#ID	preD	Flags	andMsk	andPin	ClassID	Severity	Sel	Findex	Proto	srcPort	dstPort	offset
1	0	0x80	0x0000	0x0000	40	2	0x9b	0x0001	6	0	80	0	Volume
2	0	0x80	0x0000	0x0000	40	2	0x9b	0x0001	6	0	80	0	(?i)Command
3	0	0x80	0x0000	0x0000	40	2	0x9b	0x0001	6	0	80	0	(?i)Bad
4	0	0x80	0x0000	0x0000	40	2	0x9b	0x0001	6	0	80	0	(?i)1
5	0	0x80	0x0000	0x0000	39	2	0x9b	0x0001	6	0	80	0	(?i)Invalid
6	0	0x80	0x0000	0x0000	40	2	0x8b	0x0001	6	0	80	0	(?i)Index
7	0	0x00	0x0000	0x0000	39	2	0x84	0x0001	6	0	80	0	^HTTP
8	0	0x80	0x0000	0x0000	39	2	0x84	0x0001	6	0	80	0	GET
8	7	0x80	0x0000	0x0000	39	2	0x80	0x0001	6	0	80	0	^POST
8	0	0x80	0x0000	0x0000	39	2	0x8b	0x0001	6	0	80	0	^POST
10	0	0x80	0x0000	0x0000	19	3	0x8b	0x0001	6	0	512	0	^username
13	0	0x80	0x0000	0x0000	62	1	0x8b	0x0001	6	0	22222	0	^WINDIR
14	0	0x80	0x0000	0x0000	62	1	0x8b	0x0001	6	0	22222	0	^SYSDIR
15	0	0x80	0x0000	0x0000	62	1	0x8b	0x0001	6	0	22222	0	^ABCJZDATEIV
16	0	0x80	0x0000	0x0000	62	1	0x8b	0x0001	6	0	23432	0	^RQS
17	16	0x80	0x0000	0x0000	62	1	0x8b	0x0001	6	0	23432	0	^GNT
18	0	0x80	0x0000	0x0000	62	1	0x8b	0x0001	6	0	2000	0	^Insane
19	0	0x80	0x0000	0x0000	62	1	0x8b	0x0001	6	0	63536	0	^Insane
20	0	0x80	0x0000	0x0000	62	1	0x8b	0x0001	6	0	1020	0	^Hello\.\.\.
21	20	0x80	0x0000	0x0000	62	1	0x8b	0x0001	6	0	1020	0	^Vampire
22	0	0x80	0x0000	0x0000	62	1	0x8b	0x0001	6	0	5884	0	^connected
23	22	0x80	0x0000	0x0000	62	1	0x8b	0x0001	6	0	5884	0	^getclient
24	23	0x80	0x0000	0x0000	62	1	0x8b	0x0001	6	0	5884	0	^.{0,1}client
25	7	0x80	0x0000	0x0000	18	3	0x00	0x0001	6	0	31337	0	.*
26	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	(?i)User-Agent\x3A
27	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	(?i)User-Agent\x3A
29	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	(?i)User-Agent\x3A
30	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	(?i)User-Agent\x3A
31	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	(?i)User-Agent\x3A
32	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	(?i)User-Agent\x3A
33	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	(?i)User-Agent\x3A
34	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	(?i)User-Agent\x3A
35	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	(?i)User-Agent\x3A
37	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	(OPTIONS|GET|HEAD|POST|PUT|DELETE|TRACE|CONNECT)[^\r\n]*(?i)fblogin\x3D(?-i)
38	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	^POST
39	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	POST[^\r\n]*\/abcd\.php.{6}.{0,92}(?i)\x0D.File\x3A\x20(?-i).{1,}.{0,54}(?i)\x0D.Victim\x3A\x20(?-i)
40	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	Content-Length\x3A\x203.*?\x0d?\x0a\x0d?\x0a
41	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	(OPTIONS|GET|HEAD|POST|PUT|DELETE|TRACE|CONNECT)[^\r\n]*\/bn93h4k\.php
42	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	CRYPTED0
43	0	0x80	0x0000	0x0000	18	3	0x8b	0x0001	6	0	80	0	(OPTIONS|GET|HEAD|POST|PUT|DELETE|TRACE|CONNECT)[^\r\n]*(?i)\/cfg\/stopav\.psd(?-i)
44	0	0x80	0x0000	0x0000	14	3	0x8b	0x0001	6	0	0	0	User-Agent\x3AICQ
45	0	0x80	0x0000	0x0000	14	3	0x8b	0x0001	6	0	1863	0	^.{9}\x06.{2}$EXTERNAL_NET$HOME_NET\x07\x47
46	0	0x80	0x0000	0x0000	14	3	0x8b	0x0001	6	0	1863	0	^MSG
47	0	0x80	0x0000	0x0000	14	3	0x8b	0x0001	6	0	1863	0	(?i)Content-Type\x3A(?-i).{1,}text\/plain
48	0	0x80	0x0000	0x0000	14	3	0x8b	0x0001	6	0	1863	0	^MSG
49	0	0x80	0x0000	0x0000	14	3	0x8b	0x0001	6	0	1863	0	(?i)Content-Type\x3A
50	0	0x80	0x0000	0x0000	14	3	0x8b	0x0001	6	0	1863	0	^MSG
51	0	0x80	0x0000	0x0000	14	3	0x8b	0x0001	6	0	1863	0	^MSG
52	0	0x80	0x0000	0x0000	14	3	0x8b	0x0001	6	0	1863	0	^(?i)CAL
53	0	0x80	0x0000	0x0000	14	3	0x8b	0x0001	6	0	80	0	^.{0,5}(?i)\/notifyft(?-i)
54	0	0x80	0x0000	0x0000	14	3	0x8b	0x0001	6	0	80	0	(?i)Host\x3A
