	0	0	1
+328	328	\x2emp3([\?\x5c\x2f]|$)	2	0	0	1
+329	329	\x2emp4([\?\x5c\x2f]|$)	2	0	0	1
+330	330	\x2empeg([\?\x5c\x2f]|$)	2	0	0	1
+331	331	\x2empg([\?\x5c\x2f]|$)	2	0	0	1
+332	332	\x2emswmm([\?\x5c\x2f]|$)	2	0	0	1
+333	333	\x2eoga([\?\x5c\x2f]|$)	2	0	0	1
+334	334	\x2eogg([\?\x5c\x2f]|$)	2	0	0	1
+335	335	\x2eogv([\?\x5c\x2f]|$)	2	0	0	1
+336	336	\x2eogx([\?\x5c\x2f]|$)	2	0	0	1
+337	337	\x2eopus([\?\x5c\x2f]|$)	2	0	0	1
+338	338	\x2eotf([\?\x5c\x2f]|$)	2	0	0	1
+339	339	\x2epaq8o([\?\x5c\x2f]|$)	2	0	0	1
+340	340	\x2epct([\?\x5c\x2f]|$)	2	0	0	1
+341	341	\x2epdf([\?\x5c\x2f]|$)	2	0	0	1
+342	342	\x2epfa([\?\x5c\x2f]|$)	2	0	0	1
+343	343	\x2epfb([\?\x5c\x2f]|$)	2	0	0	1
+344	344	\x2epfm([\?\x5c\x2f]|$)	2	0	0	1
+345	345	\x2ephp\x3f[a-z]+=[a-fA-Z0-9]+&[a-z]+=[0-9]+$	2	0	0	1
+346	346	\x2ephp\x3f\s*-s	2	0	0	1
+347	347	\x2epict([\?\x5c\x2f]|$)	2	0	0	1
+348	348	\x2epjpeg([\?\x5c\x2f]|$)	2	0	0	1
+349	349	\x2epls([\?\x5c\x2f]|$)	2	0	0	1
+350	350	\x2epmd([\?\x5c\x2f]|$)	2	0	0	1
+351	351	\x2epng([\?\x5c\x2f]|$)	2	0	0	1
+352	352	\x2eppt([\?\x5c\x2f]|$)	2	0	0	1
+353	353	\x2epub([\?\x5c\x2f]|$)	2	0	0	1
+354	354	\x2eqcp([\?\x5c\x2f]|$)	2	0	0	1
+355	355	\x2eqt([\?\x5c\x2f]|$)	2	0	0	1
+356	356	\x2eram?([\?\x5c\x2f]|$)	2	0	0	1
+357	357	\x2erm([\?\x5c\x2f]|$)	2	0	0	1
+358	358	\x2ermp([\?\x5c\x2f]|$)	2	0	0	1
+359	359	\x2erp([\?\x5c\x2f]|$)	2	0	0	1
+360	360	\x2ert([\?\x5c\x2f]|$)	2	0	0	1
+361	361	\x2ertf([\?\x5c\x2f]|$)	2	0	0	1
+362	362	\x2eru/\w+\?\d$	2	0	0	1
+363	363	\x2erv([\?\x5c\x2f]|$)	2	0	0	1
+364	364	\x2esami([\?\x5c\x2f]|$)	2	0	0	1
+365	365	\x2eskm([\?\x5c\x2f]|$)	2	0	0	1
+366	366	\x2eskp([\?\x5c\x2f]|$)	2	0	0	1
+367	367	\x2eslk([\?\x5c\x2f]|$)	2	0	0	1
+368	368	\x2esmi([\?\x5c\x2f]|$)	2	0	0	1
+369	369	\x2esmil([\?\x5c\x2f]|$)	2	0	0	1
+370	370	\x2espx([\?\x5c\x2f]|$)	2	0	0	1
+371	371	\x2esubstringData\s*\x28[^\x2c]*\x2c\s*0x7(f|F){6}[6-9AaBbCcDdEeFf]	2	0	0	1
+372	372	\x2eswf([\?\x5c\x2f]|$)	2	0	0	1
+373	373	\x2etga([\?\x5c\x2f]|$)	2	0	0	1
+374	374	\x2etif(f)?([\?\x5c\x2f]|$)	2	0	0	1
+375	375	\x2etorrent([\?\x5c\x2f]|$)	2	0	0	1
+376	376	\x2ette([\?\x5c\x2f]|$)	2	0	0	1
+377	377	\x2ettf([\?\x5c\x2f]|$)	2	0	0	1
+378	378	\x2evap([\?\x5c\x2f]|$)	2	0	0	1
+379	379	\x2evbs([\?\x5c\x2f]|$)	2	0	0	1
+380	380	\x2evisprj([\?\x5c\x2f]|$)	2	0	0	1
+381	381	\x2evsd([\?\x5c\x2f]|$)	2	0	0	1
+382	382	\x2ewav([\?\x5c\x2f]|$)	2	0	0	1
+383	383	\x2ewax([\?\x5c\x2f]|$)	2	0	0	1
+384	384	\x2ewm([\?\x5c\x2f]|$)	2	0	0	1
+385	385	\x2ewma([\?\x5c\x2f]|$)	2	0	0	1
+386	386	\x2ewmd([\?\x5c\x2f]|$)	2	0	0	1
+387	387	\x2ewmf([\?\x5c\x2f]|$)	2	0	0	1
+388	388	\x2ewmv([\?\x5c\x2f]|$)	2	0	0	1
+389	389	\x2ewmx([\?\x5c\x2f]|$)	2	0	0	1
+390	390	\x2ewmz([\?\x5c\x2f]|$)	2	0	0	1
+391	391	\x2ewps([\?\x5c\x2f]|$)	2	0	0	1
+392	392	\x2ewrf([\?\x5c\x2f]|$)	2	0	0	1
+393	393	\x2ewri([\?\x5c\x2f]|$)	2	0	0	1
+394	394	\x2ewvx([\?\x5c\x2f]|$)	2	0	0	1
+395	395	\x2exbm([\?\x5c\x2f]|$)	2	0	0	1
+396	396	\x2exls([\?\x5c\x2f]|$)	2	0	0	1
+397	397	\x2exlw([\?\x5c\x2f]|$)	2	0	0	1
+398	398	\x2exml([\?\x5c\x2f]|$)	2	0	0	1
+399	399	\x2expm([\?\x5c\x2f]|$)	2	0	0	1
+400	400	\x2exsl([\?\x5c\x2f]|$)	2	0	0	1
+401	401	\x2exslt([\?\x5c\x2f]|$)	2	0	0	1
+402	402	\x2exspf([\?\x5c\x2f]|$)	2	0	0	1
+403	403	\x2exul([\?\x5c\x2f]|$)	2	0	0	1
+404	404	\x2ezip([\?\x5c\x2f]|$)	2	0	0	1
+405	405	\x2f1020\d{6,16}$	2	0	0	1
+406	406	\x2fAdmin\x2fFunctionsClient\x2f(check.txt|Select.php|Update.php)	2	0	0	1
+407	407	\x2fF\s*(<<|)\s*\x2fDOS\s*\x28	2	0	0	1
+408	408	\x2fF\s*(<<|)\s*\x2fMac\s*\x28	2	0	0	1
+409	409	\x2fF\s*(<<|)\s*\x2fUnix\s*\x28	2	0	0	1
+410	410	\x2f[a-z0-9]+\.php\?php\x3dreceipt$	2	0	0	1
+411	411	\x2f\?ts\x3d[a-f0-9]{40}\x26	2	0	0	1
+412	412	\x2fblackmuscats?\x3f\d	2	0	0	1
+413	413	\x2fib2\x2f$	2	0	0	1
+414	414	\x2fkills\x2etxt\x3f(t\d|p)\x3d\d{6}$	2	0	0	1
+415	415	\x2fms162cfg\x2ejsp\x3f([sverlcfan]\x3d[^\x26\s]*\x26){8}	2	0	0	1
+416	416	\x2fpanda\x2f\x3fu\x3d[a-z0-9]{32}	2	0	0	1
+417	417	\x2ftimthumb\x2ephp\x3f[^\r\n]*?src=https?\x3a\x2f([^\x2e\x2f]+?\x2e){3}	2	0	0	1
+418	418	\x2fwidth[^\x3e]+\x2fDCTDecode	2	0	0	1
+419	419	\x3C\s*applet[^\x3E\n$]*code\s*=\s*[\x27\x22]AppletX[\x22\x27][^\x3E\n$]*archive\s*=\s*[\x22\x27][^\s\x3E\n$]{32}\x2Ejar[\x22\x27]	2	0	0	1
+420	420	\x3C\s*param\s*\x3E\s*\x3C\s*value\s*\x3E\s*\x3C\s*string\s*\x3E[^\x3C]*[\x2C\x3B]	2	0	0	1
+421	421	\x3b\s*udhcpc\s*\x3b.*\x26	2	0	0	1
+422	422	\x3c[^\x3e]+[\x22\x27]mailto\x3a[^\x3e]+\x3f[^\x3e]*\x2faltvba	2	0	0	1
+423	423	\x3c[^\x3e]+[\x22\x27]mailto\x3a[^\x3e]+\x3f[^\x3e]*\x2fimportprf	2	0	0	1
+424	424	\x3c\s*Marquee[^\x3e]*onstart\s*\x3D\s*\x22\s*document\x2e(write|writeln|open)	2	0	0	1
+425	425	\x3ccell\s+[^\x3e]*\x3aFormula\s*\x3d\s*\x22\s*\x3drept\x28	2	0	0	1
+426	426	\x3ciframe[^\x3e]*?src\x3d\x22http\x3a\x2f\x2f[^\x26\x2e]+\x26\x2346\x3b[^\x2e]+\x2epl\x2frc\x2f\x22	2	0	0	1
+427	427	\x3cimg[^\x3e]*src\x3d(\x22|\x27)?[^\x22\x27\s]{300}	2	0	0	1
+428	428	\x3cj2se[^\x3e]*(initial|max)-heap-size\s*\x3d\s*(\x22|\x27)[^\x22\x27]{50}	2	0	0	1
+429	429	\x3cscript\x3etry\x7b\w+\x2b\x2b([^\x7d]{1,4})?\x7dcatch\x28	2	0	0	1
+430	430	\x3ctime\x20[^\x3e]*(begin|end)\x3d\x22[^\x22]{13}	2	0	0	1
+431	431	\x3e\x0d\x0aSUBJECT\x3a (\d{1,3}\x2e){3}\d{1,3}\x7c[^\r\n]*\x7c\d{2,4}\x0d\x0a	2	0	0	1
+432	432	\x3fsv\x3d\d{1,3}\x26tq\x3d	2	0	0	1
+433	433	\x45\x4d\x46\x2b\x08\x40.(\x06|\x86).{28}([\xf4-\xff]\xff\xff(\xff|\x7f)|[\x00-\x06]\x00\x00\x80)	2	0	0	1
+434	434	\x5Csv\s+[^\x7D]*?\x3B[^\x7D]*?\x3B[^\x7B]{12}	2	0	0	1
+435	435	\x5F[A-F0-9]{16}	2	0	0	1
+436	436	\x5c\x00\x5c\x00[^\x5c]*?\x5c\x00\x00\x00	2	0	0	1
+437	437	\x5cdpcallout\s*\x5cdpcallout\s*\x5cdpcallout	2	0	0	1
+438	438	\x5flayouts\x2fhelp\x2easpx\x3f.*?cid0\x3d[A-Za-z\x5c\x2e0-9]*[^A-Za-z\x5c\x2f\x2e\x26\x3d0-9\s]	2	0	0	1
+439	439	\xff\x5e\x00(\x05[\x80-\xff]|\x06\x00[\x80-\xff]|\x06[^\x00])	2	0	0	1
+440	440	\xff{32}$	2	0	0	1
+441	441	\|(25[0-5]|2[0-4]\d|[01]?\d\d?)\.(25[0-5]|2[0-4]\d|[01]?\d\d?)\.(25[0-5]|2[0-4]\d|[01]?\d\d?)\.(25[0-5]|2[0-4]\d|[01]?\d\d?)\|\d+\|	2	0	0	1
+442	442	^((\.\.\/|\.\.\\).*|(\.(exe|dll)))~~	2	0	0	1
+443	443	^(.{3}[\x80-\xFF]|.{7}[\x80-\xFF])	2	0	0	1
+444	444	^(GET|OPTIONS|HEAD|POST|PUT|DELETE|CONNECT|PROPFIND|PROPPATCH|MKCOL|COPY|MOVE|LOCK|UNLOCK)[^\r\n]*\s+[^\r\n]*\x2f\x25c0\x25af\x2f	2	0	0	1
+445	445	^(GET|POST|HEAD)\s+[^\x25\r\n]*\x25[\x23\x24\x27\x2a\x2b\x2d\x2ehlqjzt1234567890]*[diouxefgacspn]	2	0	0	1
+446	446	^(NT|CallBack|SID|TimeOut)\s*\x3a\s*[^\n]{512}	2	0	0	1
+447	447	^(To|From)[^\x3e]*?\x3e[a-z0-9]*[^a-z0-9][^\x3c]*?\x3c\x2fconvert(To|From)	2	0	0	1
+448	448	^(UN)?SUBSCRIBE\s	2	0	0	1
+449	449	^([\x22\x27]\s*value)?\s*=\s*\x22[^\x22]{70}	2	0	0	1
+450	450	^([\x22\x27]\s*value)?\s*=\s*\x27[^\x27]{70}	2	0	0	1
+451	451	^(\x75|\x2d|\x2f|\x73|\xa2|\x2e|\x24|\x74)	2	0	0	1
+452	452	^(\xFF|\x3C)\x00	2	0	0	1
+453	453	^(admin|axis2)	2	0	0	1
+454	454	^(encrypt|decrypt)\x28\x27[^\x27]{129}	2	0	0	1
+455	455	^...(..)?[\x80-\xff]	2	0	0	1
+456	456	^.\x00{3}(\x03|\x04)	2	0	0	1
+457	457	^.{27}	2	0	0	1
+458	458	^.{27}	2	0	0	1
+459	459	^.{28}([0-9A-Z\x20\x2F]{4}.{8}[^\xFF].{7})*([0-9A-Z\x20\x2F]{4}.{8}\xFF{3})	2	0	0	1
+460	460	^.{28}(\x00\x1f|\x00\x20)	2	0	0	1
+461	461	^.{2}	2	0	0	1
+462	462	^.{2}\x08\xa5\x00\x01.{14}(([^\x00]|\x00[\x81-\xFF])|.{4}([^\x00]|\x00[\x81-\xFF]))	2	0	0	1
+463	463	^.{4}	2	0	0	1
+464	464	^.{4}	2	0	0	1
+465	465	^.{4}(\x00\x00\x00\x00|.{12})	2	0	0	1
+466	466	^.{8}\x01[\x35\x36\x41\x42\x44-\x49]	2	0	0	1
+467	467	^.{8}\x01[\x37-\x40\x43]	2	0	0	1
+468	468	^.{8}user\x00[^\x00]+?\x00database\x00-[^\x00]+?\x00	2	0	0	1
+469	469	^9\s(\S{101}|\S+\s(\S{349}|\S+\s\S{521}))	2	0	0	1
+470	470	^<!--\s+[\w]{52,}\s+-->\r\n	2	0	0	1
+471	471	^Authorization\s*\x3A\s*Digest\s+([^\n\x2C]*\x2C){15}	2	0	0	1
+472	472	^Authorization\x3a\s*Basic[^\n]{256}	2	0	0	1
+473	473	^CONNECT\s[^\s]{1024}	2	0	0	1
+474	474	^Connection\x3A\s*[^\r\n]*?\x2c\x2c	2	0	0	1
+475	475	^Content-Disposition\x3A\s*attachment	2	0	0	1
+476	476	^Content-Length\s*\x3A\s	2	0	0	1
+477	477	^Content-Length\s*\x3A\s*[1-9][0-9]{8}	2	0	0	1
+478	478	^Content-Length\x3a\s*0*([1-9][0-9]{8}|[7-9][0-9]{8})	2	0	0	1
+479	479	^Content-Type\x3a[\x20\x09]+application\/octet-stream	2	0	0	1
+480	480	^Content-Type\x3a[\x20\x09]+application\/x-msdos-program	2	0	0	1
+481	481	^Cookie\x3a\s?SECID=[^\x3b]+?$	2	0	0	1
+482	482	^EXECSCRIPT\s+\.\.[\x2F\x5C]\.\.	2	0	0	1
+483	483	^From\x3A[^\r\n]*Trojaner-Info<webmaster@trojaner-info\x2Ede>	2	0	0	1
+484	484	^From\x3a[^\r\n]*SpyBuddy	2	0	0	1
+485	485	^GET \x2F3010[0-9A-F]{166}00000001	2	0	0	1
+486	486	^GET\s+.*\x2Frequests\x2Fstatus\.xml\x3F.*smb\x3A\x2F\x2F[^\s\x0A\x0D]{251}	2	0	0	1
+487	487	^Host:\s*?[a-f0-9]{16}\.	2	0	0	1
+488	488	^Host:\s*?[a-f0-9]{63,64}\.	2	0	0	1
+489	489	^Host\x3A\s+.*jaiku\x2Ecom	2	0	0	1
+490	490	^Host\x3a[^\r\n]*cojud\x2Edmcast\x2Ecom	2	0	0	1
+491	491	^Host\x3a[^\r\n]*corep\x2Edmcast\x2Ecom	2	0	0	1
+492	492	^Host\x3a[^\r\n]*dcww\x2Edmcast\x2Ecom	2	0	0	1
+493	493	^Host\x3a[^\r\n]*related\x2Eyok\x2Ecom	2	0	0	1
+494	494	^Host\x3a[^\r\n]*www\x2Eyok\x2Ecom	2	0	0	1
+495	495	^Host\x3a\s*(194.192.14.125|202.75.58.179|flashupdates.info|nvidiadrivers.info|videosync.info)	2	0	0	1
+496	496	^Host\x3a\s*(cache.dyndns.info|flashcenter.info|flashrider.org|webapp.serveftp.com|web.velocitycache.com)	2	0	0	1
+497	497	^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\r?\n	2	0	0	1
+498	498	^Location:\s*?https?\x3a\x2f{2}[0-9a-f]{16}[^/]+?\/index.php\?[a-z]=[^&\r\n]{100}	2	0	0	1
+499	499	^Location\x3a[^\n]*file\x3a\x2f\x2f127\x2e0\x2e0\x2e1	2	0	0	1
+500	500	^POST\x20\x2fg[ao]lfstream\x26	2	0	0	1
\ No newline at end of file
diff --git a/test/benchmark/regex_rules/REGEX_5K b/test/benchmark/regex_rules/REGEX_5K
new file mode 100644
index 0000000..e78a023
--- /dev/null
+++ b/test/benchmark/regex_rules/REGEX_5K
@@ -0,0 +1,5001 @@
+5000
+1	1	User-Agent:\s.*.abc.net	2	0	0	1
+2	2	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*66757BFC-DA0C-41E6-B3FE-B6D461223FF5	2	0	0	1
+3	3	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1BE49F30-0E1B-11D3-9D8E-00C04F72D980	2	0	0	1
+4	4	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1C15D484-911D-11D2-B632-00C04F79498E	2	0	0	1
+5	5	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1DF7D126-4050-47F0-A7CF-4C4CA9241333	2	0	0	1
+6	6	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2C63E4EB-4CEA-41B8-919C-E947EA19A77C	2	0	0	1
+7	7	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*334125C0-77E5-11D3-B653-00C04F79498E	2	0	0	1
+8	8	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B0353C-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+9	9	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03543-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+10	10	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*37B03544-A4C8-11D2-B634-00C04F79498E	2	0	0	1
+11	11	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*418008F3-CF67-4668-9628-10DC52BE1D08	2	0	0	1
+12	12	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4A5869CF-929D-4040-AE03-FCAFC5B9CD42	2	0	0	1
+13	13	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*577FAA18-4518-445E-8F70-1473F8CF4BA4	2	0	0	1
+14	14	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*59DC47A8-116C-11D3-9D8E-00C04F72D980	2	0	0	1
+15	15	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F9CB14D-48E4-43B6-9346-1AEBC39C64D3	2	0	0	1
+16	16	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*823535A0-0318-11D3-9D8E-00C04F72D980	2	0	0	1
+17	17	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8872FF1B-98FA-4D7A-8D93-C9F1055F85BB	2	0	0	1
+18	18	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4C-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+19	19	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8A674B4D-1F63-11D3-B64C-00C04F79498E	2	0	0	1
+20	20	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9CD64701-BDF3-4D14-8E03-F12983D86664	2	0	0	1
+21	21	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9E77AAC4-35E5-42A1-BDC2-8F3FF399847C	2	0	0	1
+22	22	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A1A2B1C4-0E3A-11D3-9D8E-00C04F72D980	2	0	0	1
+23	23	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E3074E-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+24	24	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+25	25	(EnableStartApplication|EnableStartBeforePrint|EnableKeepExistingFiles|EnablePassParameters)	2	0	0	1
+26	26	(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+27	27	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+28	28	(ReadMolFile|SaveasMolFile)	2	0	0	1
+29	29	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+30	30	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22DirectAnimation\.PathControl\x22|\x27DirectAnimation\.PathControl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+31	31	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6E449683-C509-11CF-AAFA-00AA00B6015C	2	0	0	1
+32	32	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22ASControls\.InstallEngineCtl\x22|\x27ASControls\.InstallEngineCtl\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+33	33	new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\)|(\w+)[\r\n\s]*=[\r\n\s]*(\x22Shell\.Application\x22|\x27Shell\.Application\x27)[\r\n\s]*\x3b.*new[\r\n\s]*ActiveXObject[\r\n\s]*\([\r\n\s]*[\r\n\s]*\)	2	0	0	1
+34	34	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*13709620-C279-11CE-A49E-444553540000	2	0	0	1
+35	35	file\:.*\.(jpg|ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+36	36	[0-9]{3,}	2	0	0	1
+37	37	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*032038A5-B655-11D3-BB7D-0050DA276194	2	0	0	1
+38	38	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*34E7A6F9-F260-46BD-AAC8-1E70E22139D2	2	0	0	1
+39	39	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C92840-EB1C-40BD-B6A5-395EC9CD6510	2	0	0	1
+40	40	(setInstallerType|setAdditionalPackages|installLatestJRE|compareVersion|installJRE|getStaticCLSID|launch)	2	0	0	1
+41	41	param[^>]*name\s*=\s*["']?productname["']?[^>]*\s+value\s*=\s*(['"])(().|\\['"]){20}	2	0	0	1
+42	42	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B7ECFD41-BE62-11D2-B9A8-00104B138C8C	2	0	0	1
+43	43	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+44	44	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E68E401C-7DB0-4F3A-88E1-159882468A79	2	0	0	1
+45	45	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BF4C7B03-F381-4544-9A33-CB6DAD2A87CD	2	0	0	1
+46	46	(Text|EditSelText|EditText|CellFontName|Archive)	2	0	0	1
+47	47	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+48	48	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723f97-7aa0-11d4-8919-ff2d71d0d32c	2	0	0	1
+49	49	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02BF25D5-8C17-4B23-BC80-D3488ABDDC6B	2	0	0	1
+50	50	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAFEEFAC-DEC7-0000-0000-ABCDEFFEDCBA	2	0	0	1
+51	51	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+offer-(ineligible|preinstalled|declined|accepted)	2	0	0	1
+52	52	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E2883E8F-472F-4fb0-9522-AC9BF37916A7.+(service-url|banner|noexec|OS|Lang|return-page|core-product|userid|itemid|_c[xy]|sec-param|secparam)	2	0	0	1
+53	53	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2E30750-6C3D-11D3-B653-00C04F79498E	2	0	0	1
+54	54	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AD8E510D-217F-409B-8076-29C5E73B98E8	2	0	0	1
+55	55	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B0EDF163-910A-11D2-B632-00C04F79498E	2	0	0	1
+56	56	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B64016F3-C9A2-4066-96F0-BD9563314726	2	0	0	1
+57	57	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BB530C63-D9DF-4B49-9439-63453962E598	2	0	0	1
+58	58	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C531D9FD-9685-4028-8B68-6E1232079F1E	2	0	0	1
+59	59	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCC-9B79-11D3-B654-00C04F79498E	2	0	0	1
+60	60	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCE-9B79-11D3-B654-00C04F79498E	2	0	0	1
+61	61	(exe|bat|com|dll|ini)	2	0	0	1
+62	62	(exe|bat|com|dll|ini)	2	0	0	1
+63	63	(exe|bat|com|dll|ini)	2	0	0	1
+64	64	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C5702CCF-9B79-11D3-B654-00C04F79498E	2	0	0	1
+65	65	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6B14B32-76AA-4A86-A7AC-5C79AAF58DA7	2	0	0	1
+66	66	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CAAFDD83-CEFC-4E3D-BA03-175F17A24F91	2	0	0	1
+67	67	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D02AAC50-027E-11D3-9D8E-00C04F72D980	2	0	0	1
+68	68	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FA7C375B-66A7-4280-879D-FD459C84BB02	2	0	0	1
+69	69	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*011B3619-FE63-4814-8A84-15A194CE9CE3	2	0	0	1
+70	70	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0149EEDF-D08F-4142-8D73-D23903D21E90	2	0	0	1
+71	71	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E5-45B6-11D3-B650-00C04F79498E	2	0	0	1
+72	72	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0369B4E6-45B6-11D3-B650-00C04F79498E	2	0	0	1
+73	73	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*055CB2D7-2969-45CD-914B-76890722F112	2	0	0	1
+74	74	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15D6504A-5494-499C-886C-973C9E53B9F1	2	0	0	1
+75	75	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6	2	0	0	1
+76	76	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC8A96C6-3909-11D5-9001-00C04F4C3B9F	2	0	0	1
+77	77	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A105BD70-BF56-4D10-BC91-41C88321F47C	2	0	0	1
+78	78	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3895DD35-7573-11D2-8FED-00606730D3AA	2	0	0	1
+79	79	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*233C1507-6A77-46A4-9443-F871F945D258	2	0	0	1
+80	80	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B	2	0	0	1
+81	81	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1	2	0	0	1
+82	82	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*63716E93-033D-48B0-8A2F-8E8473FD7AC7	2	0	0	1
+83	83	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18477169-4752-41DC-AB0F-C50EBA75641D	2	0	0	1
+84	84	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15B168B2-AD3C-11D1-A8D8-00A0C9200E61	2	0	0	1
+85	85	(Src|Background|PackageXml)	2	0	0	1
+86	86	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(EnableKeepExistingFiles|EnableStartApplication|EnableStartBeforePrint|EnablePassParameters)	2	0	0	1
+87	87	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5\s*(SetApplicationPath|SetStartApplicationParamCode|SetCustomStartAppParameter)	2	0	0	1
+88	88	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+89	89	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+90	90	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1503569A-0AE2-4333-B6E6-466AB0BC73E5	2	0	0	1
+91	91	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4F647AD-B160-11D2-A3EF-00104BDF4755	2	0	0	1
+92	92	(Save|SaveLayoutChanges|SaveMenuUsageData)	2	0	0	1
+93	93	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F685AFD8-A5CC-410E-98E4-BAA1C559BA61	2	0	0	1
+94	94	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00200338-3D33-4FFC-AC20-67AA234325F3	2	0	0	1
+95	95	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+96	96	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0CEA3FB1-7F88-4803-AA8E-AD021566955D	2	0	0	1
+97	97	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+98	98	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*18A76B9A-45C1-11D3-80DC-00C04F6B92D0	2	0	0	1
+99	99	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4C39376E-FA9D-4349-BACC-D305C1750EF3	2	0	0	1
+100	100	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C3EB1670-84E0-4EDA-B570-0B51AAE81679	2	0	0	1
+101	101	(SaveFile|ExportToXML)	2	0	0	1
+102	102	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*05563215-225C-45EB-BB34-AFA47217B1DE	2	0	0	1
+103	103	(SnapShotToFile|SnapShotX)	2	0	0	1
+104	104	(SnapShotToFile|SnapShotX)	2	0	0	1
+105	105	(SnapShotToFile|SnapShotX)	2	0	0	1
+106	106	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+107	107	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B69003B3-C55E-4B48-836C-BC5946FC3B28	2	0	0	1
+108	108	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E87F6C8E-16C0-11D3-BEF7-009027438003	2	0	0	1
+109	109	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+110	110	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+111	111	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+112	112	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A801FD2B-6FA8-11D0-BB85-00AA00A7EAAE	2	0	0	1
+113	113	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*98C53984-8BF8-4D11-9B1C-C324FCA9CADE	2	0	0	1
+114	114	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CDBD9968-7BF1-11D4-9D36-0001029DEBEB	2	0	0	1
+115	115	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*366C9C52-C402-416B-862D-1464F629CA59.+(LoadFile|SaveFile)	2	0	0	1
+116	116	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*00000032-9593-4264-8B29-930B3E4EDCCD	2	0	0	1
+117	117	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1A01FF01-EA62-4702-B837-1E07158145FA	2	0	0	1
+118	118	(Run|SetRegistryValueAsString|PerformUpdateAsync)	2	0	0	1
+119	119	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+120	120	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C372350A-1D5A-44DC-A759-767FC553D96C	2	0	0	1
+121	121	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*74FFE28D-2378-11D5-990C-006094235084	2	0	0	1
+122	122	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D7A7D7C3-D47F-11D0-89D3-00A0C90833E6	2	0	0	1
+123	123	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B4DC8DD9-2CC1-4081-9B2B-20D7030234EF	2	0	0	1
+124	124	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C63344D8-70D3-4032-9B32-7A3CAD5091A5	2	0	0	1
+125	125	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*353359C1-39E1-491b-9951-464FD8AB071C	2	0	0	1
+126	126	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5DFB2651-9668-11D0-B17B-00C04FC2A0CA	2	0	0	1
+127	127	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*39A2C2A6-4778-11D2-9BDB-204C4F4F5020	2	0	0	1
+128	128	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3DA2AA3E-3D96-11D2-9BD2-204C4F4F5020	2	0	0	1
+129	129	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E8C31D11-6FD2-4659-AD75-155FA143F42B	2	0	0	1
+130	130	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44C79591-D0DE-49C4-BA3C-A45AB7003356	2	0	0	1
+131	131	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1B544C24-FD0B-11CE-8C63-00AA0044B520	2	0	0	1
+132	132	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*1CB1623E-BBEC-4E8D-B2DF-DC08C6F4627C	2	0	0	1
+133	133	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2D20D4BB-B47E-4FB7-83BD-E3C2EE250D26	2	0	0	1
+134	134	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31087270-D348-432C-899E-2D2F38FF29A0	2	0	0	1
+135	135	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*41D2B841-7692-4C83-AFD3-F60E845341AF	2	0	0	1
+136	136	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2EA10031-0033-450E-8072-E27D9E768142	2	0	0	1
+137	137	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4D4C9FEF-ED80-47EA-A3FA-3215FDBB33AB	2	0	0	1
+138	138	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0D076C5-E4C6-4561-8BF4-80DA8DB819D7	2	0	0	1
+139	139	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4F3E50BD-A9D7-4721-B0E1-00CB42A0A747	2	0	0	1
+140	140	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*586FB486-5560-4FF3-96DF-1118C96AF456	2	0	0	1
+141	141	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5B4B05EB-1F63-446B-AAD1-E10A34D650E0	2	0	0	1
+142	142	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*679E132F-561B-42F8-846C-A70DBDC62999	2	0	0	1
+143	143	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6C68955E-F965-4249-8E18-F0977B1D2899	2	0	0	1
+144	144	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7F1232EE-44D7-4494-AB8B-CC61B10E21A5	2	0	0	1
+145	145	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*92883667-E95C-443D-AC96-4CACA27BEB6E	2	0	0	1
+146	146	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2EDA89A-0966-4B91-9C18-AB69F098187F	2	0	0	1
+147	147	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C44C65C7-FDF1-453D-89A5-BCC28F5D69F9	2	0	0	1
+148	148	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C6CB1FE3-B05E-4F0E-818F-C83ED5A0332F	2	0	0	1
+149	149	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AECF5D2E-7A18-4DD2-BDCD-29B6F615B448	2	0	0	1
+150	150	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BC0D69A8-0923-4EEE-9375-9239F5A38B92	2	0	0	1
+151	151	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C8F209F8-480E-454C-94A4-5392D88EBA0F	2	0	0	1
+152	152	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CC45B0B0-72D8-4652-AE5F-5E3E266BE7ED	2	0	0	1
+153	153	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFFB1FC7-270D-4986-B299-FECF3F0E42DB	2	0	0	1
+154	154	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E188F7A3-A04E-413E-99D1-D79A45F70305	2	0	0	1
+155	155	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E476CBFF-E229-4524-B6B7-228A3129D1C7	2	0	0	1
+156	156	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EF105BC3-C064-45F1-AD53-6D8A8578D01B	2	0	0	1
+157	157	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EFEE43D6-BFE5-44B0-8063-AC3B2966AB2C	2	0	0	1
+158	158	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F44BB2D0-F070-463E-9433-B0CCF3CFD627	2	0	0	1
+159	159	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A20FD6F-F8FE-4a22-9EE7-307D72D09E6E	2	0	0	1
+160	160	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*ADEADEB8-E54B-11d1-9A72-0000F875EADE	2	0	0	1
+161	161	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*EC85D8F1-1C4E-46e4-A748-7AA04E7C0496	2	0	0	1
+162	162	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A2D4529E-84E0-4550-A2E0-C25D7C5CC0D0	2	0	0	1
+163	163	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E673DCF2-C316-4c6f-AA96-4E4DC6DC291E	2	0	0	1
+164	164	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D74CA70F-2236-4BA8-A297-4B2A28C2363C	2	0	0	1
+165	165	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*01002B17-5D93-4551-81E4-831FEF780A53	2	0	0	1
+166	166	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*648A5600-2C6E-101B-82B6-000000000014	2	0	0	1
+167	167	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+168	168	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*8D9563A9-8D5F-459B-87F2-BA842255CB9A	2	0	0	1
+169	169	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*04D18721-749F-4140-AEB0-CAC099CA4741	2	0	0	1
+170	170	(SaveToBMP|SaveToFile)	2	0	0	1
+171	171	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D8089245-3211-40F6-819B-9E5E92CD61A2	2	0	0	1
+172	172	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9796BED2-C1CF-11D2-9384-0008C7396667	2	0	0	1
+173	173	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+174	174	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+175	175	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*7606693A-C18D-4567-AF85-6194FF70761E	2	0	0	1
+176	176	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D22DE742-04CD-4B5C-A8A3-82AB3DAEC43D	2	0	0	1
+177	177	(SaveBarCode|SaveEnhWMF)	2	0	0	1
+178	178	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*DD50A655-10FB-11D2-A22B-00104B27F81B	2	0	0	1
+179	179	<object\s*[^>]*\s*classid\s*=\s*(.+<q1>\x22|\x27|)\s*clsid\s*\x3a\s*{?\s*7390f3d8-0439-4c05-91e3-cf5cb290c3d0\s*}?\s*(\=q1)(\s|>)	2	0	0	1
+180	180	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C26D9CA8-6747-11D5-AD4B-C01857C10000	2	0	0	1
+181	181	(exe|bat|com|dll|ini)	2	0	0	1
+182	182	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*9FAFB576-6933-4CCC-AB3D-B988EC43D04E	2	0	0	1
+183	183	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*AFBBE070-7340-11d2-AA6B-00E02924C34E	2	0	0	1
+184	184	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*77F12F8A-F117-11D0-8CF1-00A0C91D9D87	2	0	0	1
+185	185	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+186	186	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+187	187	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+188	188	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+189	189	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C0A63B86-4B21-11D3-BD95-D426EF2C7949	2	0	0	1
+190	190	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A76CEBEE-7364-11D2-AA6B-00E02924C34E	2	0	0	1
+191	191	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A009C90D-814B-11D3-BA3E-080009D22344	2	0	0	1
+192	192	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E3462D53-47A6-11D8-8EF6-DAE89272743C	2	0	0	1
+193	193	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6EEFD7B1-B26C-440D-B55A-1EC677189F30	2	0	0	1
+194	194	(Packagefiles|SaveDna|SetIdentity|AddFile)	2	0	0	1
+195	195	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D59EBAD7-AF87-4A5C-8459-D3F6B918E7C9	2	0	0	1
+196	196	(_DOWText)|(_MonthText)	2	0	0	1
+197	197	(SetupDeleteVolume|GetBackupLocationPath|CallUninstall|CanUseEasySetup|CallAddInitialProtection|CallTour)	2	0	0	1
+198	198	classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*69DEAF94-AF66-11D3-BEC0-00105AA9B6AE	2	0	0	1
+199	199	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+200	200	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B44D252D-98FC-4D5C-948C-BE868392A004	2	0	0	1
+201	201	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E381F1C0-910E-11D1-AB1E-00A0C90F8F6F	2	0	0	1
+202	202	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*02C2DD87-2E67-11D2-96EF-0000861852D5	2	0	0	1
+203	203	[\w\W]{2500,}	2	0	0	1
+204	204	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A0D43FB0-116B-47AB-80FB-6DCFA92A03E3	2	0	0	1
+205	205	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s* \x7B?\s*A6F36F3F-3AE0-458B-AFC4-AA82565E0BF8	2	0	0	1
+206	206	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*44A8091F-8F01-43B7-8CF7-4BBA71E61E04	2	0	0	1
+207	207	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*07DD3249-A591-4949-8F20-09CD347C69DC.+(DeleteValue|WriteValue)	2	0	0	1
+208	208	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*C2828995-4A83-4100-A212-3024BA117356	2	0	0	1
+209	209	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F4A32EAF-F30D-466D-BEC8-F4ED86CAF84E	2	0	0	1
+210	210	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B94C2238-346E-4C5E-9B36-8CC627F35574	2	0	0	1
+211	211	(WriteIniFileString|ShellExecute)	2	0	0	1
+212	212	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B727C217-2022-11D4-B2C6-0050DA1BD906	2	0	0	1
+213	213	(txt|ini|com|exe|bat|dll|dat)	2	0	0	1
+214	214	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*72C24DD5-D70A-438B-8A42-98424B88AFB8	2	0	0	1
+215	215	42B07B28-2280-4937-B035-0293FB812781|542FB453-5003-11CF-92A2-00AA00B8A733	2	0	0	1
+216	216	(Save|ExportImage)	2	0	0	1
+217	217	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*6B1E11AC-BF5C-4CF5-9DC9-F81F715EB790	2	0	0	1
+218	218	(DeleteFile|write)	2	0	0	1
+219	219	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+220	220	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+221	221	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+222	222	(SaveAsBMP|SaveAsWMF)	2	0	0	1
+223	223	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4871A87A-BFDD-4106-8153-FFDE2BAC2967	2	0	0	1
+224	224	WBEM\x2ESingleViewCtrl\x2E1.+(AddContextRef|ReleaseContext)	2	0	0	1
+225	225	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B68B7EB-02FF-4A41-BC14-3C303BB853F9	2	0	0	1
+226	226	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FDC7A535-4070-4B92-A0EA-D9994BCC0DC5	2	0	0	1
+227	227	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*930FD02C-BBE7-4EB9-91CF-FC45CC91E3E6	2	0	0	1
+228	228	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*36723F97-7AA0-11D4-8919-FF2D71D0D32C	2	0	0	1
+229	229	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*68AC0D5F-0424-11D5-822F-00C04F6BA8D9	2	0	0	1
+230	230	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F647CBE5-3C01-402A-B3F0-502A77054A24	2	0	0	1
+231	231	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*4932CEF4-2CAA-11D2-A165-0060081C43D9	2	0	0	1
+232	232	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CFCDAA03-8BE4-11CF-B84B-0020AFBBCCFA	2	0	0	1
+233	233	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5.+(Exec|ExecLow|ShellExec)	2	0	0	1
+234	234	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5818813E-D53D-47A5-ABBB-37E2A07056B5	2	0	0	1
+235	235	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+236	236	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+237	237	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*80AB3FB6-9660-416C-BE8D-0E2E8AC3138B	2	0	0	1
+238	238	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*333C7BC4-460F-11D0-BC04-0080C7055A83	2	0	0	1
+239	239	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*3A86F1F2-4921-4C75-AF2C-A1AA241E12BA	2	0	0	1
+240	240	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*55963676-2F5E-4BAF-AC28-CF26AA587566	2	0	0	1
+241	241	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+242	242	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2E980303-C865-11CF-BA24-444553540000	2	0	0	1
+243	243	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*79956462-F148-497F-B247-DF35A095F80B	2	0	0	1
+244	244	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0014085F-B1BA-11CE-ABC6-F5B2E79D9E3F	2	0	0	1
+245	245	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+246	246	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*27527D31-447B-11D5-A46E-0001023B4289	2	0	0	1
+247	247	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*A6FC2988-16BE-4053-BE89-F562431FD6ED	2	0	0	1
+248	248	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*0B70AB61-5C95-4126-9985-A32531CA8619	2	0	0	1
+249	249	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*979AE8AA-C206-40EC-ACA7-EC6B6BD7BE5E	2	0	0	1
+250	250	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FCB4B50A-E3F1-4174-BD18-54C3B3287258	2	0	0	1
+251	251	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*BDEB0088-66F9-4A55-ABD2-0BF8DEEC1196	2	0	0	1
+252	252	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*FAB9B41C-87D6-474D-AB7E-F07D78F2422E	2	0	0	1
+253	253	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*536600D3-70FE-4C50-92FB-640F6BFC49AD	2	0	0	1
+254	254	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6C10489-FB89-11D4-93C9-006008A7EED4	2	0	0	1
+255	255	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*658ED6E7-0DA1-4ADD-B2FB-095F08091118	2	0	0	1
+256	256	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*67DABFBF-D0AB-41fa-9C46-CC0F21721616	2	0	0	1
+257	257	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+258	258	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+259	259	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*B6FCC215-D303-11D1-BC6C-0000C078797F	2	0	0	1
+260	260	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*adb880a6-d8ff-11cf-9377-00aa003b7a11	2	0	0	1
+261	261	(ActiveXObject|CreateObject)\s*\(\s*(\x22|\x27)PLAYERPT\.PlayerPTCtrl\.1	2	0	0	1
+262	262	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E5D2CE27-5FA0-11D2-A666-204C4F4F5020	2	0	0	1
+263	263	(PostURL|AddSeperator|AddString|Post)	2	0	0	1
+264	264	(SetBgColor|SetMovieName|SetTarget|SetMatrix|SetHREF)	2	0	0	1
+265	265	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*E589DA78-AD4C-4FC5-B6B9-9E47B110679E\s*}?\s*(.*)(\s|>)	2	0	0	1
+266	266	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*25982EAA-87CC-4747-BE09-9913CF7DD2F1\s*}?(.*)\>	2	0	0	1
+267	267	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*BECB8EE1-6BBB-4A85-8DFD-099B7A60903A\s*}?(.*)\>	2	0	0	1
+268	268	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*62A989CE-D39A-11D5-86F0-B9C370762176\s*}?(.*)\>	2	0	0	1
+269	269	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*D27CDB6E-AE6D-11cf-96B8-444553540000\s*}?(.*)\>	2	0	0	1
+270	270	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+271	271	(Buildpath|GetDriveName|DriveExists|DeleteFile)	2	0	0	1
+272	272	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+273	273	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+274	274	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*E7B62F4E-82F4-11D2-BD41-00105A0A7E89	2	0	0	1
+275	275	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*8234E54E-20CB-4A88-9AB6-7986F99BE243\s*}?\s*(.*)(\s|>)	2	0	0	1
+276	276	\x2e[RemoveAccessPermission|AddLaunchPermission|AddAccessPermission|RemoveLaunchPermission]	2	0	0	1
+277	277	<object\s*[^>]*\s*classid\s*=\s*[\x22|\x27]\s*clsid\s*\x3a\s*{?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08\s*}?(.*)\>	2	0	0	1
+278	278	000(2(042[1-5]|1401|000D)|6F071)-0000-0000-C000-000000000046|6E2271(FB|0[9A-F])-F799-11CF-9227-00AA00A1EB95|ECAB(AFC0|B0AB)-7F19-11D2-978E-0000F8757E2A|3050F4F5-98B5-11CF-BB82-00AA00BDCE0B|DF0B3D60-548F-101B-8E65-08002B2BD119|2D2E24CB-0CD5-458F-86EA-3E6FA22C8E64|51B4ABF3-748F-4E3B-A276-C828330E926A|E4979309-7A32-495E-8A92-7B014AAD4961|62EC9F22-5E30-11D2-97A1-00C04FB6DD9A|B1D4ED44-EE64-11D0-97E6-00C04FC30B4A|D675E22B-CAE9-11D2-AF7B-00C04F99179F	2	0	0	1
+279	279	(javascript|http|ftp|vbscript)	2	0	0	1
+280	280	(SendCommand|Login|Snapshot|_DownloadPBControl|_DownloadPBClose|_DownloadPBOpen)	2	0	0	1
+281	281	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*CA8A9780-280D-11CF-A24D-444553540000	2	0	0	1
+282	282	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*5A074B2B-F830-49DE-A31B-5BB9D7F6B407	2	0	0	1
+283	283	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*189504B8-50D1-4AA8-B4D6-95C8F58A6414	2	0	0	1
+284	284	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+285	285	(AddAttachment|SubmitToExpress)	2	0	0	1
+286	286	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*11E7DA45-B56D-4078-89F6-D3D651EC4CD6	2	0	0	1
+287	287	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*15DBC3F9-9F0A-472E-8061-043D9CEC52F0	2	0	0	1
+288	288	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*24DC3975-09BF-4231-8655-3EE71F43837D	2	0	0	1
+289	289	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*31AE647D-11D1-4E6A-BE2D-90157640019A.+(Execute|Run|CreateLocalFile|CreateLocalFolder|DeleteLocalFile)	2	0	0	1
+290	290	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*73F57628-B458-11D4-9673-00A0D212FC63\s*}?\s*(.*)\>	2	0	0	1
+291	291	<object\s*[^>]*\s*classid\s*=\s*[\x22\x27]\s*clsid\s*\x3a\s*{?\s*DC922B67-FF61-455E-9D79-959925B6695C\s*}?\s*(.*)\>	2	0	0	1
+292	292	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*824C4DC5-8DA4-11D6-A01F-00E098177CDC	2	0	0	1
+293	293	src\s*=\s*[\x22\x27]?hcp\x3a\x2f\x2F[^\n]*?(%3c|<)script[^\n]*?defer[^\n]*?unescape	2	0	0	1
+294	294	(LogFile|ClearLogFile|SaveToFile)	2	0	0	1
+295	295	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*2745E5F5-D234-11D0-847A-00C04FD7BB08.+(AddContextRef|ReleaseContext)	2	0	0	1
+296	296	^User-Agent\x3a Downloader \d\.\d\r?$/Hm	2	0	0	1
+297	297	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x7c/P	2	0	0	1
+298	298	^((\r?\n\r?\n).)*?\r?\n\r?\nMZ	2	0	0	1
+299	299	instructions\/\d{2}\.xml	2	0	0	1
+300	300	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/downloads\/record_download\.asp	2	0	0	1
+301	301	\/updatestats\/update\d+?\.xml$	2	0	0	1
+302	302	(GET |GET (http|https)\:\/\/[-0-9a-z.]*)\/WildApp\.cab	2	0	0	1
+303	303	ctxad-\d+\.sig	2	0	0	1
+304	304	/user\d+/counter\.htm	2	0	0	1
+305	305	(cartao|mensagem|voxcards|humortadela|ouca|cartaovirtual|uol3171|embratel|yahoo|viewforhumor|humormenssagem|terra)\.scr	2	0	0	1
+306	306	(discador|ocartao|msgav|extrato|correcao|extrato_tim|visualizar|cartas&cartoes|embratel|cartao|MSN_INSTALL|VirtualCards|atualizacaonorton|serasar|CobrancaEmbratel|ExtratoTim|FlashFotos|Vacina-Norton|CartaoIloves|Cobranca|fotos_ineditas|boletocobranca|saudades|wwwuolcartoescombr|cartaoanimado)\.exe	2	0	0	1
+307	307	loaderadv\d+\.jar	2	0	0	1
+308	308	\/adv\/\d+\/win32\.exe	2	0	0	1
+309	309	\/Message\/\S+\/\S+\.xml	2	0	0	1
+310	310	\/abt\?data=\S{150}	2	0	0	1
+311	311	^User-Agent\x3a.+ZangoToolbar.+\r$/Hmi	2	0	0	1
+312	312	User-Agent\:[^\n]+wbi_v\d/iH	2	0	0	1
+313	313	User-Agent\x3a[^\n]+AskBar/iH	2	0	0	1
+314	314	\/tbrequest\d+\.php	2	0	0	1
+315	315	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+316	316	sn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+317	317	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+318	318	cn=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+319	319	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+320	320	UID=\d	2	0	0	1
+321	321	mac=0\w\:\w\w\:\w\w\:\w\w\:\w\w\:\w\w	2	0	0	1
+322	322	REGISTER\x7c\d+\x7c\d+\x7c\d+\x7c\d/P	2	0	0	1
+323	323	victim\.php\?\d\d\d\d\d	2	0	0	1
+324	324	\/Pro\/pro\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d	2	0	0	1
+325	325	\/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+	2	0	0	1
+326	326	&ID=\x7b[0-9A-F]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\x7d	2	0	0	1
+327	327	\/sd\?s=\d+&f=\d&C=\d	2	0	0	1
+328	328	\.txt$	2	0	0	1
+329	329	\.cfg$	2	0	0	1
+330	330	User-Agent\x3A\x20[^\r\n]*\x2Edll\x0D\x0A/H	2	0	0	1
+331	331	^Accept\x3a\x20[^\r\n]+\r\nUser-Agent\x3a\x20[^\r\n]+\r\nHost\x3a\x20[^\r\n]+\r?$/Hi	2	0	0	1
+332	332	\x00[\x02-\x1E][0-9]{2,30}\x02cn\x00	2	0	0	1
+333	333	\x00[\x02-\x1E][0-9]{2,30}\x02ru\x00	2	0	0	1
+334	334	^[A-F0-9]+$	2	0	0	1
+335	335	\/sd\?s=\d+&f=\d	2	0	0	1
+336	336	loadadv\d+\.exe	2	0	0	1
+337	337	\/ms\d\d\dcfg\.jsp	2	0	0	1
+338	338	^0x[0-9a-f]+$	2	0	0	1
+339	339	^[^a-z]*?[0-9]{2,30}\.ru$	2	0	0	1
+340	340	filename\x3D\x22[^\r\n]*antiv[^\n]+\.exe	2	0	0	1
+341	341	^MM \d\.\d+$	2	0	0	1
+342	342	^[a-z0-9]{1,3}\s*[0-9]\.[0-9]{1,2}\.[0-9]{2,4}	2	0	0	1
+343	343	^\w+pcsetup_\w+	2	0	0	1
+344	344	\x2Fv[0-9]{3,4}[\x2F\x3F]	2	0	0	1
+345	345	[a-f0-9]{32}\?v=	2	0	0	1
+346	346	^\/[a-z]{2}\x3Fv\x3D[0-9]$	2	0	0	1
+347	347	^\/(info|entrance|start|debug)\?s1=[a-f0-9]{100,}$	2	0	0	1
+348	348	^\/entrance\?s1=[a-f0-9]{100,}$	2	0	0	1
+349	349	^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=	2	0	0	1
+350	350	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+351	351	^[0-9][a-z]+	2	0	0	1
+352	352	\.php$	2	0	0	1
+353	353	^\/([^\x2f]+\/)*log\/\?[bc]=	2	0	0	1
+354	354	^\/v2\/(((intro_impr|s)ession|l(aunch|og)|exit)/|c((dn_(success|check)|ancel)/$|lick/))	2	0	0	1
+355	355	^\/\?pcrc=\d+&v=[\d.]+$	2	0	0	1
+356	356	^\/\?v=[\d.]+&pcrc=\d+$	2	0	0	1
+357	357	\/v\d\/[^.]+\.asp$	2	0	0	1
+358	358	\/(cld|update-effect)\?mid=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&(ct|st)=[a-z0-9]+$	2	0	0	1
+359	359	\/mu\?id=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&d=[A-Za-z]+&cl=\d+$	2	0	0	1
+360	360	^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$	2	0	0	1
+361	361	^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$	2	0	0	1
+362	362	\?alpha=([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})	2	0	0	1
+363	363	^Downloader\s\d+\.\d+$	2	0	0	1
+364	364	^\/([A-Za-z]+\d?\/)?\?q=([a-z0-9+/]*[A-Z])([A-Z0-9+/]*[a-z])([A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100}	2	0	0	1
+365	365	\/get_xml\?(file_id|stb)=	2	0	0	1
+366	366	(_[a-z]{2}){1,3}_[a-z]{3}_install\.exe	2	0	0	1
+367	367	\d{2}\.0\d{2}\.200\d{2}_English(_for)?_Windows	2	0	0	1
+368	368	^[a-zA-Z0-9_-]+$	2	0	0	1
+369	369	^\/([a-zA-Z0-9]|%2[fb]){400,}$	2	0	0	1
+370	370	User-Agent\:[^\n]+searchengine	2	0	0	1
+371	371	User-Agent\:[^\n]+SurferPlugin	2	0	0	1
+372	372	User-Agent\:[^\n]+THNALL[^\n]+\.EXE	2	0	0	1
+373	373	User-Agent\:[^\n]+XupiterToolbar	2	0	0	1
+374	374	User-Agent\:[^\n]+spywareaxe	2	0	0	1
+375	375	User-Agent\:[^\n]+iMeshBar	2	0	0	1
+376	376	User-Agent\:[^\n]+Oemji	2	0	0	1
+377	377	^\/debug\/Version\/\d_\d_\d_\d\d{1,2}?\/trace\/(mostrarFailed(EndLoading|ReadyState)|Get(XmlDataRequisites|BinaryData)|(DownloadRequisites|down_)Finish|Re(cievedXml|adyState)|PreDownloadRequisites|EndLoading|UserAdmin|Start)$	2	0	0	1
+378	378	^\x2Fevt\x2F\x3Fnexcb\x3D[a-f0-9\x2D]{10,}$	2	0	0	1
+379	379	^\/(get|install)\/\?q=	2	0	0	1
+380	380	^\/[a-f0-9]{50,}$	2	0	0	1
+381	381	^\/[\w-]{50,}$	2	0	0	1
+382	382	^\/\?pcrc=[0-9]{7,10}$	2	0	0	1
+383	383	^Downloader \d\.\d$	2	0	0	1
+384	384	\/Socks[45]\.txt$	2	0	0	1
+385	385	^Feat[^\r\n]+(Install|Updat)er	2	0	0	1
+386	386	User-Agent\:[^\n]+host(ie|oe|oi|ol)	2	0	0	1
+387	387	User-Agent\: \[.*\][A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}	2	0	0	1
+388	388	^BWL(\sToplist|\d_UPDATE)	2	0	0	1
+389	389	^\x2F[A-F0-9]{25,40}$	2	0	0	1
+390	390	^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$	2	0	0	1
+391	391	^\d+\sHTTP/1.1$	2	0	0	1
+392	392	^[a-zA-Z0-9_-]+	2	0	0	1
+393	393	[a-fA-F0-9]{8}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{4}\-[a-fA-F0-9]{12}	2	0	0	1
+394	394	\/advert\/get(ads|kws)(\.cgi)?\?(d|[ex]_dp_)id=	2	0	0	1
+395	395	\{[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\}	2	0	0	1
+396	396	CN=([^\r\n]+?\.)?showmypc\.com(\.)	2	0	0	1
+397	397	^[0-9a-fA-F]{8}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{4}\b-[0-9a-fA-F]{12}$	2	0	0	1
+398	398	(SU5TVEFMTF9JTkZP|lOU1RBTExfSU5GT|JTlNUQUxMX0lORk)	2	0	0	1
+399	399	(DQpTZXJ2ZXI6I|0KU2VydmVyOi|NClNlcnZlcjog)	2	0	0	1
+400	400	\d{13}$	2	0	0	1
+401	401	^[a-f0-9]{32}	2	0	0	1
+402	402	^[a-f0-9]{32}\"	2	0	0	1
+403	403	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+404	404	^[A-F0-9]{8}-([A-F0-9]{4}-){3}[A-F0-9]{12}	2	0	0	1
+405	405	^([A-F0-9]{2}\:){5}[A-F0-9]{2}	2	0	0	1
+406	406	^[A-F0-9]{12}	2	0	0	1
+407	407	^[A-Z0-9]{9}	2	0	0	1
+408	408	^\d+[^\r\n\s]+	2	0	0	1
+409	409	^ SQL[-_ ]Server	2	0	0	1
+410	410	^ \d+ Driver	2	0	0	1
+411	411	ORA-\d{4}	2	0	0	1
+412	412	Warning.*\Woci_	2	0	0	1
+413	413	Warning.*\Wora_	2	0	0	1
+414	414	CLI Driver.*DB2	2	0	0	1
+415	415	bdb2_\w+\(	2	0	0	1
+416	416	Exception.*Informix	2	0	0	1
+417	417	Warning.*SQLite3::	2	0	0	1
+418	418	SQL error.*POS\([0-9]+\)	2	0	0	1
+419	419	Warning.*maxdb	2	0	0	1
+420	420	i?Warning.*sybase	2	0	0	1
+421	421	Warning.*ingres_	2	0	0	1
+422	422	Warning.*sqlite_	2	0	0	1
+423	423	Ingres\W.*Driver	2	0	0	1
+424	424	Exception (condition )\d+\. Transaction rollback\.	2	0	0	1
+425	425	SQL Server.*?error \x27[0-9a-f]{8}	2	0	0	1
+426	426	^(\d{1,3}\.){3}\d{1,3}\/\d+\x00$	2	0	0	1
+427	427	^(<dll_name>[a-z0-9\-_]{1,20})\.dll\s*\\\\(([0-9]{1,3}\.){3}[0-9]{1,3}|([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})\\\w{1,10}\$\\Windows\\System32\\(=dll_name)\.dll	2	0	0	1
+428	428	^...\x30\x82..\x02\x82...{256,257}	2	0	0	1
+429	429	\/wp-content\/uploads\/optpress\/images\_(comingsoon|lncthumbs|optbuttons)\/.*?\.php	2	0	0	1
+430	430	\/notify\/(single|mass)$	2	0	0	1
+431	431	a=(S(e(lfRemove|cInfo)|tringTools|afeMode|ql)|(Bruteforc|Consol)e|FilesMan|Network|Logout|Php)	2	0	0	1
+432	432	Content\x2dSalt\x3a\x20[0-9\.\-]+\x0d\x0a	2	0	0	1
+433	433	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+434	434	[-\d]{1,4}(\x2c\x31\x25\x25\x27\x3a\x7e[-\d]{1,4}){10}	2	0	0	1
+435	435	^\d+(\+|\-|\\|\*)\d+	2	0	0	1
+436	436	^[^\r\n]+(mine\.moneropool|xmr\.crypto-pool|monerohash)[^\r\n]+kill\x20\-9	2	0	0	1
+437	437	^[\r\n\s]*=[\r\n\s]*unescape\(\s*[\x22\x27][\\%]u	2	0	0	1
+438	438	ElseIf\s+\x28\x24\w{8,10}\s+\x2deq\s+\x27\w{2}\x27\x29\s+\x7b	2	0	0	1
+439	439	^\d{4}[01]	2	0	0	1
+440	440	^\d{4}[01]	2	0	0	1
+441	441	^\d{4}[01]	2	0	0	1
+442	442	^\d{4}[01]	2	0	0	1
+443	443	^\d{4}[01]	2	0	0	1
+444	444	^\d{4}[01]	2	0	0	1
+445	445	^\d{4}[01]	2	0	0	1
+446	446	^\d{4}[01]	2	0	0	1
+447	447	^\d{4}[01]	2	0	0	1
+448	448	^\d{4}[01]	2	0	0	1
+449	449	^\d{4}[01]	2	0	0	1
+450	450	^\d{4}[01]	2	0	0	1
+451	451	^\d{4}[01]	2	0	0	1
+452	452	^\d{4}[01]	2	0	0	1
+453	453	^\d{4}[01]	2	0	0	1
+454	454	^\d{4}[01]	2	0	0	1
+455	455	^\d{4}[01]	2	0	0	1
+456	456	^\d{4}[01]	2	0	0	1
+457	457	^\d{4}[01]	2	0	0	1
+458	458	^\d{4}[01]	2	0	0	1
+459	459	^\d{4}[01]	2	0	0	1
+460	460	^\d{4}[01]	2	0	0	1
+461	461	^\d{4}[01]	2	0	0	1
+462	462	^\d{4}[01]	2	0	0	1
+463	463	^\d{4}[01]	2	0	0	1
+464	464	^\d{4}[01]	2	0	0	1
+465	465	^\d{4}[01]	2	0	0	1
+466	466	^\d{4}[01]	2	0	0	1
+467	467	^\d{4}[01]	2	0	0	1
+468	468	^\d{4}[01]	2	0	0	1
+469	469	^\d{4}[01]	2	0	0	1
+470	470	^\d{4}[01]	2	0	0	1
+471	471	^\d{4}[01]	2	0	0	1
+472	472	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+473	473	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+474	474	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+475	475	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+476	476	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+477	477	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+478	478	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+479	479	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+480	480	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+481	481	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+482	482	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+483	483	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+484	484	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+485	485	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+486	486	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+487	487	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+488	488	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+489	489	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+490	490	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+491	491	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+492	492	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+493	493	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+494	494	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+495	495	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+496	496	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+497	497	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+498	498	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+499	499	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+500	500	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+501	501	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+502	502	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+503	503	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+504	504	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+505	505	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+506	506	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+507	507	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+508	508	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+509	509	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+510	510	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+511	511	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+512	512	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+513	513	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+514	514	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+515	515	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+516	516	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+517	517	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+518	518	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+519	519	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+520	520	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+521	521	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+522	522	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+523	523	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+524	524	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+525	525	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+526	526	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+527	527	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+528	528	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+529	529	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+530	530	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+531	531	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+532	532	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+533	533	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+534	534	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+535	535	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+536	536	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+537	537	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+538	538	^\d{4}[01]	2	0	0	1
+539	539	^\d{4}[01]	2	0	0	1
+540	540	^\d{4}[01]	2	0	0	1
+541	541	^\d{4}[01]	2	0	0	1
+542	542	^\d{4}[01]	2	0	0	1
+543	543	^\d{4}[01]	2	0	0	1
+544	544	^\d{4}[01]	2	0	0	1
+545	545	^\d{4}[01]	2	0	0	1
+546	546	^\d{4}[01]	2	0	0	1
+547	547	^\d{4}[01]	2	0	0	1
+548	548	^\d{4}[01]	2	0	0	1
+549	549	^\d{4}[01]	2	0	0	1
+550	550	^\d{4}[01]	2	0	0	1
+551	551	^\d{4}[01]	2	0	0	1
+552	552	^\d{4}[01]	2	0	0	1
+553	553	^\d{4}[01]	2	0	0	1
+554	554	^\d{4}[01]	2	0	0	1
+555	555	^\d{4}[01]	2	0	0	1
+556	556	^\d{4}[01]	2	0	0	1
+557	557	^\d{4}[01]	2	0	0	1
+558	558	^\d{4}[01]	2	0	0	1
+559	559	^\d{4}[01]	2	0	0	1
+560	560	^\d{4}[01]	2	0	0	1
+561	561	^\d{4}[01]	2	0	0	1
+562	562	^\d{4}[01]	2	0	0	1
+563	563	^\d{4}[01]	2	0	0	1
+564	564	^\d{4}[01]	2	0	0	1
+565	565	^\d{4}[01]	2	0	0	1
+566	566	^\d{4}[01]	2	0	0	1
+567	567	^\d{4}[01]	2	0	0	1
+568	568	^\d{4}[01]	2	0	0	1
+569	569	^\d{4}[01]	2	0	0	1
+570	570	^\d{4}[01]	2	0	0	1
+571	571	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+572	572	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+573	573	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+574	574	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+575	575	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+576	576	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+577	577	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+578	578	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+579	579	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+580	580	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+581	581	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+582	582	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+583	583	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+584	584	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+585	585	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+586	586	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+587	587	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+588	588	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+589	589	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+590	590	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+591	591	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+592	592	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+593	593	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+594	594	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+595	595	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+596	596	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+597	597	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+598	598	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+599	599	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+600	600	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+601	601	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+602	602	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+603	603	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+604	604	^\d{4}[01]	2	0	0	1
+605	605	^\d{4}[01]	2	0	0	1
+606	606	^\d{4}[01]	2	0	0	1
+607	607	^\d{4}[01]	2	0	0	1
+608	608	^\d{4}[01]	2	0	0	1
+609	609	^\d{4}[01]	2	0	0	1
+610	610	^\d{4}[01]	2	0	0	1
+611	611	^\d{4}[01]	2	0	0	1
+612	612	^\d{4}[01]	2	0	0	1
+613	613	^\d{4}[01]	2	0	0	1
+614	614	^\d{4}[01]	2	0	0	1
+615	615	^\d{4}[01]	2	0	0	1
+616	616	^\d{4}[01]	2	0	0	1
+617	617	^\d{4}[01]	2	0	0	1
+618	618	^\d{4}[01]	2	0	0	1
+619	619	^\d{4}[01]	2	0	0	1
+620	620	^\d{4}[01]	2	0	0	1
+621	621	^\d{4}[01]	2	0	0	1
+622	622	^\d{4}[01]	2	0	0	1
+623	623	^\d{4}[01]	2	0	0	1
+624	624	^\d{4}[01]	2	0	0	1
+625	625	^\d{4}[01]	2	0	0	1
+626	626	^\d{4}[01]	2	0	0	1
+627	627	^\d{4}[01]	2	0	0	1
+628	628	^\d{4}[01]	2	0	0	1
+629	629	^\d{4}[01]	2	0	0	1
+630	630	^\d{4}[01]	2	0	0	1
+631	631	^\d{4}[01]	2	0	0	1
+632	632	^\d{4}[01]	2	0	0	1
+633	633	^\d{4}[01]	2	0	0	1
+634	634	^\d{4}[01]	2	0	0	1
+635	635	^\d{4}[01]	2	0	0	1
+636	636	^\d{4}[01]	2	0	0	1
+637	637	^\d{4}[01]	2	0	0	1
+638	638	^\d{4}[01]	2	0	0	1
+639	639	^\d{4}[01]	2	0	0	1
+640	640	^\d{4}[01]	2	0	0	1
+641	641	^\d{4}[01]	2	0	0	1
+642	642	^\d{4}[01]	2	0	0	1
+643	643	^\d{4}[01]	2	0	0	1
+644	644	^\d{4}[01]	2	0	0	1
+645	645	^\d{4}[01]	2	0	0	1
+646	646	^\d{4}[01]	2	0	0	1
+647	647	^\d{4}[01]	2	0	0	1
+648	648	^\d{4}[01]	2	0	0	1
+649	649	^\d{4}[01]	2	0	0	1
+650	650	^\d{4}[01]	2	0	0	1
+651	651	^\d{4}[01]	2	0	0	1
+652	652	^\d{4}[01]	2	0	0	1
+653	653	^\d{4}[01]	2	0	0	1
+654	654	^\d{4}[01]	2	0	0	1
+655	655	^\d{4}[01]	2	0	0	1
+656	656	^\d{4}[01]	2	0	0	1
+657	657	^\d{4}[01]	2	0	0	1
+658	658	^\d{4}[01]	2	0	0	1
+659	659	^\d{4}[01]	2	0	0	1
+660	660	^\d{4}[01]	2	0	0	1
+661	661	^\d{4}[01]	2	0	0	1
+662	662	^\d{4}[01]	2	0	0	1
+663	663	^\d{4}[01]	2	0	0	1
+664	664	^\d{4}[01]	2	0	0	1
+665	665	^\d{4}[01]	2	0	0	1
+666	666	^\d{4}[01]	2	0	0	1
+667	667	^\d{4}[01]	2	0	0	1
+668	668	^\d{4}[01]	2	0	0	1
+669	669	^\d{4}[01]	2	0	0	1
+670	670	^\d{4}[01]	2	0	0	1
+671	671	^\d{4}[01]	2	0	0	1
+672	672	^\d{4}[01]	2	0	0	1
+673	673	^\d{4}[01]	2	0	0	1
+674	674	^\d{4}[01]	2	0	0	1
+675	675	^\d{4}[01]	2	0	0	1
+676	676	^\d{4}[01]	2	0	0	1
+677	677	^\d{4}[01]	2	0	0	1
+678	678	^\d{4}[01]	2	0	0	1
+679	679	^\d{4}[01]	2	0	0	1
+680	680	^\d{4}[01]	2	0	0	1
+681	681	^\d{4}[01]	2	0	0	1
+682	682	^\d{4}[01]	2	0	0	1
+683	683	^\d{4}[01]	2	0	0	1
+684	684	^\d{4}[01]	2	0	0	1
+685	685	^\d{4}[01]	2	0	0	1
+686	686	^\d{4}[01]	2	0	0	1
+687	687	^\d{4}[01]	2	0	0	1
+688	688	^\d{4}[01]	2	0	0	1
+689	689	^\d{4}[01]	2	0	0	1
+690	690	^\d{4}[01]	2	0	0	1
+691	691	^\d{4}[01]	2	0	0	1
+692	692	^\d{4}[01]	2	0	0	1
+693	693	^\d{4}[01]	2	0	0	1
+694	694	^\d{4}[01]	2	0	0	1
+695	695	^\d{4}[01]	2	0	0	1
+696	696	^\d{4}[01]	2	0	0	1
+697	697	^\d{4}[01]	2	0	0	1
+698	698	^\d{4}[01]	2	0	0	1
+699	699	^\d{4}[01]	2	0	0	1
+700	700	^\d{4}[01]	2	0	0	1
+701	701	^\d{4}[01]	2	0	0	1
+702	702	^\d{4}[01]	2	0	0	1
+703	703	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+704	704	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+705	705	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+706	706	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+707	707	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+708	708	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+709	709	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+710	710	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+711	711	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+712	712	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+713	713	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+714	714	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+715	715	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+716	716	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+717	717	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+718	718	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+719	719	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+720	720	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+721	721	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+722	722	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+723	723	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+724	724	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+725	725	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+726	726	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+727	727	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+728	728	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+729	729	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+730	730	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+731	731	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+732	732	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+733	733	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+734	734	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+735	735	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+736	736	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+737	737	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+738	738	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+739	739	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+740	740	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+741	741	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+742	742	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+743	743	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+744	744	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+745	745	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+746	746	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+747	747	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+748	748	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+749	749	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+750	750	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+751	751	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+752	752	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+753	753	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+754	754	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+755	755	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+756	756	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+757	757	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+758	758	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+759	759	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+760	760	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+761	761	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+762	762	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+763	763	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+764	764	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+765	765	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+766	766	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+767	767	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+768	768	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+769	769	^\d{4}[01]	2	0	0	1
+770	770	^\d{4}[01]	2	0	0	1
+771	771	^\d{4}[01]	2	0	0	1
+772	772	^\d{4}[01]	2	0	0	1
+773	773	^\d{4}[01]	2	0	0	1
+774	774	^\d{4}[01]	2	0	0	1
+775	775	^\d{4}[01]	2	0	0	1
+776	776	^\d{4}[01]	2	0	0	1
+777	777	^\d{4}[01]	2	0	0	1
+778	778	^\d{4}[01]	2	0	0	1
+779	779	^\d{4}[01]	2	0	0	1
+780	780	^\d{4}[01]	2	0	0	1
+781	781	^\d{4}[01]	2	0	0	1
+782	782	^\d{4}[01]	2	0	0	1
+783	783	^\d{4}[01]	2	0	0	1
+784	784	^\d{4}[01]	2	0	0	1
+785	785	^\d{4}[01]	2	0	0	1
+786	786	^\d{4}[01]	2	0	0	1
+787	787	^\d{4}[01]	2	0	0	1
+788	788	^\d{4}[01]	2	0	0	1
+789	789	^\d{4}[01]	2	0	0	1
+790	790	^\d{4}[01]	2	0	0	1
+791	791	^\d{4}[01]	2	0	0	1
+792	792	^\d{4}[01]	2	0	0	1
+793	793	^\d{4}[01]	2	0	0	1
+794	794	^\d{4}[01]	2	0	0	1
+795	795	^\d{4}[01]	2	0	0	1
+796	796	^\d{4}[01]	2	0	0	1
+797	797	^\d{4}[01]	2	0	0	1
+798	798	^\d{4}[01]	2	0	0	1
+799	799	^\d{4}[01]	2	0	0	1
+800	800	^\d{4}[01]	2	0	0	1
+801	801	^\d{4}[01]	2	0	0	1
+802	802	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+803	803	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+804	804	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+805	805	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+806	806	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+807	807	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+808	808	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+809	809	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+810	810	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+811	811	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+812	812	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+813	813	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+814	814	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+815	815	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+816	816	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+817	817	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+818	818	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+819	819	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+820	820	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+821	821	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+822	822	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+823	823	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+824	824	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+825	825	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+826	826	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+827	827	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+828	828	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+829	829	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+830	830	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+831	831	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+832	832	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+833	833	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+834	834	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+835	835	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+836	836	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+837	837	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+838	838	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+839	839	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+840	840	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+841	841	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+842	842	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+843	843	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+844	844	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+845	845	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+846	846	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+847	847	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+848	848	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+849	849	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+850	850	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+851	851	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+852	852	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+853	853	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+854	854	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+855	855	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+856	856	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+857	857	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+858	858	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+859	859	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+860	860	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+861	861	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+862	862	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+863	863	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+864	864	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+865	865	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+866	866	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+867	867	^(\s(co(rp)?|l(lc|td)|inc))?[01]	2	0	0	1
+868	868	^[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+869	869	^.{1,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.(jsp|aspx?|php)\x22	2	0	0	1
+870	870	\x24[0-9A-Za-z]{1,5}\x3d\x28\x27?([0-9]{8}\x2c){4,}	2	0	0	1
+871	871	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+872	872	appid\x3a\s+2	2	0	0	1
+873	873	^\x3c(REQIMG|RVWCFG)\x3e	2	0	0	1
+874	874	\x22mining\x2E(subscribe|authorize)\x22	2	0	0	1
+875	875	^\s*(<var>[a-zA-Z0-9]{3,20})\s*=\s*new\s*CoinHive\s*\.\s*[^\(]+\(\s*[\x22\x27][A-Za-z0-9]+\s*[\x22\x27]\s*(\x2c\s*\x7b\s*\w+\x3a\s*\d\.\d\x7d)?\)\s*\x3b\s+(=var)\s*\.\s*start	2	0	0	1
+876	876	^\/api\/(bit|lite)coin\/balance\/	2	0	0	1
+877	877	miner[^a-z]	2	0	0	1
+878	878	(\x22login\x22\x3a\x22x\.0929c\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2282ZEhnLaX3ggrz5HbJJyinFjt8JyLomMnXYctMHJZCg368RrSyjQgN3TgrfbjqjUVdBPTP5VgEBkBYEWnTVHUgtjPweS5gc\x22\x2c\x22pass\x22\x3a\x22\x22|\x22login\x22\x3a\x224GdoN7NCTi8a5gZug7PrwZNKjvHFmKeV11L6pNJPgj5QNEHsN6eeX3DaAQFwZ1ufD4LYCZKArktt113W7QjWvQ7CW864Ah1Quz41mP4MJy\x22\x2c\x22pass\x22\x3a\x22x\x22|\x22login\x22\x3a\x2249GB8ucxW13fM78PMN2X3ZDYunniTj3pfdoyjztCkjDZQLSxRuZARgKEsfMDtoGGuiGGxWqeh6uez8mxYsPfm8TEGFq48Ce\x22\x2c\x22pass\x22\x3a\x22SynopsisX\x22|\x22login\x22\x3a\x22tyrenke\x22\x2c\x22pass\x22\x3a\x22tyrenke\x22)	2	0	0	1
+879	879	(\x22login\x22\x3a\x226243128\x22\x2c\x22pass\x22\x3a\x22myminer\x22|\x22login\x22\x3a\x226249832\x22\x2c\x22pass\x22\x3a\x22viristotal\x22|\x22login\x22\x3a\x226250474\x22\x2c\x22pass\x22\x3a\x22Minecraft\x22|\x22login\x22\x3a\x2244z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db\x22\x2c\x22pass\x22\x3a\x22bomba3\x22|\x22login\x22\x3a\x2247WpQT7o5YMPeUjZ2AYqo2HNu9SnfQ3Le5MywXMgCuBS1DHqMTQFNY7MCsWkr466gQNC5G182ZCCDiKs69mwdvr4EjvhT5c\x22\x2c\x22pass\x22\x3a\x22Krutish\x22)	2	0	0	1
+880	880	([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+881	881	\/tmp\/[^\/]+\.swf$	2	0	0	1
+882	882	name=\x22FEDEX(\s|_|\-)?[a-z0-9\-_\.\s]{0,42}\.zip\x22	2	0	0	1
+883	883	name=\x22Post_Express_Label_[a-z0-9\-_\.\s]{0,10}\.zip\x22	2	0	0	1
+884	884	=[0-9a-f]{8}\.jar/H	2	0	0	1
+885	885	^\/[a-z]{1,10}\/[a-z0-9]{32}\.php\?	2	0	0	1
+886	886	^\/[a-z0-9]{32}\?s=1$	2	0	0	1
+887	887	^[\r\n\s]+((>>).)+?\/Length[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))	2	0	0	1
+888	888	^[\r\n\s]+(\d{4}|((\d{1,2}[\r\n\s]|1[0-2][0-8][\r\n\s])))((>>).)+\/R\s+3[\r\n\s>]	2	0	0	1
+889	889	^(mous)?\.class	2	0	0	1
+890	890	\/chrome\/google_chrome_(update|installer)\.exe$	2	0	0	1
+891	891	^[^\x22\x27\x3b]*?[\x22\x27](<space>[0-7]{1,3})(<sep>[^0-9a-f])(<f>[0-7]{1,3})(=sep)[0-7]{1,3}(=sep)(<n>((=f))[0-7]{1,3})(=sep)([0-7]{1,3}(=sep)){4}(=n)(=sep)(=space)(=sep)(<z>(((=f)|(=n)))[0-7]{1,3})(=sep)(=z)(=sep)(=z)(=sep)(=f)(=sep)(=f)(=sep)(=f)	2	0	0	1
+892	892	^&v=(null|(\d+\.)+?\d+)\x3b\d+\x3b\x3b\d{3,5}x\d{3,5}\x3b/P	2	0	0	1
+893	893	findloader[^\x2f\.\?]*?\.php\?[a-z]=[^&]+$	2	0	0	1
+894	894	^[^=]+[^\x22\x27\x3b]*?(<q>[\x22\x27])(((=q)).)+?<[^\x22\x27]*?a[^\x22\x27]*?p[^\x22\x27]*?p[^\x22\x27]*?l[^\x22\x27]*?e[^\x22\x27]*?t[^\x22\x27](((=q)).)+?<[^\x22\x27]*?p[^\x22\x27]*?a[^\x22\x27]*?r[^\x22\x27]*?a[^\x22\x27]*?m	2	0	0	1
+895	895	\.php\?cashe=\d+$	2	0	0	1
+896	896	\.jar\?m=[1-2]$	2	0	0	1
+897	897	\.pdf\?p=1&s=[1-2]$	2	0	0	1
+898	898	^Host\x3a [^\r\n]+?\.bit\r\n$/Hmi	2	0	0	1
+899	899	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[^\/\.]+$	2	0	0	1
+900	900	\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.aso$	2	0	0	1
+901	901	\/viewtopic\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+902	902	\/handler\.php\?[^=]+=[a-zA-Z0-9\x2b\x2f]{43}=$	2	0	0	1
+903	903	\/tds\/[a-f0-9]{32}$	2	0	0	1
+904	904	^[a-f0-9]{32}[\x22\x27]	2	0	0	1
+905	905	Content-Disposition\x3a[^\r\n]*?\.exe\.vbe/Hi	2	0	0	1
+906	906	(\.\.\/)+kboxwww\/tmp\/	2	0	0	1
+907	907	^(<var>.{1,10})\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\\_\+(=var)\.\\_\_\+\x22\.\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\_\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\_\_\\+(=var)\.\$\_\_\+\x22	2	0	0	1
+908	908	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+909	909	^Host\x3a (<ipaddr>\b([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\b).*Referer\x3a http\x3a\/\/(=ipaddr)\//Hs	2	0	0	1
+910	910	\/\?[0-9a-f]{60,66}[\;\d\x2c]*$	2	0	0	1
+911	911	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=\x22\x27]+=(0x[a-f0-9]{8},){15}	2	0	0	1
+912	912	\/load(fla(2001[34]|0515)|msie\d{0,2}|20132551|jimage|silver|0322|db|im|rh)\.php	2	0	0	1
+913	913	debugenableplugins=[a-zA-Z0-9]+?\x3b	2	0	0	1
+914	914	^\/[a-z0-9]+\/load\.php$	2	0	0	1
+915	915	^Host\x3a\x20\d{1,3}\.\d{1,3}.\d{1,3}.\d{1,3}(\x3a\d{1,5})?\r\n/H	2	0	0	1
+916	916	^\/xteas\/code$	2	0	0	1
+917	917	\/(java(byte|db)|o(utput|ther)|r(hino|otat)|msie\d|load)\.php\?hash=	2	0	0	1
+918	918	=\w{8}\.pdf/Hi	2	0	0	1
+919	919	^\/\?[A-Za-z0-9]+=(<v1>[^&]+)&(=v1)=[A-Za-z0-9]+$	2	0	0	1
+920	920	^User-Agent\x3a[^\r\n]+rv\x3a11\.0[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$/H	2	0	0	1
+921	921	^Host\x3a\s.+\.in\r?$/Hmi	2	0	0	1
+922	922	name=\x22([a-z_]{0,8})?UPS(\s|_|\-)?[a-z0-9\-_\.\s]{0,69}\.zip\x22	2	0	0	1
+923	923	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+924	924	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?*((<var1>[^=&]+)=(=var1))?))$	2	0	0	1
+925	925	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+926	926	^(\/((af|p66)\/(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}|(([a-zA-Z]{0,12}[0-9]|([a-z0-9]{0,12}[A-Z])([A-Z0-9]{0,12}[a-z])))[A-Za-z0-9]{6,13}\?))$	2	0	0	1
+927	927	^Location\x3a\x20[a-f0-9]{32}\/e\.html\r$/Hm	2	0	0	1
+928	928	^\/(v(1\/buckets\/default\/ext-5dkJ19tFufpMZjVJbsWCiqDcclDw\/records|4\/links\/activity-stream|3\/links\/ping-centre)|gp\/(aj\/private\/reviewsGallery\/get-(application-resource|image-gallery-asset)s|cerberus\/gv)|en-us\/(p\/(onerf\/MeSilentPassport|book-2\/8MCPZJJCC98C)|store\/api\/checkproductinwishlist)|wp-(content\/themes\/am43-6\/dist\/records|includes\/js\/script\/indigo-migrate)|api2\/json\/(cluster\/(resource|task)s|access\/ticket))	2	0	0	1
+929	929	^(\/updates|\/license\/eula|\/docs\/office|\/software-activation)	2	0	0	1
+930	930	^GET\s(\/((v(i-assets\/static-asset|[12]\/preference)|idcta\/translation)s|ads\/google))	2	0	0	1
+931	931	^([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9_\/\+\-]{2}==|[a-zA-Z0-9_\/\+\-]{3}=|[a-zA-Z0-9_\/\+\-]{4})\x3b	2	0	0	1
+932	932	^(\/track|\/api\/v1\/survey\/embed|\/svc\/weather\/v2)	2	0	0	1
+933	933	\/api\/v1\/user\/(512|124)\/avatar	2	0	0	1
+934	934	^GET [^\r\n]{0,256}&parent_request_id=([A-Za-z0-9_\/\+\-%]{128,1024})={0,2}[^\r\n]{0,256} HTTP\/1\.[01]	2	0	0	1
+935	935	^\/v1\/(queue|profile|docs\/wsdl|pull)	2	0	0	1
+936	936	^GET\s(\/USAT-GUP\/user\/|\/entertainment\/|\/entertainment\/navdd-q1a2z3Z6TET4gv2PNfXpaJAniOzOajK7M\.min\.json|\/global-q1a2z3C4M2nNlQYzWhCC0oMSEFjQbW1KA\.min\.json|\/life\/|\/news\/weather\/|\/opinion\/|\/sports\/|\/sports\/navdd-q1a2z3JHa8KzCRLOQAnDoVywVWF7UwxJs\.min\.json|\/tangstatic\/js\/main-q1a2z3b37df2b1\.min\.js|\/tangstatic\/js\/pbjsandwich-q1a2z300ab4198\.min\.js|\/tangstatic\/js\/pg-q1a2z3bbc110a4\.min\.js|\/tangsvc\/pg\/3221104001\/|\/tangsvc\/pg\/5059005002\/|\/tangsvc\/pg\/5066496002\/|\/tech\/|\/travel\/)	2	0	0	1
+937	937	^POST\s(\/v4\/links\/check-activity\/check|\/v1\/stats|\/gql|\/api2\/json\/check\/ticket|\/1.5\/95648064\/storage\/history|\/1.5\/95648064\/storage\/tabs|\/u\/0\/_\/og\/botguard\/get|\/ev\/prd001001|\/ev\/ext001001|\/gp\/aw\/ybh\/handlers|\/v3\/links\/ping-beat\/check)	2	0	0	1
+938	938	^[^\n]*[\x00-\x08\x0e-\x1f]	2	0	0	1
+939	939	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+940	940	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+941	941	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+942	942	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+943	943	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+944	944	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(IMCON|IMC)[\s\w,/-]*(//(X1|MR))	2	0	0	1
+945	945	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+946	946	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+947	947	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+948	948	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+949	949	(TOP\s|T)(SECRET|S)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+950	950	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+951	951	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+952	952	(TOP\s|T)(SECRET|S)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+953	953	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+954	954	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+955	955	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+956	956	(TOP\s|T)(SECRET|S)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+957	957	(CONFIDENTIAL|C)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+958	958	(TOP\sSECRET|TS)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+959	959	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(COMINT|SI)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+960	960	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+961	961	(TOP\s|T)(SECRET|S)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+962	962	(TOP\s|T)(SECRET|S)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+963	963	(TOP\s|T)(SECRET|S)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+964	964	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+965	965	\[\[\d{1,3}\,\[\\\"\w\\\"\,\\\"[email protected].+\\\"\,\\\"	2	0	0	1
+966	966	User-Agent\:[^\n]+ARCADE_BUNDLE_DOWNLOADER	2	0	0	1
+967	967	\x20\x3A(Receiving\x20file.\x0A|Saved\x20as\x20|Spoofs\x3A\x20|Kaiten\x20wa\x20goraku|Current\x20status\x20is\x3a\x20|Removed\x20all\x20spoofs|Packeting\x20|Panning\x20|Tsunami\x20heading\x20for\x20|Unknowing\x20|Killing\x20pid\x20)	2	0	0	1
+968	968	PRIVMSG\x20\x21\S+\x20(TSUNAMI\x20|PAN\x20|UDP\x20|UNKNOWN\x20|GETSPOOFS|SPOOFS\x20)	2	0	0	1
+969	969	\x22\x3A(\w)\x3D\x22execute\s+\x22{5}\x3A.*\x3Aexecute\s*\x28\s*\s*\x29\x3Aend\s+function\x3A	2	0	0	1
+970	970	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*D27CDB6E-AE6D-11cf-96B8-444553540000	2	0	0	1
+971	971	filename\s*=\s*"WU_Details_.....\.zip	2	0	0	1
+972	972	filename\s*=\s*MySpace_document_[0-9]{5}\.zip	2	0	0	1
+973	973	filename=\x22UPS_INVOICE_NR\.[0-9]{4}-[0-9]{6}\.zip\x22	2	0	0	1
+974	974	filename=\x22UPS_LABEL_NR\.[A-Z]+_[0-9]{4}-\d+\.ZIP\x22	2	0	0	1
+975	975	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*F9769A06-7ACA-4E39-9CFB-97BB35F0E77E	2	0	0	1
+976	976	MyValue=[a-f0-9]{32}	2	0	0	1
+977	977	\x0d\x0aUser-Agent\: 0\:0\:[^\n]{120}	2	0	0	1
+978	978	User-Agent\: 0\:0\:[^\x0a|\x0d]{128}	2	0	0	1
+979	979	01E04581-4EEE-11D0-BFE9-00AA005B4383|AF604EFE-8897-11D1-B944-00A0C90312E1|7849596A-48EA-486E-8937-A2A3009F31A9|FBEB8A05-BEEE-4442-804E-409D6C4515E9|3050F391-98B5-11CF-BB82-00AA00BDCE0B|8EE42293-C315-11D0-8D6F-00A0C9A06E1F|2A6EB050-7F1C-11CE-BE57-00AA0051FE20|510A4910-7F1C-11CE-BE57-00AA0051FE20|6D36CE10-7F1C-11CE-BE57-00AA0051FE20|860D28D0-8BF4-11CE-BE59-00AA0051FE20|9478F640-7F1C-11CE-BE57-00AA0051FE20|B0516FF0-7F1C-11CE-BE57-00AA0051FE20|D99F7670-7F1A-11CE-BE57-00AA0051FE20	2	0	0	1
+980	980	(\.\.\/){1,}	2	0	0	1
+981	981	\/cgi-bin\/pr2\.cgi\?[a-zA-Z0-9]{172}	2	0	0	1
+982	982	03D9F3F2-B0E3-11D2-B081-006008039BF0|860BB310-5D01-11D0-BD3B-00A0C911CE86|E0F158E1-CB04-11D0-BD4E-00A0C911CE86|33D9A761-90C8-11D0-BD43-00A0C911CE86|4EFE2452-168A-11D1-BC76-00C04FB9453B|33D9A760-90C8-11D0-BD43-00A0C911CE86|33D9A762-90C8-11D0-BD43-00A0C911CE86|083863F1-70DE-11D0-BD40-00A0C911CE86|18AB439E-FCF4-40D4-90DA-F79BAA3B0655|31087270-D348-432C-899E-2D2F38FF29A0|D2923B86-15F1-46FF-A19A-DE825F919576|FD78D554-4C6E-11D0-970D-00A0C9191601|52CA3BCF-3B9B-419E-A3D6-5D28C0B0B50C	2	0	0	1
+983	983	4FAAB301-CEF6-477C-9F58-F601039E9B78|6CBE0382-A879-4D2A-8EC3-1F2A43611BA8|F117831B-C052-11D1-B1C0-00C04FC2F3EF|3050F667-98B5-11CF-BB82-00AA00BDCE0B|1AA06BA1-0E88-11D1-8391-00C04FBD7C09|F28D867A-DDB1-11D3-B8E8-00A0C981AEEB|6B7F1602-D44C-11D0-A7D9-AE3D17000000|7007ACCF-3202-11D1-AAD2-00805FC1270E|992CFFA0-F557-101A-88EC-00DD010CCC48|00020420-0000-0000-C000-000000000046|0006F02A-0000-0000-C000-000000000046|ABBA001B-3075-11D6-88A4-00B0D0200F88|CE292861-FC88-11D0-9E69-00C04FD7C15B	2	0	0	1
+984	984	php\?r=\d+&p=	2	0	0	1
+985	985	\/socks\.php\?name=[^&]+&port=\d{1,5}$	2	0	0	1
+986	986	SELECT.+FROM	2	0	0	1
+987	987	UNION\s+SELECT	2	0	0	1
+988	988	INSERT.+INTO	2	0	0	1
+989	989	DELETE.+FROM	2	0	0	1
+990	990	ASCII\(.+SELECT	2	0	0	1
+991	991	UPDATE.+SET	2	0	0	1
+992	992	EEED4C20-7F1B-11CE-BE57-00AA0051FE20|C7B6C04A-CBB5-11D0-BB4C-00C04FC2F410|85BBD920-42A0-1069-A2E4-08002B30309D|E846F0A0-D367-11D1-8286-00A0C9231C29|B4B3AECB-DFD6-11D1-9DAA-00805F85CFE3|ECABB0BF-7F19-11D2-978E-0000F8757E2A|466D66FA-9616-11D2-9342-0000F875AE17|67DCC487-AA48-11D1-8F4F-00C04FB611C7|00022613-0000-0000-C000-000000000046|D2D588B5-D081-11D0-99E0-00C04FC2F8EC|5D08B586-343A-11D0-AD46-00C04FD8FDFF|CC7BFB42-F175-11D1-A392-00E0291F3959|CC7BFB43-F175-11D1-A392-00E0291F3959|3F8A6C33-E0FD-11D0-8A8C-00A0C90C2BC5	2	0	0	1
+993	993	BC5F1E51-5110-11D1-AFF5-006097C9A284|F27CE930-4CA3-11D1-AFF2-006097C9A284|3BC4F3A7-652A-11D1-B4D4-00C04FC2DB8D|ECABAFC2-7F19-11D2-978E-0000F8757E2A|283807B8-2C60-11D0-A31D-00AA00B92C03|250770F3-6AF2-11CF-A915-008029E31FCD|D24D4453-1F01-11D1-8E63-006097D2DF48|03CB9467-FD9D-42A8-82F9-8615B4223E6E|598EBA02-B49A-11D2-A1C1-00609778EA66|8FE7E181-BB96-11D2-A1CB-00609778EA66|4CFB5280-800B-4367-848F-5A13EBF27F1D|B3E0E785-BD78-4366-9560-B7DABE2723BE|208DD6A3-E12B-4755-9607-2E39EF84CFC5	2	0	0	1
+994	994	6E227101-F799-11CF-9227-00AA00A1EB95|7057E952-BD1B-11D1-8919-00C04FC2C836|7007ACC7-3202-11D1-AAD2-00805FC1270E|4622AD11-FF23-11D0-8D34-00A0C90F2719|98CB4060-D3E7-42A1-8D65-949D34EBFE14|47C6C527-6204-4F91-849D-66E234DEE015|35CEC8A3-2BE6-11D2-8773-92E220524153|730F6CDC-2C86-11D2-8773-92E220524153|2C10A98F-D64F-43B4-BED6-DD0E1BF2074C|6F9F3481-84DD-4B14-B09C-6B4288ECCDE8|8E26BFC1-AFD6-11CF-BFFC-00AA003CFDFC|F0975AFE-5C7F-11D2-8B74-00104B2AFB41	2	0	0	1
+995	995	index\.php\?q=(uggc|jjj|http|www|aHR0c|d3d3)	2	0	0	1
+996	996	(file=\|.+\|)	2	0	0	1
+997	997	SELECT.+FROM	2	0	0	1
+998	998	UNION\s+SELECT	2	0	0	1
+999	999	INSERT.+INTO	2	0	0	1
+1000	1000	DELETE.+FROM	2	0	0	1
+1001	1001	ASCII\(.+SELECT	2	0	0	1
+1002	1002	UPDATE.+SET	2	0	0	1
+1003	1003	SELECT.+FROM	2	0	0	1
+1004	1004	UNION\s+SELECT	2	0	0	1
+1005	1005	INSERT.+INTO	2	0	0	1
+1006	1006	DELETE.+FROM	2	0	0	1
+1007	1007	ASCII\(.+SELECT	2	0	0	1
+1008	1008	UPDATE.+SET	2	0	0	1
+1009	1009	SELECT.+FROM	2	0	0	1
+1010	1010	UNION\s+SELECT	2	0	0	1
+1011	1011	INSERT.+INTO	2	0	0	1
+1012	1012	DELETE.+FROM	2	0	0	1
+1013	1013	ASCII\(.+SELECT	2	0	0	1
+1014	1014	UPDATE.+SET	2	0	0	1
+1015	1015	(TOP|//)\Wsecret[^\w/a]	2	0	0	1
+1016	1016	filename=\x22Facebook_(Password|Support|Document)_[A-Z0-9]{4,7}\.zip\x22	2	0	0	1
+1017	1017	\x2FU3D\x2FLength\x20172[0-5][0-9]{2}	2	0	0	1
+1018	1018	\/000[a-z][0-9]{3}\x2Eso	2	0	0	1
+1019	1019	\/000[a-z][0-9]{3}\x2Eexe	2	0	0	1
+1020	1020	UPDATE.+SET	2	0	0	1
+1021	1021	PDF-.+[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F].[0-9,A-F][0-9,A-F]	2	0	0	1
+1022	1022	^FOLD\s[^\n]{256}	2	0	0	1
+1023	1023	^FOLD\s+\/	2	0	0	1
+1024	1024	^Username\:[^\n]{100}	2	0	0	1
+1025	1025	^http\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1026	1026	^http\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1027	1027	^Content-Disposition\x3a[^\r\n]*\{[\da-fA-F]{8}(-[\da-fA-F]{4}){3}-[\da-fA-F]{12}\}	2	0	0	1
+1028	1028	^file\x3a\x2f\x2f[^\n]{400}	2	0	0	1
+1029	1029	\x3C\x3C(\x0D\x0A|\x0A)[^>]*\x2F[^JBIG2Decode](J|#4A)(B|#42)(I|#49)(G|#47)(2|#32)(D|#44)(e|#65)(c|#63)(o|#6F)(d|#64)(e|#65)	2	0	0	1
+1030	1030	OS 4_[0-3]_[1-4] like/H	2	0	0	1
+1031	1031	[a-f0-9]{16}$	2	0	0	1
+1032	1032	mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+1033	1033	(/joomla/admin|/joomla/administrator|/joomla/manage|/joomla/administration)	2	0	0	1
+1034	1034	\x3A\x02\x5B(Atk33|Exploiting|Finished|GOOGLE.*|HTTP.{0,8}|PKS-SCAN.{0,20}|Results|RSH|SCAN|TCP.{0,8}|UDP.{0,8}|v6.{0,12}|VERSION)\x5D\x02	2	0	0	1
+1035	1035	\x3A\x02(Alvo dos Pacotes|Conectando-se em|M.dia de envio|Tempo.*|Total .*)\x02	2	0	0	1
+1036	1036	NICK\x20\S+\x0AUSER\x20\S+localhost\x20localhost\x20\x3A	2	0	0	1
+1037	1037	\x3a.4\x7c.12.\x3a.4	2	0	0	1
+1038	1038	(cheguei gazelas|meh que tao|Status|Tempo|Total pacotes|Total bytes|M?dia de envio|portas? aberta)	2	0	0	1
+1039	1039	keepalive([0-9]{4}|\x7c[0-9]{4})	2	0	0	1
+1040	1040	User-Agent\x3a[^\n]+sbu-hb-	2	0	0	1
+1041	1041	User-Agent\:[^\n]+Peer Points/iH	2	0	0	1
+1042	1042	User-Agent\:[^\n]+zbu-hb-/Hi	2	0	0	1
+1043	1043	User-Agent\:[^\n]+HSN/iH	2	0	0	1
+1044	1044	User-Agent\:[^\n]+Wildtangent/iH	2	0	0	1
+1045	1045	^RMD\s+\x2f$	2	0	0	1
+1046	1046	User-Agent\x3A[^\n]+TheWorld/H	2	0	0	1
+1047	1047	^Max-dotdot[\s\r\n]*\d{3,}	2	0	0	1
+1048	1048	^Authorization\x3a Basic\s+=	2	0	0	1
+1049	1049	^Authorization\x3a Basic\s+=	2	0	0	1
+1050	1050	Host\x3a\s[a-z]{16}\.ru/H	2	0	0	1
+1051	1051	CREATE.+ENDPOINT	2	0	0	1
+1052	1052	\/[a-z]{2}\/[a-z]{4}01\/ppp\/listdir\.php\?dir=	2	0	0	1
+1053	1053	MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w	2	0	0	1
+1054	1054	MAC=0\w-\w\w-\w\w-\w\w-\w\w-\w\w	2	0	0	1
+1055	1055	\x00[0-9]{4,7}\x02co\x00	2	0	0	1
+1056	1056	\x2fsogou(config)?\x2f	2	0	0	1
+1057	1057	\/\d{8,}\/\d{4,}\/\d{4,}\.jsp	2	0	0	1
+1058	1058	adv\d+\.php	2	0	0	1
+1059	1059	a=\%[0-9a-fA-F]{2}\&b	2	0	0	1
+1060	1060	\Wcustomer\slist(s)?\W	2	0	0	1
+1061	1061	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1062	1062	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1063	1063	\Wannual\sincome(s)?\W	2	0	0	1
+1064	1064	\Wpayment\shistory\W	2	0	0	1
+1065	1065	\Waccount\sbalance(s)?\W	2	0	0	1
+1066	1066	\Wappraisal(s)?\W	2	0	0	1
+1067	1067	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1068	1068	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1069	1069	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1070	1070	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1071	1071	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1072	1072	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1073	1073	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1074	1074	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1075	1075	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1076	1076	\Winternal\suse\sonly\W	2	0	0	1
+1077	1077	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1078	1078	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1079	1079	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1080	1080	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1081	1081	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1082	1082	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1083	1083	(//)\Wconfidential[^\w/]	2	0	0	1
+1084	1084	(//)\Wrestricted[^\w/]	2	0	0	1
+1085	1085	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1086	1086	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1087	1087	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1088	1088	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1089	1089	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1090	1090	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1091	1091	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1092	1092	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1093	1093	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1094	1094	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1095	1095	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1096	1096	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1097	1097	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1098	1098	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1099	1099	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1100	1100	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1101	1101	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1102	1102	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1103	1103	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1104	1104	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1105	1105	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1106	1106	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1107	1107	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1108	1108	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1109	1109	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1110	1110	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1111	1111	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1112	1112	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1113	1113	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1114	1114	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1115	1115	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1116	1116	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1117	1117	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1118	1118	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1119	1119	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1120	1120	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1121	1121	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1122	1122	(//)\Wrestricted[^\w/]	2	0	0	1
+1123	1123	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1124	1124	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1125	1125	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1126	1126	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1127	1127	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1128	1128	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1129	1129	\Winternal\suse\sonly\W	2	0	0	1
+1130	1130	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1131	1131	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1132	1132	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1133	1133	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1134	1134	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1135	1135	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1136	1136	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1137	1137	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1138	1138	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1139	1139	\Wappraisal(s)?\W	2	0	0	1
+1140	1140	\Waccount\sbalance(s)?\W	2	0	0	1
+1141	1141	\Wannual\sincome(s)?\W	2	0	0	1
+1142	1142	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1143	1143	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1144	1144	\Wcustomer\slist(s)?\W	2	0	0	1
+1145	1145	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1146	1146	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1147	1147	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1148	1148	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1149	1149	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1150	1150	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1151	1151	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1152	1152	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1153	1153	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1154	1154	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1155	1155	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1156	1156	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1157	1157	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1158	1158	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1159	1159	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1160	1160	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1161	1161	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1162	1162	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1163	1163	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1164	1164	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1165	1165	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1166	1166	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1167	1167	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1168	1168	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1169	1169	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1170	1170	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1171	1171	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1172	1172	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1173	1173	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1174	1174	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1175	1175	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1176	1176	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1177	1177	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1178	1178	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1179	1179	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1180	1180	\Wprivate\W(/(25)?X[1-9])	2	0	0	1
+1181	1181	(//)\Wrestricted[^\w/]	2	0	0	1
+1182	1182	(//)\Wconfidential[^\w/]	2	0	0	1
+1183	1183	(//)\Wtop\ssecret[^\w/a]	2	0	0	1
+1184	1184	\Wsealed\W(/(25)?X[1-9])	2	0	0	1
+1185	1185	(law\senforcement)\Wsensitive\W(/(25)?X[1-9])	2	0	0	1
+1186	1186	\Wproprietary\W(/(25)?X[1-9])	2	0	0	1
+1187	1187	\Wprotected\W(/(25)?X[1-9])	2	0	0	1
+1188	1188	\Wlaw\senforcement\ssensitive\W	2	0	0	1
+1189	1189	\Winternal\suse\sonly\W	2	0	0	1
+1190	1190	[^\w&]d(ate)?(-)?o(f)?(-)?b(irth)?\W[\s\w,/-]*(([0-9]{2}[-/][0-9]{2}[-/][0-9]{2,4})|[0-9]{8})	2	0	0	1
+1191	1191	\Whcpcs\W[\s\w,/-]*([a-z][0-9]{10})	2	0	0	1
+1192	1192	\Wicd\W[\s\w,/-]*([a-z][0-9]{2}\.[0-9]{2})	2	0	0	1
+1193	1193	\Wndc\W[\s\w,/-]*(([0-9]{4}-[0-9]{4}-[0-9]{2}|[0-9]{5}-[0-9]{3}-[0-9]{2}|[0-9]{5}-[0-9]{4}-[0-9]{1,2}))	2	0	0	1
+1194	1194	\Wada\W[\s\w,/-]*(d[0-9]{4})	2	0	0	1
+1195	1195	\Wdsm\W[\s\w,/-]*(([2-9][0-9]{2}(\.[0-9]{1,2}?)|(v[167][0-9]\.[0-9]{1,2})))	2	0	0	1
+1196	1196	\Wcpt\W[\s\w,/-]*([0-9]{4}[ft]|[0-9]{5})	2	0	0	1
+1197	1197	\Wj(apan\s)?c(redit\s)?b(ureau)?\W[\s\w,/-]*((3[12359][0-9]{14})|(1800|2131)[0-9]{11})	2	0	0	1
+1198	1198	\W[p][a4@][sz5]{0,2}[w]([o0][r])?[d]\W	2	0	0	1
+1199	1199	\Wappraisal(s)?\W	2	0	0	1
+1200	1200	\Waccount\sbalance(s)?\W	2	0	0	1
+1201	1201	\Wpayment\shistory\W	2	0	0	1
+1202	1202	\Wannual\sincome(s)?\W	2	0	0	1
+1203	1203	\Wcredit\shistor(y|ies)\W	2	0	0	1
+1204	1204	\Wtransaction\shistor(y|ies)\W	2	0	0	1
+1205	1205	\Wcustomer\slist(s)?\W	2	0	0	1
+1206	1206	//([A-Z]{3}\s)+RESTRICTED//X5	2	0	0	1
+1207	1207	//([A-Z]{3}\s)+CONFIDENTIAL//X5	2	0	0	1
+1208	1208	//([A-Z]{3}\s)+TOP\sSECRET//X5	2	0	0	1
+1209	1209	//([A-Z]{3}\s)+(TOP\s)SECRET//X5	2	0	0	1
+1210	1210	//((NATO\sRESTRICTED)|NR)//MR	2	0	0	1
+1211	1211	//((NATO\sCONFIDENTIAL\sATOMAL)|NCA)//MR	2	0	0	1
+1212	1212	//((NATO\sCONFIDENTIAL)|NC)//MR	2	0	0	1
+1213	1213	//((COSMIC\sTOP\sSECRET\sATOMAL)|CTSA)//MR	2	0	0	1
+1214	1214	//((NATO\sSECRET\sATOMAL)|NSA)//MR	2	0	0	1
+1215	1215	//((NATO\sSECRET)|NS)//MR	2	0	0	1
+1216	1216	QQQQ\r\n((O|P|R|Z)\r\n(CC)\r\n)	2	0	0	1
+1217	1217	QQQQ\r\n((O|P|R|Z)\r\n(TT)\r\n)	2	0	0	1
+1218	1218	QQQQ\r\n((O|P|R|Z)\r\n(SS)\r\n)	2	0	0	1
+1219	1219	(CONFIDENTIAL|C)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1220	1220	(TOP\sSECRET|TS)//[\s\w,/-]*REL\sTO\sUSA[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1221	1221	(UNCLASSIFIED|U)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1222	1222	(CONFIDENTIAL|C)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1223	1223	(TOP\sSECRET|TS)//[\s\w,/-]*COMSEC[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1224	1224	(TOP\sSECRET|TS)//[\s\w,/-]*(CRITICAL\sNUCLEAR\sWEAPON\sDESIGN\sINFORMATION|CNWDI)[\s\w,/-]*(//MR)	2	0	0	1
+1225	1225	(TOP\sSECRET|TS)//[\s\w,/-]*(TALENT\sKEYHOLE|TK)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1226	1226	//FGI[\s\w,/-]*(//X5)	2	0	0	1
+1227	1227	(UNCLASSIFIED|U)//(FOR\sOFFICIAL\sUSE\sONLY|FOUO)	2	0	0	1
+1228	1228	(CONFIDENTIAL|C)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1229	1229	(TOP\sSECRET|TS)//[\s\w,/-]*NOFORN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1230	1230	(CONFIDENTIAL|C)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1231	1231	(TOP\sSECRET|TS)//[\s\w,/-]*(ORIGINATOR\sCONTROLLED|ORCON)[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1232	1232	(UNCLASSIFIED|U)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1233	1233	(CONFIDENTIAL|C)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1234	1234	(TOP\sSECRET|TS)//[\s\w,/-]*PROPIN[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1235	1235	(CONFIDENTIAL|C)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1236	1236	(TOP\sSECRET|TS)//[\s\w,/-]*(RESTRICTED\sDATA|RD)[\s\w,/-]*(//MR)	2	0	0	1
+1237	1237	SAMI[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1238	1238	(CONFIDENTIAL|C)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1239	1239	(TOP\sSECRET|TS)//[\s\w,/-]*SPECAT[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1240	1240	(TOP\sSECRET|TS)//[\s\w,/-]*STOP[\s\w,/-]*(//(25)?X[1-9])	2	0	0	1
+1241	1241	User-Agent\x3a \d{6}\x0d\x0a/H	2	0	0	1
+1242	1242	(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/s\/l\/firstping	2	0	0	1
+1243	1243	\.dyndns\.((biz|info|org|tv))\x0d\x0a/iH	2	0	0	1
+1244	1244	\.dyndns-((at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work))\.com\x0d\x0a/iH	2	0	0	1
+1245	1245	\.jpg\?t\x3d\d\.\d	2	0	0	1
+1246	1246	[0-9]{1,16}[a-f]{1,16}[0-9]{1,16}$	2	0	0	1
+1247	1247	^Content-Length\x3a\s*-\d+	2	0	0	1
+1248	1248	\W[0-9]{5}\.jar	2	0	0	1
+1249	1249	machine_id={[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+-[A-F0-9]+}	2	0	0	1
+1250	1250	[0-9]{1,8}[a-f]{1,8}[0-9]{1,8}$	2	0	0	1
+1251	1251	^[a-z0-9]{6}..\x00\x00	2	0	0	1
+1252	1252	^[a-z0-9]{7}..\x00\x00	2	0	0	1
+1253	1253	\sLOGIN\s[^\n]*?%	2	0	0	1
+1254	1254	({(\d+}[^\n]*?\sAUTH)|AUTH\s[^\n]*?{(\d+}))	2	0	0	1
+1255	1255	^\/\?[a-f0-9]{32}$	2	0	0	1
+1256	1256	[a-z]{9}[0-9]\.exe/H	2	0	0	1
+1257	1257	\.php\?inst_result=.+&hwid=	2	0	0	1
+1258	1258	^.{1,5}[a-f0-9]{100}	2	0	0	1
+1259	1259	\/scr5\.php\?p=\d+&id=\d	2	0	0	1
+1260	1260	^User-Agent\: App\d/Hmi	2	0	0	1
+1261	1261	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$	2	0	0	1
+1262	1262	\x00\x07[a-z]{7}\x02eu\x00	2	0	0	1
+1263	1263	REGISTER.{400}	2	0	0	1
+1264	1264	\/content\/jav\d?\.jar$	2	0	0	1
+1265	1265	^\/\?[a-f0-9]{32}$	2	0	0	1
+1266	1266	\.php\?[a-z]+=[a-f0-9]{64}&[^\?]+=[a-f0-9]{20}&	2	0	0	1
+1267	1267	^HTTP\x2f1\.[01] 200	2	0	0	1
+1268	1268	\.php\?[a-z]+=(([1-2][a-z]|3[0-9])\x3a){3,}([1-2][a-z]|3[0-9])&	2	0	0	1
+1269	1269	IP\:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+1270	1270	^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/index\.html?$	2	0	0	1
+1271	1271	\.(jpg|png|gif|cgi)\?pr=	2	0	0	1
+1272	1272	^\/\?affid=\d+&promo_type=\d+&promo_opt=\d+$	2	0	0	1
+1273	1273	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1274	1274	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1275	1275	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1276	1276	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1277	1277	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1278	1278	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1279	1279	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1280	1280	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1281	1281	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1282	1282	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1283	1283	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1284	1284	(POST |POST (http|https)\:\/\/[-0-9a-z.]*)\/.*perl\/fr\.pl	2	0	0	1
+1285	1285	\x2F[a-z\x2D]{60,120}.+\x2D\x2Ephp$	2	0	0	1
+1286	1286	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1287	1287	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1288	1288	^Host\x3a (\d{1,3}\.){3}\d{1,3}\r\nContent-Length\x3a \d{3}\r\nUser-Agent\x3a [^\r\n]+?\r\n$/H	2	0	0	1
+1289	1289	^\/[a-z0-9A-Z]{25,35}\/(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+(_[e7uxMhp1Kt]+)?|a2\.\.)Z(([e7uxMhp1Kt]+Q){3}[e7uxMhp1Kt]+|a2\.\.)\/	2	0	0	1
+1290	1290	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$	2	0	0	1
+1291	1291	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/$	2	0	0	1
+1292	1292	applet\/code=[\x22\x27](<val1>[a-zA-Z0-9]+)[a-z]\.(=val1)[a-z][\x22\x27][^\x3e]+\.jar[\x22\x27]	2	0	0	1
+1293	1293	code\x3D\x22[a-z]{4}\x2E[a-z]{4}\x22	2	0	0	1
+1294	1294	\x7B\x22e(v|x22\x2B\x22)(v|x22\x2B\x22|a)(a|v|x22\x2B\x22)[^\x5D]*?l\x22\x5D	2	0	0	1
+1295	1295	\x2Fgo\x2Ephp\x3Dd\x3D[a-f0-9]{16}$	2	0	0	1
+1296	1296	^[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}=	2	0	0	1
+1297	1297	\.php\?\w{2,9}\=(0[0-9a-b]|3[0-9]){5}\&\w{3,9}\=(3[0-9a-f]|4[0-9a-f])\&\w{3,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{3,9}\=(0[0-9a-b]{1,8})00020002$	2	0	0	1
+1298	1298	^\d+?.\x00\x00\x00	2	0	0	1
+1299	1299	\/[0-9a-f]{32}\.jar$	2	0	0	1
+1300	1300	\/[a-f0-9]{5,}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1301	1301	^[^OGHPDTCMLUVRBAS]	2	0	0	1
+1302	1302	&s=\{[A-Z0-9]{8}-([A-Z0-9]{4}-){3}[A-Z0-9]{12}\}&w=(\d{1,2}\.){2}\d{1,2}&b=(32|64)$/Pi	2	0	0	1
+1303	1303	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$	2	0	0	1
+1304	1304	AjaxHandler\x3d.+(script|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange|style\x3D)	2	0	0	1
+1305	1305	DELETE.+FROM	2	0	0	1
+1306	1306	UNION.+SELECT	2	0	0	1
+1307	1307	UPDATE.+SET	2	0	0	1
+1308	1308	ASCII\(.+SELECT	2	0	0	1
+1309	1309	DELETE.+FROM	2	0	0	1
+1310	1310	INSERT.+INTO	2	0	0	1
+1311	1311	UNION\s+SELECT	2	0	0	1
+1312	1312	SELECT.+FROM	2	0	0	1
+1313	1313	UPDATE.+SET	2	0	0	1
+1314	1314	ASCII\(.+SELECT	2	0	0	1
+1315	1315	DELETE.+FROM	2	0	0	1
+1316	1316	INSERT.+INTO	2	0	0	1
+1317	1317	SELECT.+FROM	2	0	0	1
+1318	1318	\/\S+\.cab	2	0	0	1
+1319	1319	User-Agent\x3a[^\n]+AskTB/iH	2	0	0	1
+1320	1320	(<p>[0-7]{3})(<d>[0-7]{3})(=p)(=d)([0-7]{3}){10}(<q>[0-7]{3})[0-7]{3}(<dot>[0-7]{3})[0-7]{3}(=dot)[0-7]{3}(=q)	2	0	0	1
+1321	1321	(<p>[0-7]{2,4})(<sep>[^0-7])(<d>((=p))[0-7]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-7]{2,4}(=sep)){10}(<q>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(<dot>[0-7]{2,4})(=sep)[0-7]{2,4}(=sep)(=dot)(=sep)[0-7]{2,4}(=sep)(=q)	2	0	0	1
+1322	1322	^\/(p(a(rs|g)e|rocess)|(securit|quer)y|(defaul|abou)t|index|login|user)\.jsp\?[a-z]{2}\x3d[a-z0-9]{9}[A-F0-9]{9}$	2	0	0	1
+1323	1323	\/gate\.php\?cmd=urls$	2	0	0	1
+1324	1324	\/gate\.php\?cmd=getexe$	2	0	0	1
+1325	1325	^User-Agent\x3a[^\r\n]*?\sMSIE\s/H	2	0	0	1
+1326	1326	^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.).+?\x2a\x86\x48\x86\xf7\x0d\x01\x09\x01.{2}(=fake_email)	2	0	0	1
+1327	1327	[^a-z0-9\-\.][a-z0-9]{32,48}\x02ru\x00\x00	2	0	0	1
+1328	1328	[^a-z0-9\-\.][a-z0-9]{32,48}\x04info\x00\x00	2	0	0	1
+1329	1329	[^a-z0-9\-\.][a-z0-9]{32,48}\x03biz\x00\x00	2	0	0	1
+1330	1330	\x2flogo\x2egif\x3f([0-9a-z]){5}\x3d\d{6,7}	2	0	0	1
+1331	1331	\.php\?label=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1332	1332	\.php\?id=[A-F0-9]+\-[A-F0-9]+&v1=[A-F0-9]+&v2=[A-F0-9]+&q=[A-F0-9]+$	2	0	0	1
+1333	1333	^\/[A-Za-z0-9]{7,8}\/index\.html?$	2	0	0	1
+1334	1334	^\/[A-Za-z0-9]+[A-Z]+[A-Za-z0-9]*\/js\.js$	2	0	0	1
+1335	1335	^Host\x3a\x20www\d+?\.[^\.]+?\.[^\.]+?\.([^\.]+\.)*?[a-z]{2,4}(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1336	1336	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1337	1337	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*gname[\r\n\s]*=>[\r\n\s]*|gname\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1338	1338	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*refresh_template_name[\r\n\s]*=>[\r\n\s]*|refresh_template_name\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1339	1339	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(gname|gowner)[\r\n\s]*=>[\r\n\s]*|(gname|gowner)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1340	1340	((\w+)[\r\n\s]*\x3a=[\r\n\s]*(\x27[^\x27]{1075,}\x27|\x22[^\x22]{1075,}\x22)[\r\n\s]*\x3b.*(refresh_template_name|user_name)[\r\n\s]*=>[\r\n\s]*|(refresh_template_name|user_name)\s*=>\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,})|\(\s*(\x27[^\x27]*\x27|\x22[^\x22]+\x22)\s*,\s*(\x27[^\x27]{1075,}|\x22[^\x22]{1075,}))	2	0	0	1
+1341	1341	^\/b\/(eve|opt|req)\/[\-f0-9A-F]{24}$	2	0	0	1
+1342	1342	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+1343	1343	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+1344	1344	\/[a-z]{1,6}\.html\?0\.[0-9]+[a-z]?$	2	0	0	1
+1345	1345	^[^\r\n]{15}\x5f[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}\x2d[^\r\n]{2}	2	0	0	1
+1346	1346	^Host\x3a[^\r\n]+\.passinggas\.net(\x3a\d{1,5})?\r?$/Hmi	2	0	0	1
+1347	1347	Server\: nginx/[a-zA-Z]	2	0	0	1
+1348	1348	^\x23\d\d\d\x2f\x21	2	0	0	1
+1349	1349	XPantivirus20\d{2}_v\d{6}\.exe	2	0	0	1
+1350	1350	\d\d\d\d\d\d\x0a	2	0	0	1
+1351	1351	PASS\s.*?\x0d\x0aNICK\s.*?\x0d\x0aUSER\s.*?\s\d\s\d\s\:\S	2	0	0	1
+1352	1352	[0-9A-Z]{240,}	2	0	0	1
+1353	1353	\x26[\x00-\xff]\x09\x00	2	0	0	1
+1354	1354	\x26[\x00-\xff]\x09\x00	2	0	0	1
+1355	1355	\.php\?id=\d+_[0-9a-f]{8}-[0-9a-f]+-[0-9a-f]{8}&cnt=	2	0	0	1
+1356	1356	OS 4_[0-3]_[1-4] like/H	2	0	0	1
+1357	1357	\.php\?f=\d+$	2	0	0	1
+1358	1358	Host\x3a ([0-9]{1,3}\.){3}[0-9]{1,3}/H	2	0	0	1
+1359	1359	User-Agent\x3a We[a-z0-9]{4}\x0d\x0a/H	2	0	0	1
+1360	1360	\.php\?t=\d{2,7}$	2	0	0	1
+1361	1361	filename=.*facebook.*\.(rar|exe|zip)	2	0	0	1
+1362	1362	filename\s*[^\n]*?(UPS|United Parcel Service)[^\n]*?\.(rar|exe|zip)	2	0	0	1
+1363	1363	flash-[A-Z0-9]+-plugin\.[A-Z0-9]+\.exe	2	0	0	1
+1364	1364	\x2Fget\x5Fdr\x2Ephp\x3F(e|ini)\x3D	2	0	0	1
+1365	1365	MalvRem_\d{3,4}\.exe	2	0	0	1
+1366	1366	avdistr_\d{3,4}\.exe	2	0	0	1
+1367	1367	RunAV_\d{3,4}\.exe	2	0	0	1
+1368	1368	installer\.\d{4}\.exe	2	0	0	1
+1369	1369	\/stetement_id\.\d+\/	2	0	0	1
+1370	1370	^\/stream\?\d$	2	0	0	1
+1371	1371	loads2\.php\?r=[0-9]{2}\.[0-9]	2	0	0	1
+1372	1372	^[\x20-\x7e]{5}.{4}\x7c\x01	2	0	0	1
+1373	1373	(\/[a-z-]+)+\.php\?[a-z]+=[0-9]+[^\r\n]+HTTP\/1\.1	2	0	0	1
+1374	1374	&cid=\d+$	2	0	0	1
+1375	1375	.*\.(ini|exe|dll|bat|com|cab|txt)	2	0	0	1
+1376	1376	^Content-Disposition\x3a\x20attachment\x3b\x20filename=[^\r\n]+?\.[a-z]{2,4}\.exe\r?$/Hmi	2	0	0	1
+1377	1377	^\/[a-z0-9A-Z]{15,35}\/((\d+[A-Z]){3}\d+|null)\/	2	0	0	1
+1378	1378	^Content-Length\x3a 2\d{2}\r?$/Hmi	2	0	0	1
+1379	1379	\/[a-z]{2,9}\.php\?([a-z0-9]{2,4}|[cktw])=[a-zA-Z0-9\x2b\x2f\x5c]{43,56}=?$	2	0	0	1
+1380	1380	\.((testdlls|threads|netstatp|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|stats|currentip)\s*[\r\n]|(iestart|ies|login|l|mirccmd|system|file\s+(cat|exists|e|del|rm|rmdir|move|copy|attrib)|down|dl\x|update|reg\s+(query|delete|write))\s+\w+|(banner|ban|advscan|asc|scanall|sa|ntscan|nts)\s*[\n\r])	2	0	0	1
+1381	1381	\x2B\x22l\x22(\x3B|\x5D)	2	0	0	1
+1382	1382	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1383	1383	^Referer\x3a[^\r\n]+\.swf/Hmi	2	0	0	1
+1384	1384	\.jpg\?id=\d+$	2	0	0	1
+1385	1385	^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){3,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$	2	0	0	1
+1386	1386	^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$	2	0	0	1
+1387	1387	^\/[a-z]{4}\.html?(\?[h-j]=\d+)?$	2	0	0	1
+1388	1388	^\/h[a-z]{3}\.html?$	2	0	0	1
+1389	1389	^\/[0-9]{8}\.html$	2	0	0	1
+1390	1390	^\/lists\/\d{15}(\d{5})?$	2	0	0	1
+1391	1391	^\/[a-z0-9]{2}\.jar$	2	0	0	1
+1392	1392	^\/([A-Za-z0-9-_]{4}){11,}([A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=)?$	2	0	0	1
+1393	1393	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+1394	1394	^([a-zA-Z]{0,119}[0-9])(<var>[a-zA-Z0-9]{9,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+1395	1395	^\/0[a-z0-9]{13}$	2	0	0	1
+1396	1396	^\/[-a-zA-Z0-9_]{70,75}==?$	2	0	0	1
+1397	1397	^User-Agent\x3a[^\r\n]+( MSIE |rv\x3a11)/Hmi	2	0	0	1
+1398	1398	\/[a-f0-9]{32}\.eot$	2	0	0	1
+1399	1399	^\/0[a-z0-9]{13}$	2	0	0	1
+1400	1400	^\/([a-z0-9_-]{0,47}?[A-Z][a-z0-9_-]{0,46}?[A-Z])([A-Z0-9_-]{0,47}?[a-z][A-Z0-9_-]{0,46}?[a-z])([A-Za-z_-]{0,47}?[0-9][A-Za-z_-]{0,46}?[0-9])[A-Za-z0-9_-]{48}\.[a-z]{2,25}\d?\??	2	0	0	1
+1401	1401	^[\x00-\x0c]\x00\x00\x00[a-z0-9]{6,12}\x00	2	0	0	1
+1402	1402	^(\x62|\x1b)	2	0	0	1
+1403	1403	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])3((=sep)|\d)*?$	2	0	0	1
+1404	1404	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])4((=sep)|\d)*?$	2	0	0	1
+1405	1405	^(\x8b|\xf2)	2	0	0	1
+1406	1406	^[a-z0-9\x02-\x50]{100,}\x00\x00\x01\x00\x01$	2	0	0	1
+1407	1407	^Host\x3a\x20[^\r\n]+\.pw\r?$/Hmi	2	0	0	1
+1408	1408	GRANT.{1,5}TO	2	0	0	1
+1409	1409	^\/\?[a-f0-9]{32}$	2	0	0	1
+1410	1410	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])0((=sep)|\d)*?$	2	0	0	1
+1411	1411	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])1((=sep)|\d)*?$	2	0	0	1
+1412	1412	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])2((=sep)|\d)*?$	2	0	0	1
+1413	1413	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])5((=sep)|\d)*?$	2	0	0	1
+1414	1414	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])6((=sep)|\d)*?$	2	0	0	1
+1415	1415	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])7((=sep)|\d)*?$	2	0	0	1
+1416	1416	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])8((=sep)|\d)*?$	2	0	0	1
+1417	1417	^\/[a-z0-9_-]+\/[A-Za-z0-9_-]{36}(<sep>[\x2c\x3b])9((=sep)|\d)*?$	2	0	0	1
+1418	1418	\/\w{1,2}\/\w{1,2}\.class$	2	0	0	1
+1419	1419	User-Agent\:[^\n]+zb-hb-/Hi	2	0	0	1
+1420	1420	^[^\r\n]*\/[0-9a-f]{78}\sHTTP	2	0	0	1
+1421	1421	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20((=refhost))/Hsi	2	0	0	1
+1422	1422	Host\x3a\x20(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1423	1423	^\/index\.php\?[a-z]{8,80}=(\d{10,13}|\d{15,20})$	2	0	0	1
+1424	1424	Host\x3a\x20([0-9]{0,22}[a-z])([a-z]*?[0-9][a-z]{0,22}[0-9])[a-z0-9]{23}\x2e[^\x2e\r\n]+\x2e[^\x2e\r\n]/H	2	0	0	1
+1425	1425	&id=\d+(\x3a([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{10,}\.{0,2})?&catid=\d+&itemid=\d+$	2	0	0	1
+1426	1426	\/pd\.php\?id=[a-f0-9]+$	2	0	0	1
+1427	1427	^\x2Fsearch\x2F\x3F[a-z]{2,5}\x3D	2	0	0	1
+1428	1428	^Referer\x3a\x20http\x3a\/\/[^\x2f]+\/[a-z0-9]{6}\/[a-z0-9]{5}\.html\r?$/Hm	2	0	0	1
+1429	1429	^[^>]*?(language\s*\s*?[\x22\x27]vbscript[\x22\x27]|type\s*\s*?[\x22\x27]text\/vbscript[\x22\x27])	2	0	0	1
+1430	1430	filename=\x22\d+?\x22/P	2	0	0	1
+1431	1431	^\/log\.php\?f=[0-1](\.[a-z]+)?$	2	0	0	1
+1432	1432	(<p>[0-9a-f]{2,4})(<sep>[\x2e\x2c\x3b\x3a])(<d>((=p))[0-9a-f]{2,4})(=sep)(=p)(=sep)(=d)(=sep)([0-9a-f]{2,4}(=sep)){10}(<q>(((=p)|(=d)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(<dot>(((=p)|(=d)|(=q)))[0-9a-f]{2,4})(=sep)[0-9a-f]{2,4}(=sep)(=dot)(=sep)[0-9a-f]{2,4}(=sep)(=q)	2	0	0	1
+1433	1433	^Host\x3a[^\r\n]+craigslist\.org[^\r\n]{20,}\r\n/Hmi	2	0	0	1
+1434	1434	^Host\x3a[^\r\n]+\r\nConnection\x3a\x20Keep-Alive\r\n(\r\n)?$/H	2	0	0	1
+1435	1435	^Content-Length\x3a[^\r\n]*?\{([^\r\n]*java\.)[^\r\n]*\.ognl[^\r\n]*\}	2	0	0	1
+1436	1436	\/j[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1437	1437	\/j[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1438	1438	\/j[a-z]+?\?f[a-z]+[a-z]+$	2	0	0	1
+1439	1439	\/f[a-z]+?\?f[a-z]+[a-z]+$	2	0	0	1
+1440	1440	\.php$	2	0	0	1
+1441	1441	\.php$	2	0	0	1
+1442	1442	GET\s[^\r\n]*?(<name>\/[^\.\/]+\.html)\?id\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(:?\d{1,5})?\r\n	2	0	0	1
+1443	1443	^\d{4}\r$	2	0	0	1
+1444	1444	^Host\x3a\x20[^\r\n]+\-login\.id\-107sbtd9cbhsbt[^\r]+$/Hmi	2	0	0	1
+1445	1445	\/form\/submit\/$	2	0	0	1
+1446	1446	pch\.php\?f=\d+$	2	0	0	1
+1447	1447	hcp_vbs\.php\?f=\d+&d=\d+$	2	0	0	1
+1448	1448	\.php\?e=\w+&f=\w+$	2	0	0	1
+1449	1449	pch2.php?c=\d+$	2	0	0	1
+1450	1450	\.jar\?t=\d+&h=[^&]+$	2	0	0	1
+1451	1451	\/adp\d\.php\[0-9a-z]{2,6}	2	0	0	1
+1452	1452	attachment\x3b[^\r\n]*?info\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1453	1453	attachment\x3b[^\r\n]*?contacts\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1454	1454	attachment\x3b[^\r\n]*?calc\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1455	1455	attachment\x3b[^\r\n]*?about\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1456	1456	hhcp.php?c=[a-f0-9]{5}$	2	0	0	1
+1457	1457	attachment\x3b[^\r\n]*?readme\.(dll|exe)[\x22\x27]?\r?$/Hmi	2	0	0	1
+1458	1458	\/content\/jav\d?\.jar$	2	0	0	1
+1459	1459	\.php\?[^&]{1,8}=[a-f0-9]{16}[\x22\x27\x3b\x20\x0a\x0d]	2	0	0	1
+1460	1460	=.*[a-f].*$	2	0	0	1
+1461	1461	<title>[a-f0-9]{10}<\/title>	2	0	0	1
+1462	1462	=[0-9a-f]{8}\.jar/H	2	0	0	1
+1463	1463	\x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}$	2	0	0	1
+1464	1464	\x2Fcontent\x2F[a-z0-9]{1,6}\x2Ephp\x3Ff\x3D[0-9]{1,5}\x3A\x3A[0-9]{1,5}$	2	0	0	1
+1465	1465	display\x3Anone\x3B\x22\x3E[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}\x2C[0-9]{2,3}[^\r\n]*\x3C\x2Fpre\x3E\x3Cscript\x3E	2	0	0	1
+1466	1466	(\x3D|\x5B\x22])e\x22\x2B\x22va	2	0	0	1
+1467	1467	(\x3D|\x5B\x22])e\x22\x2B\x22v\x22\x2B\x22a	2	0	0	1
+1468	1468	(\x3D|\x5B\x22])ev\x22\x2B\x22a	2	0	0	1
+1469	1469	\x2B\x22al\x22(\x3B|\x5D)	2	0	0	1
+1470	1470	\x2B\x22val\x22(\x3B|\x5D)	2	0	0	1
+1471	1471	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jnlp(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1472	1472	\.php\?[a-z]{2,12}=[a-f0-9]{64}&[a-z]{2,12}=	2	0	0	1
+1473	1473	^.{1,5}[a-f0-9]{100}	2	0	0	1
+1474	1474	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.eot(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1475	1475	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.jar(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1476	1476	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.exe(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1477	1477	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.php(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1478	1478	\.php\?\w{2,8}\=(0[0-9a-b]|3[0-9]){5,32}\&\w{2,9}\=(0[0-9a-b]|3[0-9]){10}\&\w{1,8}\=\d{2}\&\w{1,8}\=\w{1,8}\&\w{1,8}\=\w{1,8}$	2	0	0	1
+1479	1479	\/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php$	2	0	0	1
+1480	1480	\/news\/enter\/2012-1[0-2]-([0-2][0-9]|3[0-1])\.php	2	0	0	1
+1481	1481	\/(((detec|meri)t|[wW]atche|link)s|co(ntrolling|mplaints)|r(ea(che)?d|aise)|(alternat|fin)e|s(erver|tring)|t(hought|opic)|w(hite|orld)|en(sure|ds)|indication|kill|Web)\/([a-z]{2,19}[-_]){1,4}[a-z]{2,19}\.txt(\?[a-zA-Z]+[a-zA-Z0-9]+?&[\x3ba-zA-Z]+[a-zA-Z0-9]+?)?$	2	0	0	1
+1482	1482	\/[a-f0-9]{16}([a-f0-9]{16})?\/[a-z]\.php	2	0	0	1
+1483	1483	^\/[0-9a-f]{16}\/q\.php$	2	0	0	1
+1484	1484	^\/[0-9a-f]{16}\/q\.php	2	0	0	1
+1485	1485	^\/[0-9a-f]{32}\/ff\.php$	2	0	0	1
+1486	1486	^\/[0-9a-f]{32}\/ff\.php	2	0	0	1
+1487	1487	^\/[0-9a-f]{16}\/ff\.php$	2	0	0	1
+1488	1488	^\/[0-9a-f]{16}\/ff\.php	2	0	0	1
+1489	1489	^\/closest\/(([a-z]{1,16}[-_]){1,4}[a-z]{1,16}|[a-z0-9]{20,})\.php	2	0	0	1
+1490	1490	&jopa=\d+$	2	0	0	1
+1491	1491	\.php\?jnlp=[a-f0-9]{10}(,|$)	2	0	0	1
+1492	1492	\/[0-9a-f]{32}\/a\.php$	2	0	0	1
+1493	1493	\/[0-9a-f]{32}\/a\.php	2	0	0	1
+1494	1494	\/[0-9a-f]{16}\/a\.php$	2	0	0	1
+1495	1495	\/[0-9a-f]{16}\/a\.php	2	0	0	1
+1496	1496	\.php\?[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){5}&[^=]+=(3[0-2a-e8-9]|[47][0-2]|2[d-j]|5[2-7]|6[c-e]){10}&	2	0	0	1
+1497	1497	\/([^\/]+?\/[a-z]{2,16}[_-][a-z]{2,16}([_-][a-z]{2,16})*?|[a-z]{16,20}\/[a-z]{16,20}|closest\/[a-z0-9]+)\.php\?[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+&[A-Za-z0-9\!\(\)\*\-\_]+=[A-Za-z0-9\!\(\)\*\-\_]+$	2	0	0	1
+1498	1498	^([0-9a-z]{8})?(<p>[0-9a-z]{2})(<d>((=p))[0-9a-z]{2})(=p)(=d)([0-9a-z]{2}){10}(<q>[0-9a-z]{2})[0-9a-z]{2}(<dot>[0-9a-z]{2})[0-9a-z]{2}(=dot)[0-9a-z]{2}(=q)	2	0	0	1
+1499	1499	\.php\?[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){5}&[^=]+=([^&]?(3[0-2a-e8-9]|7[x-y6-7\-3]|x[b-e6-9xz]|\-[b-hy-z9]|w[wa-f6-9]|5[2-9a-e]|[47][0-2]|8[a-ez9]|2[d-j]|6[c-e])){10}&	2	0	0	1
+1500	1500	\.php\?[^=]+=([^&](5[5-9a-e]|8[9a-e])){5}[^=]+=[^&]+&[^=]+=([^&](5[5-9a-f]|8[9a-e])){10}([^&]60[^&]60([^&](5[5-9a-f]|8[9a-e])){10})*?&	2	0	0	1
+1501	1501	\.php\?[^=]+=[^&]{10}&[^=]+=[^&]+&[^=]+=[^&]{20}((<sep>[^&]{2})(=sep)[^&]{20})*?&	2	0	0	1
+1502	1502	^\/[a-z0-9]{6,10}\/\?[0-9]{1,2}$	2	0	0	1
+1503	1503	@\x00i\x00m\x00p\x00o\x00r\x00t\x00\x20.{4,20}[^\x00\w\s.]	2	0	0	1
+1504	1504	^\s*?\(\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27]	2	0	0	1
+1505	1505	^\s*?\(\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27]	2	0	0	1
+1506	1506	^Referer\x3a[^\r\n]+\x3a\d+\/([a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,3}|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3})/Hm	2	0	0	1
+1507	1507	^\s*?value\s*\s*?[\x22\x27]\/[a-z]+\.([Ss][Ww][Ff])[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+\x3d([a-z]+|[0-9]+)[\x22\x27]	2	0	0	1
+1508	1508	^\s*?value\s*\s*?[\x22\x27]\/([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?[\x22\x27]	2	0	0	1
+1509	1509	^\/([a-z]+\.[a-z]+\d?\?([a-z]+\x3d([a-z]+|[0-9]+)&){2,}[a-z]+=([a-z]+|[0-9]+)|([a-z]+\x2f([a-z]+|[0-9]+)\x2f){3,}[a-z]+\x2f([a-z]+|[0-9]+)\x2f?)$	2	0	0	1
+1510	1510	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1511	1511	Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=refhost)/Hsi	2	0	0	1
+1512	1512	^Host\x3a[^\r\n]*?\x3a((80(80)|312[89]))\d+\r$/Hm	2	0	0	1
+1513	1513	^(((<\/object>).)*?<param([^>]*?name\s*\s*?\x22bgcolor\x22)[^>]*?value\s*\s*?\x22#ffffff\x22)((<\/object>).)*?<param([^>]*?name\s*\s*?\x22movie\x22)[^>]*?value\s*\s*?\x22([^\x22]+\.[Ss][Ww][Ff])[^\x22]*?\x22	2	0	0	1
+1514	1514	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1515	1515	Host\x3a\x20(<host>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?Referer\x3a\x20http\x3a\x2f\x2f(=host)\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n/Hsi	2	0	0	1
+1516	1516	Referer\x3a\x20http\x3a\x2f\x2f(<host>[^\r\n\x3a\x2f]+)(\x3a\d{1,5})?\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)\r\n.*?Host\x3a\x20(=host)(\x3a\d{1,5})?\r\n/Hsi	2	0	0	1
+1517	1517	^\s*?<\/body>\s*?\s*?<\/html>\s*?$	2	0	0	1
+1518	1518	^\s*=\s*(<var1>[\x22\x27][a-z]+[\x22\x27]).+?\sid\s*=\s*(=var1)	2	0	0	1
+1519	1519	^([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$	2	0	0	1
+1520	1520	^(\s*var\s[a-z]+\s*=\s*\d+\x3b\s*\n)*\s*<\/script>\s*<object([^\r\n]*d27cdb6e-ae6d-11cf-96b8-444553540000)[^\r\n]*\s(name|id)\s*=\s*[\x22\x27](<var>[a-z]+)[\x22\x27][^\r\n]*\s(name|id)\s*=\s*[\x22\x27](=var)[\x22\x27][^\r\n]*>[\r\n]+(<spc>\s+)<param([^>]*?name\s*\s*?\x22movie\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22bgcolor\x22)[^\r\n]*>[\r\n]+(=spc)<param([^\r\n>]*name\s*\s*?\x22allowScriptAccess\x22)[^\r\n]*>[\r\n]+(=spc)<embed([^\r\n]*\ssrc\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27])[^\r\n]+[\r\n]*<\/object>\s*<\/body>\s*<\/html>\s*$	2	0	0	1
+1521	1521	^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27]	2	0	0	1
+1522	1522	^\s*=\s*[\x22\x27]\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|([a-z]*\d+[a-z]+\d)(\d*[a-z]+\d+[a-z])[a-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}\d+))(\.swf)?|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}(\.html)?(\.swf)?)[\x22\x27]	2	0	0	1
+1523	1523	^\s*=\s*[\x22\x27][a-z]+[\x22\x27]	2	0	0	1
+1524	1524	^\s*=\s*[\x22\x27][a-z]+[\x22\x27]	2	0	0	1
+1525	1525	^\s*=\s*[\x22\x27]\/[^\x22\x27]*\.html\.swf[\x22\x27]	2	0	0	1
+1526	1526	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1527	1527	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1528	1528	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)	2	0	0	1
+1529	1529	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)	2	0	0	1
+1530	1530	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)	2	0	0	1
+1531	1531	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(=space)<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27]	2	0	0	1
+1532	1532	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)	2	0	0	1
+1533	1533	^([^\r\n]*\sid\s*=[\x22\x27][a-z]+[\x22\x27])([^\r\n]*\sname\s*=[\x22\x27][a-z]+[\x22\x27])[^>]*>\s*\n\s*(<embed[^\r\n>]*allowScriptAccess\s*=\s*[\x22\x27]sameDomain[\x22\x27][^\r\n>]*\s*\n\s*)?<param([^\r\n>]*name\s*=\s*[\x22\x27]?allowScriptAccess[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]always[\x22\x27][^\r\n>]*>(<space>[\s\r\n]+)<param([^\r\n>]*name\s*=\s*[\x22\x27]?movie[\x22\x27]?)[^\r\n>]*value\s*=\s*[\x22\x27]\/[^\x22\x27]+\.swf[\x22\x27][^>\r\n]*>(=space)<param[^\r\n>]*name\s*=\s*[\x22\x27]?bgcolor[\x22\x27]?[^>\r\n]*>(=space)	2	0	0	1
+1534	1534	\/m[a-z]+?\?l[a-z]+[a-z]+$	2	0	0	1
+1535	1535	^h[a-z0-9]{0,10}\x3d[a-f0-9]{24}&p[a-z0-9]{0,10}\x3d[a-z0-9]{1,11}&i/P	2	0	0	1
+1536	1536	^p[a-z0-9]{0,20}\x3d[a-z0-9]{1,20}&i[a-z0-9]{0,20}\x3d%[0-9A-F]{2}/P	2	0	0	1
+1537	1537	\x28[\r\n\s]*?(<qa1>[\x22\x27]?)[a-f0-9]{24}(=qa1)[\r\n\s]*?,[\r\n\s]*?(<qa2>[\x22\x27]?)[a-z0-9]{1,20}(=qa2)[\r\n\s]*?	2	0	0	1
+1538	1538	=%25[0-9A-F]{2}%25[0-9A-F]{2}/P	2	0	0	1
+1539	1539	^\/a[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?q[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1540	1540	^\/s[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?d[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1541	1541	^\/k[a-z]{4,13}\?e[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1542	1542	^\/g[a-z]{4,13}\?(hash=[a-f0-9]{32}&)?t[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1543	1543	\/r[a-z]+?\?j[a-z]+[a-z]+$	2	0	0	1
+1544	1544	\/f[a-z]+?\?j[a-z]+[a-z]+$	2	0	0	1
+1545	1545	^\/o[a-z]{4,13}\?h[a-z]{4,11}=\d{6,7}$	2	0	0	1
+1546	1546	\/b[a-z]+?\?n[a-z]+[a-z]+$	2	0	0	1
+1547	1547	\/v[a-z]+?\?n[a-z]+[a-z]+$	2	0	0	1
+1548	1548	^\/[a-z]{5,14}\?[a-z]{5,12}=\d{6,7}$	2	0	0	1
+1549	1549	^\/[a-z]{5,14}\?[a-z]{5,12}=[a-z]{6,11}$	2	0	0	1
+1550	1550	^[\r\n\s]*?\,	2	0	0	1
+1551	1551	\bdig\.dll\b	2	0	0	1
+1552	1552	^\/[a-z]+?\?[a-z]+[a-z]+$	2	0	0	1
+1553	1553	^Host\x3a\x20[^\r\n]+\.(d(yndns\.[a-z]{2,3}|esi)|c(ricket|a?fe?)|(lin|wor)k|s(u|pace)|accountant|t(k|op)|g[aq]|xyz|ml|pw)(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1554	1554	^\/([a-z]{3,20}\/(([a-z\d+]*?[A-Z])([A-Z\d+]*?[a-z])[A-Za-z\d]+|\d+\/([a-z]{3,20}-)+[a-z]{3,20}|([a-z]{3,20}-)+\d+|([a-z\d]*?[A-Z]{2}[\d]))|\d+\/\d+\/\d+\/([a-z]{3,20}\/)+([a-z]{3,20}-)+[a-z]{3,20}\.html)$	2	0	0	1
+1555	1555	^(<windname>[a-z0-9]+)(<plug1>([sj]|f1))=true.+?window\.(=windname)(<plug2>(((=plug1))([sj]|f1)))=true.+?window\.(=windname)(((=plug1)|(=plug2)))([sj]|f1)=true	2	0	0	1
+1556	1556	^\/1[a-z0-9]{13}$	2	0	0	1
+1557	1557	^GET \/0(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n	2	0	0	1
+1558	1558	^\/1[a-z0-9]{13}$	2	0	0	1
+1559	1559	^GET \/4(<baseuri>[a-z0-9]{10})[a-z0-9]{3} HTTP\/1\.[01]\r\n.*?Referer\x3a http\x3a\/\/[^\/]+?\/(=baseuri)\r\n	2	0	0	1
+1560	1560	^\/3[a-z0-9]{13}$	2	0	0	1
+1561	1561	\/4[a-z0-9]{13}\?&xkey=	2	0	0	1
+1562	1562	^[a-zA-Z0-9\/\+]+?ODAvM[a-zA-Z0-9\/\+]{18}(=|%3D)[\x22\x27]	2	0	0	1
+1563	1563	^[a-zA-Z0-9\/\+]+?4MC8x[a-zA-Z0-9\/\+]{18}(=|%3D){2}[\x22\x27]	2	0	0	1
+1564	1564	^[a-zA-Z0-9\/\+]+?OjgwL[a-zA-Z0-9\/\+]{19}[\x22\x27]	2	0	0	1
+1565	1565	^(\s*?|\/\*((\*\/).)*?\*\/)*?\((\s*?|\/\*((\*\/).)*?\*\/)*?(<vname>[^\s>=]+)(\s*?|\/\*((\*\/).)*?\*\/)*?<(\s*?|\/\*((\*\/).)*?\*\/)*?32\b.{0,200}(=vname)(\s*?|\/\*((\*\/).)*?\*\/)*?\x3d(\s*?|\/\*((\*\/).)*?\*\/)*?63\b.{1,200}\+=.{0,200}\((\s*?|\/\*((\*\/).)*?\*\/)*?(=vname)	2	0	0	1
+1566	1566	^[a-zA-Z0-9]+\*\/	2	0	0	1
+1567	1567	[a-z0-9]+?\*\/	2	0	0	1
+1568	1568	^\s*?<script>\s*?(<func>[A-Za-z0-9]+)\s*?\(\s*?[\x22\x27](<var>[^1\x22\x27]+)1[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)2[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>\s*?(=func)\s*?\(\s*?[\x22\x27](=var)3[\x22\x27]\s*?\)\x3b\s*?<\/script>\s*?<script>	2	0	0	1
+1569	1569	^\s*?\n\s*?(<func>[^\x28\r\n\s]+)\s*?\(\s*?(<var>[^\+\x29]+)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+[^\r\n]+\r?\n\s*?<\/script>\s+<script>\s+(=func)\s*?\x28\s*?(=var)\+	2	0	0	1
+1570	1570	^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$	2	0	0	1
+1571	1571	^\/[a-z0-9\x2d\x5f]{62}(([a-z0-9\x2d\x5f]|=)=|[a-z0-9\x2d\x5f]{2})$	2	0	0	1
+1572	1572	^Referer\x3a[^\r\n]+\/([a-z0-9]+\.php|\d+)\r$/Hm	2	0	0	1
+1573	1573	Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2039/H	2	0	0	1
+1574	1574	Last-Modified\x3a\x20[A-Z][a-z]+, 26 Jul 2040/H	2	0	0	1
+1575	1575	^\W	2	0	0	1
+1576	1576	^\W	2	0	0	1
+1577	1577	^\/[a-z]{3}\?[A-F0-9]{8}$	2	0	0	1
+1578	1578	^Referer\x3a\x20http\x3a\x2f\x2f?[^\x2f]+\/[a-z]{3,20}((<sep>[_-]?)[a-z]{3,20}(=sep)([a-z]{3,20}(=sep))?)?[a-z]{3,20}\/\d{10,20}(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+1579	1579	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi	2	0	0	1
+1580	1580	Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1581	1581	^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}\r$/Hmi	2	0	0	1
+1582	1582	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+).*?\r\nHost\x3a\x20(((=refhost)|www\.))/Hsi	2	0	0	1
+1583	1583	Host\x3a\x20(www\.)(<refhost>[^\x3a\r\n]+).*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f((=refhost))/Hsi	2	0	0	1
+1584	1584	^Host\x3a\x20(www\.)[^\x2e]+(\.[^\x2e\r\n]+){2,}(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+1585	1585	^((<\/body).)+?Content\s*?loading.*lease wait.*?<iframe	2	0	0	1
+1586	1586	^(\x4c|\x35)	2	0	0	1
+1587	1587	^(\x76|\x0f)	2	0	0	1
+1588	1588	\/wp-(content|admin|includes)\/	2	0	0	1
+1589	1589	^\d\x00\d	2	0	0	1
+1590	1590	\.php\?$	2	0	0	1
+1591	1591	\?showforum=$	2	0	0	1
+1592	1592	^\s*5a\s*90\s*00\s*03\s*00\s*00\s*00	2	0	0	1
+1593	1593	\x2Fphp-calendar-1.1\x2Fupdate(08|10)\x2Ephp(\x3F|.*(\x26|\x3B))configfile=[^\x26\x3B]*[^a-zA-Z0-9_]	2	0	0	1
+1594	1594	(\.\.\/){1,}	2	0	0	1
+1595	1595	(\.\.\/){1,}	2	0	0	1
+1596	1596	=(https?|ftps?|php)\:\/.{0,100}cmd=	2	0	0	1
+1597	1597	MEAS\.TYPE=((link|class)&)	2	0	0	1
+1598	1598	url=.{8000}	2	0	0	1
+1599	1599	\/ssp\/files\/annonce\.pdf$	2	0	0	1
+1600	1600	\/ssp\/loadjavad\.php$	2	0	0	1
+1601	1601	\/wywg\/[a-z0-9]{2,5}\/[a-z0-9]+\.exe$	2	0	0	1
+1602	1602	\/xml\/p\.php\?id=\d{2,}	2	0	0	1
+1603	1603	ts\/in\.cgi\?pepsi\d+	2	0	0	1
+1604	1604	cs_base_path=\s*(ftps?|https?|php)\:\/	2	0	0	1
+1605	1605	\x0d\x0aHost\: (www\.)?nacha\.org\.	2	0	0	1
+1606	1606	\x26n\x3d[a-z]{5}\d{4}	2	0	0	1
+1607	1607	name=(https?|ftps?|php)	2	0	0	1
+1608	1608	\/script\.php?\d{8}	2	0	0	1
+1609	1609	Host\: \d+\.\d+\.\d+\.\d+\x0d\x0a	2	0	0	1
+1610	1610	\/[a-z]+\/[a-z0-9]{120,}\/[a-z0-9]+\/.+\.com$	2	0	0	1
+1611	1611	UPDATE.+SET	2	0	0	1
+1612	1612	ASCII\(.+SELECT	2	0	0	1
+1613	1613	DELETE.+FROM	2	0	0	1
+1614	1614	INSERT.+INTO	2	0	0	1
+1615	1615	UNION\s+SELECT	2	0	0	1
+1616	1616	SELECT.+FROM	2	0	0	1
+1617	1617	UPDATE.+SET	2	0	0	1
+1618	1618	ASCII\(.+SELECT	2	0	0	1
+1619	1619	DELETE.+FROM	2	0	0	1
+1620	1620	INSERT.+INTO	2	0	0	1
+1621	1621	UNION\s+SELECT	2	0	0	1
+1622	1622	SELECT.+FROM	2	0	0	1
+1623	1623	ver=[v\d]+	2	0	0	1
+1624	1624	\/Setup_[0-9]{3}([A-Z][0-9])?\.exe$	2	0	0	1
+1625	1625	\/\d+\/installer\/Installer(Clean)?\.exe$	2	0	0	1
+1626	1626	\/(nte|ld)\/[0-9A-Z]*trest1[0-9](\.php|\s\.asp|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$	2	0	0	1
+1627	1627	^[a-z0-9\x40\x2d\x5f]{5,12}..\x00\x00..\x00\x00\x78\x9c	2	0	0	1
+1628	1628	=sent$	2	0	0	1
+1629	1629	\.php\?get[^=]*=\d_\d{5,}$	2	0	0	1
+1630	1630	\.php\?[a-z]_info=[a-z0-9]{1,4}_\d+?$	2	0	0	1
+1631	1631	Host\x3A\x20[^\r\n]*.rr.nu/H	2	0	0	1
+1632	1632	^(.{0,63}\x00.{0,62}\x00.{0,61}\x00.{0,60}\x00)(.{0,62}\x00{2})(.{0,59}[A-Za-z0-9]{5})((<b1>.).{0,63}(=b1).{0,62}(=b1).{0,61}(=b1).{0,60}(=b1))(.(<b2>.).{0,62}(=b2).{0,61}(=b2).{0,60}(=b2).{0,59}(=b2))(..(<b3>.).{0,61}(=b3).{0,60}(=b3).{0,59}(=b3).{0,58}(=b3))(...(<b4>.).{0,60}(=b4).{0,59}(=b4).{0,58}(=b4).{0,57}(=b4))(....(<b5>.).{0,59}(=b5).{0,58}(=b5).{0,57}(=b5).{0,56}(=b5))(.....(<b6>.).{0,58}(=b6).{0,57}(=b6).{0,56}(=b6).{0,55}(=b6))(......(<b7>.).{0,57}(=b7).{0,56}(=b7).{0,55}(=b7).{0,54}(=b7))(.......(<b8>.).{0,56}(=b8).{0,55}(=b8).{0,54}(=b8).{0,53}(=b8))(........(<b9>.).{0,55}(=b9).{0,54}(=b9).{0,53}(=b9).{0,52}(=b9))(.........(<b10>.).{0,54}(=b10).{0,53}(=b10).{0,52}(=b10).{0,51}(=b10))	2	0	0	1
+1633	1633	\.tar$	2	0	0	1
+1634	1634	\x2Fjs\x2F[\r\n]*\x2Eexe$	2	0	0	1
+1635	1635	^(<mac_addr>[\x00-\xff]{6})(=mac_addr){2,}$	2	0	0	1
+1636	1636	^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED)	2	0	0	1
+1637	1637	^(BEFORE_OUTPUT_REQ|FINISHED|LOADED|LAUNCHED)	2	0	0	1
+1638	1638	^(\\r\\n|\x0d\x0a)C	2	0	0	1
+1639	1639	\/index\.php\?[a-z]=[A-Za-z0-9\/\+]*?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+?((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+((N1cm[kw]|RpbWU)9|(zdXJ[ps]|0aW1l)P|c3Vy(aT|bD)|dGltZT)[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+1640	1640	<iframe.*?src.*.*?<\/iframe>	2	0	0	1
+1641	1641	[a-z]{4,10}\x08velodrivve\x03biz\x00	2	0	0	1
+1642	1642	PRIVMSG.*@(portscan|nmap|back|udpflood|tcpflood|httpflood|linuxhelp|rfi|system|milw0rm|logcleaner|sendmail|join|part|help)	2	0	0	1
+1643	1643	\/[A-Z]Setup_[0-9]{4}\.exe$	2	0	0	1
+1644	1644	\.php.+?(c((onfi|f)g|alendar)|p(a(ge|th)|rog)|l(ang(uage)?|ib)|f(older|ile|ad)|d(omain|ir|f)|s(ettings|bp)|a(genda|uth)|i(con|ncl|d)|n(ame|ews)|r(oot|f)|gallery|type|ext|mod|[a-z](\[.*\])+?)\s*=\s*https?	2	0	0	1
+1645	1645	\/[a-f0-9]{16}\/.+?\.(exe|zip)$	2	0	0	1
+1646	1646	^\s?\+x=[0-9]*\;\ +y=[0-9]	2	0	0	1
+1647	1647	User-Agent\:[^\n]+\; UA\d\d\d\d\d\;/H	2	0	0	1
+1648	1648	^\/load.php\?showforum=(ato|obe|rhino|lib)$	2	0	0	1
+1649	1649	^[a-z]{5}\d=\x5f\d\x5f	2	0	0	1
+1650	1650	index.php\?[0-9a-f]{32}$	2	0	0	1
+1651	1651	o/\d{9}\/[0-9a-f]{32}\/[0-9]$	2	0	0	1
+1652	1652	\/out.php\?id=\d$	2	0	0	1
+1653	1653	\/\?[a-z0-9]{5,}=[a-zA-Z0-9\x25]{40,}\x253D$	2	0	0	1
+1654	1654	^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$	2	0	0	1
+1655	1655	\/((article|contact|new)s|read|(fo|tu)r)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.eot|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.EOT)$	2	0	0	1
+1656	1656	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})1\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}1\.PDF)$	2	0	0	1
+1657	1657	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})2\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}2\.PDF)$	2	0	0	1
+1658	1658	^(\/[a-z]{3,20})?\/([a-z]{3,20}[-_])+[a-z]{3,20}\.jar$	2	0	0	1
+1659	1659	\/((article|contact|new|sale)s|(fo|tu)r|public|read)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})3\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}3\.PDF)$	2	0	0	1
+1660	1660	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/foto\.png$	2	0	0	1
+1661	1661	\.png$	2	0	0	1
+1662	1662	^\/[a-zA-Z0-9_\x2f-]{300,}\.html?$	2	0	0	1
+1663	1663	\/\d+\.mp3\x3frnd\x3d\d+$	2	0	0	1
+1664	1664	(Is|CheckRemote)DebuggerPresent	2	0	0	1
+1665	1665	(Create|Connect|Peek)NamedPipe	2	0	0	1
+1666	1666	ftp(open|get)file	2	0	0	1
+1667	1667	^\/r\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1668	1668	^\/t\/l\/([a-z]{1,16}[-_]){1,4}[a-z]{1,16}\.php	2	0	0	1
+1669	1669	^\/[a-f0-9]{32}\.eot$	2	0	0	1
+1670	1670	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/new\.png$	2	0	0	1
+1671	1671	\.gif$	2	0	0	1
+1672	1672	\/(w(hite|orld)|step)\/\d+$	2	0	0	1
+1673	1673	\.psd$	2	0	0	1
+1674	1674	\.jpeg$	2	0	0	1
+1675	1675	\/(w(hite|orld)|step)\/mypic\.dll$	2	0	0	1
+1676	1676	getqq\.jpg$	2	0	0	1
+1677	1677	^[\r\n\s\+]*[\r\n\s\+]*?(<q>[\x22\x27])(((=q)).)+?\.txt\?e=\d+(&[fh]=\d+)?(=q)	2	0	0	1
+1678	1678	\.php\?t[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1679	1679	([a-z+-]{0,4}[0-9.*]+[a-z$+-]{0,4},){24}	2	0	0	1
+1680	1680	[\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]+	2	0	0	1
+1681	1681	\.php\?spl=[A-Z]{3}	2	0	0	1
+1682	1682	\.php\?b[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1683	1683	\.php\?n[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1684	1684	^[^?#]+?\.php\?page[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1685	1685	\.php\?v[a-z0-9]{1,4}=[a-f0-9]{16}$	2	0	0	1
+1686	1686	\.php\?doit[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1687	1687	^[^?#]+?\.php\?id[a-z0-9]*=[a-f0-9]{16}$	2	0	0	1
+1688	1688	(-?\d+\x3a-?\d+\x3a){100}	2	0	0	1
+1689	1689	\x2Fsrc\x2Ephp\x3Fcase\x3D[a-f0-9]{16}$	2	0	0	1
+1690	1690	[\?&]src=\d+&gpr=\d+&tkr[ib][a-f0-9]	2	0	0	1
+1691	1691	value\x3D\x22\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23[0-9]{4}\x3B\x26\x23	2	0	0	1
+1692	1692	\x2Fredirect\x2Ephp\x3Fd\x3D[0-9a-f]{8}$	2	0	0	1
+1693	1693	\/\d+\.js\?\d+&[a-f0-9]{16}$	2	0	0	1
+1694	1694	^\/[a-z0-9_\-]{48}$	2	0	0	1
+1695	1695	\.php\?e=[^&]+?$	2	0	0	1
+1696	1696	\/[a-z]\/[0-9]\/[0-9a-f]{32}$	2	0	0	1
+1697	1697	archive=[^\x3e]+?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+1698	1698	^\/[a-z]+\/$	2	0	0	1
+1699	1699	\/((article|contact|new)s|(fo|tu)r|public|read)\/pics\/image\.gif$	2	0	0	1
+1700	1700	\/w(hite|orld|step)\/.*((([A-Z][a-z]{3,20}[-._])?[A-Z][a-z]{3,20}|([a-z]{4,20}[-._])?[a-z]{4,20})\.pdf|([A-Z]{4,20}[-._])?[A-Z]{4,20}\.PDF)$	2	0	0	1
+1701	1701	\/(w(hite|orld)|step)\/get(a+|n+)\.jpg	2	0	0	1
+1702	1702	\.php\?usernms=[^@]+@[^\r\n]+$	2	0	0	1
+1703	1703	^(\x3a\d{1,5})?$	2	0	0	1
+1704	1704	^[^\r\n]+?\.(c(o(l(leg(e((confidential|-station|prowler)\.net|s?explained\.com)|iate(explained|info)\.com)|(o(rado-springs-jobs|nexplained)|umnexplore)\.com)|m(p(uter(explained\.com|themes\.net)|assiondefinition\.com)|m(oditylingerie|unesinfo|ercekid)\.com)|n(ce(rtparis\.net|ptsets\.com)|trolwedding\.com)|((rnell|upon)explained|peguide)\.com|7\.us)|a(((mpaign|talog|det)explained|n(cersexplained|adadaycore)|p(itali[sz]eguide|ricornhi)|b(leexplained|indynamic))\.com|r((tograph(yanalysis|erwhat)|cinomas?explained|scratch-remover|eblack)\.com|insurance-compare\.net)|ce\.us)|h((a(r(med-episodes|les-proxy|tpixel)|p(elsinfo|terball)|nnelexplained)|ristmas(gift-ideas|motion)|inesenewyearboom|eckingwatch)\.com|(orizo|urros)\.es)|(e(l(lularexplained|iac-diet)|ntigrade(explained|info))|(li(nical|ck)|ustomized)explained|r(uiseshipdating|iticsmart)|pu-benchmark|nc-cs)\.com|8\.biz|z\.cc)|a((ll(about(((collegi|gradu)at|yal)e|s(eminary|tudent)|(facul|varsi)ty|bestsellers|academic|teaching|harvard|ucla|pro)|babyours)|n((tip	2	0	0	1
+1705	1705	desbi|alyzelan)d|onymous-film)|(mericas-nexttopmode|gentsbal)l|r(chitectureice|lingtonwriter)|c(ademicexplaine|tionmo)d|ero(flotinfo|bicfund))\.com|u((toma(tedexplained|kers24)|stralia-airlines|xiliaryverb)\.com|di(t(jewellery\.com|report\.net)|o-planet\.com))|p((rilfools(hotel|spin)|ple-airport)\.com|[fh]i\.biz)|ir((bnb-coupon|waysinfo)\.com|portshuttleseattle\.net)|v(enue(domain|hello)\.com|li\.biz)|\.e\.gy)|b((a(c(helorexplained|kpackscope)|by(online-shop|revision)|(rcelonarea|ggagecoo)l|s(icexplained|escope)|ttle-field-3)|e((st-hoteldeal|er-calorie|t-award)s|nefitexplained)|u(y-invite|dgetyep)|logger-com)\.com|r((o(adbandinternet-providers|king(explained|guide))|unomarsalbum|yan-college)\.com|ea(st(cancertattoos\.net|explained\.com)|dmachine-recipes\.com))|o(((om(ing|s)|nd)explained|tany(explained|info)|dybuildingdomains|rrowings?24)\.com|stoncolleges\.net)|irthcertificatetemplate\.net|3g\.biz)|d(e((((benture|posit)explaine|alershipislan)d|n(guefevertreatment|verhowto)|ductguide|veloptea)\.com|(xterstre	2	0	0	1
+1706	1706	ming|ciduoustrees)\.net)|o((ctorate(s?explained|info)|llar-converter|gwalking-jobs|texplained|mainsknow)\.com|wnload(starcraft|-films|ubuntu)\.net)|(a(ncecentralsonglist|rtmouthexplained)|na-replication|hcp-server|vd-codec|rivewww)\.com|i((s(count|ease)explained|nnerparty-recipes|walifile)\.com|rect-golf\.net))|e((a(r(fulexplained|th-clinic)|sy(-costumes|repayment))|conomic(save|24))\.com|\.gy)|4((4qs|h5)\.com|[jp]\.org|ql\.biz)|3(vt\.info|gb\.biz|q\.org)|2(eat\.com|sf\.biz|u\.se)|8(c1\.net|x\.biz)|7(c\.org|p\.biz)|11r\.(biz|us))(\x3a\d{1,5})?$	2	0	0	1
+1707	1707	^[^\r\n]+?\.(f((a(c(ultyexplained|e-bok)|(ncy-font|ke-nail)s|ir(explained|fuse)|shion-wallpaper|lterguide)|i(nanc(i(al|ng)explained|epets)|rm(explained|s24)|lter-coffee)|o(r(umexplained|ecastbooks|ceestate)|x-drama)|udaninfo)\.com|re(e(-(((foodcoupon|angrybird)s|s(oundclips|tock)|photoeditor)\.com|music-download\.net)|(p(owerpointthem|roduct-sampl)es|dom-ofspeech)\.com|fileconverter\.net)|snoever\.com)|l(a(shplayerdownload\.net|tbelly-diet\.com)|oridaunemploymentclaim\.com|v-downloader\.net)|e(rtility-calculator\.net|stivalexplained\.com)|b(-smileys\.com|skins\.net))|l((i(n(k(explained|master)|colnsbirthdaytea)|(ability|ver)explained|(berty-saf|ftmov)e|stings(biz|red)|teraturemulti)|u(ng(explained|abscess)|ggageboom)|o(cationssecure|ndon-riots|gback))\.com|e((a(singexplained|ther-trousers)|(edsunited-new|d-candle)s|cturer(explained|info)|nd(ing|er)explained|isure-diving)\.com|u(kemiaexplained\.com|e\.biz)|tup\.org)|a(guay\.(com|es)|-gazzetta\.com)|6\.org)|i(n(s((ur(er(s(explained|24)|explained)|ancesexplain	2	0	0	1
+1708	1708	d)|ide-film)\.com|(pection-camera|taflex)\.net)|d(e(pendenceday(portal|realty)|mnityexplained)\.com|ividual-healthinsurance\.net)|t(er(estexplained\.com|trigo\.net)|ranet(explained|pm)\.com)|((vestment|centive)explained|expensivehyper)\.com|f(ections?explained\.com|o\.se))|((mmersio|sd)nexplained|ronmancom|pone-5)\.com|i(nkai|lg)\.biz)|m((e(tropolis((cruis|fac|mov)e|pixel)|(lanoma|dical)explained|r(idiantotal|cedes-cls)|ntal-healthjobs|morialdaycon|ssenger-mac|ansgift)|i(ami(-holidays|what)|di-editor)|baexplained)\.com|a(r((tial-empires|ket-hq)\.com|iogames-online\.net)|n((agejoin|ualzap)\.com|ipal-university\.net)|(lignanthypertension|gazinedownload)\.net|s(on(wave|car)|tersexplained)\.com|c2\.org))|e((s(ta(tes(mob|fx)|blishstyle)|lexplained)|mploy(e(eexplained|r24)|mentexplained))\.com|n(((gagement-photo|able-cookie)s|rollexplained)\.com|trepreneur-ideas\.net)|x(((hibition|po)explained|ecutive-decision)\.com|tremedeal\.net)|l(ect(ronicexplained|orate123)\.com|guay\.(com|es))|q(uityexplained\.com|8\.biz))|	2	0	0	1
+1709	1709	((o(a(d(minister|vertize|just)|cademic|llocate)|(thic-literatur|handl)e|(bailou|conduc)t|govern)|r(a(duate(explained|sinfo)|ndparentsdayplan)|oceryexplained|4)|ym(glas|car)s|m[69])\.com|a(((llaudet|te)explained|mevelocity|rnerguide)\.com|511\.net)|cwsa\.org)|h(o((me(made-biscuits|pageexplained)|(nours|tline|using)explained|6)\.com|stel-barcelona\.net)|a(r(dback(city|yoga)|vardexplained)|n(dlechange|ukkahbio)|lloweenorange)\.com|y(perthyroidsymptoms\.net|d\.me)|ellokittypictures\.net)|j((o(urnalism(explained|info)|hn-grisham|ker-tattoo)|query-examples)\.com|a(cksonvillepath\.com|vacollection\.net)|(vvg|6)\.org)|k(ilometersreach|udosexplained|jyg)\.com)(\x3a\d{1,5})?$	2	0	0	1
+1710	1710	^[^\r\n]+?\.(p(r(o(pert(ies(-forsale\.net|winters\.com)|y-(singapore|rental)\.net)|(fessors|state)explained\.com)|e(miums(e(xplained|ek)|guide)|(acher|cinct|late)sinfo|pexplained)\.com|i(va(te(car-sales|explained)\.com|do\.info)|nceton\.me))|e((n(sionexplained|thousepal|cetruck)|diatricsexplained)\.com|rsonal(trainer-certification\.net|-injuryclaims\.com)|tardo\.es)|o((wer(borrowings?|repayment|debts)|rt(land-holidays|alexplained)|intexplained|litical24)\.com|kertexas-holdem\.net)|a((ss(engersinfo|agepix)|ge(explained|as)|cemaker-surgery|ttinson-robert|rk-edu)\.com|loaltocollege\.net)|(u(blicationgift|pils?info)|ickups(articles|gen)|neumoniaexplained|sychologyquotes|lus-sign)\.com|h(o(toedit(orfreedownload\.net|ingsite\.com)|neexplained\.com)|pbb-themes\.com|yscology\.net)|cbp\.net|9\.org)|o(n(line(((f(o(ster|rce)|irstborn|raternal|ulltime)|b(r(idegroom|owse)|oxoffice)|e((valuat|xpress)e|fficient)|-(collegecourse|radiostation)|d(escendant|aughter|iscusse)|v(illage|acant)|re(sidence|al))s|c((r(iti(c(ize|al)|	2	0	0	1
+1711	1711	ue)|ew)|o(nsider|usin)|a(pture|meo)|elluloid)s|ha(racters|teau))|a(((vailabl|doptiv|llianc|pprais)e|ss(esse|ay)|unt)s|n((cestor|alyze)s|imated)|way)|per(sonal-trainer|manents))\.com|mediaconverter\.net)|e-lyrics\.com|amia\.biz)|(ver(seasexplained|drawnreal)|(wnership|ffline)explained|cean(ic-cable|you)|rphanagesinfo|klahomafuse)\.com|a(klandour\.com|pg\.org))|r(e((s(idenc(e(attorney|dating|cook|food)|yexplained)|erves(development|core))|(c(o(ver(ing|ed)|up)|laim)guid|laxationhyp|bateventur)e|g(i(on(private|mentor)|stercommunity)|ainguide)|t(r(ainingexplained|ieveguide)|ailexplained)|motecontrol-helicopter|viewwinters|payment24)\.com|alestate-perth\.net)|(a(cetracksinfo|veexplained|iserepair|tetask)|ising-antivirus|bnnetwork)\.com|o((o(m(sfootball|mateco)|fcute)|admodern)\.com|yallondonhospital\.net))|s((o((lventsourc|ftenguid)e|urceexplained|cietiesinfo|ng-india)|a(n(antoniosource|diegodiscover)|l(aryexplaine|euploa)d)|ta(nford(explained|info)|(bilis|v)eguide|r-treck)|p(ecialtyexplained|iralwatch|orts-tab)|	2	0	0	1
+1712	1712	h(oolexplained|eduleedu)|ites?explained)\.com|e((minar(y(explained|info)|explained)|c((urities|tor)explained|what)|aworld-coupons)\.com|rvertransfer\.net)|m(ier\.org|oz\.us)|hellgascard\.net|gba\.biz)|m(o((t(oristsinfo|iveshare)|ntre-breitling|dernexplained|squesinfo)\.com|hamed\.me)|(y(borrowings|-husband)|ultimediaexplained|inistriesinfo)\.com|mcd\.us)|n((a(ming(mac|our)|uticalfit|vigateadd)|e(tworkexplained|w-college))\.com|8\.biz))(\x3a\d{1,5})?$	2	0	0	1
+1713	1713	^[^\r\n]+?\.(t(e((l(e(phoneexplained|comsguide)|learth)|n(ured(explained|info)|nis-ranking))\.com|mp(l(ates-gratis\.com|ecollege\.net)|converter\.net)|a(ching(-certificate\.net|explained\.com)|m\.pro))|r(a(((nsferbyt|de-)e|in(eesinf|ge)o|mray)\.com|vel(insurance-comparison\.net|agentnerd\.com))|e(k-bicycles|nd-online)\.net|uckstool\.com|onco\.es)|(o(wn(housepic|study|euro|meta)|(tal-tool|memap)s|pgamebook|olboxsol)|u(mors?explained|lsatrain|rn-ons)|attoo-websites|ype-racer|wainfo)\.com|h((anksgivinggaming|riftexplained)\.com|e(sis-examples\.com|atreparis\.net))|i(mezonevendor\.com|dl\.net)|cmn\.biz)|w(e(b((b(estseller|ailout)|administer)\.com|site(downloader\.net|explained\.com)|developertoolbar\.net)|(l(lesley|fare)explained|akenguide)\.com)|or(th(voice|war)\.com|ld-records\.net)|ater(front-property\.net|-plants\.com)|(riterpics|hoiscan)\.com|pbh\.org|sse\.us)|s((t(ud(ent(financecontact|s?explained)|yexplained)|r(eetmaphub|ongat)|patricksweightloss|onewhat)|wissairinfo)\.com|u((mmertimelyrics|nset-wallpape	2	0	0	1
+1714	1714	|per-committee|itegraphic)\.com|b\.(name|cat|es)))|v((i(llage((in|na)no|crystal)|deo(-mediaset|explained)|ta(minssms|lwow)|rtualexplained)|o(lumesynergy|ucheragent|ters24)|a(rsityexplained|lentinesproxy)|entureexplained)\.com|qtel\.net|f1\.us)|u(n(i(versityexplained\.com|nstalltool\.net|\.me)|((secured|am)explained|ravelguide)\.com|limited-web-hosting\.net)|(cla(explained|info)|s-inflation|alinfo|zdom)\.com|[04]\.org)|y((o(u(ngstersinfo|rbroking)|mkippursocial)|(eshiva|ale)explained|vxs)\.com|nna\.biz)|zwr\.org)(\x3a\d{1,5})?$	2	0	0	1
+1715	1715	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+1716	1716	[a-z]{8}.(:?tif|gif)	2	0	0	1
+1717	1717	^.{2}[a-zA-Z0-9]+\x2e[01]	2	0	0	1
+1718	1718	(\[\s*[\x22\x27]definition[\x22\x27]\s*\]|\.definition)\(	2	0	0	1
+1719	1719	^\w+?\[[^\]]+?\]\.src[\r\n\s]*=	2	0	0	1
+1720	1720	(\/(php)?|\.php)\?[\s\+]*\-[A-Za-z]	2	0	0	1
+1721	1721	^[A-Z]=[A-Za-z/+0-9=]{200,400}$	2	0	0	1
+1722	1722	^\{?[a-fA-F0-9]{4}\}?(\x5cu\{?[a-fA-F0-9]{4}\}?){20}	2	0	0	1
+1723	1723	^\{?[a-fA-F0-9]{4}\}?(\x25u\{?[a-fA-F0-9]{4}\}?){20}	2	0	0	1
+1724	1724	[^a-zA-Z0-9_\-\.][a-zA-Z]{7}\.class	2	0	0	1
+1725	1725	^[\r\n\s]*?\\?\(.+?\\?\)\.keep\.previous[\r\n\s]*[\r\n\s]*?[\x22\x27]contentArea	2	0	0	1
+1726	1726	\/vw\.php\?i=[a-fA-F0-9]+?\-[a-fA-F0-9]+?$	2	0	0	1
+1727	1727	^[\x11\x21-\x26\x41\x45\x70-\x79]	2	0	0	1
+1728	1728	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1729	1729	^.{0,5}\x22[^\x22]+(\.{1,2}\/)+(\w+\/?)+\.jsp\x22	2	0	0	1
+1730	1730	^..[\x81\x82\x83\x84\x85\x86\x87]\x81	2	0	0	1
+1731	1731	^..[\x81\x82\x83\x84\x85\x86\x87]\x83	2	0	0	1
+1732	1732	^..[\x81\x82\x83\x84\x85\x86\x87]\x84	2	0	0	1
+1733	1733	^..[\x81\x82\x83\x84\x85\x86\x87]\x85	2	0	0	1
+1734	1734	REGISTER.{400}	2	0	0	1
+1735	1735	SELECT.+geometrycollectionfromwkb	2	0	0	1
+1736	1736	SELECT.+WHERE.+SELECT.+\x60	2	0	0	1
+1737	1737	ALTER.+DATABASE.+\x22\x2E(\x22|\x2E\x22|\x2E\x2E\x2F\x22).+UPGRADE.+DATA	2	0	0	1
+1738	1738	^Authorization\x3A Basic.{120}/Hmi	2	0	0	1
+1739	1739	^Host\x3a[^\x3a\r\n]+?\x3a[^\r\n]{6}/Hmi	2	0	0	1
+1740	1740	^[^\x00]+?\x00	2	0	0	1
+1741	1741	^[^\x00]+?\x00	2	0	0	1
+1742	1742	<OBJECT\s+[^>]*classid\s*=\s*[\x22\x27]?\s*clsid\s*\x3a\s*\x7B?\s*22C83263-E4B8-4233-82CD-FB047C6BF13E	2	0	0	1
+1743	1743	^Cache-Control\x3a\x20(max-age=0|no-cache)\r?$	2	0	0	1
+1744	1744	^\/\?id=[0-9]{13}&msg=	2	0	0	1
+1745	1745	^13\d{11}	2	0	0	1
+1746	1746	^Callback\x3a\x20<http[^>]+><http	2	0	0	1
+1747	1747	^[^\r\n]*uuid\x3a[^\r\n\x3a]{181}	2	0	0	1
+1748	1748	^[^\r\n]+#[^\x22\r\n]{2049}	2	0	0	1
+1749	1749	^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1750	1750	^[^\r\n]*urn\x3aservice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1751	1751	^[^\r\n]*urn\x3adevice\x3a[^\r\n\x3a]{181}	2	0	0	1
+1752	1752	^[^\r\n]*schemas\x3adevice\x3a[^\r\n\x3a]{1,180}\x3a[^\r\n\x3a]{181}	2	0	0	1
+1753	1753	M-SEARCH\s+[^\n]{500}	2	0	0	1
+1754	1754	(\/\.){70,}	2	0	0	1
+1755	1755	[\w]{70,}	2	0	0	1
+1756	1756	\xB6\x29\x8C\x23\xFF\xFF\xFF[\xF8-\xFF]	2	0	0	1
+1757	1757	^.{27}	2	0	0	1
+1758	1758	[0-9a-zA-Z]{200,}	2	0	0	1
+1759	1759	(GET).\/%.{1586,}	2	0	0	1
+1760	1760	ctxsys\x2Edrvxtabc\x2Ecreate\x5Ftables.+(SELECT|DELETE|CREATE|INSERT|UPDATE|OUTFILE)	2	0	0	1
+1761	1761	[^a-zA-Z0-9]+\.message	2	0	0	1
+1762	1762	\x3d[^\x26]{720}	2	0	0	1
+1763	1763	ENTER\x20LANGUAGE\x20\x3D.{55}	2	0	0	1
+1764	1764	[a-zA-Z0-9]{1000,}	2	0	0	1
+1765	1765	\xbc[\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4]	2	0	0	1
+1766	1766	\xae[\xef\xcf][\xf0\xd0][\xe5\xc5][\xee\xce]\xa0\xa2[\xe7\xc7][\xe5\xc5][\xf4\xd4]\xa2	2	0	0	1
+1767	1767	[\xf3\xd3][\xe8\xc8][\xe5\xc5][\xec\xcc][\xec\xcc][\xe5\xc5][\xf8\xd8][\xe5\xc5][\xe3\xc3][\xf5\xd5][\xf4\xd4][\xe5\xc5]	2	0	0	1
+1768	1768	[\xf6\xd6][\xe2\xc2][\xf3\xd3][\xe3\xc3][\xf2\xd2][\xe9\xc9][\xf0\xd0][\xf4\xd4]	2	0	0	1
+1769	1769	Cookie\:\ +REMOTE_ADDR=	2	0	0	1
+1770	1770	Authorization\x3a\s*Basic\s*[a-zA-Z0-9]{255,}==	2	0	0	1
+1771	1771	\x2findex\x2etmpl(\x3a\x3a\x24DATA|\x2f|\x2e)\x0d\x0a	2	0	0	1
+1772	1772	\/[a-z0-9]{30,}\.php\?height=\d+&sid=\d+&width=[a-z0-9]+&	2	0	0	1
+1773	1773	\.php\?sex=\d+&children=\d+&userid=	2	0	0	1
+1774	1774	^SSH-\s[^\n]{200}	2	0	0	1
+1775	1775	value\x22[^\x22]*\x2Eswf\x3finfo\x3D	2	0	0	1
+1776	1776	^(CLIENT|MACHINE)_INFO	2	0	0	1
+1777	1777	Host\x3a \d{8,10}(\x0d\x0a|\x3a\d{1,5}\x0d\x0a)/H	2	0	0	1
+1778	1778	\/tmp\/[^\/]+\.pdf$	2	0	0	1
+1779	1779	\/tmp\/[^\/]+\.jar$	2	0	0	1
+1780	1780	^Directory	2	0	0	1
+1781	1781	^HEAD[^s]{432}	2	0	0	1
+1782	1782	^PUT[^s]{432}	2	0	0	1
+1783	1783	^POST[^s]{432}	2	0	0	1
+1784	1784	^TRACE[^s]{432}	2	0	0	1
+1785	1785	^DELETE[^s]{432}	2	0	0	1
+1786	1786	^LOCK[^s]{432}	2	0	0	1
+1787	1787	^MKCOL[^s]{432}	2	0	0	1
+1788	1788	^COPY[^s]{432}	2	0	0	1
+1789	1789	^MOVE[^s]{432}	2	0	0	1
+1790	1790	\x2Frequests\x2Fstatus\x2Exml\x3F[^\x0A\x0D]*input\x3D[^\x0A\x0D\x26\x3B]{1000}	2	0	0	1
+1791	1791	^\/[0-9]{5}\.jar$	2	0	0	1
+1792	1792	Host\x3a \d{4,}[^A-Za-z\.]	2	0	0	1
+1793	1793	^\/[0-9]$	2	0	0	1
+1794	1794	^\/[a-z]{13,14}\.jar$	2	0	0	1
+1795	1795	^\s*?STOR\s+[^\r\n]*?nsswitch\.conf\r$	2	0	0	1
+1796	1796	^\s*?STOR\s+[^\r\n]*?\x2f(tgt|trace|rbp(c|p))\.conf\r$	2	0	0	1
+1797	1797	T.*?T.*?Y.*.*?R.*?O.*?M.*.*?T	2	0	0	1
+1798	1798	[0-9a-zA-Z]{10}	2	0	0	1
+1799	1799	[0-9a-zA-Z]{10}	2	0	0	1
+1800	1800	Host\x3a \d{4,}[^A-Za-z\.]	2	0	0	1
+1801	1801	^\/m[a-zA-Z0-9-_]{3,14}\/[a-zA-Z0-9-_]{3,17}$	2	0	0	1
+1802	1802	SELECT data FROM [^\x20]+?\x20INTO DUMPFILE [\x27\x22]c\x3a\/windows\/system32\/[a-z0-9_-]+?\.exe[\x27\x22]	2	0	0	1
+1803	1803	[a-zA-Z0-9]{5}	2	0	0	1
+1804	1804	[0-9a-zA-Z]{50}	2	0	0	1
+1805	1805	\x90{200}	2	0	0	1
+1806	1806	^\s+A{500}	2	0	0	1
+1807	1807	^[\r\n\s]*?\x28[^\x29]*?shellcode	2	0	0	1
+1808	1808	^[\r\n\s]*?\x28[^\x29]*?shellcode	2	0	0	1
+1809	1809	\.(php|asp|py|exe|htm|html)\/[joewxy](U[0-9a-f]{8})?H[0-9a-f]{8}V[0-9a-f]{8}\d{3}R[0-9a-f]{8}\d{3}T[0-9a-f]{8,}	2	0	0	1
+1810	1810	[\r\n\s]+(<var1>([a-z]([a-z0-9_])*|_+([a-z0-9])([a-z0-9_])*))[\r\n\s]*\x3d[\r\n\s]*CreateObject\(\s*[\x22\x27]Wscript\.Shell[\x27\x22]\s*\).+?(=var1)\.run	2	0	0	1
+1811	1811	^((>>).)+?#([46][1-9a-fA-F]|[57][\daA])	2	0	0	1
+1812	1812	^\s*?fun\s*?\(	2	0	0	1
+1813	1813	[\?&]mail=[^&]+?[\x3b\x2c\x7c\x27]	2	0	0	1
+1814	1814	WSH\.run\x28\x5c+?[\x22\x27][a-z0-9_-]+?\.exe	2	0	0	1
+1815	1815	^(90|0x5a|0+?132)\s*?,\s*?(71|0x47|0+?107)\s*?,\s*?(70|0x46|0+?106)\s*?,\s*?(48|0x30|0+?60)\s*?,\s*?(89|0x59|0+?131)\s*?,\s*?(84|0x54|0+?124)\s*?,\s*?(112|0x70|0+?160)	2	0	0	1
+1816	1816	\/\??[a-f0-9]{60,}(\x3b\d+){1,4}$	2	0	0	1
+1817	1817	\/\??[a-f0-9]{60,}\x3b4[0-1]\d{5}$	2	0	0	1
+1818	1818	^\/([a-z0-9]{3,7}\/)?[a-z]{3,7}\.swf$	2	0	0	1
+1819	1819	^(25)?282176\x25(25)?29\x25(25)?26chrw\x25(25)?2801	2	0	0	1
+1820	1820	^Referer\x3a[^\r\n]+\/gate.php\r$/Hm	2	0	0	1
+1821	1821	Host\x3a\x20(\.*[a-f0-9]\.*){32}\./Hm	2	0	0	1
+1822	1822	^( Systems|\.com\/techsupport)	2	0	0	1
+1823	1823	^\s*?(<v1>[^\x29\s]+)\s*?\x29\s*?To Ubound\x28(=v1)\s*?\x29\s*?(dim\s*?)?(<v2>[^\s\x3d]+)\s*?\x3d\s*?(=v2)\+Cstr\x28\s*?Chr\x28(=v1)\x28i\x29[\+\-]\d+\x29\x29.+?Execute\s*?(=v2)	2	0	0	1
+1824	1824	^[0-9][^=]	2	0	0	1
+1825	1825	^\s*?\d[\d\x2e]{255}	2	0	0	1
+1826	1826	^\s*?\d[\d\x2e]{255}	2	0	0	1
+1827	1827	\s+?trigger\s+?[^\x20]+?\s+?after\s+?insert\s+?on\s+?	2	0	0	1
+1828	1828	^..[^\x00]+\x00	2	0	0	1
+1829	1829	^..[^\x00]+\x00	2	0	0	1
+1830	1830	^..[^\x00]+\x00	2	0	0	1
+1831	1831	^..[^\x00]+\x00	2	0	0	1
+1832	1832	^([^>]*?\ssrc\s*\s*?[\x22\x27][^\x22\x27]*?\.swf[\x22\x27])([^>]*?\swidth\s*\s*?[\x22\x27]0[\x22\x27])[^>]*?\sheight\s*\s*?[\x22\x27]0[\x22\x27]	2	0	0	1
+1833	1833	^(<addr1>.{4})(<addr2>.{4})(=addr2)(=addr1)	2	0	0	1
+1834	1834	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1835	1835	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1836	1836	^[A-Za-z0-9+/]*?(amF2YXgubmFtaW5nLkluaXRpYWxDb250ZXh0|phdmF4Lm5hbWluZy5Jbml0aWFsQ29udGV4d|qYXZheC5uYW1pbmcuSW5pdGlhbENvbnRleH)	2	0	0	1
+1837	1837	Type\x2FAction.+Launch.+\x28\x2F[a-z]\x2F[a-z].+NewWindow\x20true	2	0	0	1
+1838	1838	^=\s*\x22\s*[^\s\x22\x28]{1000}	2	0	0	1
+1839	1839	^(USE|PASS|SELECT|UPDATE|INSERT|ASCII|SHOW|CREATE|DESCRIBE|DROP|ALTER)\s+?(.{1}){300}	2	0	0	1
+1840	1840	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d+?&){3,}[a-z\_\-]{4,10}=-?[a-z0-9]+$	2	0	0	1
+1841	1841	^\s*\[\s*[\x22\x27]\\u[a-f0-9]{4}\\u[a-f0-9]{4}	2	0	0	1
+1842	1842	^[^\x00]+\x00\x00\x01	2	0	0	1
+1843	1843	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1844	1844	^.{6}[^\x00]+	2	0	0	1
+1845	1845	^.{6}[^\x00]+	2	0	0	1
+1846	1846	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1847	1847	^(.[a-z0-9-]{2,}){2,}\x00\x00(\x01|\x1c)	2	0	0	1
+1848	1848	^\x20+\x3a\x20([0-9A-F]{2}\x3a){5}[0-9A-F]{2}\x0d\x00\x0a	2	0	0	1
+1849	1849	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1850	1850	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1851	1851	^(\x01((\x01((\x04((\x03(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x04(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?|\x02(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a])?)?))?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|\x02([\x01\x02\x03\x04])?|\x03([\x01\x02])?))?|\x03((\x03(\x01(\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e])?)?)?|\x01([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13])?|\x02([\x01\x02])?))?|\x05((\x02(\x01([\x01\x02\x03\x04\x05\x06\x07])?)?|\x01([\x01\x02\x03])?))?|\x02(([\x01\x02]|\x03(\x01([\x01\x02\x03])?)?))?|\x06(\x01([\x01\x02\x03\x05\x06\x07\x08\x09\x0a\x0b])?)?|\x07([\x01\x02])?|\x04))?|\x02((\x02([\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c])?|(\x01)?\x01))?)	2	0	0	1
+1852	1852	^(\x41\xd8\x41\xd8\x41\xdc){2,}\x41\x00	2	0	0	1
+1853	1853	^\s*\x28\s*retPtrAddr\.add\s*\x28\s*i\s*\*\s*8\s*\x29\s*,\s*rop\s*\x5b	2	0	0	1
+1854	1854	^\S+?drivestoredirect	2	0	0	1
+1855	1855	^\s*(f0VMR|9FTE|\/RUxG)	2	0	0	1
+1856	1856	^\s*=\s*[\x27\x22]\s*POST	2	0	0	1
+1857	1857	^.*?[\x24\x60]	2	0	0	1
+1858	1858	^\s*=\s*[^>]*file\x3a[^>]*\/\x24MFT\/	2	0	0	1
+1859	1859	^\s*(\x28|\%28)s	2	0	0	1
+1860	1860	^\s*\d*[^\x20-\x7e\r\n\t]	2	0	0	1
+1861	1861	^[\x30-\x3f\x7D]	2	0	0	1
+1862	1862	^[\x30-\x3f\x7D]	2	0	0	1
+1863	1863	AUTH\s+\S+\s+([a-zA-Z0-9\+\/=]{4})*[a-zA-Z0-9\+\/=]{3}\s	2	0	0	1
+1864	1864	^\s*((>).)+?\s*src\s*=\s*[\x22\x27]\s*[^\x27\x28]+?[\x22\x27]\s*onError\s*=\s*prompt\s*\x28\s*[^)]*?(document|s(cript|tyle\x3D)|on(mouse[a-z]|key[a-z]|load|unload|dragdrop|blur|focus|click|dblclick|submit|reset|select|change))	2	0	0	1
+1865	1865	legal[^x7B]*\x7B[^\x7D]*restore	2	0	0	1
+1866	1866	legal[^x7B]*\x7B[^\x7D]*restore	2	0	0	1
+1867	1867	errordict\s+\x2Finvalidfileaccess	2	0	0	1
+1868	1868	errordict\s+\x2Finvalidfileaccess	2	0	0	1
+1869	1869	\x2Ebindnow[^\x7D]*\x7D\s*stopped	2	0	0	1
+1870	1870	\x2Ebindnow[^\x7D]+\x7D\s*stopped	2	0	0	1
+1871	1871	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1872	1872	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1873	1873	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1874	1874	16#[^s]\d+\s*\x3E\x3E\s*setpattern	2	0	0	1
+1875	1875	^\s*	2	0	0	1
+1876	1876	^\s*	2	0	0	1
+1877	1877	^\s*	2	0	0	1
+1878	1878	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){5}	2	0	0	1
+1879	1879	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7}	2	0	0	1
+1880	1880	^(.*?(XHUtNTU0|cdS01NT|x1LTU1N)){7}	2	0	0	1
+1881	1881	Template=.*\.\.	2	0	0	1
+1882	1882	act\x3D[^\x26\s\r\n]{257}	2	0	0	1
+1883	1883	app\x3D[^\x26\s\r\n]{257}	2	0	0	1
+1884	1884	[\x20-\x7e]{5,}\x5c\x00[\x20-\x7e]{5,}	2	0	0	1
+1885	1885	^[\x50-\x59]	2	0	0	1
+1886	1886	^[^\r\n]*?\x60[^\x60]*?\$\{IFS\}	2	0	0	1
+1887	1887	\bsolusvmc-node\b	2	0	0	1
+1888	1888	^\s*?\(\s*?[^,\s]*?\s*?,\s*?[\x22\x27][a-f0-9]{100}	2	0	0	1
+1889	1889	^mail\s*?from\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b	2	0	0	1
+1890	1890	^(\x25(25)*?20|\s)*?runmumaa\W	2	0	0	1
+1891	1891	^\s*?(<var>[^=\s\x3b]+)\s*\s*?getBits\(\s*?\)\x3b.+?flashvars\s*\s*?\x5c\x22(=var)\s*\s*?\x22\s*?\+\s*?(=var)\s*?\+\s*?\x22\x5c\x22	2	0	0	1
+1892	1892	^[a-z-]+\s*?\x3a\s*?[^\r\n]*?\x28\x29\x20\x7b.*\x3b.*\x7d\s*\x3b(=[\r\n])	2	0	0	1
+1893	1893	^\s*\x28\s*[\x22\x27]\s*message	2	0	0	1
+1894	1894	^(\.|\[\s*?[\x22\x27])defineProperties\s*?\x28	2	0	0	1
+1895	1895	^[^\r\n]+\.hta\r?\n	2	0	0	1
+1896	1896	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1897	1897	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1898	1898	^(<num_value>\d+)\x7d,\x22id\x22\x3a(=num_value)	2	0	0	1
+1899	1899	^[(\x60|%60)(\x27|%27)]	2	0	0	1
+1900	1900	^\/(home\/a3user|root)\/agile3\/patches\/	2	0	0	1
+1901	1901	^.*?\x26	2	0	0	1
+1902	1902	(\x0a|\\n)\/s1Caa6	2	0	0	1
+1903	1903	^(\\r\\n|\x0d\x0a)C	2	0	0	1
+1904	1904	^\d{3}	2	0	0	1
+1905	1905	^(https\/\/|(\d{1,3}\.){3}\d{1,3}|([a-z0-9-]+\.)+[a-z]{1,8})	2	0	0	1
+1906	1906	^(==[A-Z0-9+/]{2}|=[A-Z0-9+/]{3}|[A-Z0-9+/]{4})([A-Z0-9+/]{4})*$	2	0	0	1
+1907	1907	^[A-Za-z0-9+/]{2}([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+1908	1908	[\?\&]cmd_param=[^\&\r\n]{500}	2	0	0	1
+1909	1909	(%2(52e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/))|e(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))|\.(%2(52e(%((25)?2|c0%a)f|\/)|e(%((25)?2|c0%a)f|\/))|\.(%((25)?2|c0%a)f|\/)))	2	0	0	1
+1910	1910	^.{11}([\xC0-\xC1]|[\xF5-\xFF]|\xE0[\x80-\x9F]|\xF0[\x80-\x8F]|[\xC2-\xDF]([\x80-\xBF])|[\xE0-\xEF]([\x80-\xBF]{2})|[\xF0-\xF4]([\x80-\xBF]{3})|([\x00-\x7F\xF5-\xFF])[\x80-\xBF]|([\xC2-\xDF]|[\xE0-\xEF]|[\xE0-\xEF][\x80-\xBF]|[\xF0-\xF4]|[\xF0-\xF4][\x80-\xBF]|[\xF0-\xF4][\x80-\xBF]{2})[\x80-\xBF]|([\xE0-\xEF])[\x80-\xBF]([\x80-\xBF])|([\xF0-\xF4])[\x80-\xBF]([\x80-\xBF]{2})|([\xF0-\xF4][\x80-\xBF])[\x80-\xBF]([\x80-\xBF]))	2	0	0	1
+1911	1911	^[^\x22]*[\x24\x60]+	2	0	0	1
+1912	1912	^[^\x22]*[\x24\x60]+	2	0	0	1
+1913	1913	^[a-z0-9\-_\.\/]+\x00	2	0	0	1
+1914	1914	^SOAPAction\x3a\s+?[^\r\n]*?http\x3a\/\/purenetworks\.com\/HNAP1\/([^\x2f]+?[\x2f])?[^\x2f]	2	0	0	1
+1915	1915	\/dev-report-overview\.html[^\"]*?\x3b	2	0	0	1
+1916	1916	^\s*\x22{2}	2	0	0	1
+1917	1917	^[\x22\x27]t(eamviewer(\d+|api)|v(c(hat|ontrol)|filetransfer|joinv|present|s(endfile|q(customer|support))|v(ideocall|pn))\d)	2	0	0	1
+1918	1918	^Host\x3a[^\n]{0,50}?\x3b	2	0	0	1
+1919	1919	^[\s>]	2	0	0	1
+1920	1920	^[\s>]	2	0	0	1
+1921	1921	^((\x0d\x0a).)+\x22(https?|file):\x2f\x2f	2	0	0	1
+1922	1922	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1923	1923	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1924	1924	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1925	1925	^\s*=\s*[\x22\x27][^\x22\x27\r\n]{78}	2	0	0	1
+1926	1926	^\s*?\x29	2	0	0	1
+1927	1927	^\s*?\(x\s*,\s*1,\s*24000\s*\x29	2	0	0	1
+1928	1928	^\s*[\x22\x27][^\x22\x27]{0,128}\x2e\x2e	2	0	0	1
+1929	1929	^((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*[\x22\x27]((<\/service>).)+?<soap\x3a\s*address[^>]+location=\s*?\x22[^\x22]*\r?\n[^\x22]*?process\.start	2	0	0	1
+1930	1930	=\s*\x25\s*\{\s*.+?\bProcessBuilder\b	2	0	0	1
+1931	1931	^[ a-zA-Z0-9+_]*[\x27\x3b]	2	0	0	1
+1932	1932	destination=[^&]*\x24\x28	2	0	0	1
+1933	1933	name=[^&]*\x24\x28	2	0	0	1
+1934	1934	^[^&]+\x2527(UNION|SELECT)	2	0	0	1
+1935	1935	[^&]*(\x60|\x24)	2	0	0	1
+1936	1936	(\x60|\x24)	2	0	0	1
+1937	1937	(\/GponForm\/diag_FORM\?images\/|\.html\?images\/)	2	0	0	1
+1938	1938	^((\S\:\\){2,}|\S\:\\\S\:\S\:|S\:\\\\\\([0-9]{1,3}\.){3}[0-9]{1,3}|\S\:\\\\\\([a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+1939	1939	^(www\.)?(cisco|linksys)\.com\/jnap\/	2	0	0	1
+1940	1940	^.{1,10}((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)	2	0	0	1
+1941	1941	(\%3C){1000}	2	0	0	1
+1942	1942	A{1000}	2	0	0	1
+1943	1943	id\=[^\r\n]*?(select|delete|union|update|insert)	2	0	0	1
+1944	1944	^\d{2,5}(\&|\d)	2	0	0	1
+1945	1945	^(8=|9BQQ==)\r?\n?	2	0	0	1
+1946	1946	=\s*\x25\s*\{\s*(.+?\bgetRunTime\b).+?\bexec\b	2	0	0	1
+1947	1947	^[0-9]+	2	0	0	1
+1948	1948	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\[[^\x5d]*?\W	2	0	0	1
+1949	1949	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])name\%5b[^\x5d]*?\W	2	0	0	1
+1950	1950	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\[[^\x5d]*?\W	2	0	0	1
+1951	1951	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])nam\%65\%5b[^\x5d]*?\W	2	0	0	1
+1952	1952	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\[[^\x5d]*?\W	2	0	0	1
+1953	1953	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1954	1954	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1955	1955	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])na\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1956	1956	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\[[^\x5d]*?\W	2	0	0	1
+1957	1957	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61me\%5b[^\x5d]*?\W	2	0	0	1
+1958	1958	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\[[^\x5d]*?\W	2	0	0	1
+1959	1959	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61m\%65\%5b[^\x5d]*?\W	2	0	0	1
+1960	1960	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\[[^\x5d]*?\W	2	0	0	1
+1961	1961	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1962	1962	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1963	1963	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])n\%61\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1964	1964	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\[[^\x5d]*?\W	2	0	0	1
+1965	1965	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eame\%5b[^\x5d]*?\W	2	0	0	1
+1966	1966	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\[[^\x5d]*?\W	2	0	0	1
+1967	1967	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6eam\%65\%5b[^\x5d]*?\W	2	0	0	1
+1968	1968	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\[[^\x5d]*?\W	2	0	0	1
+1969	1969	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1970	1970	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1971	1971	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6ea\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1972	1972	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\[[^\x5d]*?\W	2	0	0	1
+1973	1973	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61me\%5b[^\x5d]*?\W	2	0	0	1
+1974	1974	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\[[^\x5d]*?\W	2	0	0	1
+1975	1975	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61m\%65\%5b[^\x5d]*?\W	2	0	0	1
+1976	1976	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\[[^\x5d]*?\W	2	0	0	1
+1977	1977	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6de\%5b[^\x5d]*?\W	2	0	0	1
+1978	1978	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\[[^\x5d]*?\W	2	0	0	1
+1979	1979	(^|&|Content-Disposition[\x3a][^\n]*?name\s*\s*?[\x22\x27])\%6e\%61\%6d\%65\%5b[^\x5d]*?\W	2	0	0	1
+1980	1980	ping_addr=[\d.]*[^\d.]	2	0	0	1
+1981	1981	\?write_(m(ac|sn)|hdv|pid|tan)&[^&]*\x3b	2	0	0	1
+1982	1982	^User-Agent\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}	2	0	0	1
+1983	1983	^X-Forwarded-For\x3a[^\r\n]*\bO\x3a\d+\x3a[^\r\n]*?\{[^\r\n]*?\}	2	0	0	1
+1984	1984	pjl\x5Fready\x5Fmessage\x3D.+(script|alert|onmouse[a-z]+|onkey[a-z]+|onload|onunload|ondragdrop|onblur|onfocus|onclick|ondblclick|onsubmit|onreset|onselect|onchange)	2	0	0	1
+1985	1985	^[^=]{1,}$	2	0	0	1
+1986	1986	^\x22[^\x22]*\x3b[^\x22]*\x22/P	2	0	0	1
+1987	1987	^\s*[\x22\x27]	2	0	0	1
+1988	1988	\.hta([?&]|$)	2	0	0	1
+1989	1989	^[A-Za-z0-9+/]{0,4}?[^\x20-\x7e]	2	0	0	1
+1990	1990	\%(25)?temp\%	2	0	0	1
+1991	1991	^[a-zA-Z0-9]+$	2	0	0	1
+1992	1992	[^&]*(\x60|\x24)	2	0	0	1
+1993	1993	^User-Agent\x3a[^\r\n]*JDatabaseDriverMysqli/Hmi	2	0	0	1
+1994	1994	(localhost|127\.0\.0\.1)/W	2	0	0	1
+1995	1995	^[^\r\n]{128,}\r\n	2	0	0	1
+1996	1996	^[^\+]+\+0A	2	0	0	1
+1997	1997	^[^\+]+(\+[A-F0-9]{2}){4,}	2	0	0	1
+1998	1998	^.{0,100}\+0A.{0,100}\x40	2	0	0	1
+1999	1999	^[^\r\n]{50,}	2	0	0	1
+2000	2000	^\S{0,7}\/(meeting|fb\/smb|namedusers|metric)	2	0	0	1
+2001	2001	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+2002	2002	^(((:?0x[a-f0-9]{2}|0+?\d{1,3})\s*?,\s*?)*?\d{1,3})(((:?0x[a-f0-9]{2}|\d{1,3})\s*?,\s*?)*?0+?\d{1,3})(((:?0+?\d{1,3}|\d{1,3})\s*?,\s*?)*?0x[a-f0-9]{2})((:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?,\s*?)+(:?0x[a-f0-9]{2}|0+?\d{1,3}|\d{1,3})\s*?\)	2	0	0	1
+2003	2003	^form(Ping|Tracert)$	2	0	0	1
+2004	2004	^form(Ping|Tracert)$	2	0	0	1
+2005	2005	^.{1,50}\/uapi-cgi\/	2	0	0	1
+2006	2006	^.{1,50}\/uapi-cgi\/	2	0	0	1
+2007	2007	^[^&]{150,}	2	0	0	1
+2008	2008	^[^&]{150,}	2	0	0	1
+2009	2009	\bexec\b	2	0	0	1
+2010	2010	parent=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2011	2011	oId=[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2012	2012	[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2013	2013	^\s+?[^\s\>]+?\s+?SYSTEM\s	2	0	0	1
+2014	2014	^[^&]*(S(HOW.+(C(HARACTER.+SET|UR(DATE|TIME))|(VARI|T)ABLES)|ELECT.+(FROM|USER))|U(NION.+SELEC|PDATE.+SE)T|DELETE.+FROM|INSERT.+INTO|\/\*.+\*\/|EXEC)	2	0	0	1
+2015	2015	^[A-Z]{8}\x3a	2	0	0	1
+2016	2016	^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5bnull\x5d	2	0	0	1
+2017	2017	^\x7b/s*\x22methodInput\x22\s*\x3a\s*\x5b\x5d	2	0	0	1
+2018	2018	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2019	2019	^.{0,5}(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2020	2020	^\s*(<worker>[A-Za-z0-9_-]{1,20})\s*=\s*null\x3b.{1,300}(=worker)\s*=\s*document\.getElementById\([\x22\x27](=worker)[\x22\x27]\)\x3b.{1,300}\.addEventListener\([\x22\x27]DOMNodeInserted[\x22\x27]\s*,\s*(<callback0>[A-Za-z0-9_-]{1,20}).{0,300}(=worker)(<worker_ext>(\.\w{1,20})+)\s*=\s*\d+\x3b.{1,300}function\s*(=callback0)\([^\)]+\)\s*\{\s*.{1,300}\.requestAnimationFrame\((<callback>[A-Za-z0-9_-]{1,20})\)\x3b.{1,300}function\s*(<garbagecollector>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*.{0,100}for\s*\(let\s*(<gc_counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=gc_counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=gc_counter)(\+{2}|-{2})\s*\)\s*.{1,300}function\s*(=callback)\([^\)]+\)\s*\{\s*.{1,300}(=garbagecollector)\(\)\s*\x3b\s*.{1,300}\((=worker)(=worker_ext)\)	2	0	0	1
+2021	2021	^\s*(<opt>[A-Za-z0-9_-]{1,20})\(\)\s*\{\s*let\s*(<o_var>[A-Za-z0-9_-]{1,20})\s*=\s*\{\}\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=o_var)\.(<x_prop>[A-Za-z0-9_-]{1,20}).{1,300}for\s*\(\s*let\s*(<counter>[A-Za-z0-9_-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=counter)(\+{2}|-{2})\).{1,100}(=opt)\(\).{1,300}let\s*(<leaked_stack_obj>[A-Za-z0-9_-]{1,20})\s*=\s*null.{1,100}let\s*(<obj_proto>[A-Za-z0-9_-]{1,20})\s*=\s*\(\{\}\)\.__proto__\x3b.{1,300}(=obj_proto)\.__defineGetter__\([\x22\x27](=x_prop)[\x22\x27],\s*Error\.prototype\.toString\)\x3b\s*(\/\/[\w\s_-]+)?(\/\/\s*[^\r\n]+\r\n)?(=obj_proto)\.__defineGetter__\([\x22\x27](<message_proto>[A-Za-z0-9_-]{1,20})[\x22\x27].{1,300}delete\s*(=obj_proto)\.(=message_proto)\x3b.{1,300}(=obj_proto)\.\w+\s*=\s*Array\.prototype.{1,300}(=opt)	2	0	0	1
+2022	2022	^\s*(<func_opt>[\w-]{1,20})\((<var_a>[\w-]{1,20})\s*,\s*(<var_b>[\w-]{1,20}).{1,300}((=var_a)\.(=var_b)|(=var_b)\.(=var_a))\s*=\s*\d+\x3b\s*((=var_a)|(=var_b))\.push\(\d+\)\x3b\s*((=var_a)\.(=var_a)|(=var_b)\.(=var_b))\s*=\s*0x.{1,300}Object\.prototype\.push\s*=\s*Array\.prototype\.push\x3b\s*for\s*\(\s*let\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\).{1,300}let\s*((=var_a)|(=var_b))\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}\x3b.{1,300}(=func_opt)\(((=var_a)|(=var_b)),\s*\{\}.{1,300}let\s*(<var_o>[\w-]{1,20})\s*=\s*\{((=var_a):\s*\d+\s*,\s*(=var_b):\s*\d+|((=var_b):\s*\d+\s*,\s*(=var_a):\s*\d+))\}.{1,300}(=func_opt)\((=var_o)	2	0	0	1
+2023	2023	^\s*(<func_a>[\w-]{1,20})\((<obj1>[\w-]{1,20})\s*,\s*(<tmp_obj>[\w-]{1,20})\s*,\s*(<value>[\w-]{1,20})\).{1,300}(=obj1)\.\w+\s*=\s*\d+\.\d+\x3b\s*var\s*\w+\s*=\s*\{__proto__:\s*(=tmp_obj)\}\x3b\s*(=obj1)\.\w+\s*=\s*(=value)\x3b.{1,300}var\s*(=obj1)\s*=\s*\{\w+:\s*\d+\.\d+\s*,\s*\w+:\s*\d+\.\d+\}\x3b\s*for\s*\(\s*var\s*(<counter>[\w-]{1,20})\s*=\s*\d{1,8}\s*\x3b\s*(=counter)\s*(<|>)\s*(0x)?\d{2,}\s*\x3b\s*(=counter)(\+{2}|-{2})\)\s*\{\s*(=func_a)\((=obj1)\s*,\s*(\x22{2}|\x27{2})\s*,\s*(\x22{2}|\x27{2})\)\x3b.{1,300}(=func_a)\((=obj1)\s*,\s*(=obj1)\s*,\s*\d+\.\d{8,}.{1,300}eval\((=obj1)\.	2	0	0	1
+2024	2024	^form(RebootCheck|Wsc)$	2	0	0	1
+2025	2025	^[^&]{42,}	2	0	0	1
+2026	2026	^[^&]{512,}	2	0	0	1
+2027	2027	^Callback\x3a\x20\x3chttp[^\x3a]+\x3a\d{1,5}[^\/]/Hmi	2	0	0	1
+2028	2028	^[^&]{90,}	2	0	0	1
+2029	2029	^\d[012345]	2	0	0	1
+2030	2030	^\d[012345]	2	0	0	1
+2031	2031	^\d[012345]	2	0	0	1
+2032	2032	^\d[012345]	2	0	0	1
+2033	2033	^\d[012345]	2	0	0	1
+2034	2034	^\d[012345]	2	0	0	1
+2035	2035	^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e)	2	0	0	1
+2036	2036	^(\x3b|\x0a|\x26|\x60|\x7C|\x24|\x3e)	2	0	0	1
+2037	2037	^[^&\x0d\r]+[\n\x0a]	2	0	0	1
+2038	2038	^\s*(<func_a>[\w\-]{1,20})\((<obj_1>[\w\-]{1,20})\s*,\s*(<obj_2>[\w\-]{1,20}).{1,300}(=obj_1)\.(<prop_2>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,300}?(=obj_2)\.pop\(\).{1,300}?(=obj_1)\.(<prop_1>[\w\-]{1,20})\s*=\s*\d+(\.\d+)?.{1,500}Object\.prototype\.p(op|ush)\s*=\s*Array\.prototype\.p(op|ush)\x3b.{1,500}var\s*(<obj_3>[\w\-]{1,20})\s*=\s*\{\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)?\s*,\s*((=prop_2)\s*\x3a\s*\d+(\.\d+)?|(=prop_2)\s*\x3a\s*\d+(\.\d+)?\s*,\s*(=prop_1)\s*\x3a\s*\d+(\.\d+)).{1,500}(=func_a)\(\s*((=obj_3)\s*,\s*new\s*Object\(\)|\s*new\s*Object\(\)\s*,\s*(=obj_3)\s*).{1,500}?(=func_a)\((=obj_3)	2	0	0	1
+2039	2039	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2040	2040	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2041	2041	^[^&\r\n]+(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2042	2042	^(%[a-f0-9]{2}){5,}	2	0	0	1
+2043	2043	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2044	2044	^%(3b|0a|26|60|7C|24)	2	0	0	1
+2045	2045	^\/(icons|cgi-bin)	2	0	0	1
+2046	2046	^\/(icons|cgi-bin)	2	0	0	1
+2047	2047	^\/(icons|cgi-bin)	2	0	0	1
+2048	2048	[^\r\n]*true	2	0	0	1
+2049	2049	\x2f(FURUKAWA|APROS)\x2f	2	0	0	1
+2050	2050	[^\r\n]*(\x60|\x24|\x7c|\bsh\b)	2	0	0	1
+2051	2051	^[^\r\n=]*(union|select)	2	0	0	1
+2052	2052	^[^&=]*(union|select)	2	0	0	1
+2053	2053	^(<class>[A-Z0-9_-]{1,20})\s*.*?(<var>[A-Z0-9_-]{1,15})\s*=\s*(&amp\x3b|0x|\\x|&?h)*\d{8}\s*.*?(ReDim|Dim)\s*(=var)\(\d{4,20}\).*?set\s*(=var)\(\d+\)\s*=\s*new\s*(=class).*?Erase\s*(=var).*?Erase\s*(=var)	2	0	0	1
+2054	2054	^[^\x22]+\.jsp\x22	2	0	0	1
+2055	2055	([\x60\x3b\x7c]|%60|%3b|%7c|%26|(\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2056	2056	^[\s\x22\x27]*check_ping\b	2	0	0	1
+2057	2057	^\s*(<obj>[\w\-]{1,20})\s*=\s*document\.getElementById\(.{1,500}Class\s*(<class>[\w\-]{1,20}).{1,500}End\s*Class.{1,500}set\s*(=obj)\.scroll((Left|Top)(Max)?|Height|Width)\s*=\s*New\s*(=class)	2	0	0	1
+2058	2058	[^\r\n]*\x5c(n|c)[^\r\n]{0,100}[\x60\x24]	2	0	0	1
+2059	2059	([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2060	2060	^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2061	2061	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2062	2062	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2063	2063	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2064	2064	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2065	2065	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2066	2066	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2067	2067	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2068	2068	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2069	2069	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2070	2070	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2071	2071	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%24)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2072	2072	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2073	2073	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2074	2074	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d|\x24\x7b\x3a\x3a\-(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d|\x24\x7b\x3a\x3a\-(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d|\x24\x7b\x3a\x3a\-(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2075	2075	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2076	2076	^(l|r|d|\x24\x7b(lower|upper)\x3a(l|r|d)\x7d)(d|n|m|\x24\x7b(lower|upper)\x3a(d|n|m)\x7d)(a|i|s|\x24\x7b(lower|upper)\x3a(a|i|s)\x7d)(p|\x24\x7b(lower|upper)\x3a(p)\x7d)	2	0	0	1
+2077	2077	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)\x3a(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2078	2078	^(l|r|d|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(l|r|d)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(l|r|d)(\x7d|%7d))(d|n|m|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(d|n|m)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(d|n|m)(\x7d|%7d))(a|i|s|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)(a|i|s)(\x7d|%7d)|(\x24|%24)(\x7b|%7b)(\x3a|%3a){1,2}\-(a|i|s)(\x7d|%7d))(p|(\x24|%24)(\x7b|%7b)(lower|upper)(\x3a|%3a)p(\x7d|%7d))	2	0	0	1
+2079	2079	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2080	2080	^(j|\x24\x7b(lower|upper)\x3aj\x7d|\x24\x7b\x3a\x3a\-j\x7d)(n|\x24\x7b(lower|upper)\x3an\x7d|\x24\x7b\x3a\x3a\-n\x7d)	2	0	0	1
+2081	2081	\.((php\d{0,}|phps|pht|phtm|phtml|shtml|htaccess|phar|inc))	2	0	0	1
+2082	2082	^[^&]{100,}	2	0	0	1
+2083	2083	^[a-zA-Z0-9]+\.(zip|7z|gz)	2	0	0	1
+2084	2084	^(\x28|\x29|\x3c|\x3e|\x26|\x2a|\xe2|\x80|\x98|\x7c|\x3f|\x3b|\x5b|\x5d|\x5e|\x7e|\x21|\x2e|\xe2|\x80|\x9d|\x25|\x40|\x2f|\x5c|\x3a|\x2b|\x2c|\x60)	2	0	0	1
+2085	2085	^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr)	2	0	0	1
+2086	2086	^[a-zA-Z0-9]{2}[%a-zA-Z0-9]{9}(<addr>([%a-zA-Z0-9]{3}){4})(=addr)	2	0	0	1
+2087	2087	^[0-9]{1,10}\x3b	2	0	0	1
+2088	2088	^(%2e|\.)exec	2	0	0	1
+2089	2089	^[a-zA-Z0-9]{5,40}	2	0	0	1
+2090	2090	^[a-zA-Z0-9]{7,200}	2	0	0	1
+2091	2091	^\d+..([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))-XX:OnOutOfMemoryError=	2	0	0	1
+2092	2092	^[^&=]*(union|select|update|insert|delete)	2	0	0	1
+2093	2093	^[^&=]*(union|select|update|insert|delete)	2	0	0	1
+2094	2094	((%2F|\/)(\.|%2E){2}(%2F|\/))	2	0	0	1
+2095	2095	((%2F|\/)(\.|%2E){2}(%2F|\/))	2	0	0	1
+2096	2096	^(%2E%2E%2F|\.\.\/)	2	0	0	1
+2097	2097	^[a-zA-Z0-9]{5,45}	2	0	0	1
+2098	2098	^([A-Z]\x00){20}\x00\x00	2	0	0	1
+2099	2099	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+2100	2100	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+2101	2101	(InNhbWxfZGF0YS|JzYW1sX2RhdGEi|ic2FtbF9kYXRhI)	2	0	0	1
+2102	2102	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2103	2103	^SOAPAction\x3a\x20\x22?urn\x3aNETGEAR-ROUTER\x3aservice\x3a.{128,}(:\d#)/Hm	2	0	0	1
+2104	2104	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2105	2105	^[a-zA-Z0-9+/]{1000,}	2	0	0	1
+2106	2106	\We[\s\x22\x27,+]*?v[\s\x22\x27,+]*?a[\s\x22\x27,+]*?l\W	2	0	0	1
+2107	2107	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2108	2108	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2109	2109	^[^<]{30,}<\/NewMACAddress>	2	0	0	1
+2110	2110	^0+(&|$)	2	0	0	1
+2111	2111	^0+(&|$)	2	0	0	1
+2112	2112	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2113	2113	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2114	2114	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2115	2115	^(\x3b|\x0a|\x26|\x60|\x7c|\x24)	2	0	0	1
+2116	2116	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2117	2117	^(\x3b|\x0a|\x26|\x60|\x7C|\x24)	2	0	0	1
+2118	2118	^\/(icons|cgi-bin)	2	0	0	1
+2119	2119	^\/(icons|cgi-bin)	2	0	0	1
+2120	2120	^\/(icons|cgi-bin)	2	0	0	1
+2121	2121	^([\x60\x3b\x7c]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2122	2122	(yJ0eXAiOiJKV1Qi|InR5cCI6IkpXVCJ)/H	2	0	0	1
+2123	2123	^(CREATE|SELECT|INSERT|UPDATE|EXEC)	2	0	0	1
+2124	2124	^["']\s*:\s*["']\s*[^0-9]+	2	0	0	1
+2125	2125	^\s?([\x3b\x0a\x26\x60\x7c\x24]|%(3b|0a|26|60|7c|24))	2	0	0	1
+2126	2126	^\s*=\s*[\x22\x27]\s*ms-msdt\x3a	2	0	0	1
+2127	2127	(\x2e|%2e)(\x2e|%2e)(\x2f|%2f)	2	0	0	1
+2128	2128	myname=[^&]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2129	2129	^\x2fdefault\x2fen_US\x2fframe(\x2eA100)?\x2ehtml\?(content|sidebar)=.*\x2e\x2e\x2f	2	0	0	1
+2130	2130	^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2131	2131	^[a-z0-9\.]+([\x60\x3b\x7c\x26]|%60|%3b|%7c|%26|([\x3c\x3e\x24]|%3c|%3e|%24)(\x28|%28))	2	0	0	1
+2132	2132	[^a-zA-Z0-9_\-\.][a-zA-Z]{8}\.jar	2	0	0	1
+2133	2133	^\s?(file|https?)\x3a	2	0	0	1
+2134	2134	^(\/?\.\.?\/){2}	2	0	0	1
+2135	2135	\b(<xps>[a-zA-Z]{7})\.classPK.+?\b(=xps)\[a-zA-Z]{12}\.classPK.+?\b(=xps)\$[a-zA-Z]{12}\.classPK	2	0	0	1
+2136	2136	^[\r\n\s\+]*.+?\}[\r\n\s]*?catch	2	0	0	1
+2137	2137	^(application\/(x-)?|text\/)xml	2	0	0	1
+2138	2138	^(application\/(x-)?|text\/)xml	2	0	0	1
+2139	2139	\/((index|toc)\.html?)?\?\/\/	2	0	0	1
+2140	2140	^.{0,10}[\x3b\x0a\x26\x60\x7c\x24]	2	0	0	1
+2141	2141	[?&]ap=	2	0	0	1
+2142	2142	^\d+\s*[^\r\n]{50,}	2	0	0	1
+2143	2143	(web|decorators|seraph-config)\x2exml$	2	0	0	1
+2144	2144	com.atlassian.jira\x2f(jira\x2dwebapp\x2ddist|atlassian\x2djira\x2dwebapp)\x2fpom\x2e(properties|xml)$	2	0	0	1
+2145	2145	^[^\x3c]{,100}\x27	2	0	0	1
+2146	2146	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+2147	2147	^(Begin|End)\=/P	2	0	0	1
+2148	2148	\/\?[a-f0-9]{64}\;\d\;\d	2	0	0	1
+2149	2149	\x7b?(visibility\x3ahidden|display\x3anone)\x3b?\x7d?\x22><div>\d{16}	2	0	0	1
+2150	2150	\/[a-z]\/[0-9a-f]{32}$	2	0	0	1
+2151	2151	\/dl\/\w{1,4}\.php\?[0-9]$	2	0	0	1
+2152	2152	\/[a-f0-9]{60,}_js\?	2	0	0	1
+2153	2153	\/[a-f0-9]{60,}_jar$	2	0	0	1
+2154	2154	\/[a-f0-9]{60,}_exe$	2	0	0	1
+2155	2155	,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,[0-9\.]+\*\d,[a-z]\+\d+,	2	0	0	1
+2156	2156	^\/showthread\.php\?t=\d+$	2	0	0	1
+2157	2157	function\x20booom[1-3]{1}\x28\x29	2	0	0	1
+2158	2158	var\x20Cute(Money|Power|Shine)	2	0	0	1
+2159	2159	iframe[^\r\n]*\x2FCUTE-IE\x2Ehtml	2	0	0	1
+2160	2160	^\/[a-z][0-9a-z_+=-]{10,30}\?\w=[0-9.]+\&\w=1.6.0_\d\d$	2	0	0	1
+2161	2161	\.php\?(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+&(id=|pid=|hello=)\d+$	2	0	0	1
+2162	2162	\/[a-z0-9]+\.[a-z0-9]{2,4}\/eH[a-z0-9]{60,}$	2	0	0	1
+2163	2163	\/[a-z0-9]+\.[a-z0-9]{2,4}\/oH[a-z0-9]{60,}$	2	0	0	1
+2164	2164	\/indigo\?\d+	2	0	0	1
+2165	2165	^\/\?[a-f0-9]{32}$	2	0	0	1
+2166	2166	=[.\"]\w{8}\.jar/Hi	2	0	0	1
+2167	2167	\.php\?showtopic=[0-9]{6}$	2	0	0	1
+2168	2168	\/[0-9]\.html$	2	0	0	1
+2169	2169	^\?[a-f0-9]{32}\" 	2	0	0	1
+2170	2170	^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$	2	0	0	1
+2171	2171	^\/L[a-zA-Z0-9]+\/[a-zA-Z0-9\x5f]+\?[a-z]+=[A-Za-z0-9\x2e]{10,}$	2	0	0	1
+2172	2172	^\/t\/[a-f0-9]{32}	2	0	0	1
+2173	2173	\/[A-Z]{20,}\?[A-Z]=\d$	2	0	0	1
+2174	2174	^\/q[a-zA-Z0-9+-]{3,14}\/[a-zA-Z0-9+-]{3,16}\?[a-z]{1,6}=[a-zA-Z0-9+-\._]{7,18}$	2	0	0	1
+2175	2175	^\/Applet\.jar$	2	0	0	1
+2176	2176	\/beacon\/[a-f0-9]{8}\.htm$	2	0	0	1
+2177	2177	\/t\/[a-f0-9]{32}$	2	0	0	1
+2178	2178	^\/[0-9]{3}\.jar$	2	0	0	1
+2179	2179	^[\r\n\s]*[\d\x5b]	2	0	0	1
+2180	2180	^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.jar$	2	0	0	1
+2181	2181	^\/[a-zA-Z0-9]{25,35}\/\d{9,10}\/[a-z]{4,12}\.pdf$	2	0	0	1
+2182	2182	\/[0-9]{3}\.pdf	2	0	0	1
+2183	2183	\(\x22[0-9\x3a\x3b\x3c\x3d\x3e\x3fa-k]{50,100}\x22\).{0,200}\)\x3b<\/script><\/body>	2	0	0	1
+2184	2184	^[a-f0-9]{32}	2	0	0	1
+2185	2185	^((<\/applet>).)+?\/.{1,12}\/.{1,12}\x3a.{1,12}p.{1,12}t.{1,12}t.{1,12}h	2	0	0	1
+2186	2186	^(\s*=\s*|[\x22\x27]\s*,\s*)[\x22\x27]	2	0	0	1
+2187	2187	^[\r\n\s]*=[\r\n\s]*(<q>[\x22\x27])(((=q)).)+?\.(gif|jpe?g|p(ng|sd))(=q)	2	0	0	1
+2188	2188	^((<\/applet>).)+[\r\n\s]value[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])[a-f0-9]{32}(=q1)	2	0	0	1
+2189	2189	^\/[a-z0-9A-Z]{25,35}\/(([tZFBeDauxR]+q){3}[tZFBeDauxR]+(_[tZFBeDauxR]+)?|O7dd)k(([tZFBeDauxR]+q){3}[tZFBeDauxR]+|O7dd)\/	2	0	0	1
+2190	2190	EGYPACK_CRYPT\d	2	0	0	1
+2191	2191	\/\?[0-9a-f]{60,66}\x3b(1(0[0-3]|1\d)|90)\d{1,3}\x3b\d{1,3}$	2	0	0	1
+2192	2192	^(ckwm)*?(Exp|cc)\.class	2	0	0	1
+2193	2193	^\/command\/[a-zA-Z]{6}$	2	0	0	1
+2194	2194	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+2195	2195	^(a(ttack|dEx[xp])|([a-z]))\.class	2	0	0	1
+2196	2196	^(a(ttack|dEx[xp])|([a-z]))\.class	2	0	0	1
+2197	2197	^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27]((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){10}|(=ascii){10})	2	0	0	1
+2198	2198	^[\r\n\s\+]*[\r\n\s\+]*?[\x22\x27][^\x22\x27]+?[\x22\x27][^>]*((<hex>%[A-Fa-f0-9]{2})|(<ascii>[a-zA-Z0-9]))((=hex){9,20}|(=ascii){9,20})%3C	2	0	0	1
+2199	2199	^[a-zA-Z]{5}=[a-z0-9]{8}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{4}\-[a-f0-9]{12}$	2	0	0	1
+2200	2200	^\/[0-9]{1,2}\/red[0-9]{1,4}\.php[0-9]{0,1}$	2	0	0	1
+2201	2201	\.php\?(b=[a-fA-F0-9]{6}&)?v=1\.((4\.[0-2]\.[0-3]|5\.0\.[0-2]|6.0\.[0-4])\d?|[7-8]\.0\.\d{1,2})$	2	0	0	1
+2202	2202	&k=\d{16}(&|$)	2	0	0	1
+2203	2203	^(((?i:<\/applet>)).)+?[\r\n\s]value[\r\n\s]*[\r\n\s]*?[\x22\x27]?(\d{2,3})?(<sep>([^a-zA-Z0-9]{1,100}|[a-zA-Z0-9]{1,100}))\d{2,3}((=sep)\d{2,3}){20}	2	0	0	1
+2204	2204	^(((?i:<\/applet>)).)+?[\r\n\s]archive[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27]	2	0	0	1
+2205	2205	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+2206	2206	if.{1,10}[<>]=?\s*(<quot>[\x22\x27])1(<sep>[^0-9a-zA-Z])7((=sep)\d+)?(=quot).{1,10}[<>]=?\s*(=quot)1(=sep)7((=sep)\d+)?(=quot)	2	0	0	1
+2207	2207	^[\r\n\s]*[\r\n\s]*?[\x22\x27]http\x3a\/\/[^\/]+?\/\?[A-Za-z0-9]+=[A-Za-z0-9%]{60,}[\x22\x27]	2	0	0	1
+2208	2208	^[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\x22\x27]\.replace\([\r\n\s]*?(<q1>[\x22\x27]?)\/.+?\/g[\r\n\s]*?,[\r\n\s]*?(<q2>[\x22\x27]?)%(=q2)[\r\n\s]*?\)	2	0	0	1
+2209	2209	(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{12,16}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a)	2	0	0	1
+2210	2210	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\.zip[\x22\x27]	2	0	0	1
+2211	2211	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(<dot>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<p>((=dot))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<h>(((=p)|(=dot)))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=p).+?value[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?(=dot)([^a-f0-9]{2}){1,20}(<e>[a-f0-9]{2})([^a-f0-9]{2}){1,20}(<x>((=e))[a-f0-9]{2})([^a-f0-9]{2}){1,20}(=e)(([^a-f0-9]{2}){1,20})?[\x22\x27]	2	0	0	1
+2212	2212	\/[a-f0-9]{32}\/[a-z]+?\-[a-z]+?\.php	2	0	0	1
+2213	2213	\.php\?e=\d+(&|$)	2	0	0	1
+2214	2214	^[\r\n\s]*?[\x22\x27][a-f0-9]{2}(<sep>[^a-f0-9]{1,10})(<a>[a-f0-9]{2})(=sep)(<p>[a-f0-9]{2})(=sep)(=p)(=sep)(<l>[a-f0-9]{2})(=sep)(<e>[a-f0-9]{2})[^\x22\x27]+?(=sep)(=p)(=sep)(=a)(=sep)[a-f0-9]{2}(=sep)(=a)(=sep)[^\x22\x27]+?(=sep)(=a)(=sep)(=l)(=sep)[a-f0-9]{2}(=sep)(=e)	2	0	0	1
+2215	2215	\/cod\/[^\x2f]+\.vbs$	2	0	0	1
+2216	2216	[a-f0-9]{32}\.jar	2	0	0	1
+2217	2217	^[^a-z0-9]	2	0	0	1
+2218	2218	\.php\?dwl=[a-z]+$	2	0	0	1
+2219	2219	^[\r\n\s]*[\r\n\s]*?[\x22\x27]h(<sep>\d{2})t(=sep)t(=sep)p(=sep)\x3a	2	0	0	1
+2220	2220	^[\r\n\s]*?[\x22\x27]<([\x27\x22]\s*?\+\s*?[\x22\x27])?a([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?p([\x27\x22]\s*?\+\s*?[\x22\x27])?l([\x27\x22]\s*?\+\s*?[\x22\x27])?e([\x27\x22]\s*?\+\s*?[\x27\x22])?t	2	0	0	1
+2221	2221	^\/ep\/cl\.php$	2	0	0	1
+2222	2222	^[\r\n\s]*?[\x22\x27]<applet	2	0	0	1
+2223	2223	=\d+&e=\d+$	2	0	0	1
+2224	2224	\/\d+\/\d\.zip$	2	0	0	1
+2225	2225	(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{10,20}(=space)[0-9a-z]{2}(=space)(<w>[0-9a-z]{2})(<i>[0-9a-z]{2})(<n>[0-9a-z]{2})[0-9a-z]{4}(=w)[0-9a-z]{10}(=i)(=n)[0-9a-z]{28}(=i)[0-9a-z]{2}(=n)[0-9a-z]{6}(=a)(=v)(=a)	2	0	0	1
+2226	2226	(<a>[0-9a-z]{2})(<s>((=a))[0-9a-z]{2})[0-9a-z]{2}(=s)[0-9a-z]{2}(<y>[0-9a-z]{2})[0-9a-z]{4}(<dot>[0-9a-z]{2})(=a)(<r>[0-9a-z]{2})(=r)(=a)(=y)(=dot)	2	0	0	1
+2227	2227	^[\r\n\s]*?\(	2	0	0	1
+2228	2228	\/[a-z0-9]{32}\.jar$	2	0	0	1
+2229	2229	^[^\s]*?\s*?\/[^\r\n\s]*?\?src=	2	0	0	1
+2230	2230	^\/([\/_]*?[a-f0-9][\/_]*?){32}\/\d+?$	2	0	0	1
+2231	2231	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?\/([\/_]*?[a-f0-9][\/_]*?){64}[\x22\x27]	2	0	0	1
+2232	2232	^\/([\/_]*?[a-f0-9][\/_]*?){32}$	2	0	0	1
+2233	2233	^\/[a-zA-Z0-9_\x2f-]{300,}\.jar$	2	0	0	1
+2234	2234	^\/[a-zA-Z0-9_\x2f-]{300,}\.eot$	2	0	0	1
+2235	2235	^((<\/applet>).)+?[\x22\x27]687474703a2f2f	2	0	0	1
+2236	2236	\.html\?sv=[1-5](\,\d+?){1,3}$	2	0	0	1
+2237	2237	\/(d|xie|fla)\.php\?[a-z]+687474703a2f2f	2	0	0	1
+2238	2238	\.html\?jar$	2	0	0	1
+2239	2239	^\/\d{4,5}\/\d{7}$	2	0	0	1
+2240	2240	\/\{0,2}[A-Za-z0-9\+\/]+?LvoDc0RHa8NnZ$	2	0	0	1
+2241	2241	^[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*?\.charCodeAt[\r\n\s]*?\([\r\n\s]*?[a-zA-Z_][^\r\n\s]*[\r\n\s]*?\)[\r\n\s]*?\^[\r\n\s]*?[a-zA-Z_$][^\r\n\s]*\.charCodeAt[\r\n\s]*?\(	2	0	0	1
+2242	2242	^(<sep>[^\x22\x27]{1,10})100(=sep)97(=sep)115(=sep)104(=sep)115(=sep)116(=sep)121(=sep)108(=sep)101(=sep)46(=sep)97(=sep)114(=sep)114(=sep)97(=sep)121(=sep)	2	0	0	1
+2243	2243	^[a-z0-9]{1,500}?(<s>[a-z0-9]{2})(<t>((=s))[a-z0-9]{2})(<r>(((=s)|(=t)))[a-z0-9]{2})(=t)(<o>(((=s)|(=t)|(=r)))[a-z0-9]{2})(<b>(((=s)|(=t)|(=r)|(=o)))[a-z0-9]{2})(<y>(((=s)|(=t)|(=r)|(=o)|(=b)))[a-z0-9]{2})(=t)((((=s)|(=t)|(=r)))[a-z0-9]{4})(=s)(=t)(=r)	2	0	0	1
+2244	2244	^\/[a-z0-9]+?\?thread=\d+?&x?key=[A-F0-9]{32}$	2	0	0	1
+2245	2245	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+2246	2246	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+2247	2247	^[a-zA-Z0-9\+\/]+?(V2luSHR0cC5XaW5IdHRwUmVxdWVzdC41Lj|XaW5IdHRwLldpbkh0dHBSZXF1ZXN0LjUuM|dpbkh0dHAuV2luSHR0cFJlcXVlc3QuNS4x)	2	0	0	1
+2248	2248	\/[A-Z]\.xml$	2	0	0	1
+2249	2249	^(<sep>((100).){1,20})100(=sep)101(=sep)102(=sep)97(=sep)117(=sep)108(=sep)116(=sep)35(=sep)86(=sep)77(=sep)76(=sep)	2	0	0	1
+2250	2250	\.php\?a=[^&]+&f=[a-f0-9]{32}&u=[^&]+$	2	0	0	1
+2251	2251	\.php\?a=(dw[a-z0-9]|[hr][2-7])$	2	0	0	1
+2252	2252	(PK\x01\x02.{24}\x0a\x00.{16}[a-z]{4}.class){4}	2	0	0	1
+2253	2253	^(((?i:<\/applet>)).)+?(?i:value)[\r\n\s]*=[\r\n\s]*\x5c?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]+(=slash)	2	0	0	1
+2254	2254	^\d+u\d+s\d+h\d	2	0	0	1
+2255	2255	^((<\/applet>).)+?&#(0*?(1([0-1]\d|2[0-2])|[78][0-9]|9[07-9]|4[8-9]|5[0-7]|6[5-9])|x0*?([46][1-9A-F]|[57][0-9A]|3[0-9]))(\x3b|&#)	2	0	0	1
+2256	2256	^\s*?\d	2	0	0	1
+2257	2257	^\s*\s*?[\x22\x27][^\x22\x27\x3d]{1,20}=[a-f0-9]{20}	2	0	0	1
+2258	2258	^[^\d]{1,20}100[^\d]{1,20}101[^\d]{1,20}102[^\d]{1,20}97[^\d]{1,20}117[^\d]{1,20}108[^\d]{1,20}116[^\d]{1,20}35[^\d]{1,20}86[^\d]{1,20}77[^\d]{1,20}76	2	0	0	1
+2259	2259	^\s*?<<\s*?\/[A-Z0-9a-z]+\([A-Z0-9a-z]+\)\s*?	2	0	0	1
+2260	2260	^\/[a-f0-9]{32}\.php\?q=[a-f0-9]{32}$	2	0	0	1
+2261	2261	\.php\?req=(swf(IE)?|x(ap|ml)|jar|mp3)&	2	0	0	1
+2262	2262	(\0[a-z]{3}\.classPK.{43}){4}	2	0	0	1
+2263	2263	^[\x22\x27]	2	0	0	1
+2264	2264	^\s*\s*?window\.document\.createElement	2	0	0	1
+2265	2265	^(<sep>[^\x22\x27]{0,10})6f(=sep)6c(=sep)6c(=sep)65(=sep)63(=sep)74(=sep)47(=sep)61(=sep)72(=sep)62(=sep)61(=sep)67(=sep)65(=sep)	2	0	0	1
+2266	2266	\/3\/[a-f0-9]{32}\/http\x3a\x2f	2	0	0	1
+2267	2267	\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+)?$	2	0	0	1
+2268	2268	^\x2Fload\x5Fmodule\x2Ephp\x3Fuser\x3D(n1|11?|2)$	2	0	0	1
+2269	2269	^\x2Fmodules\x2F(n[u3]|1|2)\x2Eswf$	2	0	0	1
+2270	2270	^\x2Fmodules\x2F(1|2)\x2Ejar$	2	0	0	1
+2271	2271	^\s*?\(\s*?[\x22\x27]Flash[\x22\x27]	2	0	0	1
+2272	2272	^\s*?[\x22\x27][A-Za-z0-9\s]{500}	2	0	0	1
+2273	2273	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}<script>var	2	0	0	1
+2274	2274	^[\r\n\s]*?<script>[\r\n\s]*?[A-Za-z]+[\r\n\s]*[\r\n\s]*?[\x22\x27][A-Za-z]{9}\x20[A-Za-z\x20]{300}	2	0	0	1
+2275	2275	^\/[a-z]\?[a-z]=[0-9]{5,}$	2	0	0	1
+2276	2276	[^0-9a-f]{1,3}68[^0-9a-f]{1,3}74[^0-9a-f]{1,3}74[^0-9a-f]{1,3}70[0-9a-f]{1,3}3a	2	0	0	1
+2277	2277	^[\x22\x27]	2	0	0	1
+2278	2278	^(e(vtmgr|ext)|actmon|nciesc|EBC32|comm|tdi)\.sys[\x22\x27]	2	0	0	1
+2279	2279	^([\x22\x27]\s*?\])?\(\s*?(\[[\x22\x27])?rc4([\x22\x27]\s*?\])?\(\s*?[\x22\x27][^\x22\x27]+?[\x22\x27]\s*?,\s*?(\[[\x22\x27])?hex2bin([\x22\x27]\s*?\])?\(	2	0	0	1
+2280	2280	^[\x22\x27]	2	0	0	1
+2281	2281	^[\x22\x27]	2	0	0	1
+2282	2282	^[\x22\x27]	2	0	0	1
+2283	2283	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?[\?\&]e=\d+[\x22\x27]	2	0	0	1
+2284	2284	^[\r\n\s]*?\,[\r\n\s]*?[\x22\x27][\%\\]u"	2	0	0	1
+2285	2285	^(((<\/object>).)+?codebase\s*\s*?[\x22\x27]spl[\x22\x27])(((<\/object>).)+?\/x-java-applet)	2	0	0	1
+2286	2286	^[\w.]*?\.class	2	0	0	1
+2287	2287	^\s*\s*?[\x22\x27]\-	2	0	0	1
+2288	2288	^\s*\s*?[\x22\x27]\-	2	0	0	1
+2289	2289	\/Fqxzdh\.jar$	2	0	0	1
+2290	2290	^\s*?\(\s*?[\x22\x27](AgControl\.AgControl)[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?\.[^\x22\x27]*?A[^\x22\x27]*?g[^\x22\x27]*?C[^\x22\x27]*?o[^\x22\x27]*?n[^\x22\x27]*?t[^\x22\x27]*?r[^\x22\x27]*?o[^\x22\x27]*?l[^\x22\x27]*?[\x22\x27]\s*?\.\s*?replace\s*?\(	2	0	0	1
+2291	2291	^id=[^&]+&dom=687474703a2f2f[a-f0-9]+2e706870\s*?$/Ps	2	0	0	1
+2292	2292	[^=]+(([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+?2e)+([46][1-9a-f]|[57][0-9a]|3[0-9]|2d)+\s*?/P	2	0	0	1
+2293	2293	\.php\?spl=[\w_]+$	2	0	0	1
+2294	2294	^Content-Disposition\x3a[^\r\n]+\.swf/Hm	2	0	0	1
+2295	2295	Referer\x3a[^\r\n]+\.php\/\[\[DYNAMIC\]\]\/\d/Hm	2	0	0	1
+2296	2296	^\s*?[\x3a\x3d]\s*?[\x22\x27]?\-	2	0	0	1
+2297	2297	^\/f(\/[^\x2f]+)?\/14\d{8}(\/\d{9,10})?(\/\d)+(\/x[a-f0-9]+(\x3b\d)+?)?$	2	0	0	1
+2298	2298	^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{14,}\.html(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+2299	2299	^(<sep>.{1,50})u(=sep)n(=sep)c(=sep)t(=sep)i(=sep)o(=sep)n(=sep)\s	2	0	0	1
+2300	2300	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}(\r\n)*?<script>[^\r\n]+?\We[\x22\x27\+]*?v[\x22\x27\+]*?a[\x22\x27\+]*?l\W	2	0	0	1
+2301	2301	^(<sep>.{1,20})\.___\+(=sep)\._\\\+(=sep)\._\\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+\(\!\[\]\+\x22\x22\)\[(=sep)\._\_\]\+(=sep)\.\\\_\+(=sep)\.\\__\+(=sep)\.__\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.___\+(=sep)\.\\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\\_\+(=sep)\._\_\+(=sep)\.\_\\\+(=sep)\.\_\_\+\x22\x5c\x5c\x22\+(=sep)\.__\\+(=sep)\.\__\+(=sep)\.\\\\+(=sep)\.\\\$_\+	2	0	0	1
+2302	2302	^\/(pruncd)?flashhigh\.swf$	2	0	0	1
+2303	2303	^\/(pruncd)?flashlow\.swf$	2	0	0	1
+2304	2304	^\/(pruncd)?silverapp1\.xap$	2	0	0	1
+2305	2305	\?action=lnd$	2	0	0	1
+2306	2306	\?action=(pld|exp)&exp=	2	0	0	1
+2307	2307	^Referer\x3a[^\r\n]+\x3a\d{1,5}\/[^\r\n]*?[a-z]+?\.php\?[a-z]+\d/Hm	2	0	0	1
+2308	2308	\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Z-a-z]{18}\.jnlp$	2	0	0	1
+2309	2309	\/k\?t[a-z]*=\d{5,}$	2	0	0	1
+2310	2310	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+2311	2311	^\/[^\x2f]*?flashhigh\.swf$	2	0	0	1
+2312	2312	^\/[^\x2f]*?flashlow\.swf$	2	0	0	1
+2313	2313	^\/[^\x2f]*?iebasic\.html$	2	0	0	1
+2314	2314	^\/[^\x2f]*?silverapp1\.xap$	2	0	0	1
+2315	2315	\/[a-z]{3,7}\.php$	2	0	0	1
+2316	2316	\/([a-z0-9]{1,7}\.php)?\?zho=	2	0	0	1
+2317	2317	^\/[a-f0-9]{32}\/([a-z]*?[A-Z])([A-Z]*?[a-z])[A-Za-z]+\.(html|jar|swf)$	2	0	0	1
+2318	2318	^\/Drop2(-\d+)\.swf$	2	0	0	1
+2319	2319	^[^\r\n]*?(<name>\/[^\.\/]+\.html)\?[a-z]+?\d*[a-f0-9]{32}\sHTTP\/1\..+?\r\nReferer\x3a\x20[^\r\n]*?(=name)(\d{1,5})?\r\n	2	0	0	1
+2320	2320	^Content-Disposition\x3a[^\r\n]+\.swf/Hm	2	0	0	1
+2321	2321	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi	2	0	0	1
+2322	2322	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r?\n)/Hmi	2	0	0	1
+2323	2323	^\s*?\x28\s*?[a-z0-9]{4,6}\s*?\x28\s*?[a-z0-9]{1,3}\s*?,\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x29\s*?\x3b\s*?(<var>[a-z0-9]{1,3})\s*?\x3d\s*?\x28\s*?(=var)\s*?\x2b\s*?[a-z0-9]{1,3}\s*?\x29\s*?\x25\s*?[a-z0-9]{1,3}\.length\x3b	2	0	0	1
+2324	2324	^[A-Za-z0-9]+\x27\s*?src=\x27http\x3a[^\x27]+[\x27]\s*width=1\d\s+height=1\d\s+	2	0	0	1
+2325	2325	^Last-Modified\x3a\x20[^A-Za-z]{2}/Hm	2	0	0	1
+2326	2326	^\/ABs[A-Za-z0-9_]+(\/x?[a-f0-9]+(\x3b\d+)+)?$	2	0	0	1
+2327	2327	^\/AwoVG[A-Za-z0-9_]+$	2	0	0	1
+2328	2328	^[a-z0-9]+\x2A\x2F\x22\x6F\x66\x74\x2E	2	0	0	1
+2329	2329	^Referer\x3a[^\r\n]+?rowedmedia\.com\/search\.php\r?$/Hmi	2	0	0	1
+2330	2330	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a|\r\n)/Hmi	2	0	0	1
+2331	2331	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+2332	2332	^[a-zA-Z0-9]{9}<\/[^>]+>\s+?<[^\s]+\sid=\x22[a-zA-Z]{3,5}\x22\sstyle=\x22display\x3anone\x22>[A-Za-z0-9]{500}	2	0	0	1
+2333	2333	^[a-z]{7}(\s*?[a-z]+\s*?)*?[a-z]{7,}\x2a\x2f	2	0	0	1
+2334	2334	nb[\d+]=Yes	2	0	0	1
+2335	2335	^(<vname>[A-Za-z0-9]+)\s*\s*?navigator.userAgent.toLowerCase\x28\x29\x3b.+?if\(document.cookie[^\r\n]+\([^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]b[\x22\x27+\s]*o[\x22\x27+\s]*t[\x22\x27+\s]*[\x22\x27][^\r\n]+(=vname)[\x2e\x5b\x22\x27+\s]+i[\x22\x27+\s]*n[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*x[\x22\x27+\s]*O[\x22\x27+\s]*f[\x22\x27+\s]*\x5d?\(\s*?[\x22\x27]s[\x22\x27+\s]*p[\x22\x27+\s]*i[\x22\x27+\s]*d[\x22\x27+\s]*e[\x22\x27+\s]*r[\x22\x27+\s]*[\x22\x27]	2	0	0	1
+2336	2336	^Referer\x3a[^\r\n]+?\x3a\d+[^\r\n]*?\/[a-z0-9]+\.php\?[a-z0-9]+=\d+(\r\n|&)/Hm	2	0	0	1
+2337	2337	^GET \/(<name>a[a-z]{9,})\/.+?\r\nHost\x3a\x20(=name)\.	2	0	0	1
+2338	2338	^\s*?[\x22\x27][^\x22\x27]+\.php\?id=\d+[\x22\x27]	2	0	0	1
+2339	2339	^\W	2	0	0	1
+2340	2340	^[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(<arg>[a-z0-9]{3,})(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28[^\x29]+\x29\x3b\x2f\x2a[^\x2a]+\x2a\x2f(\x2f\x2a[^\x2a]+\x2a\x2f)*?(=arg)(\x2f\x2a[^\x2a]+\x2a\x2f)*?\x28	2	0	0	1
+2341	2341	^\s*?\d+,\s*?\d	2	0	0	1
+2342	2342	^\s*?\d+,\s*?\d	2	0	0	1
+2343	2343	\/14\d{8}(\.jar)?$	2	0	0	1
+2344	2344	^[a-z0-9]*\r\n/H	2	0	0	1
+2345	2345	^[a-z0-9]*\r\n/H	2	0	0	1
+2346	2346	filename=[a-z0-9]*\r\n/H	2	0	0	1
+2347	2347	\/\??4c2H($|[&?]utm_source=)	2	0	0	1
+2348	2348	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+2349	2349	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+2350	2350	(Byb2NMaXN0|Qcm9jTGlzd|UHJvY0xpc3)/P	2	0	0	1
+2351	2351	\/([A-Za-z]{0,3}\d)(\d{0,3}[A-Za-z])[A-Za-z0-9]{4,5}\.swf$	2	0	0	1
+2352	2352	^\s*[^>]*?[a-zA-Z]+\s*\s*?[\x22\x27]([a-z]{0,20}[A-Z])([A-Z]{0,20}[a-z])[A-Za-z]{15,21}[\x22\x27][^>]*([A-Za-z_]{0,200}[0-9])([0-9a-z_]{0,200}[A-Z])([0-9A-Z_]{0,200}[a-z])[A-Za-z0-9_]{200}	2	0	0	1
+2353	2353	\/5\/[a-f0-9]{32}\/\x20*http\x3a\x2f	2	0	0	1
+2354	2354	^\x2f+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x2f\??[a-f0-9]+\x7chttp\x3a\x2f	2	0	0	1
+2355	2355	^Refresh\x3a\x20\d+\x3b\x20url[^\r\n]+\/999\/00000\/\r?$/Hm	2	0	0	1
+2356	2356	^\s*?[\x22\x27][^\x22\x27a-f0-9]68[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]74[^\x22\x27a-f0-9]70[^\x22\x27a-f0-9]3a[^\x22\x27a-f0-9]2f[^\x22\x27a-f0-9]2f[^\x22\x27]+?[^\x22\x27a-f0-9]00[\x22\x27]	2	0	0	1
+2357	2357	^\/[a-f0-9]{32}\/e\.html$	2	0	0	1
+2358	2358	Host\x3a\x20a[a-z]{10}\.[a-z]{5}\./H	2	0	0	1
+2359	2359	\.js\?ver=[0-9]\.[0-9]{2}\.[0-9]{4}$	2	0	0	1
+2360	2360	\/\d\/?[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.html&[a-z]+=[^&]+&[a-z]+=\d{3}\.\d{3}\.\d{3,}(\.\d{3,})?$	2	0	0	1
+2361	2361	\/\d\/?[A-Z]+\/[a-f0-9]{40}\/$	2	0	0	1
+2362	2362	\/([a-z0-9]{0,10}[A-Z])([A-Z0-9]{0,10}[a-z])[A-Z-a-z0-9]{5,20}\.jar$	2	0	0	1
+2363	2363	\?([a-z\d\x3d&\x2e]*?[A-Z])([A-Z\d=&\x2e]*?[a-z])([A-Za-z=&\x2e]*?\d)[A-Za-z\d=&\x2e]{50,}$	2	0	0	1
+2364	2364	^\/([a-z0-9]+\/)?[^\x2f]+\?[a-z]{1,40}_id=\d{2,5}?&[a-z]{1,40}_id=\d{2,5}&[^&\x3d]+(_id)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$	2	0	0	1
+2365	2365	&cat_no=\d{2,5}?&no=\d{2,5}&[^&\x3d]+(_no)=([a-zA-Z0-9]+([A-Z][a-z][A-Z]|\d[a-z][A-Z]|[A-Z]\d[A-Z]|[A-Z\d]{3}[a-z]))([A-Fa-f0-9]*?[G-Zg-z])([a-z0-9]*?[A-Z])([A-Z0-9]*?[a-z])[A-Za-z0-9]{32}\x2e{0,2}$	2	0	0	1
+2366	2366	\x3capplet[^\x3e]+visibility[^\x3e]+hidden[^\x3e]	2	0	0	1
+2367	2367	^\s*?[a-z]+\s*\s*?\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b].*?([\x3d\x2b])\x28\d+[<>]\d+\?\s*?\x22[^\x22]+\x22\s*?\x3a\s*?\x22[^\x22]+\x22\s*?\x29\s*?[\x3b\x2b]	2	0	0	1
+2368	2368	^\s*?	2	0	0	1
+2369	2369	^\/[0-9a-f]{32}\.html$	2	0	0	1
+2370	2370	^\/[a-z\_\-]{4,20}\.php\?([a-z\_\-]{4,20}=\d+?&){3,}[a-z\_\-]{4,20}=-?\d+$	2	0	0	1
+2371	2371	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{4,10}=\d{1,3}&){7,}[a-z\_\-]{4,10}=-?\d+$	2	0	0	1
+2372	2372	^\/[a-z\_\-]{4,10}\.php\?([a-z\_\-]{0,10}=\d{1,3}&){3,}[a-z\_\-]{4,10}=-?\d+$	2	0	0	1
+2373	2373	\.jpg$	2	0	0	1
+2374	2374	^\s+\d+\x3b\s*\}	2	0	0	1
+2375	2375	^\/([a-z][a-z\x2f]*\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d[a-z\x2f]+\d)[a-z0-9\x2f]+\/$	2	0	0	1
+2376	2376	^\/([a-z][a-z\x2f]*-[a-z\x2f]+-)[a-z\x2f-]+\/$	2	0	0	1
+2377	2377	^http\x3a\/\/[^\x2f]+\/[A-Z]([a-z0-9]+[A-Z])([A-Z0-9]+[a-z])[A-Za-z0-9]{9,}\.html?\r?$/Hmi	2	0	0	1
+2378	2378	\.js\?chebstr=0\.\d+$	2	0	0	1
+2379	2379	\.js\?chbstr=0\.\d+$	2	0	0	1
+2380	2380	^[^\r\n\x22\?]+[&?][^=\r\n\x22]+=[a-f0-9]+[^\r\n\x22\?]*[&?][^=\r\n\x22]+=[a-f0-9]+\x22\s*\x3b\s*head\.appendChild\(\s*script\s*\)\x3b	2	0	0	1
+2381	2381	^\/([a-z\d]+[+-][a-z\d]+[+-][a-z\d]+[+-])[a-z\d+-]*\/$	2	0	0	1
+2382	2382	^\s*\(\s*[\x22\x27][\x00-\x09\x80-\xff][\x22\x27]\s*\)\s*\x3b\s*[A-Za-z0-9]+\s*=\s*[\x22\x27]	2	0	0	1
+2383	2383	^\s*\x27[^\x27]+\x27width=\x27250\x27\sheight=\x27250\x27>\s*<\/iframe>\s*<\/div>	2	0	0	1
+2384	2384	^[\x3b\x2c]postRequest\x28cfg\.urlSoftDetectorCallback	2	0	0	1
+2385	2385	^[\r\n\s]*?Base64\.decode[\r\n\s]*?\x28[\r\n\s]*?[\x22\x27]	2	0	0	1
+2386	2386	Referer\x3a\x20http\x3a\x2f\x2f[^\r\n\x2f]+\/index\.php\?[^\x3d&]+=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=)?\r\n/H	2	0	0	1
+2387	2387	^[^\n]*\x29\x3b$	2	0	0	1
+2388	2388	^\s*(<var>[^\r\n\s\x3d\x2c\x3b]+)\s*=[^\n]*<iframe([^\n>]*top\x3a-\d+px\x3b)[^\n>]+src\s*=\s*\x5c?[\x22\x27]http[^\n>]+>\s*<\/iframe>\x22\x3bdocument\.write\((=var)\)\x3b\s*$	2	0	0	1
+2389	2389	^[^\x2f\x22\x27]+\/\?[^=&\x22\x27]+=l3S	2	0	0	1
+2390	2390	^.{16}[a-z]{3}\.dll	2	0	0	1
+2391	2391	^.{16}[a-z]{4}\.dll	2	0	0	1
+2392	2392	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{7,8}\d{2,3}\.pdf\r\n/Hm	2	0	0	1
+2393	2393	\.php\?setup=d&s=\d+&r=\d+$	2	0	0	1
+2394	2394	\/\?[a-z0-9]{65,}\x3b \d\x3b \d	2	0	0	1
+2395	2395	^\/wordpress\/\?[A-Za-z0-9]{4}(&utm_source=le)?$	2	0	0	1
+2396	2396	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+2397	2397	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+2398	2398	\/\?nbVykj$	2	0	0	1
+2399	2399	^s?\x3a\x2f\x2f[^\x22\x27]+\/\?[A-Za-z0-9]{5,6}(=[^&\x22\x27]+)?[\x22\x27]\x29\x3bsetCookie\(\x22popundr\x22,1,864e5\)\}	2	0	0	1
+2400	2400	^(<var>[A-Z0-9a-z]{1,20})\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29&(=var)\x28\d+\x29	2	0	0	1
+2401	2401	^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\.[a-z]+\?time=[^&]+&stamp=[a-z]*\d+(\.[a-z]*\d+)+$	2	0	0	1
+2402	2402	^[^\r\n]+\/%(3A|20)http%3A%2F%2F/Hmi	2	0	0	1
+2403	2403	^\/\?3b[A-Z0-9a-z]{2}(&subid=[^&]*)?$	2	0	0	1
+2404	2404	^\/[a-z]+\/$	2	0	0	1
+2405	2405	^\s*\([\x22\x27][A-F0-9a-f]{32}[\x22\x27]\s*\)\s*\x3b\s*}\s*catch\s*\(e\)\s*\{\s*\}\s*\}\s*<\/script>\s*<\/body>	2	0	0	1
+2406	2406	^([^>]*? name\s*=\s*[\x22\x27]flashvars)[^>]*? value\s*=\s*[\x22\x27]url=https?\x3a[^\x22\x27]*?\.wasm	2	0	0	1
+2407	2407	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22(\!(\x22\s*?\+\s*?\x22)?)?Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+2408	2408	^(<v>[0-9a-z]{2})(<a>((=v))[0-9a-z]{2})[0-9a-z]{2}(<space>[0-9a-z]{2})[0-9a-z]{2}(<J>[0-9a-z]{2})[0-9a-z]{4}(=v)[0-9a-z]{6}(=space)[0-9a-z]{2}(=space)[0-9a-z]{64}(=J)(=a)(=v)(=a)	2	0	0	1
+2409	2409	^\d{3}px\x3b\swidth\x3a3\d{2}px\x3b\sheight\x3a3\d{2}px\x3b\x22>[^<>]*?<iframe src=[\x22\x27][^\x22\x27]+[\x22\x27]\swidth=[\x22\x27]2\d{2}[\x22\x27]\sheight=[\x22\x27]2\d{2}[\x22\x27]><\/iframe>[^<>]*?\n[^<>]*?<\/span>	2	0	0	1
+2410	2410	\/[a-z]{4,20}-a\.[a-z]{4,20}\.jar$	2	0	0	1
+2411	2411	\/view.php\?i=\d&key=[0-9a-f]{32}$	2	0	0	1
+2412	2412	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.jar$	2	0	0	1
+2413	2413	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/[0-9]{7}$	2	0	0	1
+2414	2414	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/[0-9]{7,8}\/.*\.pdf$	2	0	0	1
+2415	2415	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$	2	0	0	1
+2416	2416	^\/[a-z]\/f\.php\?k=\d(&e=\d&f=\d)?$	2	0	0	1
+2417	2417	^\/[a-z]+\/$	2	0	0	1
+2418	2418	\.php\?j=1&k=[0-9](i=[0-9])?$	2	0	0	1
+2419	2419	^\/[a-zA-Z]{7}\.jar$	2	0	0	1
+2420	2420	\/lpdf\.php\?i=[a-zA-Z0-9]+&?$	2	0	0	1
+2421	2421	[a-z0-9]{32}\.jar	2	0	0	1
+2422	2422	\/inf\.php\?id=[a-f0-9]{32}$	2	0	0	1
+2423	2423	^\s*=\s*[\x22\x27]	2	0	0	1
+2424	2424	\/vd\/\d+\x3b[a-f0-9]{32}	2	0	0	1
+2425	2425	\.php\?pprec$	2	0	0	1
+2426	2426	\.php\?c002$	2	0	0	1
+2427	2427	[a-f0-9]{32}\.jar	2	0	0	1
+2428	2428	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1)	2	0	0	1
+2429	2429	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/q\.php(=q1)	2	0	0	1
+2430	2430	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1)	2	0	0	1
+2431	2431	^((<\/iframe).)*?[\r\n\s]src[\r\n\s]*=[\r\n\s]*(<q1>[\x22\x27])http\x3a\/\/[^\x5c]+?\/([a-f0-9]{16}|[a-f0-9]{32})\/ff\.php(=q1)	2	0	0	1
+2432	2432	[a-f0-9]{32,64}\/[a-f0-9]{32,64}/\w$	2	0	0	1
+2433	2433	\?(s|page|id)=\d+$	2	0	0	1
+2434	2434	^[\r\n\s\+]*[\r\n\s\+]*?(<func>[_a-zA-Z][a-zA-Z0-9_-]+)\([\r\n\s]*?[\x22\x27](http\x3a\/\/)(<h>[^\x22\x27])(<t>((=h))[^\x22\x27])(=t)[^\x22\x27]{2}(<slash>(((=h)|(=t)))[^\x22\x27])(=slash)[^\x22\x27]*?[\x22\x27][\r\n\s]*?,[\r\n\s]*?[\x22\x27][^\x22\x27]+[\x22\x27][\r\n\s]*?\)\+(=func)	2	0	0	1
+2435	2435	\/FlashPlayer\.cpl$	2	0	0	1
+2436	2436	^((<\/applet>).)+?[\x22\x27]1337\.exe	2	0	0	1
+2437	2437	filename=[a-z]{4}\.txt\x0D\x0A/H	2	0	0	1
+2438	2438	&p=\d+\.\d+\.\d+\.\d+&j=\d+\.\d+\.\d+\.\d+&f=\d+\.\d+\.\d+\.\d+$	2	0	0	1
+2439	2439	^[\r\n\s]*[\r\n\s]*?(<q>[\x22\x27])[a-f0-9]{9,16}\.(jar|zip)(=q)	2	0	0	1
+2440	2440	^\x2Fclicker\x2Ephp$	2	0	0	1
+2441	2441	^(<var>.{1,10})\.\\_\\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\x22\x5c\x5c\x22\+(=var)\.\_\_\\+(=var)\.\\\_\+(=var)\.\_\_\_\+\(\!\[\]\+\x22\x22\)\[(=var)\.\_\\_\]\+(=var)\.\\\$\_\+(=var)\.\_\_\+	2	0	0	1
+2442	2442	\?(s|page|id)=\d+&text=\d+$	2	0	0	1
+2443	2443	^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)j51[a-f0-9]{21}\.jar(=q)\r?$/Hm	2	0	0	1
+2444	2444	^Content-Disposition\x3a[^\r\n]+\s*?(<q>[\x22\x27]?)e51[a-f0-9]{21}\.exe(=q)\r?$/Hm	2	0	0	1
+2445	2445	\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$	2	0	0	1
+2446	2446	\/\{0,2}[A-Za-z0-9\+\/]+?voDc0RHa8NnZ$	2	0	0	1
+2447	2447	^[^\x3b\r\n\x22\x27]+?[A-Za-z0-9\/\_\-]{60,}\.exe\?	2	0	0	1
+2448	2448	^[^\x3b\r\n\x22\x27]+?\.txt\?e=\d+(&[fh]=\d)?	2	0	0	1
+2449	2449	^[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)[^\x3b]+?\+[a-z]+?\.substring([^)]+?)	2	0	0	1
+2450	2450	[a-z]	2	0	0	1
+2451	2451	\.exe\?(e=)?\d+$	2	0	0	1
+2452	2452	\/j\d{2}\.php\?i=	2	0	0	1
+2453	2453	\/\?whole=\d+$	2	0	0	1
+2454	2454	^\/search\/[0-9]{64}	2	0	0	1
+2455	2455	\/m1[1-6]\.jar$	2	0	0	1
+2456	2456	\/[0-9]{4}\.html$	2	0	0	1
+2457	2457	\/\d+\.pkg$	2	0	0	1
+2458	2458	\/j_[a-z0-9]+_(0422|1723|3544|5076)\.jar$	2	0	0	1
+2459	2459	\/[a-z0-9]{3}\.php\?[a-z]=[a-zA-Z0-9]{10}$	2	0	0	1
+2460	2460	amor\d{0,2}\.jar	2	0	0	1
+2461	2461	[a-f]	2	0	0	1
+2462	2462	=(3[0-9a]|2e)+3a313[3-9](3[0-9]){8}$	2	0	0	1
+2463	2463	(<m>[0-9a-f]{2})(<sep>[^0-9a-f])(<e>((=m))[0-9a-f]{2})(=sep)([0-9a-f]{2}(=sep)){7}(=e)(=sep)(=m)(=sep)[0-9a-f]{2}(=sep)(=e)(=sep)(<d>((=e))[0-9a-f]{2})(=sep)(=d)(=sep)(=e)(=sep)(=d)	2	0	0	1
+2464	2464	^[\r\n\s]*?\([\r\n\s]*?(<q>[\x22\x27])(<m>(((=q)).)+)(=q).+?<(=m)?a(=m)?p(=m)?p(=m)l(=m)?e(=m)?t	2	0	0	1
+2465	2465	\/[a-f0-9]{32}\/[a-f0-9]{32}\.jar$	2	0	0	1
+2466	2466	^\/[a-f0-9]{32}\/[a-f0-9]{32}\.jnlp$	2	0	0	1
+2467	2467	\.jar\?java=\d+$	2	0	0	1
+2468	2468	^((<\/applet>).)+?\.jar\?java=\d+	2	0	0	1
+2469	2469	^((<\/applet>).)+?[\x22\x27]aHR0cDov	2	0	0	1
+2470	2470	^[a-f0-9]{32}=\d{1,10}\r\n/H	2	0	0	1
+2471	2471	\/1[34]\d{8}\.tpl$	2	0	0	1
+2472	2472	^[\r\n\s]*?\([\r\n\s]*?[\x22\x27]f([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?m([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?C([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?h([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?a([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?r([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?c([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?o([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?d([\x22\x27][\r\n\s]*?,[\r\n\s]*[\x22\x27])?e[\x22\x27]	2	0	0	1
+2473	2473	^\/\d{1,2}(<l>[A-Z])\d{1,2}(=l)\d{1,2}(=l)\d{1,2}\.pdf$	2	0	0	1
+2474	2474	\/java\.php\?eid=[a-f0-9]{32}&	2	0	0	1
+2475	2475	\/pdf\.php\?pdf=[a-f0-9]{32}&	2	0	0	1
+2476	2476	[&?]type=\d+($|&)	2	0	0	1
+2477	2477	^Referer\x3a[^\r\n]+?\/[a-f0-9A-Z\_\-]{32,}\.html(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+2478	2478	^\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?m\d+([\x22\x27]\s*?,\s*[\x22\x27])?C\d+([\x22\x27]\s*?,\s*[\x22\x27])?h\d+([\x22\x27]\s*?,\s*[\x22\x27])?a\d+([\x22\x27]\s*?,\s*[\x22\x27])?r\d+([\x22\x27]\s*?,\s*[\x22\x27])?c\d+([\x22\x27]\s*?,\s*[\x22\x27])?o\d+([\x22\x27]\s*?,\s*[\x22\x27])?d\d+([\x22\x27]\s*?,\s*[\x22\x27])?e\d+[\x22\x27]	2	0	0	1
+2479	2479	\/13[89]\d{7}.swf$	2	0	0	1
+2480	2480	\/[a-z]+\.php\?[a-z]+\d{7}&[a-z]+\d{7,8}$	2	0	0	1
+2481	2481	^(<sep>[^\x22\x27]{0,10})75(=sep)6e(=sep)63(=sep)74(=sep)69(=sep)6f(=sep)6e(=sep)20	2	0	0	1
+2482	2482	^\d+?\*\/\s*?(<vname>[^\s\(\x3b]{1,20})\s*?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)\s*?(\/\*\d+?\*\/\s*?)?\([^\)]+\)\s*?(\/\*\d+?\*\/\s*?)?\x3b\s*?(\/\*\d+?\*\/)?(=vname)	2	0	0	1
+2483	2483	[&?]v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=.+&v_([sfamq]|ja)=	2	0	0	1
+2484	2484	\/1(3[89]\d{7}|4\d{8})\.xap$	2	0	0	1
+2485	2485	&dr=\d+$	2	0	0	1
+2486	2486	&nrk=\d+$	2	0	0	1
+2487	2487	^Content-Disposition\x3a[^\r\n]+(\W14\d{8})\.pdf\r?$/Hm	2	0	0	1
+2488	2488	^(((<\/iframe>).)+?src\s*\s*?\x22http\x3a[^\x22]+16\.html\x22)(((<\/iframe>).)+?left\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)(((<\/iframe>).)+?top\s*?[\x3a\x3d]\s*?[\x22\x27]?\-)((<\/iframe>).)+?<\/iframe>\x27\x29	2	0	0	1
+2489	2489	^\s*?[A-Z0-9a-z\+]+?\s*?\x7d	2	0	0	1
+2490	2490	^((\/[a-z]+?)*?\/\d+\/)((\/\d+?)*?\/[a-z]+?\/)(\/([a-z]+|\d+)){4,}\/[a-z]+\.pack\.gz$	2	0	0	1
+2491	2491	^\s*?\x28\s*?(<q>[\x22\x27])(((=q)).)+?(=q)\s*?\,\s*?[\x22\x27]container[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27]\s*?,\s*?[\x22\x27]10[\x22\x27],\s*?[\x22\x27]9\.0\.0[\x22\x27]\s*?,\s*?false\s*?,\s*?flashvars,\s*?params\s*?,\s*?attributes\s*?\x29\s*?\x3b\s*?<\/script>\s*?<\/head>	2	0	0	1
+2492	2492	\/14\d{8}(\.swf)?$	2	0	0	1
+2493	2493	\/14\d{8}(\.pdf)?$	2	0	0	1
+2494	2494	^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.exe/Hm	2	0	0	1
+2495	2495	^Content-Disposition\x3a.+?filename\s*\s*?[\x22\x27]?\d\.dll/Hm	2	0	0	1
+2496	2496	\/14\d{8}(\/\d+)*?(\/x[a-f0-9]+[\x3b0-9]*)?$	2	0	0	1
+2497	2497	^\s[^\r\n]*?[\x28\x5b]\s*?[\x22\x27][^\x22\x27]?s[^\x22\x27]?u[^\x22\x27]?b[^\x22\x27]?s[^\x22\x27]?t[^\x22\x27]?r[^\x22\x27]?[\x22\x27]\s*?[\x29\x5d]\s*?(\x5d\s*?)?\x28	2	0	0	1
+2498	2498	\/video.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2499	2499	\/player.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2500	2500	\/search.php\?pid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2501	2501	^\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28(=var1)\s*\!\s*=\s*[\x27\x22][\x22\x27]\s*?\x29\s*?\{\s*?(<var2>[^\s\x3d]+)\s*\s*?(=var1)\s*?\[	2	0	0	1
+2502	2502	\/1\.php\?r$	2	0	0	1
+2503	2503	^[^a-z]?\x65[^a-z]?\x6e[^a-z]?\x67[^a-z]?\x74[^a-z]?\x68	2	0	0	1
+2504	2504	^\s*?[\x22\x27](<char>[^\x22\x27]+)[\x22\x27]\.replace\x28\s*?[\x22\x27](=char)[\x22\x27]\s*?,	2	0	0	1
+2505	2505	\/banner.php\?sid=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2506	2506	\/blog.php\?id=([0-9]*?[A-F])[A-F0-9]{10,}$	2	0	0	1
+2507	2507	\/main\.html$	2	0	0	1
+2508	2508	\.php\?id=[0-9A-F]{44,54}&rnd=[0-9]{3,7}$	2	0	0	1
+2509	2509	^\/tdstest\/[a-f0-9]{32,}\/?$	2	0	0	1
+2510	2510	\/content\/dl\.php\?sl=vbs[a-z0-9]{32}$	2	0	0	1
+2511	2511	\/content\/getvbslink\.php\?d=[a-z0-9]{32}$	2	0	0	1
+2512	2512	Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H	2	0	0	1
+2513	2513	^[a-z0-9]*\r\n/H	2	0	0	1
+2514	2514	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+2515	2515	^\s*?\x28\s*?\x22\s\x22\s*?,\s*?\x22Q(\x22\s*?\+\s*?\x22)?Q\x22	2	0	0	1
+2516	2516	\/street[1-5]\.php$	2	0	0	1
+2517	2517	\/XV-\d+\.exe$	2	0	0	1
+2518	2518	\/bad\/[A-Z0-9]+\.swf$	2	0	0	1
+2519	2519	\/\d\/[A-Z]+\/[a-f0-9]{32}\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?$	2	0	0	1
+2520	2520	^\s*?[^\x28\s]*?\x28\s*?(<a1>[^\s,\x29]+)\s*?,\s*?(<a2>[^\s,\x29]+)\s*?\x29\{[^\r\n]*?[\+=]String.fromCharCode\((=a2)\)[^\r\n]*?\}	2	0	0	1
+2521	2521	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.jar\r\n/Hm	2	0	0	1
+2522	2522	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+2523	2523	\b[a-z]{2}\d+\s*\s*?Yes	2	0	0	1
+2524	2524	^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x20http\x3a\x2f	2	0	0	1
+2525	2525	^\/[a-z]+\/[a-z]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?(\.[a-z]+)?$	2	0	0	1
+2526	2526	^[^\r\n]+\/\d\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?/H	2	0	0	1
+2527	2527	^\/[a-z]+\/[a-z]+\/\d\/[a-f0-9]{32}([a-f0-9]{8})?\/\x3ahttp\x3a\x2f	2	0	0	1
+2528	2528	^Referer\x3a[^\r\n]+\/4\/[A-Z]+\/[a-f0-9]{32}([a-f0-9]{8})?\r?$/Hm	2	0	0	1
+2529	2529	^\s*\s*?[\x22\x27]8\.8\.8\.8[\x22\x27]	2	0	0	1
+2530	2530	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)(s|&#(x[75]3|115|83)\x3b)(i|&#(x[64]9|105|73)\x3b)(d|&#(x[64]4|100|68)\x3b)(\x3a|&#(x3a|58)\x3b)([a-fA-F0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12})[^\x22\x27]+((\x5c|&#)(5[01234567]|10[012]|6[5678]|4[589]|9[789]|7[09])|(\x25|&#x)(4[123456]|6[123456]|3\d|2D))	2	0	0	1
+2531	2531	Host\x3a\x20([\x2eg-z]*[a-f0-9][\x2eg-z]*){32}\./H	2	0	0	1
+2532	2532	\/e\.html$	2	0	0	1
+2533	2533	^(<var>[a-f0-9]{6})-->\s*?<script\s*?type=[\x22\x27]text\/javascript[\x22\x27]\s*?src=[\x22\x27]http\x3a\x2f[^\x22\x27]*?\/[a-z\d]{8}\.php\?id=\d+[\x22\x27]\s*<\/script><!--\/(=var)-->	2	0	0	1
+2534	2534	[&?]t=[a-f0-9]{32}(&|$)	2	0	0	1
+2535	2535	\/5\/[A-Z]{3,}\/[a-f0-9]{32}(\.[^\x2f]+|\/[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\.[a-z]*?\d+\/?|\/\d+\/?)?$	2	0	0	1
+2536	2536	^\s*?[_$]+\x28\x29	2	0	0	1
+2537	2537	^\s*?[_$]+\x28\x29	2	0	0	1
+2538	2538	Referer\x3a\x20http\x3a\x2f+(www\.)(<refhost>[^\x3a\x2f\r\n]+)[^\r\n]*?\/search\?q=([A-Z&=\d]*?[a-z])([a-zA-Z\d&=]*?[A-Za-z=&]\d[A-Za-z])([a-zA-Z\d&=]*?[a-z\d][A-Z][A-Za-z\d])[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+&[A-Za-z0-9]+=[A-Za-z0-9]+[&=A-Za-z0-9]*?\r\n.*?Host\x3a\x20(=refhost)/Hsi	2	0	0	1
+2539	2539	^\s*?\w+\s*?\.\s*?charCodeAt	2	0	0	1
+2540	2540	^\/\?[a-f0-9]{32,64}$	2	0	0	1
+2541	2541	^[^>]*?id\s*[\x22\x27][a-z0-9]+[\x22\x27][^>]*\s*?[\x2a\d]{100}	2	0	0	1
+2542	2542	Referer\x3a\x20http\x3a\x2f+(<dl1>[^\x2e\r\n]+)\x2e[^\x2f\r\n]*?(<dl2>\x2e[^\x2e\r\n\x2f]+\x2e[^\x2e\x2f\r\n]+)\x2f(\??[a-f0-9]{32,64}\/?)?\r\n.*?Host\x3a\x20((=dl1))[^\r\n]*?(=dl2)\r\n/Hsm	2	0	0	1
+2543	2543	Referer\x3a\x20[^\r\n]*?\/[a-f0-9]{32,64}\.swf/H	2	0	0	1
+2544	2544	\.php\?id=[0-9A-F]{32,}&rnd=\d+$	2	0	0	1
+2545	2545	^((<\/div).)+?top\x3a\s*?\x2d[0-9]+px\x3b.+left\x3a\s*?\x2d[0-9]+px\x3b.+<iframe\x20.+?stack=\d+	2	0	0	1
+2546	2546	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)str2long(=sep)).+?(=sep)long2str(=sep)	2	0	0	1
+2547	2547	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)str2long(=sep)	2	0	0	1
+2548	2548	^(<sep>[^\s\x3b\x22\x27])(.+?(=sep)0xffffffff(=sep)).+?(=sep)long2str(=sep)	2	0	0	1
+2549	2549	^([^>]*?\sname\s*?\x3d\s*?[\x22\x27]?movie[\x22\x27]?)[^>]*?\svalue\s*?\x3d\s*?[\x22\x27][^\x22\x27]+\/(\??[a-f0-9]+)?[\x22\x27]	2	0	0	1
+2550	2550	^Host\x3a[^\r\n]*?\.pw\r$/Hmi	2	0	0	1
+2551	2551	^Host\x3a\x20[a-z0-9]+\.(g[aq]|cf|ml|tk|xyz|info|space)(\x3a\d{1,5})?\r$/Hm	2	0	0	1
+2552	2552	^\s*[a-z]+\s*\s*?(<q1>[\x22\x27])(((=q1)).)+?(=q1)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr\(\s*?\d+\s*?,\s*?\d+\s*?\)\s*?\x3b\s*?[a-z]+\s*\s*?(<q2>[\x22\x27])(((=q2)).)+?(=q2)\.replace\(\/\[[A-Za-z]{10,}\]\/g,\x27\x27\)\.substr	2	0	0	1
+2553	2553	^(<ccode>[a-f0-9]{6})-->.*?<script.+?<\/script>.*--/(=ccode)-->	2	0	0	1
+2554	2554	^\/[a-z]{2,20}\/[a-z]{2,20}\/(((featur|quot)e|ip)s|d(ropdown|etect)|co(mpiled|re)|header|jquery|lang|min|ga)\.js$	2	0	0	1
+2555	2555	^\s*?<script>\s*?([A-Za-z][A-Za-z\d+]+\s*?\+\s*([A-Za-z][A-Za-z\d]+|[\x22\x27]\\x[2-7][0-9a-fA-F](\\x[2-7][0-9a-fA-F]){0,4}[\x22\x27])\s*?\x3b){20}	2	0	0	1
+2556	2556	^\/js\/analytic\.php\?id=\d+&tz=\-?\d+&rs=\d+x\d+$	2	0	0	1
+2557	2557	^[\x22\x27](<script)[\x22\x27+\s]*<[\x22\x27+\s]*s[\x22\x27+\s]*c[\x22\x27+\s]*r[\x22\x27+\s]*i[\x22\x27+\s]*p[\x22\x27+\s]*t[^\r\n]+\.php\?id=\d+&tz=\x27\+tzSignature\x28\x29\+\x27&rs=	2	0	0	1
+2558	2558	^\/promo\d+(x\d+)?\/promo\.swf\?t=\d+$	2	0	0	1
+2559	2559	Content-Disposition\x3a\x20inline\x3b\x20filename=([a-z0-9]{4})?\r\n/H	2	0	0	1
+2560	2560	^\s*\x28\s*[\x22\x27]<div\s*style\s*=\s*[\x22\x27]([^\x22\x27\r\n]*position\x3aabsolute\x3b)([^\x22\x27\r\n]*top\x3a\s\-\d+px\x3b)([^\x22\x27\r\n]*left\x3a\s0px\x3b)[^\r\n]*?<iframe[^\r\n>]*\s><\/i[\x22\x27]\+[\x22\x27]frame>[^\r\n]*<\/div>[\x22\x27]\s*\x29\x3b$	2	0	0	1
+2561	2561	^#?\d+	2	0	0	1
+2562	2562	^#?\d+	2	0	0	1
+2563	2563	^\s*var\s*(<var>[^\s=]+)\s*=\s*document.createElement\(\s*[\x22\x27]iframe[\x22\x27](.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b	2	0	0	1
+2564	2564	^\s*\([^\x29]*(\%2F|\/)(\%5B|\[)(\%5E|)([^\x29]*(%3C|\<))([^\x29]*(%3E|\>))([^\x29]*(\%5C|\\)(\%6E|n))	2	0	0	1
+2565	2565	^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27]	2	0	0	1
+2566	2566	^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Chrome_Font\.exe/Hmi	2	0	0	1
+2567	2567	^[^\x2f\x22\x27]+\/([^\x22\x27]*?[?&]oq=[A-Za-z0-9+\x2f_-]+([\x22\x27]|&))([^\x22\x27]*?[&?][a-z]+_[a-z]+=\d+)([^\x22\x27]*?[&?]q=)	2	0	0	1
+2568	2568	^\s*=\s*[\x27\x22](sh(ell(32)?)?|exec)=6wLrBej5\x2f\x2f	2	0	0	1
+2569	2569	(value=[\x22\x27](sh(ell(32)?)?|exec)=|unescape\(EscapeHexString\(.)EB02EB05E8F9FFFFFF	2	0	0	1
+2570	2570	^\s*=\s*[\x22\x27][Hh][Tt][Tt][Pp][Ss]?\x3a\x2f\x2f[^\x2f]+\x2f([^\x2f\x22\x27]+=[^\x2f\x22\x27&]{0,5}QMvXcJ)[^\x2f\x22\x27]{90}	2	0	0	1
+2571	2571	^(rocket|java)script\x22>\s*var\s*(<ifr>[^\s=]+)\s*=\s*[\x22\x27]iframe[\x22\x27].*?\s*var\s*(<var>[^\s=]+)\s*=\s*document\.createElement\(\s*(=ifr)(.+?(=var)\.frameBorder\s*=\s*[\x22\x27]0[\x22\x27])(.+?document\.body\.appendChild\(\s*(=var)\s*\)).+?(=var)\.setAttribute\s*\(\s*[\x22\x27]frameBorder[\x22\x27]\s*,\s*[\x22\x27]0[\x22\x27]\s*\)\s*\x3b	2	0	0	1
+2572	2572	^[a-z]\d{3}\(new Array\(	2	0	0	1
+2573	2573	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27]iddqd?\s*=	2	0	0	1
+2574	2574	^(((<\/>).)+?FlashVars)((<\/>).)+?value\s*\s*?[\x22\x27][^=]*\s*=EB02EB05E8F9FFFFFF	2	0	0	1
+2575	2575	^[a-zA-Z0-9]{4}NzgzNDI[a-zA-Z0-9]{8}=\x22	2	0	0	1
+2576	2576	^\d{1,2}\.php$	2	0	0	1
+2577	2577	&b=[a-f0-9]{7}&k=[a-f0-9]{32}	2	0	0	1
+2578	2578	^\/[a-z]+\/$	2	0	0	1
+2579	2579	^\/[a-z]+\/$	2	0	0	1
+2580	2580	^GET\s*?\/stat\/load((?-i)[a-z0-9]*?[A-Z])((?-i)[A-Z0-9]*?[a-z])(<hname>[a-z0-9]+)\.php\s.+?Host\x3a\x20(=hname)\.	2	0	0	1
+2581	2581	^[0-9a-fA-F]{25}$	2	0	0	1
+2582	2582	^[-_\w]+$	2	0	0	1
+2583	2583	\/[a-z]{2}[0-9]{3}[a-z]{2}\/LoginFacebook\.php$	2	0	0	1
+2584	2584	^\d+$	2	0	0	1
+2585	2585	\x2Fgetfile\x2Ephp\x3Fi\x3D[0-9]\x26key\x3D[a-f0-9]{32}$	2	0	0	1
+2586	2586	^\/[a-z]{15}[0-9]\.php$	2	0	0	1
+2587	2587	^\d$	2	0	0	1
+2588	2588	\/\?[a-f0-9]{32}=[^&]+&[a-f0-9]{32}=[^&]+$	2	0	0	1
+2589	2589	^\/\d{5}$	2	0	0	1
+2590	2590	\/[0-9]{2}\.html$	2	0	0	1
+2591	2591	\.php\?[a-z]=.{2}KAhFXlx9.{2}Oj[^&]+$	2	0	0	1
+2592	2592	\x2F[0-9]{3}\.pdf$	2	0	0	1
+2593	2593	^\d{1,2}=[a-zA-Z0-9+=]{100}	2	0	0	1
+2594	2594	^\/[a-z]\.jar$	2	0	0	1
+2595	2595	\/[a-f0-9]+\.zip$	2	0	0	1
+2596	2596	^\/\d{2,}\.[a-z0-9]+$	2	0	0	1
+2597	2597	^\/\?[a-f0-9]{32}$	2	0	0	1
+2598	2598	\/(java(db|im|rh)|silver|flash|msie)\.php\?id=	2	0	0	1
+2599	2599	^[a-f0-9]{6}\x22>\r\n(<(<tag>[^>]{1,10})>[A-Za-z0-9]+?<\/(=tag)>\r\n){0,10}\r\n<script>(var [a-zA-Z0-9]{1,20}\x3b){1,20}[a-zA-Z0-9]{1,20}\s*	2	0	0	1
+2600	2600	^Host\x3a\x20[^\.\r\n]+?\.[a-z]{2,4}\r\n	2	0	0	1
+2601	2601	\/\??[a-f0-9]{60,}\x3b1\d{5}\x3b\d{1,3}$	2	0	0	1
+2602	2602	\/\??[a-f0-9]{60,}\x3b5[0-1]\d{5}$	2	0	0	1
+2603	2603	^\/[^\x2f]+?\/\??[a-f0-9]{60,66}(\x3b\d+){1,4}$	2	0	0	1
+2604	2604	(\/[A-Z][a-z][A-Z][a-z][A-Z][a-z]|(b(m(nw|wn)|n(mw|wm)|w(mn|nm))|m(b(nw|wn)|n(bw|wb)|w(bn|nb))|n(b(mw|wm)|m(bw|wb)|w(bm|mb))|w(b(mn|nm)|m(bn|nb)|n(bm|mb))))\.jar$	2	0	0	1
+2605	2605	^\/index\.php\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+2606	2606	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.swf\r\n	2	0	0	1
+2607	2607	^\/\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+2608	2608	\x20filename=\r\n(\r\n)?$	2	0	0	1
+2609	2609	PK\x01\x02.{42}(<dir>[a-z]{7,}\/)([a-z]+\.class)?(\xfe\xca\x00\x00)?(PK\x01\x02.{42}(=dir)[a-z]+\.class){6,}(PK\x01\x02.{42}[0-9a-z]{5,}(\.[a-z]{3})?)K\x05\x06.{18}$	2	0	0	1
+2610	2610	^\/index\.php\?[A-Za-z0-9_-]{15}=l3S	2	0	0	1
+2611	2611	\w_\.jar\?[a-f0-9]{8}$	2	0	0	1
+2612	2612	^\d+[\r\n\x2f]	2	0	0	1
+2613	2613	^\d+[\r\n\x2f]	2	0	0	1
+2614	2614	^\d+[\r\n\x2f]	2	0	0	1
+2615	2615	^\d+[\r\n\x2f]	2	0	0	1
+2616	2616	^\d+[\r\n\x2f]	2	0	0	1
+2617	2617	^\d+[\r\n\x2f]	2	0	0	1
+2618	2618	^\d+[\r\n\x2f]	2	0	0	1
+2619	2619	^\d+[\r\n\x2f]	2	0	0	1
+2620	2620	^\d+[\r\n\x2f]	2	0	0	1
+2621	2621	^\d+[\r\n\x2f]	2	0	0	1
+2622	2622	Content-Disposition\x3a[^\r\n]+\.exe-rc4\.exe\r\n	2	0	0	1
+2623	2623	^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/[a-zA-Z0-9]{12}\.php(\?[^&=]+=([a-zA-Z0-9]{8}|0(189|037)|flash|2(551|419)|6332))?$	2	0	0	1
+2624	2624	^\/([a-z0-9]{0,22}[A-Z]+?[a-z0-9])([A-Z0-9]{0,22}[a-z]+?[A-Z0-9])[a-zA-Z0-9]{24}\/test\.mp3$	2	0	0	1
+2625	2625	^\/\d{9,10}\/\d{4,5}$	2	0	0	1
+2626	2626	\/index\.html\?p=\d+$	2	0	0	1
+2627	2627	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]*?[a-f0-9]	2	0	0	1
+2628	2628	^Host\x3a\s*?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a/Hmi	2	0	0	1
+2629	2629	^(<split>.{1,10})2f(=split)64(=split)69(=split)76(=split)3e(=split)?[^\x22\x27]*[\x22\x27]\.replace\s*\(\s*[\x22\x27]?\/(=split)\/g[\x22\x27]?\s*,\s*[\x22\x27]\x25[\x22\x27]\s*\x29\s*\x3b	2	0	0	1
+2630	2630	^\s*=\s*[\x22\x27]?(10|127|172\.(1[6-9]|2[0-9]|3[01])|192\.168)\.	2	0	0	1
+2631	2631	\.php\?hash=I3QxW[A-Za-z0-9\+\/]+={0,2}$	2	0	0	1
+2632	2632	^[\r\n\s]*[\r\n\s]*?[\x22\x27][^\x22\x27]+?\/[a-zA-Z0-9\/\-\_]{60,}\/[a-zA-Z0-9]+\.exe\?[a-zA-Z0-9]+=[a-zA-Z0-9]+(&h=\d+)?[\x22\x27]	2	0	0	1
+2633	2633	^([^>]+action\s*=\s*[\x22\x27]http\x3a\x2f)[^>]+method\s*=\s*[\x22\x27]post[\x22\x27]	2	0	0	1
+2634	2634	^\s*type\s*=\s*[\x22\x27]\s*text\/javascript\s*[\x22\x27]\s*>\s+var\s*(<timestamp>[A-Za-z0-9]{1,25})\s*=\s*\(new\sDate\(\)\)\.getTime\(\)\;\s+(<url>[A-Za-z0-9]{1,25})\s*=\s*[\x22\x27]\s*[^\r\n]+\.php\?JBOSSESSION=\s*[\x22\x27]\s+(<urlvar2>[A-Za-z0-9]{1,25})\s*=\s*(=url)\s*\+\s*(=timestamp)\s+window\.location\.href\s*=\s*(=urlvar2)\s+	2	0	0	1
+2635	2635	^\s*[\x22\x27][^\r\n]+\/[a-z0-9]{20,40}\.js[\x22\x27]\s*>\s*<\/script>\s*<\/body>	2	0	0	1
+2636	2636	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+2637	2637	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+2638	2638	^[^\r\n]+([a-z]{26}|[0-9]{26})[a-z0-9]{26}\.html	2	0	0	1
+2639	2639	^http\:\/\/[^\r\n\x2f]+\/\?s=[a-f0-9]{32}[a-z]{2}$	2	0	0	1
+2640	2640	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+2641	2641	^(<vars>[a-z0-9]{1,20})\s*=\s*new\s*Array\x3b\r\n((=vars)\[\d{1,3}\]\s*=\s*\d{4,12}\x3b\r\n){5,40}	2	0	0	1
+2642	2642	^\/([\/_]*?[a-f0-9][\/_]*?){64}$	2	0	0	1
+2643	2643	src\s*=\s*https?\x3A\x2f+[^\x2f]*?((((static)?flick|blogge)r|p(hotobucket|icasa)|wordpress|tinypic)\.com|im(g(\.youtube|ur)\.com|ageshack\.us)|upload\.wikimedia\.org)[^\x2f]	2	0	0	1
+2644	2644	^[a-f0-9]{32}$	2	0	0	1
+2645	2645	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/	2	0	0	1
+2646	2646	[=\"]\w{8}\.jar	2	0	0	1
+2647	2647	^[a-z]{2}\.	2	0	0	1
+2648	2648	\/jdb\/[^\/]+\.class$	2	0	0	1
+2649	2649	\/lib\/adobe\.php\?id=[a-f0-9]{32}$	2	0	0	1
+2650	2650	\/i.php?token=[a-z0-9]+$	2	0	0	1
+2651	2651	\x2Fjerk\x2Ecgi\x3F[0-9]$	2	0	0	1
+2652	2652	^(\?[^=]{1,10}=[^&\r\n]{100,})?$	2	0	0	1
+2653	2653	\.php\?e=[^&]+?$	2	0	0	1
+2654	2654	\.txt\?e=\d+(&[fh]=\d+)?$	2	0	0	1
+2655	2655	^\x2F\x3Fwps\x3D[0-9]$	2	0	0	1
+2656	2656	^[^\r\n]+\/[A-Fa-f0-9]+\.js\?cp=	2	0	0	1
+2657	2657	^\/[a-z0-9]{1,4}\.jnlp$	2	0	0	1
+2658	2658	\.php\?id=[a-f0-9]{32}$	2	0	0	1
+2659	2659	^\/[a-f0-9]{32}\/[a-f0-9]{32}\.swf$	2	0	0	1
+2660	2660	\.php\?[^=]+=([^&]?[a-z0-9]{2}){5}&[^=]+=([^&]?[a-z0-9]{2}){10}&	2	0	0	1
+2661	2661	\/[A-F0-9]{8}\.js\?cp=	2	0	0	1
+2662	2662	^\/[a-z0-9]+[0-9][a-z0-9]+\/\?\d$	2	0	0	1
+2663	2663	\.exe(\?[a-zA-Z0-9]+=[a-zA-Z0-9]+)?&h=\d+$	2	0	0	1
+2664	2664	^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$	2	0	0	1
+2665	2665	^Referer\x3a\x20http\x3a\/\/[^\r\n\/]+\/(\x3a\d{1,5})?\r$	2	0	0	1
+2666	2666	\/\d{6}\.mp3$	2	0	0	1
+2667	2667	\/14\d{8}(\.xap)?$	2	0	0	1
+2668	2668	\.swf\?myid=[a-zA-Z0-9]+$	2	0	0	1
+2669	2669	\.php\?rnd=[0-9]{3,7}&id=[0-9A-F]{44,54}$	2	0	0	1
+2670	2670	\/(Flash[23]?|Ink|New|One|HQ).exe$	2	0	0	1
+2671	2671	Content-Disposition\x3a\x20[^\r\n]+filename=[a-z]{5,8}\d{2,3}\.xap\r\n	2	0	0	1
+2672	2672	Referer\x3a\x20http\x3a\x2f+(<refhost>[^\x3a\x2f\r\n]+)(\x3a\d{1,5})?[^\r\n]*?\/(index.html)?\r\n.*?\r\nHost\x3a\x20(=refhost)[\x3a\r]	2	0	0	1
+2673	2673	\/\d{2,}\.xap$	2	0	0	1
+2674	2674	\.php\?rnd=\d+&id=[0-9A-F]{32,}$	2	0	0	1
+2675	2675	\/\?keyword=(([a-f]{0,31}[0-9])([0-9]{0,31}[a-f])[a-f0-9]{32}|\d{5})$	2	0	0	1
+2676	2676	^\/(.*?[&?][a-z]{2}_[a-z]{2}=\d+(&))(.*?[&?]q=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&))(.*?[&?]oq=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}|[A-Za-z0-9_-]{3})+(&)).*?[&?][a-z]{3}=[A-Za-z_]{3,20}([a-z\d]*\x2e)([a-z\x2e]*\d)[a-z\d\x2e]+(&|$)	2	0	0	1
+2677	2677	^Content-Disposition\x3a[^\r\n]+filename\s*=\s*[\x22\x27]?Font_Update\.exe	2	0	0	1
+2678	2678	^\s*[\x22\x27]\s*http[^\x22\x27]+\.php\s*[\x22\x27]\s*\x2c\s*[\x22\x27]\s*uylzJB3mWrFjellI9iDFGQjO	2	0	0	1
+2679	2679	=[a-f0-9]{32,}(&|$)	2	0	0	1
+2680	2680	\&e=(cve|flash)	2	0	0	1
+2681	2681	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.htm$	2	0	0	1
+2682	2682	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-z.-]+\/[a-f0-9]{40}\/[a-z.-]+\/[a-z0-9]+\.swf$	2	0	0	1
+2683	2683	^(0x[a-f0-9]{1,2}, ){500}	2	0	0	1
+2684	2684	^[0-9_,{AbZwP&-]{2000}	2	0	0	1
+2685	2685	^[A-F0-9]+	2	0	0	1
+2686	2686	^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_	2	0	0	1
+2687	2687	^[a-z]{5}[0-9]{1,2}=_[0-9]{1,2}_	2	0	0	1
+2688	2688	^[a-z0-9]{13}\.[a-z]{3}$	2	0	0	1
+2689	2689	^\d+$	2	0	0	1
+2690	2690	Host\x3a\x20(<refhost>[^\x3a\r\n]+)(\x3a\d{1,5})?\r\n.*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f(=refhost)(\x3a\d{1,5})?\/?	2	0	0	1
+2691	2691	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\r$|\x3a)	2	0	0	1
+2692	2692	^\/[a-z]{3,20}\.php\?sid=[A-F0-9]{40,200}$	2	0	0	1
+2693	2693	^\/[a-z]{3,20}\.php\?id=4[A-F0-9]{39,200}$	2	0	0	1
+2694	2694	^\/\?o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&o?q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+$	2	0	0	1
+2695	2695	(.*?[?&]oq=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&)).*?[?&]q=([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$)	2	0	0	1
+2696	2696	(.*[^&]{3,4}QMvXcJ).*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+&.*([A-Za-z_-]*[0-9])([a-z0-9_-]*[A-Z][a-z0-9_-]*[A-Z])([A-Z0-9_-]*[a-z][A-Z0-9_-]*[a-z])[A-Za-z0-9_-]+(&|$)	2	0	0	1
+2697	2697	^[HX3][^&]Q[cdM][^&]{3}[ab]R	2	0	0	1
+2698	2698	^\/\?[a-f0-9]{114}$	2	0	0	1
+2699	2699	Date\x3a\x20(<dstring>[^\r\n]+)\r\n.*?Last-Modified\x3a\x20(=dstring)\r\n	2	0	0	1
+2700	2700	^\/[a-f0-9]{16}$	2	0	0	1
+2701	2701	^GET (<uri>(\/[A-Za-z0-9]+)?\/\d+\/\d+)\sHTTP\/1\.1\r\nUser-Agent\x3a\x20http\x3a\/\/(<host>[^\r\n]+)(=uri)\r\nHost\x3a\x20(=host)\r\n(\r\n)?$	2	0	0	1
+2702	2702	^Referer\x3a[^\r\n]+?\/[a-z0-9A-Z\_\-]{26,}\.html(\x3a\d{1,5})?\r$	2	0	0	1
+2703	2703	\/3\/(M[ABCDFGHIJKMOPSTUZ]|E[ABDEGIJKMNPRSVY]|R[ABCEFGHIKLMNPST]|G[ABCEGKMNPSTUV]|A[BCGLMNPQSUVZ]|O[ABCDFIJMNRST]|S[ABEGILMPRSUW]|T[ABEGHILMPSTY]|N[BCGHIKMPSTV]|I[ABCFGKLNSV]|L[ABCGIMNPST]|W[ABCGKMPRTZ]|Z[ABCDKMNSTU]|F[ABCGMNPTW]|H[BCEGKMPST]|K[CDFHLMPST]|U[ACGHLMNRV]|Y[BCGKLMPSU]|C[CELMNSTV]|D[ABCGIMST]|V[BCLMST]|J[BDFST]|P[GJKMN]|Q[ABGIM]|B[BGLS]|X[ACMS])\/[a-f0-9]{32}(\.[^\x2f]+|\/\d+\.\d+\.\d+\.\d+\/?)?$	2	0	0	1
+2704	2704	^\/([A-Za-z_-]*?\d)([a-z0-9_-]*?[A-Z])([A-Za-z0-9_-]{4}){15,}([[A-Za-z0-9_-]{2}\x2e?\x2e|[A-Za-z0-9_-]{3}\x2e)$	2	0	0	1
+2705	2705	^\d$	2	0	0	1
+2706	2706	^[A-F0-9]{16}\x22>	2	0	0	1
+2707	2707	^\/(([a-z]{16}|[0-9]{16}))[a-zA-Z0-9]{16}\/[a-zA-Z0-9]{16}\/[a-f0-9]{40}\/[a-zA-Z0-9]+\.jpg$	2	0	0	1
+2708	2708	^[A-F0-9]{16}(&|&amp\x3b)id=\d+(&|&amp\x3b)gid=[A-F0-9\-]+\x22>	2	0	0	1
+2709	2709	^[^>]*?\>	2	0	0	1
+2710	2710	^-?\d+=([a-zA-Z0-9]|%[A-F0-9]{2}){2}(<var1>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){6}(<var2>([a-zA-Z0-9]|%[A-F0-9]{2}))([a-zA-Z0-9]|%[A-F0-9]{2}){2}(=var2)([a-zA-Z0-9]|%[A-F0-9]{2}){4}(=var1)/P	2	0	0	1
+2711	2711	^\s*?[\x22\x27]([A-Z]{0,19}[a-z]{1,19}[A-Z])[a-zA-Z]{14,20}[\x22\x27][^<>]*([A-Za-z]{0,99}\d)[A-Za-z0-9\x20]{100}	2	0	0	1
+2712	2712	^\s*?(<var1>[^\x29]+)\x29[^\n]*\s*?(=var1)\s*?\x7c{2}\s*?\d+?\s*?\x2c	2	0	0	1
+2713	2713	^\s+\d{1,2}\x3b\s+else\s+(<var>[a-z]+)\s+\-=\s+\d{1,2}\x3b\s+return\s+[a-z]+\.charAt\x28(=var)\/\d{1,2}\x29\x7d	2	0	0	1
+2714	2714	^[a-z0-9_-]+\.([0-9_-]*[A-Z])[A-Z0-9_-]+\.[^\x22]+\x22\s	2	0	0	1
+2715	2715	^[a-z]{10}\.[a-z]{3}\r?$/Hm	2	0	0	1
+2716	2716	Last-Modified\x3a Mon, ((0[29]|16|23|30))\d{2} Jul 2001/H	2	0	0	1
+2717	2717	^\d+\x3b	2	0	0	1
+2718	2718	^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500}	2	0	0	1
+2719	2719	^\s*\s*?[\x22\x27](687474703a2f)[^\x22\x27]{0,10}6[^\x22\x27]{0,10}8[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}4[^\x22\x27]{0,10}7[^\x22\x27]{0,10}0[^\x22\x27]{0,10}3[^\x22\x27]{0,10}a[^\x22\x27]{0,10}2[^\x22\x27]{0,10}f	2	0	0	1
+2720	2720	^[^\x27]+[\x27]\s*	2	0	0	1
+2721	2721	^\d+\x3b	2	0	0	1
+2722	2722	^([A-Z0-9]*?[a-z])([a-z0-9]*?[A-Z])[A-Za-z0-9]+\x2a\x2f[^\n]*?Function\s*?\x28\s*?[\x22\x27](<var1>[^\x22\x27]+)[\x22\x27]\s*,\s*[\x22\x27]if\s*?\x28\s*?(=var1)\s*[=!]{2}\s*?[\x27\x22][\x22\x27]\s*?\x29\s*?\{	2	0	0	1
+2723	2723	^\s*?\x22[a-zA-Z0-9]{7}l[a-zA-Z0-9]\x22\s*((<\/).){500}	2	0	0	1
+2724	2724	^\s*\x27[^\x27\x3b\r\n]+\x27width=\x27250\x27\sheight=\x27250\x27\>	2	0	0	1
+2725	2725	^[^A-Za-z0-9]	2	0	0	1
+2726	2726	^http\x3a\x2f[^\x27]+[\x27](\swidth=\d{1,2}\sheight=\d{1,2}\s|\sheight=\d{1,2}\swidth=\d{1,2}\s)	2	0	0	1
+2727	2727	^\s*\(\s*[\x22\x27]id[\x22\x27]\s*,\s*?(<var>[^,\x29\s\x3b]+)\s*\x29.*?\.appendChild\s*\(\s*(=var)	2	0	0	1
+2728	2728	^[^<]+\x0d\x0a<\/script>	2	0	0	1
+2729	2729	\?src=[a-z]+snet$	2	0	0	1
+2730	2730	^[0-9a-f]{6}	2	0	0	1
+2731	2731	^(\x20id=\x22\d+\x22)?\x20style=\x22([^\x22\r\n]*top\x3a\x20-\d{3}px\x3b)([^\x22\r\n]*left\x3a-\d{3}px\x3b)([^\x22\r\n]*position\x3a\x20absolute\x3b)[^\x22\r\n]*\x22>\x20<iframe[^\r\n>]*><\x2f	2	0	0	1
+2732	2732	^(\s+style=\x27hidden\x27)?\s+src=\x27https?\x3a[^>\x22\x27]+[\x22\x27]\s*width=\x270\x27\s+	2	0	0	1
+2733	2733	(NocncoMjE3Ni|Y2hydygyMTc2K|jaHJ3KDIxNzYp)	2	0	0	1
+2734	2734	^[^\d](.{0,20}[^\d])?100[^\d](.{0,20}[^\d])?101[^\d](.{0,20}[^\d])?102[^\d](.{0,20}[^\d])?97[^\d](.{0,20}[^\d])?117[^\d](.{1,20}[^\d])?108[^\d](.{0,20}[^\d])?116[^\d](.{0,20}[^\d])?35[^\d]([^\d].{0,20}[^\d])?86[^\d](.{0,20}[^\d])?77[^\d](.{0,20}[^\d])?76[^\d]	2	0	0	1
+2735	2735	^(<sep>((\.\\_\\+).){1,10})\.\\_\\+(=sep)\.___\+(=sep)\.\\\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\_\\_\+(=sep)\.\_\\\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\_\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\_\+(=sep)\.\_\\_\+(=sep)\.\\_\\_\+\"\\\"\+(=sep)\.\_\_\\+(=sep)\.\\\\+(=sep)\.\_\_\$	2	0	0	1
+2736	2736	^[\r\n\s]*[\r\n\s]*?(-[\r\n\s]*?\d|0[\r\n\s]*?-)	2	0	0	1
+2737	2737	SELECT.+FROM	2	0	0	1
+2738	2738	DELETE.+FROM	2	0	0	1
+2739	2739	INSERT.+INTO	2	0	0	1
+2740	2740	UPDATE.+SET	2	0	0	1
+2741	2741	UNION.+SELECT	2	0	0	1
+2742	2742	INTO.+OUTFILE	2	0	0	1
+2743	2743	^SITE\s+EXEC\s[^\n]*?%[^\n]*?%	2	0	0	1
+2744	2744	^PASS\s[^\n]{100}	2	0	0	1
+2745	2745	^MKD\s[^\n]{100}	2	0	0	1
+2746	2746	^REST\s[^\n]{100}	2	0	0	1
+2747	2747	^DELE\s[^\n]{100}	2	0	0	1
+2748	2748	^RMD\s[^\n]{100}	2	0	0	1
+2749	2749	^RMDIR\s[^\n]{100}	2	0	0	1
+2750	2750	^SITE\s+NEWER\s[^\n]{100}	2	0	0	1
+2751	2751	^SITE\s+ZIPCHK\s[^\n]{100}	2	0	0	1
+2752	2752	^USER\s+w0rm	2	0	0	1
+2753	2753	^ALLO\s[^\n]{100}	2	0	0	1
+2754	2754	^CEL\s[^\n]{100}	2	0	0	1
+2755	2755	^CMD\s[^\n]{100}	2	0	0	1
+2756	2756	^CWD\s[^\n]{100}	2	0	0	1
+2757	2757	^SITE\s+CPWD\s[^\n]{100}	2	0	0	1
+2758	2758	^SITE\s+NEWER	2	0	0	1
+2759	2759	^STAT\s+[^\n]*\x3f	2	0	0	1
+2760	2760	^APPE\s[^\n]{100}	2	0	0	1
+2761	2761	^CWD\s+~	2	0	0	1
+2762	2762	^MODE\s+[^ABSC]{1}	2	0	0	1
+2763	2763	^SITE\s[^\n]{100}	2	0	0	1
+2764	2764	^SITE\s+CHOWN\s[^\n]{100}	2	0	0	1
+2765	2765	^SITE\s+EXEC	2	0	0	1
+2766	2766	^XCWD\s[^\n]{100}	2	0	0	1
+2767	2767	^STOR\s[^\n]{100}	2	0	0	1
+2768	2768	^SITE\s+CHMOD\s[^\n]{100}	2	0	0	1
+2769	2769	^LIST\s[^\n]{100,}	2	0	0	1
+2770	2770	^RENAME\s[^\n]*?%[^\n]*?%	2	0	0	1
+2771	2771	^MKDIR\s[^\n]*?%[^\n]*?%	2	0	0	1
+2772	2772	^PASS\s[^\n]*?%[^\n]*?%	2	0	0	1
+2773	2773	^USER\s[^\n]*?%[^\n]*?%	2	0	0	1
+2774	2774	^MDTM\s[^\n]{100}	2	0	0	1
+2775	2775	^RETR\s[^\n]*?%[^\n]*?%	2	0	0	1
+2776	2776	^CWD\s[^\n]*?\.\.\.	2	0	0	1
+2777	2777	^CWD\s+~root	2	0	0	1
+2778	2778	^NLST\s[^\n]{100}	2	0	0	1
+2779	2779	^PORT	2	0	0	1
+2780	2780	REST\s+[0-9]+\n	2	0	0	1
+2781	2781	^RETR\s[^\n]{100}	2	0	0	1
+2782	2782	^RNFR\s[^\n]{100}	2	0	0	1
+2783	2783	^RNTO\s[^\n]{100}	2	0	0	1
+2784	2784	^STAT\s[^\n]{100}	2	0	0	1
+2785	2785	^STOU\s[^\n]{100}	2	0	0	1
+2786	2786	^XMKD\s[^\n]{100}	2	0	0	1
+2787	2787	\s+.*?%.*?%	2	0	0	1
+2788	2788	^530\s+(Login|User)	2	0	0	1
+2789	2789	^PASS\s*\n	2	0	0	1
+2790	2790	^LIST\s+\x22-W\s+\d	2	0	0	1
+2791	2791	^USER\x20[^\x00\x20\x0a\x0d]{100}	2	0	0	1
+2792	2792	^STAT\s+[^\n]*\x2a	2	0	0	1
+2793	2793	^MDTM \d+[-+]\D	2	0	0	1
+2794	2794	^[^\r\n]+\.jar	2	0	0	1
+2795	2795	^\d\.\d(_\d+)?\@\r\n	2	0	0	1
+2796	2796	\x5csecure\x5c[^\x00]{50}	2	0	0	1
+2797	2797	\x5C[^\x5C\x00]{257}	2	0	0	1
+2798	2798	^\s*=\s*.*?\.([abcdehijlmnoprsvwx])(a(d[ep]|s[x])|c(rt|[ho]m|li|pl|md|pp)|d(iz|ll)|e(m[fl]|xe|bs)|h(lp|sq|ta)|jse?|m(d[abzew]|s[tcgip]|htm|ht)|p(cd|if|l[xsc]|[lm]|ot)|r(eg|ar)|s(cr|ct|[hy]s|wf)|v(b[es]?|xd)|w(m[dfsz]|p[msz]|s[cfh])|xl[tw]|folder|fol|ba[st]|i(sp|n[sif])|lnk|nws|ocx|zip|url)[\x27\x22\n\r\s]	2	0	0	1
+2799	2799	(a|#61)(p|#70)(p|#70)(l|#6C)(i|#69)(c|#63)(a|#61)(t|#74)(i|#69)(o|#6F)(n|#6E)(\x2F|#2F)x-shockwave-flash	2	0	0	1
+2800	2800	^[^\r\n]*[\[\|\{][A-Z]{3}[\]\|\}]	2	0	0	1
+2801	2801	^[^\r\n]*win	2	0	0	1
+2802	2802	^[^\r\n]*-PC	2	0	0	1
+2803	2803	^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl)	2	0	0	1
+2804	2804	^[A-Za-z0-9\/\+\x0D\x0A]+?(5leG|LmV4|uZXhl)	2	0	0	1
+2805	2805	^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb)	2	0	0	1
+2806	2806	^[A-Za-z0-9\/\+\x0D\x0A]+?(uY29t|5jb2|LmNvb)	2	0	0	1
+2807	2807	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3)	2	0	0	1
+2808	2808	^[A-Za-z0-9\/\+\x0D\x0A]+?(LnNjc|Euc2Ny|S5zY3)	2	0	0	1
+2809	2809	User-Agent\x3a.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi	2	0	0	1
+2810	2810	User-Agent\:.*[^\x5c]\x5c[^\x5c\x3d\x2f\x3b\x28\x29]/Hi	2	0	0	1
+2811	2811	^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}B[\x0d\x0a]{0,2}0[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}t[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}u[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}3[\x0d\x0a]{0,2}M[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}x[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}T[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}q[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}N[\x0d\x0a]{0,2}0	2	0	0	1
+2812	2812	^[A-Za-z0-9\/\+\x0D\x0A]+?c[\x0d\x0a]{0,2}H[\x0d\x0a]{0,2}Q[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}1[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}k[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}5[\x0d\x0a]{0,2}n[\x0d\x0a]{0,2}c[\x0d\x0a]{0,2}y[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}v[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}P[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Y[\x0d\x0a]{0,2}3	2	0	0	1
+2813	2813	^[A-Za-z0-9\/\+\x0D\x0A]+?B[\x0d\x0a]{0,2}w[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}C[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}W[\x0d\x0a]{0,2}J[\x0d\x0a]{0,2}l[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}G[\x0d\x0a]{0,2}R[\x0d\x0a]{0,2}p[\x0d\x0a]{0,2}b[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}d[\x0d\x0a]{0,2}z[\x0d\x0a]{0,2}L[\x0d\x0a]{0,2}2[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}s[\x0d\x0a]{0,2}Z[\x0d\x0a]{0,2}U[\x0d\x0a]{0,2}9[\x0d\x0a]{0,2}i[\x0d\x0a]{0,2}a[\x0d\x0a]{0,2}m[\x0d\x0a]{0,2}V[\x0d\x0a]{0,2}j[\x0d\x0a]{0,2}d	2	0	0	1
+2814	2814	\d*?\.bin	2	0	0	1
+2815	2815	^[^\r\n]*(W(in(dows)?)?[^a-z0-9]?(XP|[7-8])|Vista)	2	0	0	1
+2816	2816	^\d+/V	2	0	0	1
+2817	2817	^\s*,\s*[a-zA-Z]\x3a[\x2f\x5c]	2	0	0	1
+2818	2818	^((PK).)*?\x50\x4b\x05\x06\x00\x00\x00\x00\x01\x00\x01\x00	2	0	0	1
+2819	2819	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+2820	2820	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+2821	2821	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+2822	2822	U3lzdGVtLk5ldC5XZWJDbGllbn|N5c3RlbS5OZXQuV2ViQ2xpZW50|TeXN0ZW0uTmV0LldlYkNsaWVud	2	0	0	1
+2823	2823	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+2824	2824	(UwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0|MAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ad|TAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAH)	2	0	0	1
+2825	2825	\bshell\b	2	0	0	1
+2826	2826	\benable\b	2	0	0	1
+2827	2827	^[^\r\n]+\.(t(ar|gz)|exe|zip)	2	0	0	1
+2828	2828	^([\x7f-\xff]){100}/Hi	2	0	0	1
+2829	2829	^((<\/script>).)*?src\s*=\s*\x5c?[\x22\x27]https?\x3a\/\/(www\.)?pastebin\.com\/raw(\/|\.php\?i=)[A-Z-a-z0-9]{8}[\x22\x27]	2	0	0	1
+2830	2830	^.{42}[\x20-\x7f]{1,500}\.jsPK\x05\x06.{4}\x01\x00\x01\x00	2	0	0	1
+2831	2831	\/[0-9]{1,2}\.dat$	2	0	0	1
+2832	2832	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+2833	2833	\.(s(e(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp|irc).com|m(inecraft.net|p3.com)|b(eer.com|log.net))|curitytactics.com)|tufftoread.com|ytes.net)|m(y(securitycamera.(com|net|org)|(activedirectory|vnc).com|(mediapc|effect|psx).net|d(issent.net|dns.me)|ftp.(biz|org))|lbfan.org|mafan.biz)|d((itchyourip|amnserver|ynns).com|dns(.(net|me)|king.com)|ns(iskinky.com|for.me)|vrcam.info)|h(o((mesecurity(ma|p)c|sthampster).com|pto.(org|me))|ealth-carereform.com)|c((o(uchpotatofries|llegefan)|able-modem).org|iscofreak.com)|p((rivatizehealthinsurance|gafan).net|oint(2this.com|to.us))|f(reedynamicdns.(net|org)|antasyleague.cc)|((3utiliti|quicksyt)es|onthewifi).com|b(logsyte.com|ounceme.net|rasilia.me)|n(et-freaks.com|flfan.org|hlfan.net)|re(ad-books.org|directme.net)|u(nusualperson.com|fcfan.org)|(eating-organic|viewdns).net|w(orkisboring.com|ebhop.me)|g(eekgalaxy.com|olffan.us)|ilovecollege.info|loginto.me|access.ly|zapto.org)(\x3a\d{1,5})?$	2	0	0	1
+2834	2834	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+2835	2835	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+2836	2836	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)\.com|d(ad\.info|dns\.com)|ftp\.(info|name)|(mom|z)\.info|www\.biz)|(r(b(asic|onus)|(slov|fac)e)|efound)\.com|oneyhome\.biz)|d(yn(amicdns\.((org|co|me)\.uk|biz)|dns\.pro|ssl\.com)|ns((-(stuff|dns)|0[45]|et|rd)\.com|[12]\.us)|dns\.(m(e\.uk|obi|s)|info|name|us)|(smtp|umb1)\.com|hcp\.biz)|(j(u(ngleheart|stdied)|etos|kub)|y(ou(dontcare|rtrap)|gto)|4(mydomain|dq|pu)|q(high|poe)|2(waky|5u)|z(yns|zux)|vizvaz|1dumb)\.com|s(e((llclassics|rveusers?|ndsmtp)\.com|x(idude\.com|xxy\.biz))|quirly\.info|sl443\.org|ixth\.biz)|o(n(mypc\.(info|biz|net|org|us)|edumb\.com)|((urhobb|cr)y|rganiccrap|tzo)\.com)|f(ree((ddns|tcp)\.com|www\.(info|biz))|a(qserv|rtit)\.com|tp(server|1)\.biz)|a(((lmostm|cmeto)y|mericanunfinished)\.com|uthorizeddns\.(net|org|us))|n(s(0(1\.(info|biz|us)|2\.(info|biz|us))|[123]\.name)|inth\.biz)|c(hangeip\.(n(ame|et)|org)|leansite\.(info|biz|us)|ompress\.to)|i((t(emdb|saol)|nstanthq|sasecret|kwb)\.com|ownyour\.(biz|or	2	0	0	1
+2837	2837	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net|x(x(xy\.(info|biz)|uz\.com)|24hr\.com)|p(canywhere\.net|roxydns\.com|ort25\.biz)|w(ww(host|1)\.biz|ikaba\.com|ha\.la)|e((smtp|dns)\.biz|zua\.com|pac\.to)|https443\.(net|org)|bigmoney\.biz)(\x3a\d{1,5})?$	2	0	0	1
+2838	2838	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+2839	2839	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+2840	2840	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.ru(pacetechnology\.ne|oon\.i)t|hop\.tm|uka\.se)|c((hickenkiller|rabdance)\.com|o(ntinent\.kz|alnet\.ru)|sproject\.org|c\.st|f\.gs)|m(i(ne(craftn(ation\.net|oob\.com)|\.bz)|l\.nf)|ooo\.(info|com)|adhacker\.biz)|t(h(emafia\.info|cgirls\.com)|wilightparadox\.com|ime4film\.ru|ruecsi\.org|28\.net)|a(((vangardkennel|gropeople)\.r|buser\.e)u|ntongorbunov\.com|llowed\.org|x\.lt)|h(a(ck(quest\.com|ed\.jp)|ppyforever\.com)|ome(net\.or|\.k)g|-o-s-t\.name)|p((rivatedns|sybnc|ort0|wnz)\.org|(hoto-frame|irat3)\.com|unked\.us)|i(n(fo\.(gf|tm)|c\.gs)|gnorelist\.com|iiii\.info|z\.rs)|b(i(gbox\.info|z\.tm)|yte4byte\.com|ot\.nu|rb\.dj)|d(earabba\.org|-n-s\.name|alnet\.ca|ynet\.com)|(w(ith-linux|hynotad)|3dxtras|ohbah)\.com|u(n(do\.it|i\.cx)|k\.(is|to)|s\.to)|v((erymad\.ne|r\.l)t|ietnam\.ro)|r(o(ot\.sx|\.lt)|-o-o-t\.net)|n(eon\.org|ow\.im|a\.tl|x\.tc)|j(umpingcrab\.com|avafaq\.nu)|f((art|ram)ed\.net|tp\.sh)|(k(ir22\.r|\.v)|69\.m)u|l(inux[dx]\.org|eet\.la)|e(vils	2	0	0	1
+2841	2841	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+2842	2842	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+2843	2843	((esy|hol)\.es|(890m|16mb)\.com|pe\.hu)$	2	0	0	1
+2844	2844	Content-Disposition\x3a[^\r\n]*?\.xla[\s\x22\x27]	2	0	0	1
+2845	2845	\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)(\x3a\d{1,5})?$	2	0	0	1
+2846	2846	^[\d\s]	2	0	0	1
+2847	2847	^USER [^\r\n]*?\x22	2	0	0	1
+2848	2848	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+2849	2849	^(\x3a\d{1,5})?$	2	0	0	1
+2850	2850	\.(gif|jpe?g|png)$	2	0	0	1
+2851	2851	^((jp|pn)g|bmp)	2	0	0	1
+2852	2852	^(logins|c(cdata|ookie))	2	0	0	1
+2853	2853	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+2854	2854	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+2855	2855	\/winhost(32|64)\.(exe|pack)$	2	0	0	1
+2856	2856	\/pony\.(exe|pack)$	2	0	0	1
+2857	2857	^[^>]+url=sms\x3a	2	0	0	1
+2858	2858	\/[^\x2f]+\.[^\x2f]+\.wsf$	2	0	0	1
+2859	2859	^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4})	2	0	0	1
+2860	2860	^(\+|\x2520|\x24IFS|\x252B|\s)+(x|[0-9]{3,4})	2	0	0	1
+2861	2861	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+2862	2862	^[^\r\n]+\.(s(((cien|pa)c|it)e|tream)|c(l(ick|ub)|ountry|ricket)|m((aiso|e)n|o(bi|m))|p(r(ess|o)|arty|ink|w)|r(e([dn]|view)|acing)|w(eb(site|cam)|in)|b((outiq|l)ue|id)|d(ownload|ate|esi)|(accountan|hos)t|l(o(an|l)|ink)|t(rade|ech|op)|v(oyage|ip)|g(dn|b)|online|faith|kim|xyz)	2	0	0	1
+2863	2863	^((jp|pn)g|bmp)	2	0	0	1
+2864	2864	^(logins|c(cdata|ookie))	2	0	0	1
+2865	2865	^(m(ultipart|essage|odel)|a(pplication|udio|ccept)|(exampl|imag)e|video|text|\*)	2	0	0	1
+2866	2866	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+2867	2867	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+2868	2868	^[a-z]+\-[a-z]+\-[a-z]+\.glitch\.me$	2	0	0	1
+2869	2869	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+2870	2870	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+2871	2871	^[a-z0-9]+\-[a-z0-9]+\-[a-f0-9]{6}\.netlify\.app$	2	0	0	1
+2872	2872	^[a-f0-9]{8,}\.duckdns\.org$	2	0	0	1
+2873	2873	^[^\x3b\x2f\x28]+$	2	0	0	1
+2874	2874	^[^\r\n]{100,}	2	0	0	1
+2875	2875	^[^\r\n]{100,}	2	0	0	1
+2876	2876	^[^\r\n]{100,}	2	0	0	1
+2877	2877	^[^\r\n]{100,}	2	0	0	1
+2878	2878	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+2879	2879	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2880	2880	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2881	2881	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2882	2882	[a-z]{8}.[a-z]{3}	2	0	0	1
+2883	2883	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.zip$	2	0	0	1
+2884	2884	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.vbs$	2	0	0	1
+2885	2885	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.pif$	2	0	0	1
+2886	2886	^\/attachments\/[0-9]{18}\/[0-9]{18}\/\w+\.(p(ptx?|df|ng)|(gi|rt)f|docx?|jpe?g|xlsx?)\.exe$	2	0	0	1
+2887	2887	CN=ssl\d{1,2}.ovh.net($|,)	2	0	0	1
+2888	2888	(\.[a-z]{2}|$)	2	0	0	1
+2889	2889	[a-f0-9]{32}$	2	0	0	1
+2890	2890	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P	2	0	0	1
+2891	2891	^(\x3b|\r\n)	2	0	0	1
+2892	2892	CN=([^\r\n]+?\.)?\.gov\.procurement\.(\.)	2	0	0	1
+2893	2893	^[a-f0-9]+	2	0	0	1
+2894	2894	^[a-f0-9]+	2	0	0	1
+2895	2895	^[a-f0-9]+	2	0	0	1
+2896	2896	^Agent\d{5,6}$	2	0	0	1
+2897	2897	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2898	2898	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2899	2899	(Q29ubmVjdGlvbi1zcGVjaWZpYyBETlMgU3VmZml4|Nvbm5lY3Rpb24tc3BlY2lmaWMgRE5TIFN1ZmZpe|Db25uZWN0aW9uLXNwZWNpZmljIEROUyBTdWZmaX)	2	0	0	1
+2900	2900	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2901	2901	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2902	2902	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2903	2903	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2904	2904	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2905	2905	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2906	2906	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2907	2907	wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2908	2908	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2909	2909    wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2910	2910	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2911	2911	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2912	2912	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2913	2913	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2914	2914	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2915	2915	(R(Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dUxYTndaV05wWm1saklFUk9VeUJUZFdabWFY|iMjV1WldOMGFXOXVMWE53WldOcFptbGpJRVJPVXlCVGRXWm1hW)|E(yOXVibVZqZEdsdmJpMXpjR1ZqYVdacFl5QkVUbE1nVTNWbVptbD|YjI1dVpXTjBhVzl1TFhOd1pXTnBabWxqSUVST1V5QlRkV1ptYV)|UTI5dWJtVmpkR2x2YmkxemNHVmphV1pwWXlCRVRsTWdVM1ZtWm1sN|TnZibTVsWTNScGIyNHRjM0JsWTJsbWFXTWdSRTVUSUZOMVptWnBl|52Ym01bFkzUnBiMjR0YzNCbFkybG1hV01nUkU1VElGTjFabVpwZ|OdmJtNWxZM1JwYjI0dGMzQmxZMmxtYVdNZ1JFNVRJRk4xWm1acG)	2	0	0	1
+2916	2916	Mjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0|GIyNXVaV04wYVc5dU	2	0	0	1
+2917	2917	RMjl1Ym1WamRHbHZiaTF6Y0dWamFXWnBZeUJFVGxNZ1UzVm1abWw0	2	0	0	1
+2918	2918	.*[^A-Za-z0-9]edu\.rf\.gd$	2	0	0	1
+2919	2919	\x2edoc[xm]?$	2	0	0	1
+2920	2920	\x2exls[xm]?$	2	0	0	1
+2921	2921	\/\d+$	2	0	0	1
+2922	2922	function(\s_0x[0-9a-f]{4})?\(_0x[0-9a-f]{6},_0x[0-9a-f]{6}\){var _0x[0-9a-f]{6}=/Qi	2	0	0	1
+2923	2923	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2924	2924	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2925	2925	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2926	2926	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2927	2927	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2928	2928	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2929	2929	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2930	2930	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+2931	2931	\sLOGIN\s[^\n]*?\s\{	2	0	0	1
+2932	2932	\sLSUB\s[^\n]*?\s\{	2	0	0	1
+2933	2933	\sRENAME\s[^\n]{100}	2	0	0	1
+2934	2934	\sFIND\s[^\n]{100}	2	0	0	1
+2935	2935	\sFETCH\s[^\n]{500}	2	0	0	1
+2936	2936	\sLOGIN\s[^\n]{100}	2	0	0	1
+2937	2937	\sAUTHENTICATE\s[^\n]{100}	2	0	0	1
+2938	2938	\sLIST\s[^\n]*?\s\{	2	0	0	1
+2939	2939	\sPARTIAL.*BODY\[[^\]]{1024}	2	0	0	1
+2940	2940	AUTH\s[^\n]{100}	2	0	0	1
+2941	2941	\sCREATE\s*\{	2	0	0	1
+2942	2942	\sRENAME\s[^\n]*?\s\{	2	0	0	1
+2943	2943	\sLIST\s[^\n]{100}	2	0	0	1
+2944	2944	\sCREATE\s[^\n]{1024}	2	0	0	1
+2945	2945	\sLSUB\s[^\n]{100}	2	0	0	1
+2946	2946	\sAUTHENTICATE\s[^\n]*?\{	2	0	0	1
+2947	2947	\sPARTIAL.*BODY\.PEEK\[[^\]]{1024}	2	0	0	1
+2948	2948	\sUNSUBSCRIBE\s[^\n]{100}	2	0	0	1
+2949	2949	\sUNSUBSCRIBE\s[^\n]*?\s\{	2	0	0	1
+2950	2950	\sSUBSCRIBE\s[^\n]{100}	2	0	0	1
+2951	2951	\sSUBSCRIBE\s[^\n]*?\s\{	2	0	0	1
+2952	2952	\sSTATUS\s[^\n]{100}	2	0	0	1
+2953	2953	\sSTATUS\s[^\n]*?\s\{	2	0	0	1
+2954	2954	\sFETCH\s[^\n]*?\s\{	2	0	0	1
+2955	2955	\sEXAMINE\s[^\n]{100}	2	0	0	1
+2956	2956	\sEXAMINE\s[^\n]*?\s\{	2	0	0	1
+2957	2957	\sAPPEND\s[^\n]{256}	2	0	0	1
+2958	2958	\sCOPY\s[^\n]*?\{	2	0	0	1
+2959	2959	\sDELETE\s[^\n]*?\{	2	0	0	1
+2960	2960	\sDELETE\s[^\n]{100}	2	0	0	1
+2961	2961	\sLOGIN\s\w+\s\{\d+\}[\r]?\n[^\n]*?%	2	0	0	1
+2962	2962	 (FREE XXX|dildo|masturbat|oral sex|ejaculat|up skirt|tits|bondage|lolita|clitoris|cock suck|hardcore (teen|anal|sex|porn)|raw sex|((fuck|sex|porn|xxx) (movies|dvd))|((naked|nude) (celeb|lesbian)))\b	2	0	0	1
+2963	2963	^RETR\s+[^\r\n]+?\x2eexe\r?$	2	0	0	1
+2964	2964	\<xdp\x3axdp(\s+[^\>]*)?\>((\<\/xdp[^\>]*\>).)*?\<pdf	2	0	0	1
+2965	2965	SELECT @@version_compile_os\s*?\x3b	2	0	0	1
+2966	2966	^Server\x3a[^\r\n]*Portable SDK for UPnP devices(\/?\s*$|\/1\.([0-5]\..|8\.0.|(6\.[0-9]|6\.1[0-7])))	2	0	0	1
+2967	2967	^Server\x3a[^\r\n]*Intel SDK for UPnP devices	2	0	0	1
+2968	2968	^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27]	2	0	0	1
+2969	2969	^[8-9]\.0	2	0	0	1
+2970	2970	^(<global_var>(((\]\,__\\x3a\+\+)).)+)]\,__\$\x3a\+\+(=global_var)	2	0	0	1
+2971	2971	^Host\x3a\x20[^\r\n]+\.((b(bsindex|0ne)|chatnook|gotgeeks|3d-game|4irc)\.com|s((cieron|uroot)\.com|lyip\.(com|net))|d(arktech\.org|eaftone\.com|tdns\.net)|e(towns\.(net|org)|ffers\.com)|flnet\.org)(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+2972	2972	^Host\x3a\x20[^\r\n]+\.cd\.am(\x3a\d{1,5})?\r$/Hmi	2	0	0	1
+2973	2973	^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}[^\r\n]*\x3C\x2Fiframe\x3E	2	0	0	1
+2974	2974	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2975	2975	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2976	2976	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2977	2977	^[a-f0-9]{4}([\%\\]u[a-f0-9]{4}){20}	2	0	0	1
+2978	2978	^(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?m(\x22\s*?\+\s*?\x22)?C(\x22\s*?\+\s*?\x22)?h(\x22\s*?\+\s*?\x22)?a(\x22\s*?\+\s*?\x22)?r(\x22\s*?\+\s*?\x22)?c(\x22\s*?\+\s*?\x22)?o(\x22\s*?\+\s*?\x22)?d(\x22\s*?\+\s*?\x22)?e	2	0	0	1
+2979	2979	^(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?m(\x27\s*?\+\s*?\x27)?C(\x27\s*?\+\s*?\x27)?h(\x27\s*?\+\s*?\x27)?a(\x27\s*?\+\s*?\x27)?r(\x27\s*?\+\s*?\x27)?c(\x27\s*?\+\s*?\x27)?o(\x27\s*?\+\s*?\x27)?d(\x27\s*?\+\s*?\x27)?e	2	0	0	1
+2980	2980	for\x28[^\x3D\r\n]*[0-9]{1,6}\x2D[0-9]{1,5}\x3B[^\x3D\r\n]\x3E\x3D0\x3B[^\x29\r\n]\x2D\x2D\x29	2	0	0	1
+2981	2981	^User-Agent\x3a[^\r\n]*?Googlebot/Hmi	2	0	0	1
+2982	2982	^\s*?\([^\)]*?(<var>[^\.]+)\s*?\.\s*?length\s*<\s*(0?[0-9]{5,}|0x[a-z0-9]{3,})[^)]+\)\s*?\{\s*?(=var)\s*\s*?(=var)\s*?\+\s*?(=var)\s*?\}	2	0	0	1
+2983	2983	^(nc)?\s*([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=)	2	0	0	1
+2984	2984	\x00[0-9]{4,7}\x02in\x00	2	0	0	1
+2985	2985	^Server\x3a[^\r\n]*miniupnpd\/1\.[0-3]	2	0	0	1
+2986	2986	^[\r\n\s]*=[\r\n\s]*[\x22\x27][^\x22\x27]+\.ser[\x22\x27]	2	0	0	1
+2987	2987	^\s+?(<vname>[^\s\x3d]+)\s*\s*?(0x((6[4-9a-f]|[7-9a-f])|\d{3,})|\d{3,}).+?[\s\x3b]for\s*?\([^\x3b\)]*?\x3b[^\x3b\)]+?\s*?(=vname)[^\)]+?\)\s*?(\{[^}]*?|[^\r\n]*?)document\s*\.\s*createElement	2	0	0	1
+2988	2988	^((<\/title).)*\x26\x23x1F512	2	0	0	1
+2989	2989	^\/tmp\/.+\.exe$	2	0	0	1
+2990	2990	^(&).	2	0	0	1
+2991	2991	((\?|&))pasa=(&).	2	0	0	1
+2992	2992	se(rve((((counterstri|qua)k|exchang|gam)e|h(alflife|umour|ttp)|p(ics|2p)|sarcasm|ftp)\.com	2	0	0	1
+2993	2993	\.(m(y(p(op3\.(net|org)|icture\.info)|n(etav\.(net|org)|umber\.org)|(secondarydns|lftv|03)	2	0	0	1
+2994	2994	))|g(r8(domain|name)\.biz|ettrials\.com|ot-game\.org)|l(flink(up\.(com|net|org)|\.com)|ongmusic\.com)|t(o(ythieves\.com|h\.info)|rickip\.(net|org))|(undefineddynamic-dns|rebatesrule|3-a)\.net	2	0	0	1
+2995	2995	\.(s(tr(eetdirectory\.co\.id|angled\.net)|(at(dv\.net|-dv)|vlen)\.rupacetechnology\.ne	2	0	0	1
+2996	2996	.in|z\.lv)|(24-7\.r|qc\.t)o|(55|gw)\.lt|1337\.cx)(\x3a\d{1,5})?$	2	0	0	1
+2997	2997	^(\d{1,3}\.){3}\d{1,3}(\x3a\d+)?$	2	0	0	1
+2998	2998	\.jpg(\?\d+)?$	2	0	0	1
+2999	2999	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3000	3000	^[^0-9]	2	0	0	1
+3001	3001	^(\x3a\d{1,5})?$	2	0	0	1
+3002	3002	\.(arm(5n|7)?|m(ips|psl))$	2	0	0	1
+3003	3003	\.dyndns\.(biz|info|org|tv)$	2	0	0	1
+3004	3004	(at-home|at-work|blog|free|home|ip|mail|office|pics|remote|server|web|wiki|work)\.com	2	0	0	1
+3005	3005	^[^&=?]*\/wp-content\/themes\/	2	0	0	1
+3006	3006	^(\x3a\d{1,5})?$	2	0	0	1
+3007	3007	^\x22(v(mware|irtual|irtualbox|m\x20ware|box))	2	0	0	1
+3008	3008	^\x22(v(mware|irtual|irtualbox|m\x20ware|box))	2	0	0	1
+3009	3009	^\x22(v(mware|irtual|irtualbox|m\x20ware|box))	2	0	0	1
+3010	3010	^[a-z0-9.]+\.kali\.org	2	0	0	1
+3011	3011	dynamic\.(com|net)|\.(info|me)|api\.info|get\.org|53\.biz|dns01\.com	2	0	0	1
+3012	3012	(h(ard-work|unt)e|financialadviso)r|de(mocrat|signer)	2	0	0	1
+3013	3013	\.com|y\.net)|a([klr]\.com|z\.net)|c([at]\.com|o\.net)|la\.net)|or	2	0	0	1
+3014	3014	\.com|ndof(internet\.(net|org)|theinternet\.org))|le(btimnetz|itungsen)	2	0	0	1
+3015	3015	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3016	3016	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3017	3017	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3018	3018	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3019	3019	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3020	3020	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3021	3021	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3022	3022	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3023	3023	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3024	3024	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3025	3025	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3026	3026	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3027	3027	^1\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3028	3028	^2\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3029	3029	^3\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3030	3030	^4\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3031	3031	^5\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3032	3032	^6\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3033	3033	^7\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3034	3034	^8\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3035	3035	^9\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3036	3036	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3037	3037	^\d	2	0	0	1
+3038	3038	^User-Agent\x3a\x20iTunes\/10\.6\.[0-1]	2	0	0	1
+3039	3039	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3040	3040	(/d{6})	2	0	0	1
+3041	3041	CN=([^\r\n]+?\.)?hizliresim\.com(\.)	2	0	0	1
+3042	3042	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3043	3043	^ip[23]?\.bablosoft\.com$	2	0	0	1
+3044	3044	^[A-Z]=[A-Za-z/+0-9=]{200,400}$	2	0	0	1
+3045	3045	CN=([^\r\n]+?\.)?sharepointin\.com(\.)	2	0	0	1
+3046	3046	CN=([^\r\n]+?\.)?templatern\.com(\.)	2	0	0	1
+3047	3047	CN=([^\r\n]+?\.)?prizegives\.com(\.)	2	0	0	1
+3048	3048	CN=([^\r\n]+?\.)?shareholds\.com(\.)	2	0	0	1
+3049	3049	CN=([^\r\n]+?\.)?mesharepoint\.com(\.)	2	0	0	1
+3050	3050	CN=([^\r\n]+?\.)?prizewings\.com(\.)	2	0	0	1
+3051	3051	CN=([^\r\n]+?\.)?doctricant\.com(\.)	2	0	0	1
+3052	3052	CN=([^\r\n]+?\.)?sharession\.com(\.)	2	0	0	1
+3053	3053	CN=([^\r\n]+?\.)?sharepointle\.com(\.)	2	0	0	1
+3054	3054	CN=([^\r\n]+?\.)?mcsharepoint\.com(\.)	2	0	0	1
+3055	3055	CN=([^\r\n]+?\.)?officenced\.com(\.)	2	0	0	1
+3056	3056	CN=([^\r\n]+?\.)?templatent\.com(\.)	2	0	0	1
+3057	3057	CN=([^\r\n]+?\.)?sharepointen\.com(\.)	2	0	0	1
+3058	3058	CN=([^\r\n]+?\.)?officence\.com(\.)	2	0	0	1
+3059	3059	CN=([^\r\n]+?\.)?templateau\.com(\.)	2	0	0	1
+3060	3060	CN=([^\r\n]+?\.)?sharesbyte\.com(\.)	2	0	0	1
+3061	3061	CN=([^\r\n]+?\.)?officences\.com(\.)	2	0	0	1
+3062	3062	CN=([^\r\n]+?\.)?officentry\.com(\.)	2	0	0	1
+3063	3063	CN=([^\r\n]+?\.)?officested\.com(\.)	2	0	0	1
+3064	3064	CN=([^\r\n]+?\.)?prizemons\.com(\.)	2	0	0	1
+3065	3065	CN=([^\r\n]+?\.)?prizewel\.com(\.)	2	0	0	1
+3066	3066	CN=([^\r\n]+?\.)?sharestion\.com(\.)	2	0	0	1
+3067	3067	CN=([^\r\n]+?\.)?attemplate\.com(\.)	2	0	0	1
+3068	3068	CN=([^\r\n]+?\.)?windocyte\.com(\.)	2	0	0	1
+3069	3069	CN=([^\r\n]+?\.)?logodownload\.org(\.)	2	0	0	1
+3070	3070	^[0-9a-f]{32}	2	0	0	1
+3071	3071	# \d+d \d+dh \d+m # 	2	0	0	1
+3072	3072	\x0D\x0A\x0D\x0ASLP\x3A\d+\x3BMOD\x3A[\S\x3B]+\x3BURL\x3Ahttp\x3A\x2F{2}[^\x3B]+\x3BSRV\x3Aupd\x3B	2	0	0	1
+3073	3073	^\x23\d\d\d\x2f\x21	2	0	0	1
+3074	3074	\x06\x00?$	2	0	0	1
+3075	3075	\.php\?i=\w+_[0-9A-F]{8}&k=\d+$	2	0	0	1
+3076	3076	.asp\?username=.+&serverMac=([0-9A-F]{2}-){5}[0-9A-F]{2}&edition=	2	0	0	1
+3077	3077	\/smain\?scout=acxc[a-z]{3}$	2	0	0	1
+3078	3078	\?sid=[0-9A-F]{180}	2	0	0	1
+3079	3079	.asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2})	2	0	0	1
+3080	3080	\/chr\/\d+\/e\/t\d+\?lid=	2	0	0	1
+3081	3081	mac=([0-9A-F]{2}:){5}([0-9A-F]{2})	2	0	0	1
+3082	3082	mac=([0-9A-F]{2}:){5}([0-9A-F]{2})	2	0	0	1
+3083	3083	cmd=give&pcname=.+&status=\d+$	2	0	0	1
+3084	3084	\?uid=[0-9a-f]{40}&action=\w+&v=[\w.]+&b=\d+$	2	0	0	1
+3085	3085	Host\x3a [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}	2	0	0	1
+3086	3086	\/[0-9A-Z]+\/[0-9A-Z]+\.bin$	2	0	0	1
+3087	3087	\x2fpeca\d+\x2eexe	2	0	0	1
+3088	3088	\.php\?v=[A-Za-z0-9.]+&id=-?\d+&wv=[0-9.]{1,14}$	2	0	0	1
+3089	3089	si\x5F[a-z]{5}[0-9]{5}\x2Ecb	2	0	0	1
+3090	3090	seclog\x5F[a-z]{5}[0-9]{5}\x5F.+\x2Ekcb	2	0	0	1
+3091	3091	&si=\d+&si=\d+&rd=20\d{11}	2	0	0	1
+3092	3092	\x2f\x3fdata\x3d[a-fA-F0-9]{60}	2	0	0	1
+3093	3093	\S{20,40}\'\>	2	0	0	1
+3094	3094	\.php\?e=\d+&o=\w+&b=\w+&id=[0-9a-f]{32}$	2	0	0	1
+3095	3095	c\x3d[0-9a-f]{100}	2	0	0	1
+3096	3096	^\x23BOT\x23(VisitUrl|OpenUrl|Ping|RunPrompt|CloseServer|SvrUninstall|URLUpate|URLDownload)	2	0	0	1
+3097	3097	^\x23botCommand\x25(close\x20command|Error|Finish|Http\x20Flood|Mass\x20Download|Respond\x20\x5bOK|Syn\x20Flood|UDP\x20Flood|uninstall|Update|)	2	0	0	1
+3098	3098	hash=\{[a-f0-9]+-	2	0	0	1
+3099	3099	\/server_privileges\.php\?[0-9a-f]{32}=\d+(&\w+)?$	2	0	0	1
+3100	3100	\.php\?w=\d+&fail=\d+&i=[0-9a-f]{32}$	2	0	0	1
+3101	3101	(\.php|\.asp|\.py|\.exe|\.htm|\.html)\/[A-Z0-9]+$	2	0	0	1
+3102	3102	ddos\.(phat(icmp|syn|wonk)|stop|(syn|udp|http)flood|targa3|(syn|ack|random) ([0-9]{1,3}\.){3}[0-9]{1,3})	2	0	0	1
+3103	3103	floodnet ([0-9]{1,3}\.){3}[0-9]{1,3}|(tcp|syn|udp|ack|ping|icmp)(flood)? ([0-9]{1,3}\.){3}[0-9]{1,3}	2	0	0	1
+3104	3104	\.(upda|getfile|dl\dx|dl|download|execute)\w*\s+http\x3a\x2f\x2f	2	0	0	1
+3105	3105	(ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})|(advscan|asc|xscan|xploit|adv\.start) (webdav|netbios|ntpass|dcom(2|135|445|1025)|mssql|lsass|optix|upnp|dcass|beagle[12]))	2	0	0	1
+3106	3106	\x3A\x02\x034\x5B(BackConnect|help|HTTP.*|SCAN|TCP.*|UDP.*|VERSION)\x5D\x03\x02	2	0	0	1
+3107	3107	ntscan [0-9]{1,4} [0-9]{1,4}|dcom\.self|scan\.(start|stop)|scan ([0-9]{1,3}\.[0-9]{1,3})	2	0	0	1
+3108	3108	((\.aim\w*|ascanall|\x3agetshit200)\s+\w+)|((@kill|@get_os_version|@get_computer_name|@get_bot_version|@update|@restart|@reboot|@shutdown)\s)	2	0	0	1
+3109	3109	(testdlls|threads|nsp|speed|uptime|installed|secure|sec|unsecure|unsec|process|ps|rand|exploitftpd|eftpd|flusharp|farp|flushdns|fdns|resolve|dns|pstore|pst|sysinfo|si|netinfo|ni|driveinfo|di|currentip)\s*[\r\n]	2	0	0	1
+3110	3110	((cvar\.set)|(http\.(execute|update))|((aol)spam\.(setlist|settemplate|start|stop|setuser|setpass))|sniffer\.(addstring|delstring)|pingstop|udpstop|scan(all|stats|del|stop)|clone(stop|start)|c_(raw|mode|nick|join|part|privmsg|action))	2	0	0	1
+3111	3111	((T?FTP)\x3a File transfer|(random|sequential) Port Scan|Random (Spreading|Scanner)|Exploiting IP|Exploiting\.\.|flooding\x3a|flood stopped|sending packets)|Random Method started|FINDFILE|Scan stopped|No scan thread found|thread\(s\) stopped|\x3aExec 	2	0	0	1
+3112	3112	PRIVMSG\s+\S+\s+\x3a\s*(\.user |\.logout|\.die|\.restart|\.mail |\.dns |\.download |\.exec |\.find |\.cmd |\.php |\.tcpflood |\.udpflood |\.raw |\.rndnick|\.pscan |\.ud\.server )	2	0	0	1
+3113	3113	\x7Cddos\x7C(syn|http)\x7C	2	0	0	1
+3114	3114	\?rnd=\d{5,7}\x20HTTP1\/1\.[01]\x0d\x0aHost\x3a\x20	2	0	0	1
+3115	3115	\?aid=\d{9}&url=[\w\.\-]{23}$	2	0	0	1
+3116	3116	\?subid=\d{9}&u=[\w\.\-]{23}$	2	0	0	1
+3117	3117	FileName\x3D[^\r\n]*\x2E(dll|exe)	2	0	0	1
+3118	3118	Subject\x3A\x20[^\r\n]*C\x3A\x5C[^\r\n]*\x2Eexe	2	0	0	1
+3119	3119	download\x2FAntivirus_\d+\x2Eexe	2	0	0	1
+3120	3120	\/installer\.\d+\.exe	2	0	0	1
+3121	3121	\/installer_\d+\.exe	2	0	0	1
+3122	3122	\x0d\x0aHost\: [a-z\x2e]+(security|virus|pro|anti|scan|mypc|total|protect|check|guard|defend)	2	0	0	1
+3123	3123	Setup_20\d+\x2Eexe	2	0	0	1
+3124	3124	\/dl\/AcroIEHelpe(r)?(\d)?\.dll	2	0	0	1
+3125	3125	mac=[0-9A-Fa-f]{12}&	2	0	0	1
+3126	3126	\?type=slg&id=[0-9A-Z]{18}	2	0	0	1
+3127	3127	phid=[A-F0-9]{64}	2	0	0	1
+3128	3128	mode=\d+D[0-9A-F]{150}	2	0	0	1
+3129	3129	^x=[0-9a-zA-Z]{50}/P	2	0	0	1
+3130	3130	\/x\/\?0\w{35}$	2	0	0	1
+3131	3131	\/down\d+\/down\/\?s=[A-F0-9]+\&t=\d+\/\d+\/20	2	0	0	1
+3132	3132	\?spl=\d+&br=[A-Za-z]+&vers=\d\.\d&s=[a-z0-9]+[^&]$	2	0	0	1
+3133	3133	\?spl=MS[0-9]{2}-[0-9]{3}$	2	0	0	1
+3134	3134	\.php\?(land=\d+|affid=\d{5})&(land=\d+|affid=\d{5})$	2	0	0	1
+3135	3135	[1-3]\x2Finstaller\x2FInstaller\x2Eexe	2	0	0	1
+3136	3136	\x2FLayouts\x2FLandings\x2FCentralLandings\x2F\d+\x2Fimages\x2F	2	0	0	1
+3137	3137	MyValue=[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:[a-f0-9]{2}\:	2	0	0	1
+3138	3138	\/(ucleaner|udefender|ufixer)\.com\/demo\.php\?	2	0	0	1
+3139	3139	\.php\?1=[a-z0-9]+_[a-z0-9_]+&i=	2	0	0	1
+3140	3140	^User-Agent\:[^\n]+PassSickle/Hmi	2	0	0	1
+3141	3141	\/cd\/un\.php.id=[A-F0-9\-]+&ver=	2	0	0	1
+3142	3142	&os=[a-f0-9]{50}	2	0	0	1
+3143	3143	^GET\x20[^\x0D\x0A]+\x3Fmod\x3Dcmd\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+	2	0	0	1
+3144	3144	^POST\x20[^\x0D\x0A]+\x3Fmod\x3Dlog\x26user\x3D\w+[^\x0D\x0A]*\x20HTTP\x2F1\x2E0\x0D\x0A.*\x0D\x0AHost\x3A\x20\w+.*\x0D\x0A\x0D\x0Acurr\x3D.*\x26next\x3D	2	0	0	1
+3145	3145	Content-Length\x3a [1-9]	2	0	0	1
+3146	3146	Host\x3a\s[a-z]{15,19}\.ru(\x3a8080)?/Hm	2	0	0	1
+3147	3147	gameover(\d+)?\.php	2	0	0	1
+3148	3148	\x2F[a-z]{5}\x2Ephp\x3Fid\x3D	2	0	0	1
+3149	3149	\.php\?m=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&[vs]=	2	0	0	1
+3150	3150	\.php\?s=\d&m=[A-F0-9]{16}$	2	0	0	1
+3151	3151	\?id=[A-Za-z]+_[A-Za-z0-9]+&	2	0	0	1
+3152	3152	\/index.dat\?\d{5,9}$	2	0	0	1
+3153	3153	\x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+[a-f0-9]{12}&ext\x3D	2	0	0	1
+3154	3154	^User-Agent\x3a [a-z0-9]{92}/Hmi	2	0	0	1
+3155	3155	\/crack\.\d+\.exe$	2	0	0	1
+3156	3156	^\d+\x7cddos\x7c([^\x7c]+\x7c){5}[^\x7c]+$	2	0	0	1
+3157	3157	^\d+\x7cdlexec\x7c([^\x7c]+\x7c){3}[^\x7c]+$	2	0	0	1
+3158	3158	\.txt$	2	0	0	1
+3159	3159	^\d+\x3a\d\x7c\d+\x7c[0-9a-z]+\x7c\d	2	0	0	1
+3160	3160	\.php\?cmd=getFile&counter=\d	2	0	0	1
+3161	3161	codec=\d+D\d+D\d	2	0	0	1
+3162	3162	(\.aim\w*|ascanall)\s+\w	2	0	0	1
+3163	3163	report=\d+&pid=\d+&wv=[A-Za-z0-9]/P	2	0	0	1
+3164	3164	User\x2DAgent\x3A\x20[a-f0-9]{5,14}\x0D\x0A/H	2	0	0	1
+3165	3165	.php\?gd=\d+_\d+_\d+$	2	0	0	1
+3166	3166	\x2f\d+?\x2erar$	2	0	0	1
+3167	3167	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/null\/null$	2	0	0	1
+3168	3168	^\/[a-f0-9]{24}\/[a-f0-9]{24}\/[a-f0-9]{24}\/1\.[4-7]\.[0-2]\.[0-9]{1,2}\/	2	0	0	1
+3169	3169	^KEEPALIVE\x7c?\d	2	0	0	1
+3170	3170	kill\-\d+.\d+.\d+.\d+\:\d+%\d	2	0	0	1
+3171	3171	\x0d\x0aMagic-Number\x3a\s+\d+\|\d	2	0	0	1
+3172	3172	\/ping\/[0-9a-fA-F]{64}\/[0-9a-fA-F]+\/[0-9a-fA-F]	2	0	0	1
+3173	3173	\x3Fmod\x3D\w*?\x26id\x3D[^\x26\s]+?\x5F\w+?\x26up\x3D[^\x26]+?\x26mid\x3D[^\x26\s]	2	0	0	1
+3174	3174	Host\: \d+\.\d+\.\d+\.\d	2	0	0	1
+3175	3175	\?n=\d+&id=.+&t=.+&i=\d	2	0	0	1
+3176	3176	id=[a-f0-9-]+&	2	0	0	1
+3177	3177	ID=.{40}&.{6}	2	0	0	1
+3178	3178	(web(\.(velocitycache\.com|autoflash\.info)|update\.(dyndns\.info|hopto\.org)|app\.serveftp\.com)|flash(center\.info|rider\.org)|cache\.dyndns\.info)\r?$/Hmi	2	0	0	1
+3179	3179	((nvidia(s(tream|oft)|drivers)|(rendercode|videosyn)c|flashupdates|syncstream)\.info|194\.192\.14\.125|202\.75\.58\.179)\r?$/Hmi	2	0	0	1
+3180	3180	\/search\?q\=\d+&aq=\d	2	0	0	1
+3181	3181	\x7C(NEW|Awaiting commands)	2	0	0	1
+3182	3182	\x7C(NEW|Awaiting commands)	2	0	0	1
+3183	3183	\x7C(NEW|Awaiting commands)	2	0	0	1
+3184	3184	^\x3c\x21\x2d\x2d\x0d\x0a\x3cimg\x20border=\d+\x20src=\x22\S+\x2f\x23KX8\x2e	2	0	0	1
+3185	3185	^\d+\s*-->	2	0	0	1
+3186	3186	^[0-4]\s*src=\x22[^\x22]+\x22\swidth=\d+\sheight=\d+>\r\n-->	2	0	0	1
+3187	3187	\&p=[0-9A-Za-z]{5}\-[0-9A-Za-z]{5}\-	2	0	0	1
+3188	3188	^Accept-Encoding\x3a\s+([a-z]){3}/Hmi	2	0	0	1
+3189	3189	user=[a-f0-9]{32}&	2	0	0	1
+3190	3190	\/tlog\.php\?logn=[^\s]+&pss=[^\s]	2	0	0	1
+3191	3191	ntarg\.php\?[^\s]*(notdoing|howme|uname)=	2	0	0	1
+3192	3192	\/tnewu\.php\?nlogin=[^\s]+&npss=[^\s]+&invitedby=[^\s]	2	0	0	1
+3193	3193	updatea\.php\?p=\d	2	0	0	1
+3194	3194	&d=.{44}$	2	0	0	1
+3195	3195	filename=j[a-f0-9]{23}\.jar/H	2	0	0	1
+3196	3196	^hello\/[0-9]\.[0-9]\/[0-9]{3}	2	0	0	1
+3197	3197	^[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+3198	3198	^[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+3199	3199	NICK {[a-z]{2,3}\x2D.+?x86[a-z]}[a-z]	2	0	0	1
+3200	3200	^\d+\w+\/\d+\w+ free \(\d+% used\)	2	0	0	1
+3201	3201	^[A-Z]\x3a\x5f	2	0	0	1
+3202	3202	filename=e[a-f0-9]{23}\.exe/H	2	0	0	1
+3203	3203	^Host\x3a\x20[a-z0-9]+\.[a-z0-9]+\.[a-z0-9]+\.pl\x3a\d{2,5}\r$/Hm	2	0	0	1
+3204	3204	^[A-Z]{3}\|[UA]\|[DL]\|W([78]|_XP|VIS)\|x(86|64)\|	2	0	0	1
+3205	3205	^([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4})	2	0	0	1
+3206	3206	^[a-z0-9\+\/]+={0,2}$	2	0	0	1
+3207	3207	^(\r\n|$)	2	0	0	1
+3208	3208	^\d+?\x5d	2	0	0	1
+3209	3209	^[\r\n\s]*?<<((>>).)+?\/[a-zA-Z\d]*?#([46][1-9a-fA-F]|[57][\daA])([a-zA-Z\d])*?#([46][1-9a-fA-F]|[57][\daA])	2	0	0	1
+3210	3210	^(4\x00[1-9a-f]|5\x00[\da])	2	0	0	1
+3211	3211	^Referer\x3a[^\r\n]+\/[a-f0-9]{8}\/1(0\/[0-2]|1\/\d)\/\r$/Hm	2	0	0	1
+3212	3212	data_\d{4}_\d{1,2}_\d{1,2}_\d{1,2}_\d{1,2}\.txt	2	0	0	1
+3213	3213	^\d+?\x7cOnConnect\x7c	2	0	0	1
+3214	3214	^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01	2	0	0	1
+3215	3215	^[a-z0-9]{23}[a-f0-9]{33}.[a-z0-9\-_]+.[a-z0-9\-_]+\x00\x00\x01\x00\x01	2	0	0	1
+3216	3216	^[0-9a-f]{22,46}	2	0	0	1
+3217	3217	^((PCACTIV|ONLIN)ETIME|WEBSITE[DS]|CHATROOM|KEYLOGS)	2	0	0	1
+3218	3218	^\S{2,3}\x7c\S+?[au]\x7D\w{2,11}\x0d?\x0a	2	0	0	1
+3219	3219	^\/[A-Z]{1}[0-9]{1,3}\/[A-X]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/[A-Z]{1}[0-9]{4,5}[A-M]{1}[0-9]{1,2}[A-Z]{1}[0-9]{1,2}\/$	2	0	0	1
+3220	3220	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3221	3221	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3222	3222	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3223	3223	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3224	3224	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3225	3225	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3226	3226	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3227	3227	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3228	3228	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3229	3229	^[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])[a-zA-Z0-9/]{2}(M[1fhl]|T[1fhl]|s[hl])	2	0	0	1
+3230	3230	^(x(86|64)@)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+3231	3231	^[^\x00]+?\x00	2	0	0	1
+3232	3232	Host\x3a\x20([^\r\n]+\.)?bitcrypt\.cc(\x3a\d{1,5})?\r\n/Hmi	2	0	0	1
+3233	3233	ID=\d{24}($|&)	2	0	0	1
+3234	3234	^[a-z0-9_-]*?\.class	2	0	0	1
+3235	3235	name=\x22[a-z0-9\-_\.\s]{0,25}\.gadget\x22	2	0	0	1
+3236	3236	^..[\x0d-\x20](\d{0,27}[a-z])([a-z]{0,27}\d)[a-z0-9]{21,28}(\x03(biz|com|net|org))\x00\x00\x01\x00\x01	2	0	0	1
+3237	3237	^\d\.\d\.\d{4}\]\r\n\(C\)\x20Copyright\x20\d{4}(\x2d\d{4})?\x20Microsoft Corp(:?\.|oration)	2	0	0	1
+3238	3238	^\d+?\.\d+?\sstarted	2	0	0	1
+3239	3239	^\/[0-9A-F]{16}\/[0-9A-Za-z\+\/]{100,}$	2	0	0	1
+3240	3240	MyValue=[a-f0-9]{32}	2	0	0	1
+3241	3241	^([a-zA-Z0-9\x2d\x5f]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]*?9\.9\.9\.9\s+?([a-zA-Z0-9\_\-]{1,63}\.)+?[a-zA-Z0-9\x2d\x5f]{1,63}[\r\n]	2	0	0	1
+3242	3242	^PRIVMSG.*@(portscan|back|(tcp|udp|http)flood|tsunami|(de)?voice|reset|die|say|join|part|(de)?op)	2	0	0	1
+3243	3243	name=\x22DHL(\s|_|\-)?[a-z0-9\-_\.\s]{0,63}\.zip\x22	2	0	0	1
+3244	3244	\/.+(www\.)?[a-z0-9]+\.[a-z]{2,3}\.exe$	2	0	0	1
+3245	3245	adobe-flash\.v\.\d{5}\.exe	2	0	0	1
+3246	3246	\x2Finvoice\x2Escr$	2	0	0	1
+3247	3247	forum\/\?[0-9a-f]{8}$	2	0	0	1
+3248	3248	ups(_parcel_delivery-tracking-notice-|-Delivery-Notification-Message_)\S*\.zip	2	0	0	1
+3249	3249	Host\x3A\x20[^a-z]*[0-9]{4,30}\x2Ecn\x0D\x0A/Hi	2	0	0	1
+3250	3250	User-Agent\x3a\x20[a-z]{3,4}\x0d\x0a/H	2	0	0	1
+3251	3251	\/xxxx_\d+\/	2	0	0	1
+3252	3252	^Host\x3a\s[^\r\n]+?\.[abedgfihkmlonqpsruwvyxz]{16}\.waw\.pl\r$/Hmi	2	0	0	1
+3253	3253	\x10[abedgfihkmlonqpsruwvyxz]{16}\x03waw\x02pl\x00	2	0	0	1
+3254	3254	^[^\x3b]+\\x([57][0-9a]|4[0-9a-f]|6[1-9a-f]|3[0-9])	2	0	0	1
+3255	3255	^(<q>[\x22\x27])(((=q))[^\r\n\x2c])+?(=q)\s*?\+\s*?[\x22\x27][^\r\n\x2c]*?[cg][\x22\x27\+\s]*?[o][\x22\x27\+\s]*?[vm][\x22\x27\+\s]*?\.[\x22\x27\+\s]*?b[\x22\x27\+\s]*?r[\x22\x27\+\s]*?\x2c	2	0	0	1
+3256	3256	^..[\x0d-\x20][a-z]{13,32}(\x03(biz|com|net|org)|\x04info|\x02ru)\x00\x00\x01\x00\x01	2	0	0	1
+3257	3257	^\d	2	0	0	1
+3258	3258	[^\x33][^\x6f\x19\x18\x0e\x4f\x09\x08\x11\x0c\x0f\x0d\x1f\x10\x39][\x00-\x07\x0b\x0a\x1e\x1d\x12\x13\x15\x10\x1b\x1a\x54-\x5f\x50-\x52\x40-\x4b\x4d\x4e\x70-\x7f\x60-\x67\x69-\x6d]{1,14}\x33	2	0	0	1
+3259	3259	^\x2d?\d	2	0	0	1
+3260	3260	My\x20IP\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x0A	2	0	0	1
+3261	3261	^[^\r\n]{0,7}\b(M[ACDEFGHKLMNOPQRSTUVWXYZ]|B[ABDEFGHIJLMNOQRSTVWYZ]|S[ABCDEGHIJKLMNORSTVXYZ])	2	0	0	1
+3262	3262	^[^\r\n]{0,7}\b(M(A[CFR]|D[AGV]|N[EGP]|L[IT]|Y[ST]|[MS])	2	0	0	1
+3263	3263	^[a-z0-9_-]*?\.class	2	0	0	1
+3264	3264	^.\x00\x00\x00[a-z0-9]+?\x00	2	0	0	1
+3265	3265	^\d+[\r\n]*?$	2	0	0	1
+3266	3266	^[^\r\n]*?\x3a[^\r\n]*?(port(scan)?|udp[1-3]|tcp|http|download)[^\r\n]+?(\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}|https?\x3A\x2F\x2F)	2	0	0	1
+3267	3267	^[^\r\n]*?(p[ao]rt|udp|c?tcp|http|d(ie|ownload)|mail|c?back|(msg|notice)?flood)	2	0	0	1
+3268	3268	^[a-z]{12}	2	0	0	1
+3269	3269	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x40\x24\x40$	2	0	0	1
+3270	3270	^[a-z]{16}	2	0	0	1
+3271	3271	\/get\/get\.php$	2	0	0	1
+3272	3272	^[A-Za-z0-9\s/+]{100}	2	0	0	1
+3273	3273	^Host\x3a\x20ns1\.help(update(d\.(com?|net?|org?)|k\.(at?|eu?|tw)|r\.net|s\.com)|checks\.net)	2	0	0	1
+3274	3274	^<(<var1>[a-z])>[a-z0-9/]+<\/(=var1)><(<var2>[a-z])>[a-z0-9/]+<\/(=var2)>	2	0	0	1
+3275	3275	^[^\r\n]+?\n$	2	0	0	1
+3276	3276	\x21\x20UDP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+3277	3277	\x21\x20TCP\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+3278	3278	\x21\x20HOLD\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+3279	3279	\x21\x20SCANNER\x20(ON|OFF)\x0A	2	0	0	1
+3280	3280	\x21\x20JUNK\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+3281	3281	^[a-z][a-f0-9]{33}	2	0	0	1
+3282	3282	^[a-z][a-f0-9]{33}	2	0	0	1
+3283	3283	^[a-z][a-f0-9]{33}	2	0	0	1
+3284	3284	^[a-z][a-f0-9]{33}	2	0	0	1
+3285	3285	^[a-z][a-f0-9]{33}	2	0	0	1
+3286	3286	^[a-z][a-f0-9]{33}	2	0	0	1
+3287	3287	^[a-z][a-f0-9]{33}	2	0	0	1
+3288	3288	^[a-z][a-f0-9]{33}	2	0	0	1
+3289	3289	^Host\x3A[^\r\n]+?\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(\x3a\d{1,5})?\r?$/Hmi	2	0	0	1
+3290	3290	^[a-f0-9]+$	2	0	0	1
+3291	3291	^[0-9A-F]{12}$	2	0	0	1
+3292	3292	^\S{2,3}\x2d(XP|2K3|VIS|2K8|W7|ERR)\w?\x2d\w+?\x7D\w+?\r\n?	2	0	0	1
+3293	3293	^(MIPS(EL)?|POWERPC|ARM|X86)\x0a$	2	0	0	1
+3294	3294	^(ON|OFF)	2	0	0	1
+3295	3295	^\d+MHz\x00	2	0	0	1
+3296	3296	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})system$	2	0	0	1
+3297	3297	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}D\x3a\x00+?$	2	0	0	1
+3298	3298	^.{2}(<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x08.{2}(=var)	2	0	0	1
+3299	3299	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3300	3300	^[\x53\x54]	2	0	0	1
+3301	3301	^[a-z0-9]{50}	2	0	0	1
+3302	3302	^[a-z0-9]{50}	2	0	0	1
+3303	3303	^\x3c\x2a\x60[\x20-\x7e]+\x60\x2a\x3e$	2	0	0	1
+3304	3304	^\d+\]\r\n$	2	0	0	1
+3305	3305	^((menelao|ho[mr]u)s|adair|johan|kweku)\r\n	2	0	0	1
+3306	3306	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d	2	0	0	1
+3307	3307	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\x7d	2	0	0	1
+3308	3308	^[A-F0-9]{8,12}	2	0	0	1
+3309	3309	^(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?$	2	0	0	1
+3310	3310	^[\x01\x03\x08\x09\x0b]\x00	2	0	0	1
+3311	3311	^\d{1,3}[0-2]	2	0	0	1
+3312	3312	\.tar$	2	0	0	1
+3313	3313	^[a-zA-Z0-9]{8}	2	0	0	1
+3314	3314	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+3315	3315	\x7c[a-f0-9]{16}\x7c\d+\x7c$	2	0	0	1
+3316	3316	[^\x28][^\x76\x74\x02\x03\x15\x54\x12\x13\x0a\x17\x14\x16\x04\x0b\x22][\x05\x09\x0b\x0e\x08\x06\x1a-\x1f\x10\x11\x18\x19\x40-\x47\x48-\x4f\x50-\x53\x55\x56\x58-\x5e\x60-\x68\x6a-\x6f\x70\x72\x76-\x7e]{1,14}\x28	2	0	0	1
+3317	3317	\x00\x05value$	2	0	0	1
+3318	3318	^[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+3319	3319	^\d{1,5}	2	0	0	1
+3320	3320	^.{2}[a-z]{5,}\.[a-z]{2}\x30	2	0	0	1
+3321	3321	^(#+[A-Z]+)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?\${10}	2	0	0	1
+3322	3322	^(in|out)	2	0	0	1
+3323	3323	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3324	3324	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3325	3325	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3326	3326	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3327	3327	^[0-9A-F]{12}	2	0	0	1
+3328	3328	^\d{1,6}\x00pl\x7c	2	0	0	1
+3329	3329	^\d{1,6}\x00sc\x7e\x7c	2	0	0	1
+3330	3330	^\d{1,6}\x00scPK\x7c	2	0	0	1
+3331	3331	^\d{1,6}\x00rn\x7c	2	0	0	1
+3332	3332	^\d{1,6}\x00ret\x7c	2	0	0	1
+3333	3333	^\d{1,6}\x00cap\x7c	2	0	0	1
+3334	3334	^\d{1,6}\x00kl\x7c	2	0	0	1
+3335	3335	^\d{1,6}\x00fm\x7c	2	0	0	1
+3336	3336	^\d{1,6}\x00proc\x7c	2	0	0	1
+3337	3337	^\d{1,6}\x00rg\x7c	2	0	0	1
+3338	3338	^\d{1,6}\x00srv\x7c	2	0	0	1
+3339	3339	^\d{1,6}\x00rs\x7c	2	0	0	1
+3340	3340	^\d{1,6}\x00mic\x7c	2	0	0	1
+3341	3341	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+3342	3342	^NOTICE [^\r\n]+? \x3aREWRITING\x0a[^\r\n]+?\x0ato\x0a[^\r\n]+?\x0a	2	0	0	1
+3343	3343	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3344	3344	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3345	3345	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3346	3346	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3347	3347	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3348	3348	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3349	3349	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3350	3350	^.{3}(<var>[a-z]+)\x20.*?\x55\x04\x03.{2}www\.[a-z](=var)	2	0	0	1
+3351	3351	^([A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(64)?$	2	0	0	1
+3352	3352	^([A-F1-9]*?[a-km-zGHJ-NP-Z])[a-km-zA-HJ-NP-Z1-9]{25,34}(64)?$	2	0	0	1
+3353	3353	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3354	3354	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3355	3355	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3356	3356	^\d+	2	0	0	1
+3357	3357	^.{2}[a-z]{5,}\.[a-z]{2,3}[01]	2	0	0	1
+3358	3358	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+3359	3359	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+3360	3360	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+3361	3361	^.{2}[a-z]{5,}\.[a-z]{2}[01]	2	0	0	1
+3362	3362	^.{2}[a-z]{25}\.[a-z]{2,3}[01]	2	0	0	1
+3363	3363	^(([0-9]{1,3}\.){3}[0-9]{1,3})(={2})	2	0	0	1
+3364	3364	\/\?[A-Z]{10,}$	2	0	0	1
+3365	3365	^User-Agent\x3a[^\r\n]+?(MSIE|rv\x3a11)/Hm	2	0	0	1
+3366	3366	\/\d{10}\?w=\d{3}&i=\d{6,10}&v=\d\.\d$	2	0	0	1
+3367	3367	\.php$	2	0	0	1
+3368	3368	^KEEPALIVE\d+$	2	0	0	1
+3369	3369	\x24RECYCLE\.BIN\.\x7B[0-9A-F]{8}\x2D([0-9A-F]{4}\x2D){3}[0-9A-F]{12}\x7D\x5C\x7B[0-9A-F]{8}\x2D([0-9A-F]{4}\x2D){3}[0-9A-F]{12}\x7D\.(scr|pif|cmd)	2	0	0	1
+3370	3370	^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][A-Z0-9]	2	0	0	1
+3371	3371	^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][A-Z0-9]	2	0	0	1
+3372	3372	\.php\?e=\d{4}\-\d{4}&h=[a-f0-9]{32}$	2	0	0	1
+3373	3373	^[a-f0-9]{7,}$	2	0	0	1
+3374	3374	^.{2}(www)\d?[A-Z]?([a-z]{3,20}\.)?[a-z]{5,}(\d[a-z]{5,})?\.[a-z]{2,5}[01]	2	0	0	1
+3375	3375	^[^\x00]+(\xff\xd9)?$	2	0	0	1
+3376	3376	^0103F\x00[^\x00]+(\xff\xd9)?$	2	0	0	1
+3377	3377	^0103F\x00[^\x00]+(\xff\xd9)?$	2	0	0	1
+3378	3378	^.{2}((\d[A-Z]?|[A-Z]\d?)[a-z]{6,20}|[A-Z]?[a-z]{3,7}\d[a-z]{3,7})\.((\d[A-Z]?|[A-Z]\d?)[a-z]{6,20}|[A-Z]?[a-z]{3,7}\d[a-z]{3,7})\.((com|net|org)[01])[a-z]{2,}[01]	2	0	0	1
+3379	3379	^(<v1>\S{1,100})\s+(<v2>\S{1,100})\s+=\s+\x22\x22\x3b\s+(=v2)\s+\+\=\s+\x27(=v1).+?(=v1)\x27\x3b.+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27].+?(=v2)\s\+=\s[\x22\x27]	2	0	0	1
+3380	3380	^[a-z]{12}	2	0	0	1
+3381	3381	^[a-f0-9]{14}$	2	0	0	1
+3382	3382	^\d	2	0	0	1
+3383	3383	\.php\?id=\d+&magic=(-)?\d+$	2	0	0	1
+3384	3384	^.{2}(<CN>((\d?[A-Z]?|[A-Z]?\d?)([a-z]{3,20}|[a-z]{3,6}[0-9_][a-z]{3,6})\.){0,2}?(\d?[A-Z]?|[A-Z]?\d?)[a-z]{3,}([0-9_-][a-z]{3,})?\.(com|org|net|tv)[a-z]{2,9})[01].*?(=CN)[01]	2	0	0	1
+3385	3385	^.[\x0e\x0f]((www|ns))[a-z0-9]{2,3}	2	0	0	1
+3386	3386	^.[\x0a\x0b]((www|ns))[a-z0-9]{1,2}	2	0	0	1
+3387	3387	^KEEPALIVE\x7c?\d	2	0	0	1
+3388	3388	^[a-f0-9]{13,30}$	2	0	0	1
+3389	3389	^[a-f0-9]{13,30}$	2	0	0	1
+3390	3390	^[a-f0-9]{13,30}$	2	0	0	1
+3391	3391	^[a-f0-9]{13,30}$	2	0	0	1
+3392	3392	^[a-f0-9]{13,30}$	2	0	0	1
+3393	3393	^[a-f0-9]{13,30}$	2	0	0	1
+3394	3394	^[a-f0-9]{13,30}$	2	0	0	1
+3395	3395	^[a-f0-9]{13,30}$	2	0	0	1
+3396	3396	^[a-f0-9]{13,30}$	2	0	0	1
+3397	3397	^[a-f0-9]{13,30}$	2	0	0	1
+3398	3398	^[a-f0-9]{13,30}$	2	0	0	1
+3399	3399	^[a-f0-9]{13,30}$	2	0	0	1
+3400	3400	^[a-f0-9]{13,30}$	2	0	0	1
+3401	3401	^[a-f0-9]{13,30}$	2	0	0	1
+3402	3402	^[a-f0-9]{13,30}$	2	0	0	1
+3403	3403	^[a-f0-9]{13,30}$	2	0	0	1
+3404	3404	^[A-F0-9]+\x00	2	0	0	1
+3405	3405	Cookie\x3a mstshash=[a-zA-Z]\r\n	2	0	0	1
+3406	3406	^[^A-Za-z0-9]	2	0	0	1
+3407	3407	^(FM|SM|CP|CM|MC|NF|CH|PS|PT)	2	0	0	1
+3408	3408	^(Lg|Execute|FLD|Sc)\x7c\x2d\x7c	2	0	0	1
+3409	3409	^(\x40|\x21|\x23|\x7e|\x24)	2	0	0	1
+3410	3410	\bnethelper\b/Vi	2	0	0	1
+3411	3411	^\d	2	0	0	1
+3412	3412	[\x04\x06]\x88\x4d\x76$	2	0	0	1
+3413	3413	[\xb0\xb2]\x63\x70\x7b$	2	0	0	1
+3414	3414	^(.{0,56}\x00.{0,55}\x00.{0,54}\x00.{0,53}\x00)(.{0,54}\x00{2})	2	0	0	1
+3415	3415	\r\nHost\x3a[^\r\n]+\r\n(Pragma|Cache-Control)\x3a\x20no-cache\r\n(Connection\x3a Keep-Alive\r\n)?(\r\n)?$/H	2	0	0	1
+3416	3416	^Accept\x3a\x20\*\/\*\r\nConnection\x3a\x20close\r\nHost\x3a\x20[^\r\n\x2e]+\x2e[^\r\n\x2e]+(\x3a\d{1,5})?\r\n(\r\n)?$/H	2	0	0	1
+3417	3417	name\x3d\x22(message|letter|.*lebanon\x2donline\x2ecom\x2elb)?\x2ezip\x22\x0d\x0a	2	0	0	1
+3418	3418	^[A-Za-z0-9+/=]+\x24\x3a\d+\x3a\x24$	2	0	0	1
+3419	3419	^[acdefghijlmopqrtwz]{16}\.mynumber\.org$	2	0	0	1
+3420	3420	^Host\x3a (\d+\.){3}\d+$	2	0	0	1
+3421	3421	^[0-9A-Z]{8}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9]{12}-0[0-9]{1}	2	0	0	1
+3422	3422	^(_|Keylogger)	2	0	0	1
+3423	3423	[^\x12][^\x4e\x38\x39\x2f\x6e\x28\x29\x30\x2d\x2e\x2c\x3e\x31\x18][\x40-\x48\x4a-\x4d\x31-\x34\x3a-\x3c\x3f\x50-\x5f\x60-\x6c\x6f\x73-\x7f\x70\x71\x20-\x27\x2a\x2b]{1,14}\x12	2	0	0	1
+3424	3424	^[0-9]{2,3}\x00\x6c\x6c(<var>[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x41-\x5a\x5b-\x60\x7b-\x7e])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(=var)[^\r\n]+(=var)$	2	0	0	1
+3425	3425	^(GET|POST)\/(watch|search|find|results|open|search|close)\/\?(text=|from=|aq=|ai=|ags=|oe=|btnG=|oprnd=|utm=|channel=|itwm=)	2	0	0	1
+3426	3426	itwm=[A-Za-z0-9\-\_]{29,35}	2	0	0	1
+3427	3427	&itwm=[A-Za-z0-9\-\_]{29,35}	2	0	0	1
+3428	3428	[A-Z0-9\-]{16}-FILE-[^\r\n]+.tmp	2	0	0	1
+3429	3429	Mozilla\/[0-9]{1,2}.[0-9]{1,2}\(compatible\; MSIE [0-9]{1,2}.[0-9]{1,2}\;\)\x0d\x0a	2	0	0	1
+3430	3430	^.{2}[A-Za-z][a-z]*?@[a-z]+\.com0	2	0	0	1
+3431	3431	^User-Agent\x3a\x20[^\r\n]+?(MSIE|rv\x3a11\.0)/Hmi	2	0	0	1
+3432	3432	^\x00+?[\x20-\x7f]+?\x00+?$	2	0	0	1
+3433	3433	^\x00+?[\x20-\x7f]+?\x00+?$	2	0	0	1
+3434	3434	^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi	2	0	0	1
+3435	3435	^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi	2	0	0	1
+3436	3436	^[^\s]*iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea\.[a-z]{2,5}\x0d\x0a/Hi	2	0	0	1
+3437	3437	^[\x22\x27][a-z][\x27\x22]	2	0	0	1
+3438	3438	^.(.[a-z]{4,12}\.(us|org|net|biz|info|mobi|com)[01]).*?\x55\x04\x03.	2	0	0	1
+3439	3439	^[0-9]{3}\x7cx	2	0	0	1
+3440	3440	^[0-9]{2}\x7cx	2	0	0	1
+3441	3441	^[a-f0-9]{40,}$	2	0	0	1
+3442	3442	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3443	3443	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps	2	0	0	1
+3444	3444	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/Ps	2	0	0	1
+3445	3445	([0-9A-F]{8}\-){5}\-SH	2	0	0	1
+3446	3446	^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+3447	3447	^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+3448	3448	^((\d{1,3}\.){3}\d{1,3}|((https?\x3a\/\/)?[a-z0-9\-]{1,30}\.){1,8}[a-z]{1,8})	2	0	0	1
+3449	3449	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3450	3450	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3451	3451	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3452	3452	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3453	3453	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3454	3454	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3455	3455	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3456	3456	^d([\x22\x27][\r\n\s]*?\+[\r\n\s]*?[\x22\x27])?e([\x22\x27][\r\n\s])	2	0	0	1
+3457	3457	^.{4}[\x0a-\x7f]{0,100}[\x00-x09\x80-\xff]	2	0	0	1
+3458	3458	^\/([a-z]*[0-9][a-z-0-9]*)([0-9]*[a-z][a-z-0-9]*)[a-z0-9]{5,8}$	2	0	0	1
+3459	3459	Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}(\x3a\d{1,5})?\r\n/H	2	0	0	1
+3460	3460	\/js\/bin\.exe\\d+$	2	0	0	1
+3461	3461	^.{1}([\x20-\x7e]{0,8}?[^\x20-\x7e])(<var>.{10,120}?[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+3462	3462	^.{2}[a-z]+@[a-z]+\.com[01]	2	0	0	1
+3463	3463	^.{2}[a-z]+@[a-z]+\.com[01]	2	0	0	1
+3464	3464	^.{2}[A-Za-z][a-z]*?@[a-z]+\.com[01]	2	0	0	1
+3465	3465	\x00[0-9]{4,7}\x02in\x00	2	0	0	1
+3466	3466	^[\x0e-\x1e]([a-f0-9]{2}){1,3}(dc([a-f0-9]{2}){1,3}){3}.[a-f0-9]{2}	2	0	0	1
+3467	3467	^[\x08-\xFF]([a-f0-9]{2})*?dc978a97	2	0	0	1
+3468	3468	^(gdqg|hdqh|idqi|jdqj|kdqk|ldql|mdqm|ndqn|odqo|pdqp|qdqq|rdqr|sdqs|tdqt|udqu|vdqv|wdqw|xdqx|ydqy|zdqz)[a-j](\x02ch|\x03biz)	2	0	0	1
+3469	3469	^(adra|bdrb|cdrc|ddrd|edre|fdrf|gdrg|hdrh|idri|jdrj|kdrk|ldrl|mdrm|ndrn|odro|pdrp|qdrq|rdrr|sdrs|tdrt|udru|vdrv|wdrw|xdrx|ydry|zdrz)[a-j](\x02ch|\x03biz)	2	0	0	1
+3470	3470	^(0+30)[0-9A-Z]+30[^0-9]	2	0	0	1
+3471	3471	[a-z]{4,10}\.velodrivve\.biz$	2	0	0	1
+3472	3472	[a-z]{4,10}\.bedrifg\.org$	2	0	0	1
+3473	3473	[a-z]{4,10}\.fedbook\.org$	2	0	0	1
+3474	3474	[a-z]{4,10}\.goodbird\.biz$	2	0	0	1
+3475	3475	[a-z]{4,10}\.verekt\.biz$	2	0	0	1
+3476	3476	[a-z]{4,10}\.barrout\.org$	2	0	0	1
+3477	3477	[a-z]{4,10}\.biojart\.biz$	2	0	0	1
+3478	3478	[a-z]{4,10}\.benefin\.org$	2	0	0	1
+3479	3479	\.(upda|getfile|dl\dx|dl|download|execute)\w*\s+ftp\x3a\x2f\x2f	2	0	0	1
+3480	3480	\/operator\/login\.php$	2	0	0	1
+3481	3481	^.{8}[\x20-\x7e]+?\x7b\x9e	2	0	0	1
+3482	3482	^Subject\x3a [^\r\n]+?Foi Instalado	2	0	0	1
+3483	3483	^\/[56]\d{4}\x2c.*?\x2c[A-Z]\x3a[\x2f\x5c].+?\.exe	2	0	0	1
+3484	3484	\x00\x07[a-z0-9]{7}\x02eu\x00	2	0	0	1
+3485	3485	[^a-z0-9\-\.][a-z]{32,48}\x02ru\x00\x00	2	0	0	1
+3486	3486	^ETag\x3a\x20\x22\d+75BCD15\d+\x3a[a-f0-9]{1,6}	2	0	0	1
+3487	3487	^<(<var1>[a-z])>[a-z0-9/]+<\/(=var1)><(<var2>[a-z])>[a-z0-9/]+<\/(=var2)>$	2	0	0	1
+3488	3488	^Host\x3a[^\r\n]+?cvredirect.no-ip.net/Hmi	2	0	0	1
+3489	3489	^Host\x3a[^\r\n]+?cvredirect.ddns.net/Hmi	2	0	0	1
+3490	3490	^Keylogger\r$	2	0	0	1
+3491	3491	^[\x22\x27]NEGOCIO_ONLINE(\.(zip|exe))[\x27\x22]\x0d\x0a	2	0	0	1
+3492	3492	^[A-F0-9]{48}\.bin\r\n	2	0	0	1
+3493	3493	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d+\/stat\x03\x08\x0c$	2	0	0	1
+3494	3494	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d+\/control\x03\x08\x0c$	2	0	0	1
+3495	3495	^Host\x3a[^\r\n]+?\r\n(\r\n)?$/Hi	2	0	0	1
+3496	3496	^Host\x3a[^\r\n]+\.asia\r\n/Hmi	2	0	0	1
+3497	3497	^Host\x3a[^\r\n]+\.ru\r\n/Hmi	2	0	0	1
+3498	3498	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title><\/html>$	2	0	0	1
+3499	3499	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3a)(l|&#(x[64]c|108|76)\x3b)	2	0	0	1
+3500	3500	^\s*\s*?[\x22\x27](c|&#(x[64]3|99|67)\x3b)(l|&#(x[64]c|108|76)\x3b)	2	0	0	1
+3501	3501	^[a-z0-9]{1,10}[A-F0-9]+\.bin\r\n$	2	0	0	1
+3502	3502	^\s*\s*?[\x22\x27]javax.naming.InitialContext	2	0	0	1
+3503	3503	\x7c([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})$	2	0	0	1
+3504	3504	^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/n\d+\.png$	2	0	0	1
+3505	3505	(JUNK|HOLD) Flooding (\d{1,3}\.){3}\d{1,3} for \d+ seconds.\r?\n	2	0	0	1
+3506	3506	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})Wrod--\\\$	2	0	0	1
+3507	3507	^(:?[78]|XP)	2	0	0	1
+3508	3508	\.php\?\d{1,4}$	2	0	0	1
+3509	3509	\.php\?\d{1,4}$	2	0	0	1
+3510	3510	\/config\.php\?id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+	2	0	0	1
+3511	3511	^AuthToken=[A-Za-z0-9+/]{43}=$	2	0	0	1
+3512	3512	\.[^\x3F]+\?id=\d+&act=\d+$	2	0	0	1
+3513	3513	^.{2}[A-Z]?[a-z]+\.[A-Z]?[a-z]+@gmail\.com[01]	2	0	0	1
+3514	3514	^[0-9A-Z]+232A	2	0	0	1
+3515	3515	^\d{1,3}$	2	0	0	1
+3516	3516	^(Cek\x20This|miss\x20[A-Za-z0-9]{2,20}|[A-Za-z0-9]{2,20}Porn)\r\n	2	0	0	1
+3517	3517	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3518	3518	^(likes|check|login_status)\.json\?	2	0	0	1
+3519	3519	^[0-9A-F]{16}$	2	0	0	1
+3520	3520	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3521	3521	^[A-F0-9]{8}(-[A-F0-9]{4}){3}-[A-F0-9]{12}\/	2	0	0	1
+3522	3522	^[a-z0-9/%=]{100,}$	2	0	0	1
+3523	3523	^(-[0-9]+|[A-F0-9]{32})=1$	2	0	0	1
+3524	3524	^(-[0-9]+|[A-F0-9]{32})=1&type=zip$	2	0	0	1
+3525	3525	^(-[0-9]+|[A-F0-9]{32})=1&type=filter$	2	0	0	1
+3526	3526	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}&u=	2	0	0	1
+3527	3527	^[A-Za-z0-9\/\.=]{250,}$	2	0	0	1
+3528	3528	^\d+\x0a$	2	0	0	1
+3529	3529	^[A-Za-z0-9]{25,}$	2	0	0	1
+3530	3530	^\d{2,4}$	2	0	0	1
+3531	3531	^[a-z0-9]{6}$	2	0	0	1
+3532	3532	^=?[a-z0-9]{6}$	2	0	0	1
+3533	3533	^(pe|pp|s)$	2	0	0	1
+3534	3534	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3535	3535	^(mfa\.[\w-]{84}|[\w-]{24}\.[\w-]{6}\.[\w-]{27})\x0d\x0a	2	0	0	1
+3536	3536	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})\d(\r\n)?$/Hmi	2	0	0	1
+3537	3537	&p=[a-z0-9]{12}(&v=[a-z0-9\.-]{1,24})?$	2	0	0	1
+3538	3538	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3539	3539	^[A-F0-9]{8}$	2	0	0	1
+3540	3540	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\x00$	2	0	0	1
+3541	3541	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3542	3542	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+3543	3543	^[a-z]{200,}$	2	0	0	1
+3544	3544	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3545	3545	^(The White House|And increasing numbers|Drivers for a parcel|The Italian region worst hit|Although Interpol issued|President Donald Trump|Restaurants are still allowed|A paper released on Friday)	2	0	0	1
+3546	3546	^[a-f0-9]{32}$	2	0	0	1
+3547	3547	^[A-Za-z0-9\-_\.]{20,80}\.[a-z]{2}\d{2}\.com$	2	0	0	1
+3548	3548	^[a-fA-F0-9]{61}\.[a-fA-F0-9]{63}\.[a-fA-F0-9]{63}\.	2	0	0	1
+3549	3549	^88[a-fA-F0-9]{38}b9\.	2	0	0	1
+3550	3550	^8b[a-fA-F0-9]{46}b9\.	2	0	0	1
+3551	3551	&uuid=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+3552	3552	^[a-z]{256}$	2	0	0	1
+3553	3553	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3554	3554	\x2Fu\x2Fupd\x5F(cb|.+\x2Ecb)	2	0	0	1
+3555	3555	^(\d+|(\w+)?grabbers?|uploader)(&luck=\d)?$	2	0	0	1
+3556	3556	\x2F(data|main|patch)\x2Ecfg	2	0	0	1
+3557	3557	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3558	3558	c\x3d[0-9a-f]{100}	2	0	0	1
+3559	3559	\.php\?U=\d+@\d+@\d+@\d+@\d+@[a-f0-9]+$	2	0	0	1
+3560	3560	^(0-9]{1,3}\.){3}\d{1,3}$	2	0	0	1
+3561	3561	^[^?#]+?\.php\?f=\w+&e=\d+$	2	0	0	1
+3562	3562	id=[A-F0-9]{20}	2	0	0	1
+3563	3563	^(x\d{1,2}){5,}	2	0	0	1
+3564	3564	\?ca[sc]hingDeny=[0-9A-Za-z]{16}&	2	0	0	1
+3565	3565	^[a-f0-9]-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+3566	3566	^[a-f0-9]-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+3567	3567	^\d+$	2	0	0	1
+3568	3568	^\d+$	2	0	0	1
+3569	3569	^\d+$	2	0	0	1
+3570	3570	^[a-z0-9]{60}	2	0	0	1
+3571	3571	^[A-F0-9\-]+&ver=	2	0	0	1
+3572	3572	^[A-F0-9\-]+&ver=	2	0	0	1
+3573	3573	\/task.php\?id=[^&]{32,64}&task=\d	2	0	0	1
+3574	3574	^[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}&a=	2	0	0	1
+3575	3575	c\x3d[0-9A-F]{100}	2	0	0	1
+3576	3576	^[a-f0-9]{100,200}\/[a-f0-9]{6,9}\/[A-Z0-9_]{4,200}\.com	2	0	0	1
+3577	3577	\.php\?m=\w&n=\w+_\w+(@|@.c|@.t)$	2	0	0	1
+3578	3578	^\d{5,9}$	2	0	0	1
+3579	3579	\x2F[a-z]{5}\x2Ephp\x3Fid\x3D.+121212121212	2	0	0	1
+3580	3580	^[a-z]{3,6}\x3d[A-F0-9]{50}	2	0	0	1
+3581	3581	^([0-9A-F][0-9A-F]-){5}([0-9A-F][0-9A-F])	2	0	0	1
+3582	3582	verint=\d+&uid=\d+&wv=[A-Za-z0-9]+&report=\d+&abbr=[A-Za-z0-9]+&pid=\d	2	0	0	1
+3583	3583	^\d+$	2	0	0	1
+3584	3584	^(\d+|x.+)	2	0	0	1
+3585	3585	^[a-z0-9]{12,14}(&p2=([a-z0-9]([\._-])?){1,24}(_DROPPER)?)$	2	0	0	1
+3586	3586	id=x.+_[0-9A-F]{8}&build_id=.	2	0	0	1
+3587	3587	^[A-Za-z0-9+\/=]+?$	2	0	0	1
+3588	3588	v=\d+&rnd=\d	2	0	0	1
+3589	3589	\?mac=[0-9]*?&os=[a-z]*?&ver=[0-9]{8}&id=	2	0	0	1
+3590	3590	p4=\d+&p5=\d+&hs=\d	2	0	0	1
+3591	3591	^[a-f0-9]	2	0	0	1
+3592	3592	^\d	2	0	0	1
+3593	3593	\x2Ephp\x3Fid\x3D\d*\x26v\x3D\d*\x26tm\x3D\d*\x26b\x3D	2	0	0	1
+3594	3594	\.asp\?mac=([0-9A-F]{2}-){5}([0-9A-F]{2})+&ver=\d	2	0	0	1
+3595	3595	id=\d+&bid=[^&]+&query=\w+&data=\w	2	0	0	1
+3596	3596	^[a-z]{1,4}\x3d[a-z0-9]+?$	2	0	0	1
+3597	3597	^\d{5}\x2eddns[a-z0-9]\x2eeu$	2	0	0	1
+3598	3598	^\/[A-Z]+\.php\?php=receipt$	2	0	0	1
+3599	3599	^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x3A[0-9]{1,5}	2	0	0	1
+3600	3600	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3601	3601	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3602	3602	^[a-f0-9]{8}\x2D[a-f0-9]{8}\x2D[a-f0-9]{8}\x2D[a-f0-9]{8}$	2	0	0	1
+3603	3603	^(id|key)=	2	0	0	1
+3604	3604	User-Agent\x3a[^\r\n]+[^\x20]\x3bTrident\/4\.0\x29\s\d{2}\x3a\d{2}\s\r$	2	0	0	1
+3605	3605	&userid=\d{4}&other=[MF]	2	0	0	1
+3606	3606	^[A-Z]{10}$	2	0	0	1
+3607	3607	^\x2F[a-f0-9]{40,60}$	2	0	0	1
+3608	3608	\/[a-z0-9]+$	2	0	0	1
+3609	3609	^[a-z0-9]{196}	2	0	0	1
+3610	3610	^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+3611	3611	^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+3612	3612	^https?\:\/\/[a-f0-9]{16}\.[^\r\n]+?\/index\.php\?[a-z]=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+3613	3613	\/[a-z]\/$	2	0	0	1
+3614	3614	^\/ad[^\x2f]*?\/\?[a-z]{1,5}\x3d\x2e?[a-z0-9]+?$	2	0	0	1
+3615	3615	^[a-z]{15}$	2	0	0	1
+3616	3616	^[a-z]{3,4}\/\d{1,4}$	2	0	0	1
+3617	3617	^subject=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})_((list|que)_done|ini(_done)?)&data	2	0	0	1
+3618	3618	^\d+?\x22	2	0	0	1
+3619	3619	^\/[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{5}\/\d+\/\d{2}[a-zA-Z0-9\+\/]+={0,2}\/[a-zA-Z0-9\+\/]+={0,2}\d{3}\/$	2	0	0	1
+3620	3620	^[^\r\n]+?\$	2	0	0	1
+3621	3621	^[A-Za-z0-9]{15}([A-Za-z0-9]{19})?$	2	0	0	1
+3622	3622	=[A-Za-z0-9\/\+]+={0,2}$	2	0	0	1
+3623	3623	^[a-f0-9]{32}\/[0-9]$	2	0	0	1
+3624	3624	\/get\d*\.php\?c=[A-Z]{8}&d=[0-9A-F]{250,}$	2	0	0	1
+3625	3625	\/crypt_[^\/]*?sell[^\/]*?\d\.exe$	2	0	0	1
+3626	3626	\/[A-F0-9]+$	2	0	0	1
+3627	3627	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+3628	3628	^[^\x22\x2f\r\n]+?\x22\r\n	2	0	0	1
+3629	3629	^[^&]+?&\d+$	2	0	0	1
+3630	3630	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3631	3631	^id=[A-Z0-9]+?&info=[A-Z0-9]+?$	2	0	0	1
+3632	3632	^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}	2	0	0	1
+3633	3633	^\x2F(policy|cache)$	2	0	0	1
+3634	3634	^(ode)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&h(wid)	2	0	0	1
+3635	3635	(\?|&)guid=[^!&]+?\!	2	0	0	1
+3636	3636	^\d+\d+?(&ver=\d+?)?&req=\d+?(&r=)?$	2	0	0	1
+3637	3637	^mac=([A-F0-9]{2}-){5}[A-F0-9]{2}&t1=	2	0	0	1
+3638	3638	\.((jp|pn)g|cgi|gif)\?tq=	2	0	0	1
+3639	3639	^\/[b-u][A-Za-z0-9]{6,25}\.php$	2	0	0	1
+3640	3640	^Last-Modified\x3a(\s[^\r\n]{2}|[^\r\n\s]{3}),	2	0	0	1
+3641	3641	^\d{5,}$	2	0	0	1
+3642	3642	\?[0-9a-f]{6}$	2	0	0	1
+3643	3643	\?ID=[A-Z]{10}$	2	0	0	1
+3644	3644	^[0-9A-F]{12,24}	2	0	0	1
+3645	3645	^\x2F[a-f0-9]{40,60}$	2	0	0	1
+3646	3646	\.cgi\?s(id)\d{1,12}&r=	2	0	0	1
+3647	3647	\/([^\x2f]+?\/)?[a-z-_]+?\.(php|html)$	2	0	0	1
+3648	3648	^\x2fimage\x2f[A-Za-z0-9\+_-]+\.jpg$	2	0	0	1
+3649	3649	\/\/?$	2	0	0	1
+3650	3650	^(\x3a\d{1,5})?$	2	0	0	1
+3651	3651	^(\x3a\d{1,5})?$	2	0	0	1
+3652	3652	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})$	2	0	0	1
+3653	3653	^[A-Za-z0-9]{48}\x3a([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})$	2	0	0	1
+3654	3654	\/0\/$	2	0	0	1
+3655	3655	^[^\x2f]+\/[a-z0-9]+$	2	0	0	1
+3656	3656	\/([a-z]{4,9}\/[a-z]{3,10}\?[a-z_]{2,9}=[0-9]{2,8}|[a-z]{10})&[a-z]{5,9}=[a-zA-Z0-9_*]{30,}$	2	0	0	1
+3657	3657	^[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\$%^&\(\)\x20_{}\.~]{1,14}_	2	0	0	1
+3658	3658	^\/lolo\/[0-9]+\/[0-9]+\/[0-9]+\/[0-9]+\.html$	2	0	0	1
+3659	3659	^\/log\/[0-9]+\/[0-9]+\/\?id=[0-9]+$	2	0	0	1
+3660	3660	^\/[\/a-z0-9]+$	2	0	0	1
+3661	3661	^\/\?\d([A-Za-z0-9~_]{4})*([A-Za-z0-9~_]{2}--|[A-Za-z0-9~_]{3}-|[A-Za-z0-9~_]{4})$	2	0	0	1
+3662	3662	^\/UID\d+\.jsp\?	2	0	0	1
+3663	3663	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+3664	3664	\.php\?id=[a-zA-Z]{15,}&?x=\d+&?os=[0-9.]+&?n=\d	2	0	0	1
+3665	3665	^[0-9A-F]{550,}\.html	2	0	0	1
+3666	3666	\/Setup_\d+\.exe$	2	0	0	1
+3667	3667	\?0=.*\&1=.*\&2=.*\&3=.*\&4=.*\&5=.*\&6=.*\&7=.*\&8=	2	0	0	1
+3668	3668	&ver=\d\.\d$	2	0	0	1
+3669	3669	^\/([A-Fa-f0-9]+|index\.php)$	2	0	0	1
+3670	3670	^(c(omment|_id)|m(jdu)?)=	2	0	0	1
+3671	3671	^\/1+$	2	0	0	1
+3672	3672	(MSIE|rv\x3a11)	2	0	0	1
+3673	3673	\/\d+\.png\?uid=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+3674	3674	&data=([a-z]\d){7,}$	2	0	0	1
+3675	3675	^([a-z]\d){7,}\.zip\x22	2	0	0	1
+3676	3676	(MSIE|rv\x3a11\.0)	2	0	0	1
+3677	3677	^\x2f[a-zA-Z]{4,}\x2ephp\x3f[a-zA-Z]{2,10}\x3d([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+	2	0	0	1
+3678	3678	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+3679	3679	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})$	2	0	0	1
+3680	3680	=0[0-2](&\w+=[a-fA-F0-9]{8}){2}&\w+=[a-fA-F0-9]+$	2	0	0	1
+3681	3681	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+3682	3682	0[0-2]0000[a-fA-F0-9]{16,}$	2	0	0	1
+3683	3683	^\d+$	2	0	0	1
+3684	3684	^([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})+	2	0	0	1
+3685	3685	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+?$	2	0	0	1
+3686	3686	^\x5b[^\r\n]+\(64\s=\s\d\)\sEXE\s=	2	0	0	1
+3687	3687	^[a-zA-Z0-9+/]{43}	2	0	0	1
+3688	3688	^winver=\d+&ver=\d+$	2	0	0	1
+3689	3689	^\/\?0=([^&]+?&\d+)+?[^=&]+?$	2	0	0	1
+3690	3690	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+3691	3691	^[a-z]{2,}=(%[A-F0-9]{2})+&	2	0	0	1
+3692	3692	^[a-z]{2,}=(%[A-F0-9]{2})+&	2	0	0	1
+3693	3693	^\/[^\x2f]+\/0000[A-F0-9]{4}\/0[0-2]\/[A-F0-9]{8}$	2	0	0	1
+3694	3694	^\/0[0-2]\/[^\x2f]+\/0000[A-F0-9]{4}\/[^\x2f]+\/[A-F0-9]{8}$	2	0	0	1
+3695	3695	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]svchost\.exe[\x22\x27]\r\n	2	0	0	1
+3696	3696	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]explorer\.exe[\x22\x27]\r\n	2	0	0	1
+3697	3697	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]hkcmd\.exe[\x22\x27]\r\n	2	0	0	1
+3698	3698	^Content-Disposition\x3a attachment\x3b filename=[\x27\x22]server\.exe[\x22\x27]\r\n	2	0	0	1
+3699	3699	^\d+?\/(\d+?\/-?\d+?\.(php|jsp))?$	2	0	0	1
+3700	3700	\?uid=\d+&context=\w+&mode=text&data=\w+$	2	0	0	1
+3701	3701	^\/\d+$	2	0	0	1
+3702	3702	^\/sys\/(who|genid|data|upload|update)	2	0	0	1
+3703	3703	^a=(%[0-9A-Fa-f]{2})+\x26b=[0-9A-Za-z]+(%3[dD]){0,2}\x26c=(%[0-9A-Fa-f]{2})+$	2	0	0	1
+3704	3704	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3705	3705	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+3706	3706	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3707	3707	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3708	3708	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+3709	3709	^\/[a-z]+\/[a-z]+\.exe$	2	0	0	1
+3710	3710	\.php\?uid=\d{5,6}&ver=[^&]+(&traff=\d+)?$	2	0	0	1
+3711	3711	^Host\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+3712	3712	^[a-z]{4,12}=([A-Za-z0-9+/]{4})*[A-Za-z0-9+/]{3}=&[a-z]{4,12}=[A-Za-z0-9+/]{4}	2	0	0	1
+3713	3713	\/0[0-2](\/[^\/]*?)?\/0000[a-fA-F0-9]{4}(\/[^\/]*?)?\/[a-fA-F0-9]{8}(\?\w+=[a-fA-F0-9]+)?$	2	0	0	1
+3714	3714	^http\x3a\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/[a-z_-]+\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r?$	2	0	0	1
+3715	3715	^[C-J]\r\n	2	0	0	1
+3716	3716	^[A-Z]+$	2	0	0	1
+3717	3717	^(32|64)$	2	0	0	1
+3718	3718	\/$	2	0	0	1
+3719	3719	^[a-f0-9]+(\x20[a-f0-9]+)+$	2	0	0	1
+3720	3720	^\/-?[a-f0-9]{8,9}\/-?\d+(\.php|\/)$	2	0	0	1
+3721	3721	&_=\d+$	2	0	0	1
+3722	3722	&_=\d+$	2	0	0	1
+3723	3723	&_=\d+$	2	0	0	1
+3724	3724	^User-Agent\x3a[^\r\n]+\r\nHost\x3a[^\r\n]+\r\nCache-Control\x30442e9d036a40c8cbd41f8f4c9afab1ba\x20no-cache\r\n(\r\n)?$	2	0	0	1
+3725	3725	^\d+$	2	0	0	1
+3726	3726	^[a-z]=[a-f0-9]{80,}$	2	0	0	1
+3727	3727	\/[a-f0-9]{32}\.png$	2	0	0	1
+3728	3728	&(un)?key=[A-Z]+$	2	0	0	1
+3729	3729	\.php\?pn=[^&]+&s=[0-9]+&x=0\.[0-9]{7}$	2	0	0	1
+3730	3730	^\/([a-z]{4,9}\/[a-z]{4,12}\?[a-z]{4,7}\=[0-9]{5,7})$	2	0	0	1
+3731	3731	^\/p\?\d+(\x3b\d+){4}$	2	0	0	1
+3732	3732	^\/s\?\d+\x3b\d+\x3b\d{1,2}\.\d_(32|64)_\d+(\x3b\d+){4}$	2	0	0	1
+3733	3733	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3734	3734	\/[a-f0-9]{8}\/archive\/\d{8,10}\.html$	2	0	0	1
+3735	3735	\?[0-9a-f]{5,}=\d+&id=\d+&v=\d+$	2	0	0	1
+3736	3736	iid=[a-fA-F0-9]{32}&kernel=	2	0	0	1
+3737	3737	iid=[a-fA-F0-9]{32}&username=	2	0	0	1
+3738	3738	^[a-z]{2}\x3d[a-z0-9]+?[A-F0-9]+?$	2	0	0	1
+3739	3739	^\x2F[a-z]\x2Ephp\x3Fp\x3D[a-z0-9]{30,}$	2	0	0	1
+3740	3740	^\x2Ftrack\x2F\x3Fip\x3D\d&data\x3D	2	0	0	1
+3741	3741	\/\d{5}\/(<s1>[a-z]{3})[a-z]\.php\?(=s1)_id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3742	3742	^filename=[a-z]+?\.[a-z]+?&data=	2	0	0	1
+3743	3743	^Host\x3a[^\r\n]+\r\n(Connection\x3a\x20Keep-Alive\r\n)?(\r\n)?	2	0	0	1
+3744	3744	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+3745	3745	^\x0a([A-Za-z0-9/+]{4})*([A-Za-z0-9/+]{2}==|[A-Za-z0-9/+]{3}=|[A-Za-z0-9/+]{4})\x0a	2	0	0	1
+3746	3746	_W\d+\.[A-F0-9]+\/\d+\/[^\x2f]+\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/$	2	0	0	1
+3747	3747	x20InfoPath\x2e\d[^\x29]+$	2	0	0	1
+3748	3748	\/\d{4,}\.txt$	2	0	0	1
+3749	3749	\/([a-z]+|\d+)\.jpg	2	0	0	1
+3750	3750	\?[a-z0-9]{32}$	2	0	0	1
+3751	3751	[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+3752	3752	\.[a-z]{3,4}$	2	0	0	1
+3753	3753	\/[A-Za-z]{4,9}\.dot$	2	0	0	1
+3754	3754	\/get(_new)?\.php\?[a-zA-Z]{4,}=0\.[0-9]{10,}&key=[a-zA-Z0-9]{4,}$	2	0	0	1
+3755	3755	\/get(_new)?\.php\?[a-zA-Z]{4,}=0\.[0-9]{10,}&key=[a-zA-Z0-9]{4,}&pdf=[a-zA-Z]{4,}$	2	0	0	1
+3756	3756	^\/document\.php\?rnd=[0-9]{4}&id=[A-F0-9]{100,}$	2	0	0	1
+3757	3757	\/0[0-2](\/[^\/]*?)?\/0000[a-fA-F0-9]{4}(\/[^\/]*?)?\/[a-fA-F0-9]{8}(\?\w+=[a-fA-F0-9]+)?$	2	0	0	1
+3758	3758	^[a-zA-Z]{4,}=0\.[0-9]{10,}&jndj=[a-zA-Z0-9]{4,}$	2	0	0	1
+3759	3759	^[a-zA-Z]{4,}=0\.[0-9]{10,}&jndj=[a-zA-Z0-9]{4,}&ncm=[a-zA-Z]{4,}$	2	0	0	1
+3760	3760	^\/[a-f0-9]+000[a-f0-9]{37}$	2	0	0	1
+3761	3761	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3762	3762	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]/P	2	0	0	1
+3763	3763	\.php\?check=\d$	2	0	0	1
+3764	3764	^tekst=\w+$	2	0	0	1
+3765	3765	^User-Agent\x3a MSIE \d+\.\d+\r\n	2	0	0	1
+3766	3766	\/libso\d{1,4}\.php\?id=[a-zA-Z0-9]+$	2	0	0	1
+3767	3767	\/[0-9]{2}\.exe\?[0-9]$	2	0	0	1
+3768	3768	^\/0[a-f0-9]{48}$	2	0	0	1
+3769	3769	path=[A-Z]\x3a\x5c[A-F0-9]+\r\nlog=	2	0	0	1
+3770	3770	^(Connection\x0d\x0a)?\x0d\x0a$	2	0	0	1
+3771	3771	^[a-z0-9]{10,}$	2	0	0	1
+3772	3772	\?sid=[a-f0-9]{40}&cid=[0-9]$	2	0	0	1
+3773	3773	[A-F0-9]{8}(-[A-F0-9]{4}){2}-[A-F0-9]{8}	2	0	0	1
+3774	3774	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3775	3775	\/[A-Za-z]+\.php\?(id|token1|token2|C)=[A-Za-z0-9]	2	0	0	1
+3776	3776	^([a-zA-Z]*?\d)([a-z0-9]*?[A-Z])[a-zA-Z0-9+/]{30}	2	0	0	1
+3777	3777	^[a-z]{256}$	2	0	0	1
+3778	3778	^[abcdefghiklmnopqrstvxyz123456789]{62}\.aaaaaaaaaaaa	2	0	0	1
+3779	3779	^(Connection\x3a[^\r\n]+\r\n)?Accept\x3a[^\r\n]+\r\n(Accept-Encoding\x3a[^\r\n]+\r\n)	2	0	0	1
+3780	3780	\.php\?lid=[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}-[A-Z0-9]{4}$	2	0	0	1
+3781	3781	^[A-F0-9]{2}F4[A-F0-9]{2}0(1|2|3)[A-F0-9]{8}	2	0	0	1
+3782	3782	&m=\d$	2	0	0	1
+3783	3783	^[a-f0-9]{31}\x3B([a-zA-Z0-9+/=]+)?\r?$	2	0	0	1
+3784	3784	\?q=[a-f0-9]{32}$	2	0	0	1
+3785	3785	^(<id>[a-z])\x22\sname=\x22(=id)\x22>TVqQAA	2	0	0	1
+3786	3786	^version=\d{4}-\d{1,2}-\d{1,2}$	2	0	0	1
+3787	3787	[\x80-\xff]	2	0	0	1
+3788	3788	(xyz|pw)$	2	0	0	1
+3789	3789	^[A-Z0-9_-]+\.analytics-akadns\.com$	2	0	0	1
+3790	3790	^[A-Z0-9_-]+\.akamai-analytics\.com$	2	0	0	1
+3791	3791	^[A-Z0-9_-]+\.akamai-information\.com$	2	0	0	1
+3792	3792	^[A-Z0-9_-]+\.akamai-technologies\.com$	2	0	0	1
+3793	3793	^[A-Z0-9_-]+\.sync-akamai\.com$	2	0	0	1
+3794	3794	^\/[^\r\n]+\.php\?[a-f0-9]{32}+$	2	0	0	1
+3795	3795	^.{0,15}[^\x20-\x7e\r\n]	2	0	0	1
+3796	3796	\?---[A-Z]$	2	0	0	1
+3797	3797	^\/help(me)?\.bmp$	2	0	0	1
+3798	3798	\/[a-z0-9]{16}\.php\?ufw=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3799	3799	(BrowsingHistoryView|WebBrowserPassView)\.exe$	2	0	0	1
+3800	3800	[\x80-\xff]	2	0	0	1
+3801	3801	\.php\?a=\d{5,10}.+\x3a\d\x3a\d\x3a\d\.\d\x3a\d$	2	0	0	1
+3802	3802	=8ACEFC[0-9A-F]{150,}$	2	0	0	1
+3803	3803	\?[a-f0-9]{32}$	2	0	0	1
+3804	3804	^ps0=[A-F0-9]+\&ps1=[A-F0-9]+($|\&[a-z]s\d=)	2	0	0	1
+3805	3805	\.php\?computerid=[a-fA-F0-9]{32}&(public|private)=\d$	2	0	0	1
+3806	3806	^[^_]+_[^\_]+_[A-F0-9]{10}_[0-9]{2}-[0-9]{2}-20[0-9]{2}\s[0-9]{1,2}\.[0-9]{1,2}\.[0-9]{1,2}\.	2	0	0	1
+3807	3807	\/(tr(_w)?|ft)\.so$	2	0	0	1
+3808	3808	^([a-zA-Z0-9+/\x20]{4})*([a-zA-Z0-9+/\x20]{2}==|[a-zA-Z0-9+/\x20]{3}=|[a-zA-Z0-9+/\x20]{4})$	2	0	0	1
+3809	3809	^\/v\d+\/lady_[ix]	2	0	0	1
+3810	3810	\/(IUpdate|fbclient|IETask|Mixeds|Ubuntu10)\.dll$	2	0	0	1
+3811	3811	\?action=\d(&botId=[A-F0-9]{32})?$	2	0	0	1
+3812	3812	^[^&]+?\.html\?s=[^&]+?&d=$	2	0	0	1
+3813	3813	\/victim\.php\?info=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&ip=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3814	3814	\/savekey\.php\?file=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&id=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3815	3815	\/images\/.*_2[FB].*\.(avi|gif|bmp|jpeg|png)$	2	0	0	1
+3816	3816	^[A-F0-9]{8}$	2	0	0	1
+3817	3817	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a)?	2	0	0	1
+3818	3818	[A-Za-z]{1,10}=[A-Za-z0-9_+\x2d\x2e]	2	0	0	1
+3819	3819	^\/kb\/\d{4,8}$	2	0	0	1
+3820	3820	\.[a-z]{3}\?[a-z]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3821	3821	^[a-zA-Z]{7}=([A-Za-z0-9+/]|%2[FB]){2}AAAA[a-z]A[^\s=]+=?$	2	0	0	1
+3822	3822	END\x20CERTIFICATE-----$	2	0	0	1
+3823	3823	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+3824	3824	^get=\d+($|&)	2	0	0	1
+3825	3825	^(Mozilla\/|Shockwave)	2	0	0	1
+3826	3826	=11&[^&]{1,7}2[^&]{6,12}&[^&]{1,7}410&[^&]{1,7}650&[^&]{1,7}51$	2	0	0	1
+3827	3827	(\x20MSIE\x20|rv\x3a11)	2	0	0	1
+3828	3828	^id=[0-9A-Z]+&count=	2	0	0	1
+3829	3829	^guid=[^&]+?&ver=[^&]+?(&fc=[^\r\n]+)?$	2	0	0	1
+3830	3830	\.php\?rid=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3831	3831	^machine=[^&]+$/Pi	2	0	0	1
+3832	3832	\.(arm(5n|7)?|m(ips|psl))$	2	0	0	1
+3833	3833	[a-z]+\.php\?aid=\d+&sid=[a-z0-9]+$	2	0	0	1
+3834	3834	^\/oscp\/[a-z]+$	2	0	0	1
+3835	3835	\/(countdown|check)\/[a-f0-9]{30,45}\/([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})?$	2	0	0	1
+3836	3836	\.php\?key=[^\r\n]+&string=[^\r\n]+?(\x3a\x3a[^\x3a]+?){5,}$	2	0	0	1
+3837	3837	\.php\?key=[^\r\n]+&string=[^\r\n]+?((\x3a\x3a|3A3A)[^\x3a]+?){5,}$	2	0	0	1
+3838	3838	^((Passwords|PCinformation)\.txt|(Data|GrabbedTxtFiles)\.zip)\x22\r\n	2	0	0	1
+3839	3839	\/[a-z]+2\.php\?jpg=[^&]+$	2	0	0	1
+3840	3840	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$	2	0	0	1
+3841	3841	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$	2	0	0	1
+3842	3842	\.php\?Hwid=[^&]+[0-9](&(Pc|Etat)=[^&]+)?(&user=[^&]+&Ip=[^&]+&Ping=[^&]+&v=[^&]+&Ville=[^&]+&Pays=[^&]+&Region=[^&]+)?$	2	0	0	1
+3843	3843	\.php\?[a-z]{3,8}=[a-f0-9]{16}[01][a-z]+$	2	0	0	1
+3844	3844	^((a((lbu|d)m|ccount|uthor)|c(ont(ac|en)|lien)t|p(artners|hoto)|(memb|us)er|session|video|hash|key|id)=[a-z0-9]{6,12}&){4}	2	0	0	1
+3845	3845	\.(aspx|txt)\?[a-z0-9]{3}=[a-f0-9]{32}&[a-z0-9]{3}=[^&]+&[a-z0-9]{3}=[a-f0-9]{32}$	2	0	0	1
+3846	3846	\.php\?string=[a-zA-Z0-9+=]+$	2	0	0	1
+3847	3847	^([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})$	2	0	0	1
+3848	3848	^c=[A-F0-9]{10,}&v=[^&]+&h=[^&]+&t=[0-9]$	2	0	0	1
+3849	3849	^([a-f0-9]{30,60})$	2	0	0	1
+3850	3850	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3851	3851	\x26affid\x3D[0-9]{4,7}$	2	0	0	1
+3852	3852	[\x80-\xff]{16}	2	0	0	1
+3853	3853	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+3854	3854	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}	2	0	0	1
+3855	3855	^[0-9a-f]{4,8}\x3d\x2d?\d+(&id\x3d\d+)?$	2	0	0	1
+3856	3856	^[A-Z0-9]{18}$	2	0	0	1
+3857	3857	^[a-z]{3,4}\x2F[a-f0-9]{24}$	2	0	0	1
+3858	3858	^\/[a-z0-9]{1,10}\/?\?.+?$	2	0	0	1
+3859	3859	\/[a-z0-9A-Z]\.exe$	2	0	0	1
+3860	3860	^\d+$	2	0	0	1
+3861	3861	^\d+$	2	0	0	1
+3862	3862	^\/[a-z0-9+\/=]{16,400}$	2	0	0	1
+3863	3863	&s=\{?[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}\}?(&|$)	2	0	0	1
+3864	3864	^(cache|logs)\/[^\x2f]+\.(exe|dll|doc|bin)$	2	0	0	1
+3865	3865	^\/[a-z0-9.&-]+([a-z0-9]{4}-){3}[a-z0-9.&+-]+$	2	0	0	1
+3866	3866	=\d+$	2	0	0	1
+3867	3867	\/[A-Z0-9]+\.[aj]sp\?[a-zA-Z0-9+/\x20=]+$	2	0	0	1
+3868	3868	\.php\?w=\d+&i=[0-9a-f]{32}&a=\d+$	2	0	0	1
+3869	3869	\?action=\w+gen&v=\d	2	0	0	1
+3870	3870	\/counter(\?[a-z]?\d{1,2}|[^\x2f]*\d\.exe|.*?[]([A-Za-z_-]{0,200}[0-9][A-Za-z_-]{0,200}[0-9])([A-Z0-9_-]{0,200}[a-z][A-Z0-9_-]{0,200}[a-z])([a-z0-9_-]{0,200}[A-Z][a-z0-9_-]{0,200}[A-Z])[A-Za-z0-9_-]{50,}(&|$)	2	0	0	1
+3871	3871	^[^\r\n]+\.(jpe?g|gif|png)\r\n	2	0	0	1
+3872	3872	^\/report[0-9]?_(v[0-9])?[A-Z]?[A-F0-9_-]+_[0-9]{1,3}_(st(arted|ep)|already|mark|p(rocess|a(ge|yload))|watch2|http|image|gdiplus|crc|DIRRR|finished|(ex(cept|ecuted)))	2	0	0	1
+3873	3873	\/[a-z]+\.php\?[A-F0-9]{250,}$	2	0	0	1
+3874	3874	^Accept\x3a\x20text\/\*,\x20application\/\*\r\nUser-Agent\x3a\x20[^\r\n]+\r\n(Pragma|Cache-Control)\x3a\x20no-cache\r\nConnection\x3a Keep-Alive\r\nHost\x3a[^\r\n]+?\r\n(\r\n)?$	2	0	0	1
+3875	3875	^[A-F0-9]{250,}$	2	0	0	1
+3876	3876	^\d+?$	2	0	0	1
+3877	3877	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3878	3878	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}	2	0	0	1
+3879	3879	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+3880	3880	^\/debug\/trace\/(Fw(Downloaded|Check)|N(oFw|sis))$	2	0	0	1
+3881	3881	^\/[a-z]+\.php\?num=\d+&rev=	2	0	0	1
+3882	3882	^[A-Za-z0-9]{14,15}$	2	0	0	1
+3883	3883	^\d{2}$	2	0	0	1
+3884	3884	\.php\?v\x3d\d+?\x26rs\x3d((\d+?\x2d){3})?\d+?\x26n\x3d\d	2	0	0	1
+3885	3885	^(<vname>[^\r\n\x3a]+)(<n1>[0-4])\x3a\x20\d+\r\n(=vname)(<n2>(((=n1))[0-4]))\x3a\x20\d+\r\n(=vname)(<n3>((((=n1)|(=n2)))[0-4]))\x3a\x20\d+\r\n(=vname)((((=n1)|(=n2)))[0-4])\x3a\x20\d+\r\n	2	0	0	1
+3886	3886	\/counter\/\?id=[A-Z0-9_-]{60,}&rnd=\d{1,}$	2	0	0	1
+3887	3887	^[0-9a-f]{32}\.php	2	0	0	1
+3888	3888	^[A-F0-9]{30}	2	0	0	1
+3889	3889	^[a-f0-9]{24}$	2	0	0	1
+3890	3890	^\x00\x00\x00[\x72-\x74]	2	0	0	1
+3891	3891	(\d{1,3}\.){3}\d{1,3} (\d{1,3}\.){3}\d{1,3} \x3a(Linux|FreeBSD|SunOS)	2	0	0	1
+3892	3892	^\d+[\x22\x27]	2	0	0	1
+3893	3893	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3894	3894	^[0-9]{2,3}\x00\x6c\x6c(<var>[\x20-\x2f\x30-\x39\x3a-\x40\x5b-\x60\x7b-\x7e][\x20-\x7e]+?[\x20-\x2f\x30-\x39\x3a-\x40\x5b-\x60\x7b-\x7e])	2	0	0	1
+3895	3895	^(-[0-9]+|[A-F0-9]{32})=1&type=txt$	2	0	0	1
+3896	3896	^([a-f0-9]{2}-){5}[a-f0-9]{2}	2	0	0	1
+3897	3897	^[a-f0-9]{18}\x22	2	0	0	1
+3898	3898	^(<id>[a-z])\x22\sname=\x22(=id)\x22>[a-zA-Z0-9+/=]{28}	2	0	0	1
+3899	3899	^[A-Za-z0-9]{10,}[\-\)\(]{1,2}	2	0	0	1
+3900	3900	data=[a-zA-Z0-9\+\/]{64}/P	2	0	0	1
+3901	3901	<root><clnt>\d{8}-\d{4}-\d{4}-\d{4}-[0-9A-F]{12}</clnt><code>CheckUpdate</code>/P	2	0	0	1
+3902	3902	\d{2}\x7C\d{1,3}\x7C\d{1,3}http\x3A\x2F\x2F	2	0	0	1
+3903	3903	^X-ID\x3a\x20\d+\r?$/Hm	2	0	0	1
+3904	3904	\/ff\.ie\?rnd=\x2d?\d	2	0	0	1
+3905	3905	c=[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}-[a-z0-9]{2}	2	0	0	1
+3906	3906	^.{2}(<fake_org>([asdfgh]+|[qwerty]+|[zxcvbn]+|[23werf]+)[01]).+?\x06\x03\x55\x04\x0a.{2}(=fake_org)	2	0	0	1
+3907	3907	^\d{1,6}\x00msg\x7c	2	0	0	1
+3908	3908	^\/counter\/\?([a-z]=(0\.\d{8}|1[A-Z0-9a-z]+))+&r=\d+$	2	0	0	1
+3909	3909	[^A-Za-z0-9+/]TVqQA	2	0	0	1
+3910	3910	\/im(age|g)\.php\?id=\d+$	2	0	0	1
+3911	3911	^.{1,1000}p([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?(\^([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])?)?o([\x22\x27]\s*[\x26\x2b]\s*[\x22\x27])	2	0	0	1
+3912	3912	^(-[0-9]+|[A-F0-9]{32})=1$	2	0	0	1
+3913	3913	^([a-z0-9]{0,19}[A-Z])(([A-Z0-9]{0,19}[a-z])|([A-Za-z]{0,19}\d)|([A-Z]+\.))[a-zA-Z0-9]{3,20}[\x2e\x20][a-z]{2,3}$	2	0	0	1
+3914	3914	^.{0,15}[^\x20-\x7e\r\n]	2	0	0	1
+3915	3915	^\d{30}\w{6}-\d{2}-\d{3}-\d{9}$	2	0	0	1
+3916	3916	(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+3917	3917	^[a-zA-Z0-9/+]{171}=	2	0	0	1
+3918	3918	ms-?office	2	0	0	1
+3919	3919	^(Connection\r\n)?\r\n$	2	0	0	1
+3920	3920	^(Connection\r\n)?\r\n$	2	0	0	1
+3921	3921	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3922	3922	^[0-9]+lu[0-9]+d[0-9]+$	2	0	0	1
+3923	3923	^[a-f0-9]{16}$	2	0	0	1
+3924	3924	^[a-z0-9_\/+-]{1000}	2	0	0	1
+3925	3925	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3926	3926	^\d{4,8}$	2	0	0	1
+3927	3927	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3928	3928	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3929	3929	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3930	3930	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3931	3931	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3932	3932	^[\x00-\x01]\x00.\x00[\x00-\x01]\x00.\x00.{4}\x01\x00.\x00{3}.{48}\x05\x00{3}	2	0	0	1
+3933	3933	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3934	3934	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3935	3935	^[\x00-\x01]\x00.\x00{3}	2	0	0	1
+3936	3936	^[\x00-\x01]\x00.\x00[\x00-\x01]\x00.\x00.{4}\x01\x00.\x00{3}.{48}\x05\x00{3}	2	0	0	1
+3937	3937	^Host\x3a\x20[^\r\n]+\r\n(Connection\x3a\x20Keep-Alive\r\n)?(\r\n)?$	2	0	0	1
+3938	3938	^(WOW64\x3b\s)?Trident\/[457]\.0\x3b\s*SLCC2\x3b\s\.NET\sCLR\s2\.0\.50727\x3b\s\.NET\sCLR\s3\.5\.30729\x3b\s(\x20\.NET\x20CLR\x203\.5\.30729\x3b\s)?\.NET\sCLR\s3\.0\.30729\x3b\sMedia\sCenter\sPC\s6\.0\x3b\s\.NET4\.0C\x3b\s\.NET4\.0E(\.NET4\.0E(\x3b\s)?)?(\x3b\sInfoPath\.3)?\)$	2	0	0	1
+3939	3939	^[a-z0-9]+\.(biz|com|net|org)	2	0	0	1
+3940	3940	\/wp-(content|admin|includes)\/	2	0	0	1
+3941	3941	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3942	3942	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3943	3943	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3944	3944	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3945	3945	^[A-Za-z0-9\/\-\+]{40,}\.=auth\.	2	0	0	1
+3946	3946	^[A-Za-z0-9\/\-\+]{10,}\.=connect\.	2	0	0	1
+3947	3947	^[A-Za-z0-9\/\-\+]{10,}AAAA--\.	2	0	0	1
+3948	3948	^[A-Z]{2}-[0-9]{1,5}\x3aEnd(\x3a[0-9]{1,5})?$	2	0	0	1
+3949	3949	^[a-z0-9]{8}	2	0	0	1
+3950	3950	^(\d{1,3}\.)\d{1,3}$	2	0	0	1
+3951	3951	^\/[a-z]\.php\?query=[a-f0-9]{32}$	2	0	0	1
+3952	3952	^[A-F0-9]{50,}$	2	0	0	1
+3953	3953	^([A-Z0-9+\/]{4})*([A-Z0-9+\/]{2}==|[A-Z0-9+\/]{3}=|[A-Z0-9+\/]{4})$	2	0	0	1
+3954	3954	^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$	2	0	0	1
+3955	3955	^data=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+3956	3956	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+3957	3957	^(<js>\$[a-z0-9]{1,15})\s*=\s*\[System\.Text\.Encoding\]::ASCII\.GetString\(\[System\.Convert\]::FromBase64String\((=js)\)\)\s*Set-Content\s*(-Path\s*C:\\Windows\\Temp\\[a-z0-9]{1,15}\.[a-z0-9]{2,4}\s*|-Value\s*(=js)\s*|-Encoding\s*ASCII){3}	2	0	0	1
+3958	3958	^(<content>\[a-z0-9]{1,15})\s*=\s*\[System\.Convert\]::FromBase64String\(\$[a-z0-9]{1,15}\)\s*Set-Content\s*(-Path\s*C:\\Windows\\Temp\\[a-z0-9]{1,15}\.vbe\s*|-Value\s*(=content)\s*|-Encoding\s*Byte){3}	2	0	0	1
+3959	3959	^[a-zA-Z0-9\x21\x2a\x2f\x2e\x3b\x3a\x5b\x5d\x7b\x7d]+$	2	0	0	1
+3960	3960	^[0-9]{3,5}\s*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+3961	3961	^[a-z0-9]{3,10}$	2	0	0	1
+3962	3962	^[a-z0-9]{5,30}$	2	0	0	1
+3963	3963	^\d{3,15}$	2	0	0	1
+3964	3964	^\/([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3965	3965	^[a-z]{3,10}=[a-z0-9]+$	2	0	0	1
+3966	3966	^[a-z]{3,10}=[a-z0-9]+$	2	0	0	1
+3967	3967	^[a-z]{3,10}=[a-z0-9]+$	2	0	0	1
+3968	3968	^\.(space|press|website)$	2	0	0	1
+3969	3969	^\/hyllkjit\/[a-f0-9]{8}\/\?n=\d{4,10}$	2	0	0	1
+3970	3970	^9([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+3971	3971	^(\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(?<pushvar>\.push\x28\x22)(\x22|[\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)([\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)([\x20-\x7e]{0,70}\x22)\x29\x3b\s*[^\.]+(=pushvar)	2	0	0	1
+3972	3972	^lessie(\/[0-9]\.0)?$	2	0	0	1
+3973	3973	^Cakle(\/[0-9]\.0)?$	2	0	0	1
+3974	3974	^Damien(\/[0-9]\.0)?$	2	0	0	1
+3975	3975	^Solar(\/[0-9]\.0)?$	2	0	0	1
+3976	3976	^muhstik(-scan)?(\/[0-9]\.0)?$	2	0	0	1
+3977	3977	^Shaolin(\/[0-9]\.0)?$	2	0	0	1
+3978	3978	^Rift(\/[0-9]\.0)?$	2	0	0	1
+3979	3979	^Tsunami(\/[0-9]\.0)?$	2	0	0	1
+3980	3980	^Yowai(\/[0-9]\.0)?$	2	0	0	1
+3981	3981	^Yakuza(\/[0-9]\.0)?$	2	0	0	1
+3982	3982	^Hentai(\/[0-9]\.0)?$	2	0	0	1
+3983	3983	\/[A-Za-z0-9]{2,8}[-_][a-zA-Z0-9-_]+\/\?InvoiceType=Regular&date=[0-9-_]+$	2	0	0	1
+3984	3984	^[A-F0-9]+\x2d\x2d\x3e(\r\n)?$	2	0	0	1
+3985	3985	^CN=(help|g(ui(de|ld)|round))\.domainoutlet\.site$	2	0	0	1
+3986	3986	^CN=((jasper|qwe|alter|car|param|bike|genwar)\.)?drivethrough\.top$	2	0	0	1
+3987	3987	^CN=((justin|digest)\.)?drinkeatgood\.space$	2	0	0	1
+3988	3988	^\d	2	0	0	1
+3989	3989	^\/[a-zA-Z0-9]{1,19}\/?\?[abdefijhgv\x22](\x7C\x2d?\d+?[^\\\*\+\=\|\:\;\x22\?\<\>\,\#][a-zA-Z0-9-!@#\%^&\(\)\x20_{}\.~]{1,14})?$	2	0	0	1
+3990	3990	^\/(<n>\d)(=n){1,2}$	2	0	0	1
+3991	3991	\/\d+$	2	0	0	1
+3992	3992	^\/[a-f0-9]{7,8}\/[a-f0-9]{7,8}\/$	2	0	0	1
+3993	3993	^GET\x20\/[A-F0-9]{32}\x20HTTP\/1\.1\r\nHost\x3a\x20[^\r\n]+\r\n\r\n$	2	0	0	1
+3994	3994	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+3995	3995	_[A-F0-9]{12}\.jpg$	2	0	0	1
+3996	3996	_[A-F0-9]{12}&filename=\w{1,20}\.jpg$	2	0	0	1
+3997	3997	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+3998	3998	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+3999	3999	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+4000	4000	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4001	4001	^[0-9]{3}$	2	0	0	1
+4002	4002	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4003	4003	^.+(IlR5cGUiO|JUeXBlIj|iVHlwZSI6)	2	0	0	1
+4004	4004	\.jpg\?v=\d+&d=(\d{8}T\d{6}Z)([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+4005	4005	^\/[^\x2f]+\/pops[a-z]?\.php$	2	0	0	1
+4006	4006	\.php\?s=\d+&cn=	2	0	0	1
+4007	4007	^[a-z]{4,10}\.freemooon\.org$	2	0	0	1
+4008	4008	[a-z]{4,10}\.olimpian\.org$	2	0	0	1
+4009	4009	[a-z]{4,10}\.sunsay\.biz$	2	0	0	1
+4010	4010	[a-z]{4,11}\.feellgood\.org$	2	0	0	1
+4011	4011	[a-z]{4,11}\.kinomix\.org$	2	0	0	1
+4012	4012	[a-z]{4,10}\.beneton\.biz$	2	0	0	1
+4013	4013	[a-z]{4,10}\.bigdoggi\.biz$	2	0	0	1
+4014	4014	[a-z]{4,10}\.bjksfohseaguu\.org$	2	0	0	1
+4015	4015	[a-z]{4,10}\.closedoors\.net$	2	0	0	1
+4016	4016	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4017	4017	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4018	4018	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4019	4019	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4020	4020	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$	2	0	0	1
+4021	4021	^(www|bbs|cms|down|up|file|ftp)	2	0	0	1
+4022	4022	\/log\/proc\.php.key=[a-z0-9]{11}	2	0	0	1
+4023	4023	code=[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}-[0-9a-f]{2}	2	0	0	1
+4024	4024	x=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+4025	4025	mac=[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}-[a-f0-9]{2}	2	0	0	1
+4026	4026	^RAV\d\.\d\d	2	0	0	1
+4027	4027	^([a-z0-9:.,]{3,10}\s){50,}[a-z0-9:.,]{3,10}\s*$	2	0	0	1
+4028	4028	^[a-zA-Z0-9]{20}	2	0	0	1
+4029	4029	\x2E(p(hp|ng)|jpe?g|cgi|gif)\x3F(v\d{1,2}|pr)\x3D	2	0	0	1
+4030	4030	\/\?rnd=\d+&id=\d+$	2	0	0	1
+4031	4031	port=[1-9]{1,5}	2	0	0	1
+4032	4032	\/getfile\.php\?r=-?\d+&p=	2	0	0	1
+4033	4033	\/manda\.php\?id=(-)?\d{8,10}&v=\w	2	0	0	1
+4034	4034	\/\?id(\d+)?&rnd=\d+$	2	0	0	1
+4035	4035	\.php\?hdr_ctx=[0-9]{1,5}_[0-9]{1,5}$	2	0	0	1
+4036	4036	^\/\d+\.functions$	2	0	0	1
+4037	4037	\/\d{10}$	2	0	0	1
+4038	4038	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4039	4039	^[A-F0-9]{100,}$	2	0	0	1
+4040	4040	^\d	2	0	0	1
+4041	4041	^\/[a-z-_]+?\.(php|html)$	2	0	0	1
+4042	4042	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4043	4043	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+4044	4044	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4045	4045	^data=[a-zA-Z0-9+\/]{64}	2	0	0	1
+4046	4046	^\d{4}$	2	0	0	1
+4047	4047	\.(jpg|png|gif)\?v[0-9]{1,2}=[0-9]+&tq=	2	0	0	1
+4048	4048	^\/[mp]od[12]\/[^\/]+?\.exe$	2	0	0	1
+4049	4049	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4050	4050	\/[0-9]{2}\.exe$	2	0	0	1
+4051	4051	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+4052	4052	[\x80-\xff]	2	0	0	1
+4053	4053	\.(me|net)$/W	2	0	0	1
+4054	4054	\/[A-Z]?[a-z]{1,3}[0-9]?\.exe$	2	0	0	1
+4055	4055	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4056	4056	^[a-z]\.	2	0	0	1
+4057	4057	^((malwarehuntertea|nomoreranso)m|politiaromana|ransomware|carder)\.(bit|coin)$	2	0	0	1
+4058	4058	^((malwarehuntertea|nomoreranso)m|politiaromana|ransomware|carder)\.(bit|coin)$	2	0	0	1
+4059	4059	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4060	4060	^m=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+4061	4061	^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))&[A-Za-z0-9-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))(&sql=\d*)?$	2	0	0	1
+4062	4062	\/[0-9]{10}.php1$	2	0	0	1
+4063	4063	^[A-F0-9]{10,}(BBZ|BBY)[A-F0-9]{,1000}$	2	0	0	1
+4064	4064	^[A-F0-9]{10,}$	2	0	0	1
+4065	4065	^[A-F0-9]{10,}$	2	0	0	1
+4066	4066	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+4067	4067	^\/d[0-9]?\.php\?check$	2	0	0	1
+4068	4068	^\/d[0-9]?\.php\?servers$	2	0	0	1
+4069	4069	^\/[a-z]\.php\?check=[a-f0-9]{32}$	2	0	0	1
+4070	4070	^[a-f0-9]{8}$	2	0	0	1
+4071	4071	\.aspx\?m=[A-F0-9]{3,40}&i=[A-F0-9]{3,40}&p=[A-F0-9]{3,40}$	2	0	0	1
+4072	4072	^([\x3a\x2c\x2e]?[A-Za-z0-9]{1,8}[\x3a\x2c\x2e]?[\x3a\x2c\x2e]?\s*){50,}$	2	0	0	1
+4073	4073	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4074	4074	^[a-z]{1,10}=[A-Z]+(&[a-z]{1,10}=[A-Z]+){2,}$	2	0	0	1
+4075	4075	^[A-F0-9]{16}$	2	0	0	1
+4076	4076	\/rpt\d	2	0	0	1
+4077	4077	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4078	4078	^\/fbot\.arm\d{1}\.u$	2	0	0	1
+4079	4079	^\/[A-F0-9]{30,60}\/1\/0\/0$	2	0	0	1
+4080	4080	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4081	4081	^[A-F0-9]+$	2	0	0	1
+4082	4082	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+4083	4083	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+4084	4084	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+4085	4085	^POST\s(<urivar>\/([a-z]{2,25}\/){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(=urivar)\r\n	2	0	0	1
+4086	4086	^[a-z0-9\-\.]{1,60}\.ssmailer\.com$	2	0	0	1
+4087	4087	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4088	4088	^[a-z]=[a-f0-9]{80,}$	2	0	0	1
+4089	4089	^Mozilla\/\d+\.\d+\x20\x28compatible\x3b\x20MSIE\x20\d+\.\d+\x3b\x20Windows\x20NT\x20\d+\.\d+\x3b\x20SV1\x29$	2	0	0	1
+4090	4090	^php.{0,500}[\x80-\xff]	2	0	0	1
+4091	4091	^[a-zA-Z0-9_-]{2,6}=[a-zA-Z0-9_-]+(\x3b\x20[a-zA-Z0-9_-]{2,6}=[a-zA-Z0-9_-]+){1,6}={0,2}?$	2	0	0	1
+4092	4092	^[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(&[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$	2	0	0	1
+4093	4093	^[A-F0-9]{8}_[A-F0-9]{8}\.sql	2	0	0	1
+4094	4094	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+4095	4095	\/[a-z-_]{75,}\.php$	2	0	0	1
+4096	4096	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4097	4097	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4098	4098	^[^\x20-\x7e\r\n]{2}$	2	0	0	1
+4099	4099	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+4100	4100	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4101	4101	^\/\?([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4102	4102	^[a-zA-Z0-9=/&?\x2e-]+$	2	0	0	1
+4103	4103	^\d{5,10}$	2	0	0	1
+4104	4104	^[a-z0-9/%=]{100,}$	2	0	0	1
+4105	4105	\/[a-z0-9]+\/[a-z0-9]+\.exe$	2	0	0	1
+4106	4106	^[a-zA-Z0-9]+$	2	0	0	1
+4107	4107	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[A-Za-z]+?	2	0	0	1
+4108	4108	^.([a-z0-9+/]*?[A-Z])([A-Z0-9+/]*?[a-z])([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\.29a\.de$	2	0	0	1
+4109	4109	(^|\.)en-content\.com$	2	0	0	1
+4110	4110	ch=1$	2	0	0	1
+4111	4111	^\/\?ptrxcz_[a-z0-9A-Z]{30}$	2	0	0	1
+4112	4112	[a-z]{2}\.CAB.bin	2	0	0	1
+4113	4113	\.php\?(print_)?receipt=(s00|\d{3})_\d+$	2	0	0	1
+4114	4114	^sleep \d+[\r\x2c]	2	0	0	1
+4115	4115	\.php\?id=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}&os=\d\.\d[^&]*&bot_id=	2	0	0	1
+4116	4116	\.php\?id=[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}-(\d{1,3}\.){3}\d{1,3}&gr	2	0	0	1
+4117	4117	\(b\x3a\d+?\x3bc\x3aAMD-	2	0	0	1
+4118	4118	\(b\x3a\d+?\x3bc\x3aINT-	2	0	0	1
+4119	4119	^\/uploading\/id=\d{2,20}&u=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4120	4120	user=[a-f0-9]{31,32}&	2	0	0	1
+4121	4121	^$	2	0	0	1
+4122	4122	\/gate\.php\?reg=([a-z]{10}|[A-Za-z]{15})$	2	0	0	1
+4123	4123	\(b\x3a\d+?\x3bc\x3a[^\x3b]+AuthenticAMD\x3b	2	0	0	1
+4124	4124	\(b\x3a\d+?\x3bc\x3a[^\x3b]+GenuineIntel\x3b	2	0	0	1
+4125	4125	\?hostid=[0-9A-F]+?&	2	0	0	1
+4126	4126	^\/[a-z0-9]{3,}\/upload\/img\.jpg$	2	0	0	1
+4127	4127	\.php\?[a-zA-Z0-9]+[a-zA-Z0-9]+?&[a-zA-Z0-9]+([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4})(&[a-zA-Z0-9]+[a-f0-9]{32}){2}$	2	0	0	1
+4128	4128	\.php\?ver=\d\&cver=\d\&id=\d{5}$	2	0	0	1
+4129	4129	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4130	4130	^\x2Flts\x2Etxt$	2	0	0	1
+4131	4131	\/\d\d[A-F0-9]{4}0000\/log$	2	0	0	1
+4132	4132	\/[a-z]{2,3}\/(\d{3,4}x\d{3,4}|default)\.bmp\.gz$	2	0	0	1
+4133	4133	\/cp\/\?(logo\.jpg|adm)	2	0	0	1
+4134	4134	\x2Fping\x2Ehtml\x3Fr\x3D[0-9]{5,14}$	2	0	0	1
+4135	4135	^g=[A-Z0-9]+&cmd=	2	0	0	1
+4136	4136	&arg2=(([a-f0-9]{32})|([A-Za-z0-9\x2b\x2f]{4})*([A-Za-z0-9\x2b\x2f]{2}==|[A-Za-z0-9\x2b\x2f]{3}=|[A-Za-z0-9\x2b\x2f]{4}))(&|$)	2	0	0	1
+4137	4137	filename=[a-f0-9]{13}\.file\r\n	2	0	0	1
+4138	4138	\/monitor\.php\?resp=ID\x3a[A-Za-z]{15}	2	0	0	1
+4139	4139	\/gate\.php\?cmd=(get(installconfig|exe)|urls)$	2	0	0	1
+4140	4140	\.php\?(q|name)=	2	0	0	1
+4141	4141	^\x2F(acheb|bajree|cyacrin|dauber|eaves)\x2Easpx\x3FRandom\x3D[a-z]{16}$	2	0	0	1
+4142	4142	^\/201\d{5,8}\/\d{6,11}\/\d{5,10}\.jsp$	2	0	0	1
+4143	4143	\.php\?a1=\d+&a2=([0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}-[0-9A-Fa-f]{2}|([A-Za-z0-9\+\/]{4})*([A-Za-z0-9\+\/]{2}==|[A-Za-z0-9\+\/]{3}=|[A-Za-z0-9\+\/]{4}))(&a\d+=[^&]+)+$	2	0	0	1
+4144	4144	&HD=[A-F0-9]{32}&	2	0	0	1
+4145	4145	&id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&os=	2	0	0	1
+4146	4146	\.asp\?MAC=[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}-[A-F0-9]{2}&VER=[^&]+$	2	0	0	1
+4147	4147	\/log\?(start|install)\x7caid=	2	0	0	1
+4148	4148	\.php\?user=[a-f0-9]{32}&id=\d+&type=\d+($|&)	2	0	0	1
+4149	4149	^\/post\.aspx\?[^&]+=[0-9]{9,10}$	2	0	0	1
+4150	4150	^\/j\/[a-f0-9]{8}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{4}[\x2d\x5f]?[a-f0-9]{12}\/0001\/?$	2	0	0	1
+4151	4151	^\x2Fel\x2Fsregister\x2Ephp\x3Fname\x3D[a-f0-9]{32}$	2	0	0	1
+4152	4152	^\x2Fel\x2Fslogin\x2Ephp\x3Fuid\x3D[a-f0-9]{32}$	2	0	0	1
+4153	4153	\.php\?m=[A-F0-9]{12}	2	0	0	1
+4154	4154	&rvz1=\d+&rvz2=\d+?$	2	0	0	1
+4155	4155	^\/getc(loud|onf)\/\?c=	2	0	0	1
+4156	4156	^\/home\/index\.asp\?typeid=(1[13]?|[3579])$	2	0	0	1
+4157	4157	\/tasksz\.php\?(dc|load)	2	0	0	1
+4158	4158	^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3Ffile(index\x3D[A-Z]|n\x3Dnoexist|wh\x3Dfalse)	2	0	0	1
+4159	4159	^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3FRe\x3D	2	0	0	1
+4160	4160	^\x2F[^\x2F]+\x2Fin(fo|dex)\x2Ephp\x3Fverify\x3D	2	0	0	1
+4161	4161	\.asp\?IDPC=[^\x26]*?\x26(Status=|Msg=)[^\x26]*?$	2	0	0	1
+4162	4162	^OPC=\d	2	0	0	1
+4163	4163	^\/[^\x2f]+?\.hlp$	2	0	0	1
+4164	4164	^\/(components|wp-content|tmp)/api/[a-zA-Z0-9\/\x20]{43}=\/(toll|inv|notice|get_label)$	2	0	0	1
+4165	4165	&build_id=[A-F0-9]+$	2	0	0	1
+4166	4166	^&op=\d{1,2}&id=\w+?&ui=.+?&bv=\d{1,2}\.\d{1,2}($|&)	2	0	0	1
+4167	4167	\/vtris\d?\.php\?srs=\d{1,10}$	2	0	0	1
+4168	4168	\/soft(32|64)\.dll$	2	0	0	1
+4169	4169	\/ord\/[^\x2f]+?\.exe$	2	0	0	1
+4170	4170	\/zConfig\/\d+$	2	0	0	1
+4171	4171	\/zImprimer\/\d+-	2	0	0	1
+4172	4172	\/enc\/1$	2	0	0	1
+4173	4173	^\/p\/(p(hphphphphphphp|thon)|(dropytho|admmmom)n|u(pdata-server|dom)|eyewheye|joompler|rubbay|tempzz)	2	0	0	1
+4174	4174	[a-z]\d{2}$	2	0	0	1
+4175	4175	\/images2\/[0-9a-fA-F]{500}	2	0	0	1
+4176	4176	uwf(ekfyj|ubpeb)|d(xowub|zycaf)|h(duxic|zubvo)|x(fokur|osgik)	2	0	0	1
+4177	4177	z(u(pivzed|qijcel)|aefofin|idamuk|ylhomu)	2	0	0	1
+4178	4178	\/[a-z]\.htm\?[A-Za-z0-9]+$	2	0	0	1
+4179	4179	Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+4180	4180	Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+4181	4181	\/p?2p\/[a-z]{3}$	2	0	0	1
+4182	4182	\/\d\.php\?sid=[0-9A-F]{32}$	2	0	0	1
+4183	4183	^Host\x3a\x20\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?\r?$	2	0	0	1
+4184	4184	^\/mod_jshoppi(-|ng|\/)	2	0	0	1
+4185	4185	( MSIE |rv\x3a11)	2	0	0	1
+4186	4186	( MSIE |rv\x3a11)	2	0	0	1
+4187	4187	( MSIE |rv\x3a11)	2	0	0	1
+4188	4188	( MSIE |rv\x3a11)	2	0	0	1
+4189	4189	\/[a-z]+\.k(ey)?btc$	2	0	0	1
+4190	4190	&id=[A-F0-9]+$	2	0	0	1
+4191	4191	\/images\/view\.php$	2	0	0	1
+4192	4192	\/txt\/read\.php$	2	0	0	1
+4193	4193	^hwid=[A-F0-9]{4}(-[A-F0-9]{4}){7}&func=	2	0	0	1
+4194	4194	\/[A-Za-z0-9-_]{75,}\.html$	2	0	0	1
+4195	4195	filename=\x22[A-Z]\x3a\\.+?\\[a-f0-9]{32}\.zip\x22\r\n	2	0	0	1
+4196	4196	^\/me\/(get(ref|ua)\.php|videos\.txt)$	2	0	0	1
+4197	4197	\/infect(-\d)?\.php$	2	0	0	1
+4198	4198	&hash=[^&]+$	2	0	0	1
+4199	4199	^Host\x3a[^\r\n]+?webdav\.cloudme\.com[^\r\n]*?\r?$	2	0	0	1
+4200	4200	\.exe\?dummy=\d+$	2	0	0	1
+4201	4201	^(<v1>.).{33}(=v1).{9}(<v2>.)(.{4}(=v2)){3}	2	0	0	1
+4202	4202	\.png$	2	0	0	1
+4203	4203	\x26enckey\x3D[A-F0-9]+$	2	0	0	1
+4204	4204	^\/action\.php\?action=get_(mails|red)$	2	0	0	1
+4205	4205	^Host\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4206	4206	\/data\.cfg$	2	0	0	1
+4207	4207	\/bn_versions\/\d+?\.exe$	2	0	0	1
+4208	4208	^(Accept\x3a\x20text\/\*, application\/\*\r\n)?User-Agent\x3a[^\r\n\x3b\x28\x29]+\r\nHost\x3a[^\r\n]+checkip\.dyndns\.org\r\nCache-Control\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4209	4209	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4210	4210	&user=\d+$	2	0	0	1
+4211	4211	^Host\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4212	4212	\/web_[0-9A-F]{12}\.jpg$	2	0	0	1
+4213	4213	^Mozilla(\/4\.0)?$	2	0	0	1
+4214	4214	Host\x3a\x20[a-z0-9]{16}\.[^\r\n]*?(tor|onion)	2	0	0	1
+4215	4215	^\/([^\x2f]+\/)?rp\?[a-z]=	2	0	0	1
+4216	4216	^User-Agent\x3a\x20(\d*[a-z])[a-z0-9]+\r\nHost\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4217	4217	^Host\x3a[^\r\n]+bagacaoutra\.ru\r\n	2	0	0	1
+4218	4218	^Host\x3a[^\r\n]+bagacavoltou\.ru	2	0	0	1
+4219	4219	^Host\x3a[^\r\n]+bagacaveia\.ru	2	0	0	1
+4220	4220	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4221	4221	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4222	4222	\/state[^\x2f]*\.php\?[A-Za-z0-9+/]*={0,2}$	2	0	0	1
+4223	4223	^Accept\x3a\x20\*\/\*,[^\r\n]+, MZ	2	0	0	1
+4224	4224	^\/[^\x2f]+?\.exe$	2	0	0	1
+4225	4225	^[A-F0-9]+$	2	0	0	1
+4226	4226	\/redirect\.php\?loc=mail$	2	0	0	1
+4227	4227	&(uid|name|file)=[a-f0-9]+$	2	0	0	1
+4228	4228	\?HostID=([A-F0-9]{2}(-|<>)){5}[A-F0-9]{2}$	2	0	0	1
+4229	4229	\/\?bit=(32|64)&version=\d{4}-\d{1,2}-\d{1,2}$	2	0	0	1
+4230	4230	\/\?check$	2	0	0	1
+4231	4231	^Host\x3a[^\r\n]+\r\nAccept-Language\x3a[^\r\n]+\r\nAccept\x3a[^\r\n]+\r\nAccept-Encoding\x3a[^\r\n]+\r\nConnection\x3a\x20close\r\nUser-Agent\x3a[^\r\n]+\r\n(\r\n)?$	2	0	0	1
+4232	4232	[A-Z]{100}(&\w+=[a-zA-Z0-9/+=]+){0,2}$	2	0	0	1
+4233	4233	^\w+=([a-zA-Z0-9/+=]{1,30}&\w+=)?[a-zA-Z0-9+/]{0,13}[A-Z]{200}	2	0	0	1
+4234	4234	boardid|bbsNo|strBoardID|userid|bbs|filename|code|pid|seqNo|ReportID	2	0	0	1
+4235	4235	\/setup\/[a-zA-Z0-9!-]{100,}$	2	0	0	1
+4236	4236	\/app\.exe$	2	0	0	1
+4237	4237	^Host\x3a[^\r\n]+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4238	4238	=c3NoOi8v[A-Za-z0-9+/]+={0,2}$	2	0	0	1
+4239	4239	\.asp\?([A-Za-z0-9+*]{4})*([A-Za-z0-9+*]{2}==|[A-Za-z0-9+*]{3}=|[A-Za-z0-9+*]{4})$	2	0	0	1
+4240	4240	\?wd=([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})$	2	0	0	1
+4241	4241	&version=\d+$	2	0	0	1
+4242	4242	^[A-Za-z0-9/_]+={0,2}$	2	0	0	1
+4243	4243	\/[a-z]\/infects\/[a-z]\?[a-z]=[^\\\*\+\=\|\:\;\x22\?\<\>\,\#]	2	0	0	1
+4244	4244	^\d{4}	2	0	0	1
+4245	4245	^\d{4}	2	0	0	1
+4246	4246	^Host\x3a\x20(\d{1,3}\.){3}\d{1,3}\r\nCache-Control\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4247	4247	\/lns.txt$	2	0	0	1
+4248	4248	^\/[a-z]+?\.*?ini\?\d+$	2	0	0	1
+4249	4249	\/[a-f0-9]{8}\/page_\d{8,10}\.html$	2	0	0	1
+4250	4250	^[a-z]{1,7}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4251	4251	SSID=[0-9]{5}[0-8][01][a-f0-9]{36}	2	0	0	1
+4252	4252	SSID=[0-9]{5}[0-8][01][a-f0-9]{36}	2	0	0	1
+4253	4253	^[\x20-\x7e\s]{0,20}[^\x20-\x7e\s]	2	0	0	1
+4254	4254	^s?\x3a\x2f+[^\r\n\s]+\.exe	2	0	0	1
+4255	4255	\.jpg\?vid=\d+$	2	0	0	1
+4256	4256	^[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\n[^\x3a]+\x3a\x20\d+\r\nUser-Agent\x3a	2	0	0	1
+4257	4257	\.php\?[a-z]+=0000[a-fA-F0-9]{4}&[a-z]+=\?[A-F0-9]+&[a-z]=\d{4}&[a-z]=\d{4}$	2	0	0	1
+4258	4258	^[0-9a-f]+$	2	0	0	1
+4259	4259	\/r\.php\?[A-F0-9]+=?$	2	0	0	1
+4260	4260	^m=([A-Za-z0-9+/]{4}){11}(([A-Za-z0-9+/]{4}){6})?AA==	2	0	0	1
+4261	4261	\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/\x20]{2}==|[A-Za-z0-9+/\x20]{3}=|[A-Za-z0-9+/\x20]{4})$	2	0	0	1
+4262	4262	^\d+\x20	2	0	0	1
+4263	4263	^\d+\x20	2	0	0	1
+4264	4264	^\d+\x20	2	0	0	1
+4265	4265	^\d+\x20	2	0	0	1
+4266	4266	^\d+\x20	2	0	0	1
+4267	4267	^\d+\x20	2	0	0	1
+4268	4268	^\d+\x20	2	0	0	1
+4269	4269	^\d+\x20	2	0	0	1
+4270	4270	\.php\?a1=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]	2	0	0	1
+4271	4271	\/(im(age|g)|pict)\.(jpg|php)\?id=\d+&act=[12]$	2	0	0	1
+4272	4272	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4273	4273	\.php\?hwid=[A-F0-9]{16}$	2	0	0	1
+4274	4274	^\/img\/[a-f0-9]{32}\/[a-f0-9]+\/general\.png$	2	0	0	1
+4275	4275	^\/\d+$	2	0	0	1
+4276	4276	^[\x2fa-z\d]+\.exe$	2	0	0	1
+4277	4277	\.php\?command=(g(hl|et(ip|id|backconnect))|update2?|dl|log)($|&)	2	0	0	1
+4278	4278	\.(gif|jpe?g)\.zip$	2	0	0	1
+4279	4279	^(zh-CN|en-US)\x3b rv\x3a1\.7\.6\)\r\n	2	0	0	1
+4280	4280	(,0x[0-9a-f]{2}){10}$	2	0	0	1
+4281	4281	\/default\.aspx?\?tmp=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4282	4282	^[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})(&[a-z]+\d*=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})){2,}$	2	0	0	1
+4283	4283	\/\d{8,10}\.html$	2	0	0	1
+4284	4284	^\x40\x24[^\x20-\x7e\r\n]+$	2	0	0	1
+4285	4285	^\/[A-F0-9]+$	2	0	0	1
+4286	4286	^\/[a-z0-9]+\.jpg\?([a-z0-9]*[A-Z]+[a-z0-9])[A-Za-z0-9]+=\d{1,4}$	2	0	0	1
+4287	4287	\.png\x3f[0-9a-f]{4,8}\x3d\d+?$	2	0	0	1
+4288	4288	^Host\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4289	4289	[a-z0-9]anel_includes	2	0	0	1
+4290	4290	\.pdf\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4291	4291	\.zip\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4292	4292	\.htm\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4293	4293	\.xml\/\?[A-Za-z0-9]+=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4294	4294	^\/[a-z0-9_-]+\.jpg\?[A-Za-z0-9]{2,10}=\d{1,4}$	2	0	0	1
+4295	4295	^(www\.)?google(\.[a-z]{2,3})+$	2	0	0	1
+4296	4296	\.log$	2	0	0	1
+4297	4297	\/([a-z0-9]+_){4,}[a-z0-9]+(\/[a-f0-9]+)*?\/[a-f0-9]+\.([Ee][Xx][Ee])[a-z0-9]+$	2	0	0	1
+4298	4298	^\/pm\.sh\?\d+$	2	0	0	1
+4299	4299	\.asp\?m=(INS|UAC)(&p=&a=)?&i=201\d{11}&	2	0	0	1
+4300	4300	\?ver=\d+$	2	0	0	1
+4301	4301	^\/(i686|arm|mips(el)?)\?ver=\d+$	2	0	0	1
+4302	4302	&u=[a-f0-9]{16}&p=	2	0	0	1
+4303	4303	\/[a-f0-9]{16}\.down$	2	0	0	1
+4304	4304	\.php\/data$	2	0	0	1
+4305	4305	\/catalog\/\d{3,}$	2	0	0	1
+4306	4306	\.php\?cookie=1$	2	0	0	1
+4307	4307	^\/[A-Za-z0-9]+?\/file\.php$	2	0	0	1
+4308	4308	\/tor\/[^\x2f\x2e]+(32|64)\.dll$	2	0	0	1
+4309	4309	\.php\?shinu=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4310	4310	[A-Za-z0-9]+\x2d\x2e	2	0	0	1
+4311	4311	^\/link\.txt\?[0-9]{1,2}\x3a[0-9]{1,2}\x3a[0-9]{1,2}	2	0	0	1
+4312	4312	\.php\?uuid=[a-z0-9]{32}$	2	0	0	1
+4313	4313	^(Referer\x3a[^\r\n]+\r\n)?Host\x3a[^\r\n]+[\r\n]+$	2	0	0	1
+4314	4314	\.exe\?$	2	0	0	1
+4315	4315	^\/\w+\.php\?f=[a-z]?\d{1,3}(\.(dat|gif))?$	2	0	0	1
+4316	4316	\/\?[a-zA-Z0-9]{1,3}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4317	4317	\.php\?cn(ame)	2	0	0	1
+4318	4318	^(Host\x3a [^\r\n]+?\r\nConnection\x3a Keep-Alive|Connection\x3a Keep-Alive\r\nHost\x3a [^\r\n]+?)\r\n(\r\n)?$	2	0	0	1
+4319	4319	\.php\?file=(64|86)$	2	0	0	1
+4320	4320	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4321	4321	meta=(([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4}))?(&?id=[a-z]+)?$	2	0	0	1
+4322	4322	^\/[a-z]+?\/\?([a-z]+[A-Za-z0-9\x5f\x2d]+&){1,}ai=[^&]{5}([A-Za-z0-9\x5f\x2d]{4})*([A-Za-z0-9\x5f\x2d]{2}==|[A-Za-z0-9\x5f\x2d]{3}=|[A-Za-z0-9\x5f\x2d]{4})(&|$)	2	0	0	1
+4323	4323	(^|=)[A-F0-9]{70,}($|&)	2	0	0	1
+4324	4324	^[A-Za-z0-9+/]{64}\x0a	2	0	0	1
+4325	4325	\/viewforum\.php\?f=\d+&sid=[A-F0-9]{32}$	2	0	0	1
+4326	4326	\?uid=\d{8}&ver=\d\.\d{2}&mk=[0-9a-zA-Z]{6}&os=[A-Za-z0-9]+&rs=[a-z]+&c=\d+&rq=\d	2	0	0	1
+4327	4327	^Content-Disposition\x3a[^\r\n]*\.sct[\x22\x27\s\r\n]	2	0	0	1
+4328	4328	\.php\?cmd=p&id=\w+.*?&rnd=[\x2e\d]+$	2	0	0	1
+4329	4329	myguy\.(xls(\.hta)?|exe)$	2	0	0	1
+4330	4330	\/invoice[^a-z\/]*?\.(exe|zip|7z|rar|com|vbs|ps1)$	2	0	0	1
+4331	4331	\/[\x2f\x2bA-Za-z0-9]{59}AAA==$	2	0	0	1
+4332	4332	^\/[^\x2f]+?\/create\.php\?[a-z0-9]+\x3d[a-z0-9\x5f\x2d]+?$	2	0	0	1
+4333	4333	\.php\?id=\d+&stat=[a-z0-9]{32}(&cidl=\d+|&sidl=[\d%:\x20-]+)?$	2	0	0	1
+4334	4334	\/[A-Z0-9]{4,8}\/[A-Z0-9]{8}\.DAT$	2	0	0	1
+4335	4335	\.exe\?\.\d+$	2	0	0	1
+4336	4336	^Host\x3a[^\r\n]+\r\n((Cache-Control|Pragma)\x3a[^\r\n]+\r\n)?(\r\n)?$	2	0	0	1
+4337	4337	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4338	4338	^\/Search\/en-US\?query=[a-z]{200,400}&pgArea=header$	2	0	0	1
+4339	4339	\/stat\d+\.php	2	0	0	1
+4340	4340	\?url=[0-9]&affid=[0-9]{5}	2	0	0	1
+4341	4341	\.php\?id=[0-9a-f]{8}$	2	0	0	1
+4342	4342	^6\.[0-2]\x20\d\d\x3a\d\d\x20	2	0	0	1
+4343	4343	^IPHONE\d+\x2e\d+\x28(host\x3a|[^\r\n\x2c]+\x2c(\d{1,3}\.){3}\d{1,3})	2	0	0	1
+4344	4344	(1|2)\.(p(hp|ng)|jpe?g|cgi|gif)\?sv=\d{2,3}&tq=	2	0	0	1
+4345	4345	[\?&]p=\d&t=\d(&|$)	2	0	0	1
+4346	4346	^\x2fhistory\x2f[A-Za-z0-9+_-]+\x2easp$	2	0	0	1
+4347	4347	^\x2fdocs\x2fname\x3d\x2f[A-Za-z0-9+_-]+$	2	0	0	1
+4348	4348	^\x2ftech\x2fs\x2easp\x3fm\x3d[A-Za-z0-9+_-]+$	2	0	0	1
+4349	4349	^\x2fmanage\x2fasp\x2fitem\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26mux\x3d[A-Za-z0-9+_-]+$	2	0	0	1
+4350	4350	^\x2farticle\x2f30441\x2fReview\x2easp\x3fid\x3d[A-Za-z0-9+_-]+\x26\x26data\x3d[A-Za-z0-9+_-]+$	2	0	0	1
+4351	4351	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4352	4352	^\/[A-Za-z0-9-_]{30,}\/$	2	0	0	1
+4353	4353	^build\d	2	0	0	1
+4354	4354	^[a-zA-Z0-9]{5}6164(3[0-9]){4}31303[0-9]([a-f0-9][a-f0-9]){5,}\.	2	0	0	1
+4355	4355	^[a-zA-Z0-9]{5}6364(3[0-9]){4}\d{1,3}\.	2	0	0	1
+4356	4356	^[a-zA-Z0-9]{5}6464(3[0-9]){4}\.	2	0	0	1
+4357	4357	^[a-zA-Z0-9]{5}6664(3[0-9]){4}\.	2	0	0	1
+4358	4358	^[a-zA-Z0-9]{5}6864(3[0-9]){4}31303[0-9]\.	2	0	0	1
+4359	4359	^[a-zA-Z0-9]{5}7264(3[0-9]){4}31303[0-9]([a-f0-9][a-f0-9]){10,}\.	2	0	0	1
+4360	4360	^[a-zA-Z0-9]{5}7164(3[0-9]){4}\.	2	0	0	1
+4361	4361	^[a-f0-9]{8}$	2	0	0	1
+4362	4362	^\d{1,3}$	2	0	0	1
+4363	4363	^\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}	2	0	0	1
+4364	4364	^[A-Za-z0-9\/\+\=]{100,}$	2	0	0	1
+4365	4365	\.(txt|gif|exe|bmp)$	2	0	0	1
+4366	4366	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4367	4367	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4368	4368	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4369	4369	^[A-F0-9]{128}$	2	0	0	1
+4370	4370	^DEMONS((\/|\s)[0-9]\.0)?$	2	0	0	1
+4371	4371	^Hakai((\/|\s)[0-9]\.0)?$	2	0	0	1
+4372	4372	^Messiah((\/|\s)[0-9]\.0)?$	2	0	0	1
+4373	4373	^Liquor((\/|\s)[0-9]\.0)?$	2	0	0	1
+4374	4374	^Nija((\/|\s)[0-9]\.0)?$	2	0	0	1
+4375	4375	^Gemini((\/|\s)[0-9]\.0)?$	2	0	0	1
+4376	4376	^Kayla((\/|\s)[0-9]\.0)?$	2	0	0	1
+4377	4377	^Sector((\/|\s)[0-9]\.0)?$	2	0	0	1
+4378	4378	^OSIRIS((\/|\s)[0-9]\.0)?$	2	0	0	1
+4379	4379	^lessie(\/[0-9]\.0)?$	2	0	0	1
+4380	4380	^Cakle(\/[0-9]\.0)?$	2	0	0	1
+4381	4381	^Damien(\/[0-9]\.0)?$	2	0	0	1
+4382	4382	^Solar(\/[0-9]\.0)?$	2	0	0	1
+4383	4383	^muhstik(-scan)?(\/[0-9]\.0)?$	2	0	0	1
+4384	4384	^Shaolin(\/[0-9]\.0)?$	2	0	0	1
+4385	4385	^Rift(\/[0-9]\.0)?$	2	0	0	1
+4386	4386	^Tsunami(\/[0-9]\.0)?$	2	0	0	1
+4387	4387	^Yowai(\/[0-9]\.0)?$	2	0	0	1
+4388	4388	^Yakuza(\/[0-9]\.0)?$	2	0	0	1
+4389	4389	^Hentai(\/[0-9]\.0)?$	2	0	0	1
+4390	4390	^[a-zA-Z/+=]$	2	0	0	1
+4391	4391	\?uid=[A-F0-9]{15,}&pid=\d+$	2	0	0	1
+4392	4392	\.php\?[A-F0-9]{15,25}$	2	0	0	1
+4393	4393	^(Sucessful|Failed|Missing\x20CBA8|Missing\x20LANDesk\x20Agent)$	2	0	0	1
+4394	4394	^POST\shttp\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})	2	0	0	1
+4395	4395	^name=v[0-9]{1,2}_kt[0-9]{1,2}p[0-9]{1}_[0-9]{8,10}$	2	0	0	1
+4396	4396	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4397	4397	^\/[a-z]\.php	2	0	0	1
+4398	4398	^\d{1,6}$	2	0	0	1
+4399	4399	^[A-Z0-9]{8}	2	0	0	1
+4400	4400	^\d{15}	2	0	0	1
+4401	4401	^(winload(32)?|cmms)\x0d\x0a	2	0	0	1
+4402	4402	^\d$	2	0	0	1
+4403	4403	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4404	4404	^\/[a-z]+\/\?ip=	2	0	0	1
+4405	4405	^(\d{1,3}\.){3}\d{1,3}	2	0	0	1
+4406	4406	^\d{1,5}\.[2-5]0[0-5]\.\d+? Firefox\/7\.0\.1	2	0	0	1
+4407	4407	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4408	4408	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4409	4409	^(update_hash|js|key|arsiv_(hash|link))$	2	0	0	1
+4410	4410	\/([A-Za-z0-9_-]{4})*([A-Za-z0-9_-]{2}==|[A-Za-z0-9_-]{3}=|[A-Za-z0-9_-]{4})\.jpg$	2	0	0	1
+4411	4411	^[a-z0-9]{11}=\d{16}$	2	0	0	1
+4412	4412	^[A-Za-z0-9]{3,25}=[a-f0-9]{28,}$	2	0	0	1
+4413	4413	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4414	4414	^Hello, World((\/|\s)[0-9]\.0)?$	2	0	0	1
+4415	4415	\/cgi\/[a-z0-9]{1,31}\.bin$	2	0	0	1
+4416	4416	^[0-9a-zA-Z=%-]{0,48}(%[A-F0-9]{2}){4}	2	0	0	1
+4417	4417	\?id=\d+&act=[12]$	2	0	0	1
+4418	4418	\?id=\d+&act=\d$	2	0	0	1
+4419	4419	^([A-F0-9]{2}%3A){5}[A-F0-9]{2}&	2	0	0	1
+4420	4420	\/([a-z]{0,7}[0-9])([0-9]{0,7}[a-z])[a-z0-9]{7,8}\/([a-z]{0,7}[0-9])([0-9]{0,7}[a-z])[a-z0-9]{7,8}$	2	0	0	1
+4421	4421	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})&isAdvpp=(true|false)$	2	0	0	1
+4422	4422	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+4423	4423	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+4424	4424	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+4425	4425	^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}	2	0	0	1
+4426	4426	^\d\.\d_(64|32)_\d\x3a	2	0	0	1
+4427	4427	(^|\.)15438\.xyz$	2	0	0	1
+4428	4428	(^|\.)12724\.xyz$	2	0	0	1
+4429	4429	(^|\.)21736\.xyz$	2	0	0	1
+4430	4430	^[a-f0-9]+\x08\x00$	2	0	0	1
+4431	4431	^[A-Za-z0-9]	2	0	0	1
+4432	4432	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4433	4433	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4434	4434	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4435	4435	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4436	4436	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4437	4437	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4438	4438	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4439	4439	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4440	4440	\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a(Cache\-Control|Connection|Pragma)\x0d\x0a	2	0	0	1
+4441	4441	^Host\x3a\x20(\d{1,3}\.){3}\d{1,3}\r\nConnection\x3a\x20close(\r\n)+$	2	0	0	1
+4442	4442	^[A-Z]+$	2	0	0	1
+4443	4443	^\d+$	2	0	0	1
+4444	4444	^(64|86)$	2	0	0	1
+4445	4445	\/counter\/?[a-z]?\d{1,2}|[^\x2f]*\d\.exe|.*?[]([A-Za-z_-]{0,200})	2	0	0	1
+4446	4446	^\/(\w+\/){1,5}\?[a-z]{1,6}=[a-z0-9]{2,40}(&[a-z]{1,6}=([a-z0-9]){1,40})	2	0	0	1
+4447	4447	^\d{5,10}\x7d	2	0	0	1
+4448	4448	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+4449	4449	\/\d{8,10}\.html$	2	0	0	1
+4450	4450	^\d{1,3}=	2	0	0	1
+4451	4451	(Proxy-)?Connection\x3a[^\r\n]+?\r\n(Pragma|Cache-Control)\x3a[^\r\n]+?\r\n(\r\n)?$	2	0	0	1
+4452	4452	\/?[a-zA-Z0-9]{1,3}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4453	4453	^\d+$	2	0	0	1
+4454	4454	^\/\?m=[abcde]&p1=[a-f0-9]{8,12}(&p2=[^&]+)?(&p3=[^&]+)?$	2	0	0	1
+4455	4455	[&?]a=([a-zA-Z0-9_-]{25,}|(0\.)?\d+)(&|$)	2	0	0	1
+4456	4456	^[A-Za-z]{1,10}	2	0	0	1
+4457	4457	\.(aspx?|php)\?q=(KT)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$	2	0	0	1
+4458	4458	^[A-Za-z]{1,10}=[^&]+(&[A-Za-z]{1,10}=[^&]+){10,}$	2	0	0	1
+4459	4459	^[a-f0-9]{32}\x3b$	2	0	0	1
+4460	4460	^\/(kas|ser|mac)[0-9]+\.png$	2	0	0	1
+4461	4461	^\/s\.php\?id=[a-z0-9]{2,6}$	2	0	0	1
+4462	4462	\.php\?d=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4463	4463	^[a-z0-9]!\x22#	2	0	0	1
+4464	4464	^[a-f0-9]{16}$	2	0	0	1
+4465	4465	^[A-Za-z0-9]{3,4}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})	2	0	0	1
+4466	4466	^[A-Za-z0-9]{3,4}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+4467	4467	[a-z0-9]{3,4}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+$	2	0	0	1
+4468	4468	^Mozilla\/4\.0\x20\(compatible\x3b\x20MSIE\x20\d{1,2}\.0\.\d+\.\d+\.0\x3b\x20Windows\x20NT\x20	2	0	0	1
+4469	4469	^[\x20-\x7e\r\n]{0,28}[^\x20-\x7e\r\n]	2	0	0	1
+4470	4470	^\/([a-z]{0,9}?\d)(\d{0,9}?[a-z])[a-z0-9]{4,10}$	2	0	0	1
+4471	4471	(^|&)id=\d+($|&)	2	0	0	1
+4472	4472	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+4473	4473	^\d?\.dll$	2	0	0	1
+4474	4474	^(32|64)$	2	0	0	1
+4475	4475	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)$	2	0	0	1
+4476	4476	\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a\d{1,5}$	2	0	0	1
+4477	4477	^env=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4478	4478	\/pict\.(jpg|php|xsp)\?id=\d+((&data=|&bid=)[^&]*?)?$	2	0	0	1
+4479	4479	^SESSIONID=[A-Z0-9]{16}	2	0	0	1
+4480	4480	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+4481	4481	^(\/\w{3,12}){2,4}\?[a-z]{3,12}=([A-Za-z0-9+/\x20]{4})*([A-Za-z0-9+/\x20]{2}==|[A-Za-z0-9+/\x20]{3}=|[A-Za-z0-9+/\x20]{4})$	2	0	0	1
+4482	4482	^\d+$	2	0	0	1
+4483	4483	^POST \/(<filep>[a-z]{5,8})\.php HTTP.+?\r\nHost\x3a\x20(=filep)[a-z]+?\.net\r\n	2	0	0	1
+4484	4484	[=\"]\w{8}\.jar	2	0	0	1
+4485	4485	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4486	4486	filename\x3D\x22[^\r\n]*security[^\n]+\.exe	2	0	0	1
+4487	4487	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4488	4488	^[A-F0-9]{30}$	2	0	0	1
+4489	4489	\.php\?cx=[A-F0-9]+&b=[A-F0-9]+&gt=[A-F0-9]+&tx=[A-F0-9]+$	2	0	0	1
+4490	4490	^\/ucD[A-Za-z0-9_\/\-+]{171}$	2	0	0	1
+4491	4491	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+4492	4492	^<CHECK>([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/CHECK>$	2	0	0	1
+4493	4493	^[a-zA-Z0-9\/+_-]{171}$	2	0	0	1
+4494	4494	\/\d+\/\d+\.exe$	2	0	0	1
+4495	4495	^[A-Za-z0-9]{20,22}&usg=[A-Za-z0-9_]{34}&bvm=bv\.81[1-7]{6}\,d\.[A-Za-z0-9_]{3}\r\n	2	0	0	1
+4496	4496	^fn=[^&]*\.gif&code=\d+$	2	0	0	1
+4497	4497	^[A-F0-9]+$	2	0	0	1
+4498	4498	^log=save&session_id=[^&]+&value=[^&]+$	2	0	0	1
+4499	4499	(\\x70)|[Pp]\^?((\\x4f)|(\\x5f)|[Oo])	2	0	0	1
+4500	4500	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4501	4501	^([a-f0-9]{2}){23,60}$	2	0	0	1
+4502	4502	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4503	4503	^[0-9]*?[a-z]/P	2	0	0	1
+4504	4504	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a8080$	2	0	0	1
+4505	4505	^\/[a-z]{4}(\d{1,3}\.){3}\d{1,3}[a-z]{6}\.txt	2	0	0	1
+4506	4506	^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+4507	4507	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})+	2	0	0	1
+4508	4508	^[a-zA-Z0-9=/&?\x2e-]+$	2	0	0	1
+4509	4509	^[a-f0-9]{8}\.grp[0-9]*\.ping\.adm\.([a-f0-9]+\.){2,}	2	0	0	1
+4510	4510	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})$	2	0	0	1
+4511	4511	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+4512	4512	^[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}$	2	0	0	1
+4513	4513	^[\x20-\x25\x27-\x3c\x3e-\x7e]{25,}$	2	0	0	1
+4514	4514	^(i686|x86_64|arm|mipsel)\-(static-linux|w64|iamsatan)\-(mingw32|uclibc(gnueabi)?)	2	0	0	1
+4515	4515	^[^\\\*\+\=\|\:\;\x22\?\>\>\,\#][a-zA-Z0-9-!@#]	2	0	0	1
+4516	4516	^([A-Za-z0-9])	2	0	0	1
+4517	4517	^\/[^\x2f]+?\.htm$	2	0	0	1
+4518	4518	^\d{2,7}$	2	0	0	1
+4519	4519	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\.bin$	2	0	0	1
+4520	4520	^Host\x3A\x20\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x2E\d{1,3}\x3A\d{1,5}\r?$	2	0	0	1
+4521	4521	^Host\x3a[^\r\n]+\r\nUser-Agent\x3a[^\r\n]+\r\nContent-Length\x3a\x20\d+\r\n(\r\n)?$	2	0	0	1
+4522	4522	plugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes\/[^\x2f]+|tric)|osts?\	2	0	0	1
+4523	4523	^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}){1,5})\sHTTP\/1\.1\r\nReferer\x3a\x20http\x3a\x2f\x2f[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}(\x3a[0-9]{2,5})?(=urivar)\r\n	2	0	0	1
+4524	4524	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4525	4525	^[a-zA-Z0-9\/+_-]{171}$	2	0	0	1
+4526	4526	^cnc\.[a-fA-F0-9]{14}.xyz$	2	0	0	1
+4527	4527	^[^&]+&[a-z]=[^&]+&[a-z]=[A-F0-9]+$	2	0	0	1
+4528	4528	^[A-Za-z0-9]{3,20}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4529	4529	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4530	4530	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4531	4531	_aWQ9[a-zA-Z0-9\/]{43,46}(JmdpZD|Z2lkP|ZnaWQ9)	2	0	0	1
+4532	4532	^\/[a-f0-9]+$	2	0	0	1
+4533	4533	^[A-Z]{4}	2	0	0	1
+4534	4534	\.php\?host=[^&]+&password=[a-f0-9]{32}$	2	0	0	1
+4535	4535	^(\d{1,3}\.){3}\d{1,3}(\x3a\d{1,5})?$	2	0	0	1
+4536	4536	^\x2F[a-f0-9]{40,60}$	2	0	0	1
+4537	4537	^[^\r\n]+\.exe(\x3b)?$	2	0	0	1
+4538	4538	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4539	4539	\r\nHost\x3a[^\r\n]+\r\n(Content-Length\x3a\x20\d+\r\n)?Connection\x3a\x20Keep-Alive\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4540	4540	Content-Disposition\x3a[^\r\n]+=[\x22\x27]?[a-z]?\d{1,3}(\.dat)?[\x22\x27]?\r\n	2	0	0	1
+4541	4541	Content-Disposition\x3a[^\r\n]+=[\x22\x27]?[a-z]?\d{1,3}(\.dat)?[\x22\x27]?\r\n	2	0	0	1
+4542	4542	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4543	4543	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4544	4544	[A-Za-z]{1,10}=A-Za-z0-9_+\x2d\x2e	2	0	0	1
+4545	4545	^Host\x3a\x20[^\r\n]+\r\n(Cache-Control|Pragma)\x3a\x20no-cache\r\n(\r\n)?$	2	0	0	1
+4546	4546	^[a-z0-9]+\.appsync-api\.(eu|us)-(ea|we)st-[12]\.avsvmcloud\.com$	2	0	0	1
+4547	4547	^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4}))	2	0	0	1
+4548	4548	a-z0-9\(_~\-\.\x00]{300,}\x00$	2	0	0	1
+4549	4549	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$/Wm	2	0	0	1
+4550	4550	^[a-f0-9]{8}\.(s(pac|it)e|net|top)$/Wm	2	0	0	1
+4551	4551	^[A-Z0-9\-]{30,42}$	2	0	0	1
+4552	4552	^\d+?\r\n	2	0	0	1
+4553	4553	^__io_r=[0-9]{10}_[01]_[0-9]{4,5}_[0-9]{7,8}_[0-9]{1,2}\x3b\x20	2	0	0	1
+4554	4554	\.php\?c=[a-f0-9]{160}$	2	0	0	1
+4555	4555	Cache-Control\r\n(\r\n|Cookie\r\n\r\n)$	2	0	0	1
+4556	4556	^[A-Za-z0-9_-]{1,15}=([A-Za-z0-9-_]{1,25}|([A-Za-z0-9+/]{4}))	2	0	0	1
+4557	4557	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4558	4558	^dkv=[a-f0-9]{32}\x3bYSC=\d+$	2	0	0	1
+4559	4559	^(resp|onl|pr)=	2	0	0	1
+4560	4560	^id=\d+&cred=[a-z]+\x7c	2	0	0	1
+4561	4561	[\x80-\xff]	2	0	0	1
+4562	4562	(retdl|fb|step) HTTP\/1\.1$	2	0	0	1
+4563	4563	^\/[0-9]{6,16}-(pro|xl2|us1)$	2	0	0	1
+4564	4564	^(81|freq|domains|over|rate|npcap\.exe)\/?\s*[^\/]*$	2	0	0	1
+4565	4565	^\/[0-9a-f]{16}$	2	0	0	1
+4566	4566	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4567	4567	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4568	4568	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4569	4569	^[A-F0-9]{24}	2	0	0	1
+4570	4570	^[a-z0-9]{32}=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4571	4571	^\/[a-z0-9]{32}\/\d\/$	2	0	0	1
+4572	4572	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4573	4573	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4574	4574	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4575	4575	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]/Psi	2	0	0	1
+4576	4576	^transfer=[A-Za-z0-9/+=]+$	2	0	0	1
+4577	4577	^__gads=\d{9,10}:[01]:\d+:\d+(:\d{2,4})?\x3b\s_gat=(10|6)\.[0-3]\.\d{4,6}\.(32|64)	2	0	0	1
+4578	4578	^[A-Z]{256}$	2	0	0	1
+4579	4579	^[0-9]{90,180}\r\n	2	0	0	1
+4580	4580	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\r\n	2	0	0	1
+4581	4581	^\/vpn-service\/[a-z]{15}\/crunchyroll-vpn$	2	0	0	1
+4582	4582	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4583	4583	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4584	4584	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4585	4585	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4586	4586	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4587	4587	^SSID=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4588	4588	^(id|tfzT)=	2	0	0	1
+4589	4589	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4590	4590	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$	2	0	0	1
+4591	4591	^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}	2	0	0	1
+4592	4592	^[a-zA-Z0-9]{32}\.dot$	2	0	0	1
+4593	4593	^[0-9A-F]{21,22}\x20HTTP\/1\.1$	2	0	0	1
+4594	4594	^[0-9A-F]+$	2	0	0	1
+4595	4595	^C=(M[ACDEGHKLMNOPQRSTUVWXYZ]|G[ABDEFGHILMNPQRSTUWY]|B[ABDEFGHIJMNORSTVWZ]|A[DEFGILMNOQRSTUWXZ])	2	0	0	1
+4596	4596	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4597	4597	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4598	4598	\x1c([a-z0-9]{28})[^\r\n]+(\x03(net|com)|\x02in)	2	0	0	1
+4599	4599	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4600	4600	^[a-zA-Z0-9/+]{171}=$	2	0	0	1
+4601	4601	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4602	4602	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4603	4603	^OSID=[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+4604	4604	\=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4605	4605	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4606	4606	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4607	4607	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4608	4608	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4609	4609	^[a-z0-9_]{6}[^a-z0-9_]	2	0	0	1
+4610	4610	^[a-z0-9]{5}\.com$	2	0	0	1
+4611	4611	^[a-z]{3,15}\x3a\x20	2	0	0	1
+4612	4612	^[a-zA-z]{5,10}_[A-F0-9]{12}$	2	0	0	1
+4613	4613	^[a-zA-z]{5,10}_[A-F0-9]{12}$	2	0	0	1
+4614	4614	^[^\"]+\x7c\x22\x2c\x22	2	0	0	1
+4615	4615	^[a-z0-9]{32}	2	0	0	1
+4616	4616	^[a-z0-9]{32}	2	0	0	1
+4617	4617	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4618	4618	^(curl|wget)_?(c(ve_20(1((7_1161|8_760)0|9_10758)|20_16846)|url_xxljobUnauth)|tp5)$	2	0	0	1
+4619	4619	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4620	4620	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4621	4621	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4622	4622	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+4623	4623	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4624	4624	^_?([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4625	4625	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4626	4626	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4627	4627	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4628	4628	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4629	4629	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4630	4630	^[a-f0-9]{5,12}&a=	2	0	0	1
+4631	4631	CN=([^\r\n]+?\.)?hotjar\.info(\.)	2	0	0	1
+4632	4632	^\/\?d=[a-f0-9]{16}$	2	0	0	1
+4633	4633	^[a-z]{1}	2	0	0	1
+4634	4634	^Date\x3a\x20[^\r\n]+[0-9]{2}::[0-9]{2}\x20	2	0	0	1
+4635	4635	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}	2	0	0	1
+4636	4636	^[A-P]{256}$	2	0	0	1
+4637	4637	^[a-f0-9]{32}\r\n\r\nPK	2	0	0	1
+4638	4638	^pk=[A-Za-z0-9]{8,50}&value=[a-f0-9]{50,500}$	2	0	0	1
+4639	4639	^[A-Z]{2}-[A-Z0-9]{10,20}-[A-Z0-9]{6,10}-[A-Z0-9]{2,8}-[A-Z0-9]{2,8}-[0-9]{2,5}$	2	0	0	1
+4640	4640	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$	2	0	0	1
+4641	4641	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$	2	0	0	1
+4642	4642	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\:\d{1,5})?$	2	0	0	1
+4643	4643	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+4644	4644	^\.(93joshua|purrple|black)$	2	0	0	1
+4645	4645	Content-Disposition\x3a\x20form-data\x3b\s*name=\x22(source|formdata|billinfo|cardinfo)\x22	2	0	0	1
+4646	4646	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4647	4647	^[A-Za-z0-9_-]+$	2	0	0	1
+4648	4648	plugins\/content\/vote\/\.ssl\/[a-z0-9]|a(nel\/includes)	2	0	0	1
+4649	4649	^CN=www\.[0-9a-z]{8,20}\.net$	2	0	0	1
+4650	4650	^[A-F0-9]+$	2	0	0	1
+4651	4651	\.[dghbcijklmnfqrwxyz23stuopaev4569]{26}\.[a-z0-9_-]{1,50}\.[a-z]{2,8}$	2	0	0	1
+4652	4652	^[a-zA-z]{8}\.	2	0	0	1
+4653	4653	^[a-zA-z]{8}\.	2	0	0	1
+4654	4654	[^\x18][^\x44\x32\x33\x25\x64\x22\x23\x3a\x27\x24\x26\x34\x3b\x12]	2	0	0	1
+4655	4655	^[A-F0-9]{32}	2	0	0	1
+4656	4656	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4657	4657	^tt[cf]$	2	0	0	1
+4658	4658	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4659	4659	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4660	4660	^([1-3]?)\/download\.php\?filename=ccom	2	0	0	1
+4661	4661	^[a-z]$	2	0	0	1
+4662	4662	\/([0-9]*?[a-z]*?[a-z0-9)([a-z0-9]*[0-9][a-z]*[0-9][a-z0-9]*\.exe)(setup\d+\.exe)[a-z0-9]{5,15}\.exe	2	0	0	1
+4663	4663	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+4664	4664	^User-Agent\x3a\x20(Mozilla\/|Shockwave)	2	0	0	1
+4665	4665	id\x3d[a-z0-9]{8}\x2d[a-z0-9]{4}\x2d[a-z0-9]{4}\x2d[a-z0-9]{4}\x2d[a-z0-9]{12}\x26key\x3d[a-z0-9]{512}	2	0	0	1
+4666	4666	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+4667	4667	^([a-f0-9]{32})=([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4668	4668	^[a-z0-9]{32}	2	0	0	1
+4669	4669	^[\x20-\x7e]+?.{8}\x7d\x9f	2	0	0	1
+4670	4670	^[\x20-\x7e]+?.{8}\x7a\x9f	2	0	0	1
+4671	4671	^[\x20-\x7e]+?.{8}\x78\x9a	2	0	0	1
+4672	4672	^[\x20-\x7e]+?.{8}\x7f\x9f	2	0	0	1
+4673	4673	^[\x20-\x7e]+?.{8}\xc3\x70	2	0	0	1
+4674	4674	^[\x20-\x7e]+?.{8}\x7c\x9e	2	0	0	1
+4675	4675	^.{4}[\x20-\x7e]+?.{4}\x78\x9c	2	0	0	1
+4676	4676	^[\x20-\x7e]+?.{8}\x7c\x99	2	0	0	1
+4677	4677	^[\x20-\x7e]+?.{8}\x7f\x9b	2	0	0	1
+4678	4678	^[\x20-\x7e]+?.{8}\x31\xd9	2	0	0	1
+4679	4679	^[\x20-\x7e]+?.{8}\x70\x9b	2	0	0	1
+4680	4680	^[\x20-\x7e]+?.{8}\xda\x41	2	0	0	1
+4681	4681	^[\x20-\x7e]+?.{8}\x7a\x9a	2	0	0	1
+4682	4682	^[\x20-\x7e]+?.{8}\x3f\xa6	2	0	0	1
+4683	4683	^[\x20-\x7e]+?.{8}\x70\x9b	2	0	0	1
+4684	4684	^[\x20-\x7e]+?.{8}\x39\xdd	2	0	0	1
+4685	4685	^.{4}[\x20-\x7e]+?.{4}\x78\x9c	2	0	0	1
+4686	4686	^[\x20-\x7e]+?.{8}\x3b\xd8	2	0	0	1
+4687	4687	^[\x20-\x7e]+?.{8}\x79\x9b	2	0	0	1
+4688	4688	^[\x20-\x7e]+?.{8}\x7c\x9c	2	0	0	1
+4689	4689	^[\x20-\x7e]+?.{8}\x79\x95	2	0	0	1
+4690	4690	^[\x20-\x7e]+?.{8}\x71\x95	2	0	0	1
+4691	4691	^[\x20-\x7e]{5,}.{8}\x78\x9c	2	0	0	1
+4692	4692	^[\x20-\x7e]+?.{8}\x7b\x95	2	0	0	1
+4693	4693	^[\x20-\x7e]+?.{8}\x79\x9f	2	0	0	1
+4694	4694	^[A-Z]{14}$	2	0	0	1
+4695	4695	^.{4}[\x20-\x7e]+?.{4}\x71\x94	2	0	0	1
+4696	4696	^[\x20-\x7e]*?.{8}\x79\x9e	2	0	0	1
+4697	4697	^.{4}[\x20-\x7e]+?.{4}\x7c\x9c	2	0	0	1
+4698	4698	^[\x20-\x7e]+?.{8}\x7f\x9d	2	0	0	1
+4699	4699	^[\x20-\x7e]+?.{8}\x49\xa5	2	0	0	1
+4700	4700	^[\x20-\x7e]+?.{8}\x79\x94	2	0	0	1
+4701	4701	^.{8}[\x20-\x7e]+?.{5}\x7b\x9e	2	0	0	1
+4702	4702	^.{4}[\x20-\x7e]+?.{4}\x7d\x94	2	0	0	1
+4703	4703	^[\x20-\x7e]+?.{8}\x7d\x94	2	0	0	1
+4704	4704	^multipart/form-data\x3b\x20boundary=[a-f0-9]{60}$	2	0	0	1
+4705	4705	^([A-Z0-9+/]{4})*([A-Z0-9+/]{2}==|[A-Z0-9+/]{3}=|[A-Z0-9+/]{4})	2	0	0	1
+4706	4706	^[\x20-\x7e]+?.{8}\x7b\x98	2	0	0	1
+4707	4707	^[\x20-\x7e]+?.{8}\x31\xad	2	0	0	1
+4708	4708	^[\x20-\x7e]+?.{8}\x40\xa3	2	0	0	1
+4709	4709	^[\x20-\x7e]+?.{8}\x7d\x98	2	0	0	1
+4710	4710	^.{4}[\x20-\x7e]{5}.{4}\x7a\x9a	2	0	0	1
+4711	4711	^[\x20-\x7e]+?.{8}\x71\x9d	2	0	0	1
+4712	4712	^[\x20-\x7e]+?.{8}\x7a\x9b	2	0	0	1
+4713	4713	^.{8}\x70\x94[\x20-\x7e]	2	0	0	1
+4714	4714	^[\x20-\x7e]+?.{8}\x79\xda	2	0	0	1
+4715	4715	^[\x20-\x7e]+?.{8}\x30\xa5	2	0	0	1
+4716	4716	^[\x20-\x7e]+?.{8}\x70\x9a	2	0	0	1
+4717	4717	^[\x20-\x7e]+?.{8}\x79\x9b	2	0	0	1
+4718	4718	^[\x20-\x7e]+?.{8}\x31\xd9	2	0	0	1
+4719	4719	^[\x20-\x7e]+?.{8}\x79\x9c	2	0	0	1
+4720	4720	^[\x20-\x7e]+?.{8}\x7d\x99	2	0	0	1
+4721	4721	^[\x20-\x7e]+?.{8}\x7b\x9d	2	0	0	1
+4722	4722	^[\x20-\x7e]+?.{8}\x2e\x96	2	0	0	1
+4723	4723	^[\x20-\x7e]+?.{8}\x78\x9c	2	0	0	1
+4724	4724	^[\x20-\x7e]+?.{8}\x70\x98	2	0	0	1
+4725	4725	^[\x20-\x7e]+?.{8}\x4a\xae	2	0	0	1
+4726	4726	^[\x20-\x7e]+?.{8}\x71\x9e	2	0	0	1
+4727	4727	^.{8}[\x20-\x7e]+?[\x00]*?\x78\x9c	2	0	0	1
+4728	4728	^.{8}[\x20-\x7e]+?[\x00]*?\x78\x9c	2	0	0	1
+4729	4729	^.{8}[\x20-\x7e]+?\x79\x94	2	0	0	1
+4730	4730	^[\x20-\x7e]+?.{8}\x84\x60	2	0	0	1
+4731	4731	^[\x20-\x7e]+?.{8}\x40\xd8	2	0	0	1
+4732	4732	^[\x20-\x7e]+?.{8}\x7f\x94	2	0	0	1
+4733	4733	^[\x20-\x7e]+?.{8}\x79\x9c	2	0	0	1
+4734	4734	^[\x20-\x7e]+?.{8}\x7a\x9c	2	0	0	1
+4735	4735	^[\x20-\x7e]+?.{8}\x7e\x9c	2	0	0	1
+4736	4736	^[\x20-\x7e]+?.{8}\x39\x99	2	0	0	1
+4737	4737	^[\x20-\x7e]+?.{8}\x49\xa2	2	0	0	1
+4738	4738	^[\x20-\x7e]+?.{8}\x79\x9d	2	0	0	1
+4739	4739	^[\x20-\x7e]+?.{8}\x7b\x9f	2	0	0	1
+4740	4740	^[\x20-\x7e]+?.{8}\x79\x9a	2	0	0	1
+4741	4741	^[\x20-\x7e]+?.{8}\x70\x94	2	0	0	1
+4742	4742	^[\x20-\x7e]+?.{8}\x44\xdf	2	0	0	1
+4743	4743	^.{4}[\x20-\x7e]+?.{4}\x7b\x9e	2	0	0	1
+4744	4744	^[\x20-\x7e]+?.{8}\x7b\x9e	2	0	0	1
+4745	4745	^[\x20-\x7e]+?.{8}\x83\x7f	2	0	0	1
+4746	4746	^.{8}[\x20-\x7e]+?\x7c\x9f	2	0	0	1
+4747	4747	^[\x20-\x7e]+?.{8}\x7d\x9a	2	0	0	1
+4748	4748	^.{9,28}\x78\x9c	2	0	0	1
+4749	4749	^.{8}[\x20-\x7e]{5}\x78\x9c	2	0	0	1
+4750	4750	^[\x20-\x7e]+?.{8}\x4a\xd5	2	0	0	1
+4751	4751	^[\x20-\x7e]+?.{8}\x79\xdd	2	0	0	1
+4752	4752	^[\x20-\x7e]+?.{8}\x70\x9e	2	0	0	1
+4753	4753	^[\x20-\x7e]+?.{10}\x7a\x5d	2	0	0	1
+4754	4754	^.{8}[\x20-\x7e]+?.{5}\x7c\x9e	2	0	0	1
+4755	4755	^[\x20-\x7e]+?.{8}\x7d\x9e	2	0	0	1
+4756	4756	^[\x20-\x7e]+?.{8}\x70\x9c	2	0	0	1
+4757	4757	^[\x20-\x7e]+?.{8}\x3b\xdf	2	0	0	1
+4758	4758	^[\x20-\x7e]+?.{8}\x47\xd9	2	0	0	1
+4759	4759	^[\x20-\x7e]+?.{8}\x79\x99	2	0	0	1
+4760	4760	^.{8}[\x20-\x7e]+?.{2}\x78\x9c	2	0	0	1
+4761	4761	^.{4}[\x20-\x7e]{5}.{4}\x96\x71	2	0	0	1
+4762	4762	^[\x20-\x7e]+?.{8}\x7b\x9b	2	0	0	1
+4763	4763	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4764	4764	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4765	4765	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4766	4766	([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4767	4767	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4768	4768	^[a-f0-9]{32}	2	0	0	1
+4769	4769	>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}>	2	0	0	1
+4770	4770	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4771	4771	^[A-Za-z0-9_]{20}\/[a-f0-9]{40}$	2	0	0	1
+4772	4772	\/[a-z0-9]{1,31}\.bin$	2	0	0	1
+4773	4773	^[A-Za-z0-9\-_~]{75,}$	2	0	0	1
+4774	4774	(JmJ1aWxkP|YnVpbGQ9|ZidWlsZD)	2	0	0	1
+4775	4775	^[\x80|\x40]\x00[\x80|\x40]\x00\x00\x00	2	0	0	1
+4776	4776	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4777	4777	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4778	4778	^[A-Za-z0-9]{16,32}$	2	0	0	1
+4779	4779	^[a-zA-Z0-9_-]{171}$	2	0	0	1
+4780	4780	(Q(k(MIdh|UMcR)|0IPdR)|(DQg91|FRghw)F|(NCD3U|VGCHA)X)	2	0	0	1
+4781	4781	(fCxTeXN0ZW0gSWRsZS|wsU3lzdGVtIElkbGUg|8LFN5c3RlbSBJZGxlI)	2	0	0	1
+4782	4782	(I(iwidmFsdWUiO|sInZhbHVlIjo)i|iLCJ2YWx1ZSI6I)	2	0	0	1
+4783	4783	^[0-9a-f]{64}$	2	0	0	1
+4784	4784	^[0-9a-f]{64}$	2	0	0	1
+4785	4785	^[\x01-\x4c]$	2	0	0	1
+4786	4786	CN=([^\r\n]+?\.)?OU=Delegated\ Licensor,KYP\ SDT\ LTD(\.)	2	0	0	1
+4787	4787	^\/([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4788	4788	^key=\w+\&data=	2	0	0	1
+4789	4789	^\d+$	2	0	0	1
+4790	4790	\.php\?zs=[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}&t=[0-9]{1,2}$	2	0	0	1
+4791	4791	^[0-9D]+$	2	0	0	1
+4792	4792	\.(dll|exe|zip|json)$	2	0	0	1
+4793	4793	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4794	4794	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4795	4795	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4796	4796	^\/[a-zA-Z0-9]{9,12}\/t\.html$	2	0	0	1
+4797	4797	^\/[a-z]{3,10}\.php\?[a-z]{3,10}=([A-Za-z0-9+/]{4})	2	0	0	1
+4798	4798	^[a-z]{256}$	2	0	0	1
+4799	4799	^[0-9]&(index|pi|serv)=	2	0	0	1
+4800	4800	^[0-9]&(index|pi|serv)=	2	0	0	1
+4801	4801	^[0-9]&(index|pi|serv)=	2	0	0	1
+4802	4802	^\/[a-zA-Z0-9+=]{29,44}.{0,8}=$	2	0	0	1
+4803	4803	^(\d{1,3}\.){3}\d{1,3}$	2	0	0	1
+4804	4804	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})	2	0	0	1
+4805	4805	^[A-Za-z0-9]{1,15}=([A-Za-z0-9+\/]{4})*([A-Za-z0-9+\/]{2}==|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{4})$	2	0	0	1
+4806	4806	(IiwiM2ZlMTEiOi|IsIjNmZTExIjoi|iLCIzZmUxMSI6I)	2	0	0	1
+4807	4807	(IiwiYXU1byI6I|IsImF1NW8iOi|iLCJhdTVvIjoi)	2	0	0	1
+4808	4808	(ifQ==|In0=|J9)$	2	0	0	1
+4809	4809	^[a-z]{256}-\.jpg$	2	0	0	1
+4810	4810	^[IJKL].*(PT0iLC|09Iiwi|9PSIsI)[a-zA-Z0-9+\/]+(PT0iLC|09Iiwi|9PSIsI)	2	0	0	1
+4811	4811	^[a-f0-9]{5,12}&a=	2	0	0	1
+4812	4812	^[a-zA-Z0-9]{12}\.onion	2	0	0	1
+4813	4813	^\x7b(\x22[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.[a-z]{2,10}\x22,){4}\x22[a-z0-9_\-\.]+@[a-z0-9_\-\.]+\.[a-z]{2,10}\x22\x7d$	2	0	0	1
+4814	4814	^[a-z]{256}\.gif$	2	0	0	1
+4815	4815	(JTBEJTBBJTBEJTBBJTREJTY1JTZEJTZGJTcyJTc5JTNBJTIw|UwRCUwQSUwRCUwQ)	2	0	0	1
+4816	4816	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(\x3a\d+)?$	2	0	0	1
+4817	4817	^\/[a-zA-Z0-9]{9,12}\/x\.html$	2	0	0	1
+4818	4818	^[0-9]+$	2	0	0	1
+4819	4819	^([A-Za-z0-9%+\/]{4,6})*([A-Za-z0-9%+\/]{2}==|[A-Za-z0-9%+\/]{3}=|[A-Za-z0-9%+\/]{4})$	2	0	0	1
+4820	4820	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4821	4821	^[\x01-\x04]	2	0	0	1
+4822	4822	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4823	4823	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4824	4824	[a-z]{8}.(:?psd|dib)	2	0	0	1
+4825	4825	[a-z]{8}.(:?dib|psd)	2	0	0	1
+4826	4826	https:\/\/[a-z0-9]{8}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{12}	2	0	0	1
+4827	4827	^[a-z0-9]{6}_[a-z0-9]{32}	2	0	0	1
+4828	4828	\.php\?[a-z]{3}=(baby|child|adult)	2	0	0	1
+4829	4829	^[a-f0-9=]{5,12}&ap=	2	0	0	1
+4830	4830	^[0-9]{8}$	2	0	0	1
+4831	4831	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4832	4832	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4833	4833	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4834	4834	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4835	4835	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4836	4836	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4837	4837	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4838	4838	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4839	4839	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4840	4840	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4841	4841	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$	2	0	0	1
+4842	4842	^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$	2	0	0	1
+4843	4843	^(update|designs)$	2	0	0	1
+4844	4844	^\d$	2	0	0	1
+4845	4845	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\x3a80$	2	0	0	1
+4846	4846	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4847	4847	\*\*\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\*\*	2	0	0	1
+4848	4848	^\/wp\x2dcontent\/[a-z]{3}\/[0-9]{16}\.exe$	2	0	0	1
+4849	4849	^[A-Za-z0-9-_]{176}$	2	0	0	1
+4850	4850	^\/\.x\/irq\d$	2	0	0	1
+4851	4851	^\/\.x\/\dsh$	2	0	0	1
+4852	4852	^(?<len>.{2})\xc0\xff(=len)\x00\x00.{2}\x00\x00\x01\x78\x9c	2	0	0	1
+4853	4853	\x24url[0-9]{1}\s=\s'(http|https):\/\/[^']*\x27\x3b	2	0	0	1
+4854	4854	^\/[A-Za-z0-9]{10,11}\/	2	0	0	1
+4855	4855	\.php\?serial=[a-z0-9]{16}	2	0	0	1
+4856	4856	^[0-3]{2}_[0-2]{2}\.php$	2	0	0	1
+4857	4857	^dBrowser\x20\d\x20CallGetResponse\x3a\d$	2	0	0	1
+4858	4858	^\/\w$	2	0	0	1
+4859	4859	^\/wrte\?maid=[A-Z0-9]{8}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{12}$	2	0	0	1
+4860	4860	^\/[a-z0-9]{1,3}\/service\?uuid=[A-Z0-9]{8}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{4}\-[A-Z0-9]{12}$	2	0	0	1
+4861	4861	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n][\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n][\x20-\x7e\r\n]{0,20}	2	0	0	1
+4862	4862	^\/wp-includes\/[A-Za-z0-9]{10}\/$	2	0	0	1
+4863	4863	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4864	4864	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4865	4865	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4866	4866	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4867	4867	^.\d{1,2}\.\d+\.\d+	2	0	0	1
+4868	4868	^[\x20-\x7e\r\n]{0,13}[^\x20-\x7e\r\n]	2	0	0	1
+4869	4869	^[A-Za-z0-9]{16,32}$	2	0	0	1
+4870	4870	^[A-Za-z0-9]{16,32}$	2	0	0	1
+4871	4871	^\d+$	2	0	0	1
+4872	4872	^\/[A-Za-z0-9]{30}\.php$	2	0	0	1
+4873	4873	^[a-f0-9]{5}([a-zA-Z0-9+\/]{4})*([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})	2	0	0	1
+4874	4874	^([a-zA-Z0-9+/]{4})*([a-zA-Z0-9+/]{2}==|[a-zA-Z0-9+/]{3}=|[a-zA-Z0-9+/]{4})$	2	0	0	1
+4875	4875	^[a-zA-Z0-9+\/]+([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})$	2	0	0	1
+4876	4876	^[a-zA-Z0-9+\/]+([a-zA-Z0-9+\/]{2}==|[a-zA-Z0-9+\/]{3}=|[a-zA-Z0-9+\/]{4})$	2	0	0	1
+4877	4877	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4878	4878	^[a-z0-9]{8}\r\n	2	0	0	1
+4879	4879	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+4880	4880	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4881	4881	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4882	4882	^[0-9]{6,10}\.	2	0	0	1
+4883	4883	^\/[a-zA-z]{14}\/	2	0	0	1
+4884	4884	^\/[a-zA-z]{14}\/	2	0	0	1
+4885	4885	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4886	4886	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4887	4887	^[A-Z]{16}$	2	0	0	1
+4888	4888	^\/\x3fusername\x3d[a-z0-9]{2,3}_\d$	2	0	0	1
+4889	4889	^[A-Z]{16}$	2	0	0	1
+4890	4890	^[A-Z]{16}$	2	0	0	1
+4891	4891	^([A-F0-9]\x00){12}	2	0	0	1
+4892	4892	^([A-F0-9]\x00){12}	2	0	0	1
+4893	4893	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4894	4894	^[A-F0-9]{12}	2	0	0	1
+4895	4895	^([A-F0-9]\x00){12}	2	0	0	1
+4896	4896	^[A-F0-9]{12}	2	0	0	1
+4897	4897	^(<letter>[a-z])(=letter)\,	2	0	0	1
+4898	4898	O=(GoDaddy)[A-Z][a-z]+\s[A-Z][a-z]+\s(NL|Pty|Inc|Corp|Ltd)\.?,.+CN=[a-z]{5,}\.[a-z]{2,3}($|,)	2	0	0	1
+4899	4899	[eE]mail(Address)admin@	2	0	0	1
+4900	4900	^.{2}(<fake_email>([asdfgh]+|[qwerty]+|[zxcvbn]+)\@([asdfgh]+|[qwerty]+|[zxcvbn]+)\.)	2	0	0	1
+4901	4901	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+4902	4902	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+4903	4903	^[A-F0-9]{12}	2	0	0	1
+4904	4904	^\d	2	0	0	1
+4905	4905	^\x2F[a-z]{1}\x2Ehtm$	2	0	0	1
+4906	4906	\/index.dat\?\d{5,9}$	2	0	0	1
+4907	4907	^\/[A-Za-z]{2,}\/\?[a-z]\sHTTP\/1\.[0-1]\r\nUser-Agent\x3a Mozilla\/4\.0	2	0	0	1
+4908	4908	^Host\x3a\x20([a-z0-9]{0,19}[A-Z])([A-Z0-9]{0,19}[a-z])[a-zA-Z0-9]{4,20}\.[a-z]{2,3}/H	2	0	0	1
+4909	4909	^[a-zA-Z0-9\+\/]+={0,2}$/P	2	0	0	1
+4910	4910	filename=[a-f0-9]{32}v\.(docm|zip)\x0d\x0a/Hmi	2	0	0	1
+4911	4911	^((\x00\x00\x00).)*?_\x00((\x00\x00).)*?_\x00((\x00\x00).)*?_\x00	2	0	0	1
+4912	4912	^[a-z]\x29	2	0	0	1
+4913	4913	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/title	2	0	0	1
+4914	4914	^.{2}([a-z]{0,15}\d)(<var>[a-z0-9]{4,16}[01]).+?\x06\x03\x55\x04\x0a.{2}(=var)	2	0	0	1
+4915	4915	^\/[a-z]$	2	0	0	1
+4916	4916	^([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4917	4917	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4918	4918	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4919	4919	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4920	4920	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4921	4921	^.{2}(<fake_loc>([asdfgh]+|[qwerty]+|[zxcvbn]+|[23werf]+)[01])	2	0	0	1
+4922	4922	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4923	4923	^[a-z0-9/=\+]$	2	0	0	1
+4924	4924	^[a-z0-9/=\+]$	2	0	0	1
+4925	4925	^\/d\/[a-z]+\d+\.jpg$	2	0	0	1
+4926	4926	\/p?2p\/[0-9]{1,2}\.exe$	2	0	0	1
+4927	4927	^\/2p\/[a-z]{1,2}\.exe$	2	0	0	1
+4928	4928	\/[a-z0-9]{3,}\.gz$	2	0	0	1
+4929	4929	\/mss\d+\.exe$	2	0	0	1
+4930	4930	^\/download\/ftp\/(grabftp|grabftp64)\.bin$	2	0	0	1
+4931	4931	^\/image\/(data|flags)\/[^\x2f]+\.exe$	2	0	0	1
+4932	4932	(\x20MSIE\x20|rv\x3a11)	2	0	0	1
+4933	4933	^[\x20-\x7e\r\n]{0,20}[^\x20-\x7e\r\n]	2	0	0	1
+4934	4934	^\/[a-z]{3,6}\/[a-z]{3,6}\.[a-z]{3}$	2	0	0	1
+4935	4935	^[A-Z]{2}-[0-9]{1,5}\x3aBegin$	2	0	0	1
+4936	4936	^[A-Z]{2}-[0-9]{1,5}\x3aStartU$	2	0	0	1
+4937	4937	^\/command\/[A-Fa-f0-9]{8}\-([A-Fa-f0-9]{4}\-){3}[A-Fa-f0-9]{12}\.cmd$	2	0	0	1
+4938	4938	^<CHECK>([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})<\/CHECK>	2	0	0	1
+4939	4939	^\{\x22uid\x22\x3a\x22[a-f0-9]+\x22\}$	2	0	0	1
+4940	4940	^[A-Za-z0-9_-]{171}$	2	0	0	1
+4941	4941	^\/[a-f0-9]{8}\/\D+\d{8,10}\.html$	2	0	0	1
+4942	4942	^POST\s(<urivar>\/([A-Z0-9a-z]{2,25}\/){1,10})\sHTTP\/1\.1\r\n	2	0	0	1
+4943	4943	^\x2f\x00{3}[A-Z0-9]{6}_[a-f0-9]+\x00{16}$	2	0	0	1
+4944	4944	[A-Za-z0-9]{62}	2	0	0	1
+4945	4945	^(php)?Yuok\\\d\d	2	0	0	1
+4946	4946	Data\\\d\d	2	0	0	1
+4947	4947	^[a-zA-Z0-9\/+]{171}=$	2	0	0	1
+4948	4948	^\/\?id\=[A-Z]{12,28}[0-9]$	2	0	0	1
+4949	4949	^\/\?id\=[A-Z]{12,28}[0-9]$	2	0	0	1
+4950	4950	\/\?p=p52dcW[A-Za-z]{4}	2	0	0	1
+4951	4951	^.{2}(<var>[a-zA-Z0-9]{24}[01]).+?\x06\x03\x55\x04\x07.{2}(=var)	2	0	0	1
+4952	4952	^(<var>[a-zA-Z0-9]{1,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+4953	4953	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+4954	4954	^([a-z0-9]{0,119}[A-Z])([A-Z0-9]{0,119}[a-z])(<var>[a-zA-Z0-9]{10,120}[01]).+?\x55\x04\x03.{2}(=var)	2	0	0	1
+4955	4955	^.(<orgname>.[^01]+).*?\x55\x04\x0b.(=orgname)	2	0	0	1
+4956	4956	[^\x15][^\x49\x3f\x3e\x28\x69\x2f\x2e\x37\x2a\x29\x2b\x39\x36]	2	0	0	1
+4957	4957	^[0-9]-[0-9]-[0-9]{5}-[0-9]\r\n	2	0	0	1
+4958	4958	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4959	4959	^[A-Za-z0-9\/_\-\+]{171}=$	2	0	0	1
+4960	4960	[a-zA-Z0-9]{8}\/	2	0	0	1
+4961	4961	^[a-z]\.(tech|online)$	2	0	0	1
+4962	4962	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+4963	4963	^[a-zA-Z0-9-_]{171}$	2	0	0	1
+4964	4964	[a-z0-9]{8}\/.*\?[a-z0-9]{3,10}=[a-z0-9]{8,11}$	2	0	0	1
+4965	4965	updateb\.php\?p=\d	2	0	0	1
+4966	4966	&os=[0-9a-z]{40}	2	0	0	1
+4967	4967	&(<vname>[a-z]+)1=[A-F0-9]+&(=vname)2=[A-F0-9]+&(=vname)3=[A-F0-9]+&(=vname)4=[A-F0-9]	2	0	0	1
+4968	4968	^[1-z]{13}=[0-9]{16}$	2	0	0	1
+4969	4969	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4970	4970	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4971	4971	^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$	2	0	0	1
+4972	4972	^\/[A-F0-9]{33}$	2	0	0	1
+4973	4973	^\d+?\x00	2	0	0	1
+4974	4974	%(USERPROFILE|APPDATA)%	2	0	0	1
+4975	4975	%(USERPROFILE|APPDATA)%	2	0	0	1
+4976	4976	%(USERPROFILE|APPDATA)%	2	0	0	1
+4977	4977	%(USERPROFILE|APPDATA)%	2	0	0	1
+4978	4978	^[0-9]{10}$	2	0	0	1
+4979	4979	^key=[A-F0-9]{32}$	2	0	0	1
+4980	4980	^[a-f0-9]{60}\x0d\x0a	2	0	0	1
+4981	4981	^(pro)([A-Za-z0-9+/]{4})*([A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})$	2	0	0	1
+4982	4982	[0-9]{1,2}	2	0	0	1
+4983	4983	\d{1,2}	2	0	0	1
+4984	4984	[0-9]{1,2}	2	0	0	1
+4985	4985	[0-9]{1,2}	2	0	0	1
+4986	4986	[0-9]{1,2}	2	0	0	1
+4987	4987	[0-9]{1,2}	2	0	0	1
+4988	4988	CN=([^\r\n]+?\.)?supportmicrohere\.com(\.)	2	0	0	1
+4989	4989	CN=([^\r\n]+?\.)?jbdelmarket\.com(\.)	2	0	0	1
+4990	4990	[0-9]{1,3}	2	0	0	1
+4991	4991	[0-9]{1,3}	2	0	0	1
+4992	4992	^ETag\x3a\x20[0-9]{6}-[0-9]{3,5}-[0-9]{8}\r\n	2	0	0	1
+4993	4993	^([0-9]{1,3}\.){3}[0-9]{1,3}$/W	2	0	0	1
+4994	4994	[a-f0-9]{60}$	2	0	0	1
+4995	4995	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+4996	4996	^([0-9]{1,3}\.){3}[0-9]{1,3}$	2	0	0	1
+4997	4997	^[a-z0-9]{33}	2	0	0	1
+4998	4998	^[qbedm]{1}[a-zA-Z]{1,3}646[a-zA-Z0-9]{1,3}\.	2	0	0	1
+4999	4999	^[zjr9x]{1}[tmdhpz]{1}[0-9a-z]{1,6}266([a-zA-Z0-9]{1,6})?\.	2	0	0	1
+5000	5000	^5\.[0-2]\x20\d\d\x3a\d\d\x20	2	0	0	1
\ No newline at end of file
diff --git a/test/maat_framework_gtest.cpp b/test/maat_framework_gtest.cpp
index f5ebf66..98fbb9b 100644
--- a/test/maat_framework_gtest.cpp
+++ b/test/maat_framework_gtest.cpp
@@ -7466,7 +7466,7 @@ TEST_F(MaatCmdTest, StreamScanSegfaultWhenVersionRollBack_TSG6324) {
     //DON'T DO THIS!!!
 	//Roll back version, trigger full update.	
 	//This operation generates FATAL logs in test_maat_redis.log.yyyy-mm-dd.
-	//For example: Add group 22 vt_id 0 to clause 2 of compile 979 failed, group is already exisited
+	//For example: Add group 22 vt_id 0 to clause 2 of compile 979 failed, group is already existed
 	maat_cmd_incrby(maat_inst, "MAAT_VERSION", -100);
 
 	//Wating for scanner garbage collect expiration.