Play interactive tourEdit tour

Windows Analysis Report
http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6Mz

Overview

General Information

Sample URL:	http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cm
Analysis ID:	1555221
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

HTML page contains suspicious onload / onerror event

Suspicious execution chain found

Connects to several IPs in different countries

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Downloads executable code via HTTP

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

HTML page contains hidden javascript code

HTML page contains string obfuscation

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Stores files to the Windows start menu directory

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

×

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\Downloads\Unconfirmed 897116.crdownload

ReversingLabs: Detection: 37%

Phishing

HTML page contains suspicious onload / onerror event

Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: (function(img) { window.ftclick = "https://googleads.g.doubleclick.net/dbm/clk%
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: (function(img) { window.ftclick = "https://googleads.g.doubleclick.net/dbm/clk%
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: (function(img) { window.ftclick = "https://googleads.g.doubleclick.net/dbm/clk%
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: (function(img) { window.ftclick = "https://googleads.g.doubleclick.net/dbm/clk%
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: (function(img) { window.ftclick = "https://googleads.g.doubleclick.net/dbm/clk%

HTML page contains hidden javascript code

Source: http://www.oldversion.com/windows/pdfcreator-1-6-2

HTTP Parser: Base64 decoded: [null,null,null,3]

HTML page contains string obfuscation

Source: https://googleads.g.doubleclick.net/pagead/html/r20241107/r20190131/zrt_lookup_fy2021.html

HTTP Parser: Found new string: script (function() {var u = 'https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B36y1k98nkSMgnhQjbJb5cG_S6XjzKZu_FujRDy_UUNsY_MJlMOiafNV0PHcAsbBhYI49W84ZXrRklNQPNsNWNKGKUCei6XtMbyVULg4vDPNwiVhdfrqaRf1SrKEloaZkkvLpHOLKV_-48Q5WCb7mNifkeLtC2i8OYbAwFU0IFPeRDEF8ok-zdWOXkt8cuZlmh3GiLN-Arx3dm4xUh5zAMQJ8fGiyHSnPF9W5dxaxWlE_mRoY&cry=1&dbm_d=AKAmf-DedrGWOkf_DSIfQnwQ0er5Y0lolBETP4Ov5nn9MleOTemcuheZ97LWuF4GY3Ve37dFcPc8xhI6I-BAmOz4lUPY4rsHiQT58lDS7MNt5JGQCeqFNc5IOQoZBgL4pHb5459N6ZmvC3cqDWDZ_V_m9whhCyOTu-Wh0eybmVpcIj6rTskeZAX33AUC1ap0noXYLcBMX4JXKc8y7_O5vKfjLbUJIZLcfkbLIVGIIdT4CCjhe94dZVNmxcVdKWLjEQuBTbXvRTiJVe0F0PO65lYyK8nLCZqJbScuq4x_VL21mkiMzVIhW3iAqnMbpSjPMIPTeYXV3WhYMB5FW2vLmx_XvcanAKH_f7snYv2dfexkCUJPGXGKzw-_zRECJ5IJwom1Un7kTQYkFp1HXn12r8ars34KFjUo2xcdKgVuUZULbun2oj2KXeVr6OUcmSQNZIIcCUtUb8r7r7mEmDoO0Yaj-kz4MWqL4QoUMolkHBVmb8RVUihTGDf5X5cTGL53k25Ixg9O6kuIcHF9OHbW7yfYan7FVr6hlvTQkXFJOopKCFeaMEr7zRqzniYjdk3mNMaXKkK3N3c39xbkmKVMzufTb2oZz888FtkS1swWUhOwKxkr22_E7pPvD8Zu-VzRzIeMhANsJTSsx2CZCO48wRFouK3pcvF_ao272JGr7Tw5cQm8r3wBq...

HTML page is missing a favicon

Source: http://www.oldversion.com/	HTTP Parser: No favicon
Source: http://www.oldversion.com/	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/pdfcreator/	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/pdfcreator/	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/pdfcreator/	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/pdfcreator/	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/pdfcreator/	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/pdfcreator/	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: http://www.oldversion.com/windows/download/pdfcreator-1-6-2	HTTP Parser: No favicon
Source: https://www.pdfforge.org/pdfcreator/support	HTTP Parser: No favicon

Compliance

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

File created: C:\Program Files (x86)\PDFCreator\SetupLog.txt

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

File created: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\Program license - english - OC.rtf

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.18:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.242.255.91:443 -> 192.168.2.18:50202 version: TLS 1.2

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Child: C:\Windows\SysWOW64\rundll32.exe

Allocates a big amount of memory (probably used for heap spraying)

Source: chrome.exe

Memory has grown: Private usage: 21MB later: 29MB

Networking

Connects to several IPs in different countries

Source: unknown

Network traffic detected: IP country count 12

Downloads executable code via HTTP

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Wed, 13 Nov 2024 14:51:43 GMTContent-Type: application/x-ms-dos-executableConnection: keep-aliveContent-Disposition: attachment; filename*=UTF-8''pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exeContent-Length: 17464864Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 ce 7a 0b 01 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 a8 2a 00 00 00 00 00 00 00 00 00 00 a0 67 0a 01 80 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 64 93 00 00 00 10 00 00 00 94 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 4c 02 00 00 00 b0 00 00 00 04 00 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 88 0e 00 00 00 c0 00 00 00 00 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 b4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 a8 2a 00 00 00 10 01 00 00 2c 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.141.63
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 20.12.23.50
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.209.192
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Downloads compressed data via HTTP

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: keep-aliveContent-Length: 27597Last-Modified: Mon, 11 Dec 2023 17:20:28 GMTx-amz-server-side-encryption: AES256Cache-Control: public, max-age=1800Content-Type: application/javascript; charset=utf-8Etag: "824beb891744db98ccbd3a456e59e0f7+gzip"Content-Encoding: gzipAccess-Control-Allow-Methods: GETAccess-Control-Allow-Origin: *P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"Accept-Ranges: bytesDate: Wed, 13 Nov 2024 14:51:24 GMTX-Served-By: cache-iad-kcgs7200137-IAD, cache-fra-etou8220024-FRAX-Cache: HIT, HITVary: Accept-EncodingTW-CDN: FTData Raw: 1f 8b 08 00 00 00 00 00 00 03 dc bd e9 7a db 48 92 28 fa ff 3c 05 85 9e 51 01 4d 08 22 29 c9 0b 58 28 8e cb 56 4d 7b c6 db 58 72 f7 37 23 ab f5 41 44 52 44 19 04 d8 58 24 ab 24 9e 87 b8 0f 75 9f eb 46 44 66 02 99 40 82 92 ab aa bb cf b9 33 d5 32 01 e4 9e 91 91 b1 c7 4f 55 3a 2f e3 2c dd dd fd 49 fc f2 d6 79 56 66 e5 ed 9a 99 de 79 97 71 1a ed ee da fb f6 db 93 d7 c7 03 fb ec c9 d3 67 cf cf ef c7 a3 fb f1 d8 71 ee 4f f3 38 62 69 b9 ef 95 ac 28 ed 34 bc 8e af c2 32 cb bd aa 60 f9 8b 2b f8 e2 dc df db 37 d0 44 76 e3 5d 5c 94 37 65 99 ef ee ea cf de 4d 1c 5d b1 b2 e8 7b ef 25 59 18 b1 a8 fe dc fd b8 e5 93 ed b8 bf b1 f7 38 8d cb fb fb 85 58 18 bb 74 ee e4 ef 01 b3 19 3c 65 b9 7d 1d e6 83 d4 8d dd 2c 60 67 a3 73 b7 80 7f c6 e7 6e 18 8c dc 79 70 76 3e 0d bf cf bc 84 a5 57 e5 72 1a 0e 87 4e 1c 64 67 e1 b9 9b 9f c5 e7 bb bb 73 6f 5d 15 4b 1b 1f a0 aa 43 6f 83 d1 14 5b 4d 07 71 3a 28 9c f7 97 3f b3 79 a9 ec c8 32 2c de df a4 1f f2 6c cd f2 f2 d6 9b 87 49 62 17 6e ea c0 2e 95 67 e9 79 50 c0 1f 87 5a a8 76 77 2b 18 e3 74 2e bb 77 e6 5e b1 8c 17 a5 ed d8 ce 86 46 1d dc 6d dc 3c b8 1b f9 a3 cd b4 9e 58 8c 13 8b 17 76 7a c6 ce 9d 9c 95 55 9e 0e f0 b7 c7 be ae b3 bc 2c a6 58 35 0f f0 55 70 17 fb cc 4d fc 9d b1 2b 3e fa 77 9b cd 54 54 2a b1 12 0d 30 97 75 dd dc 6d 7e c7 30 61 2f 09 76 46 cd bb 4d ec b1 40 5d 6e ec 8b c1 32 ba 69 90 9f 95 e7 53 18 d7 68 27 08 52 07 07 e8 30 be 7e e9 d9 04 e6 cc 92 82 51 f9 2c 48 d9 cd 00 96 68 15 17 cc ae 5b 63 d0 e1 1d 6f 26 38 83 87 f3 0d d4 69 1a 08 32 87 66 56 c0 d6 45 d9 bc 5a 01 fc 7a 00 04 c7 09 c3 9f c5 8f b7 a7 e1 d5 bb 70 c5 6c 6b c9 c2 c8 72 70 b3 ab a6 e8 3c 67 61 c9 44 69 db 2a e6 79 bc 2e 2d 67 5a 79 f3 65 98 17 ac 0c ac aa 5c ec 3d b3 dc ca 2b e3 15 cb aa 32 18 4f 46 6e ec a5 73 d8 29 0f 4a bc 00 d0 Data Ascii: zH(<QM")X(VM{Xr7#ADRDX$$uFDf@32OU:/,IyVfyqgqO8bi(42`+7Dv]\7eM]{%Y8Xt<e},`gsnypv>WrNdgso]KCo[Mq:(?y2,lIbn.gyPZvw+t.w^Fm<XvzU,X5UpM+>wTT*0um~0a/vFM@]n2iSh'R0~Q,Hh[co&8i2fVEZzplkrp<gaDi*y.-gZye\=+
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: keep-aliveContent-Length: 27597Last-Modified: Mon, 11 Dec 2023 17:20:28 GMTx-amz-server-side-encryption: AES256Cache-Control: public, max-age=1800Content-Type: application/javascript; charset=utf-8Etag: "824beb891744db98ccbd3a456e59e0f7+gzip"Content-Encoding: gzipAccess-Control-Allow-Methods: GETAccess-Control-Allow-Origin: *P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"Accept-Ranges: bytesDate: Wed, 13 Nov 2024 14:51:25 GMTX-Served-By: cache-iad-kcgs7200137-IAD, cache-fra-etou8220079-FRAX-Cache: HIT, HITVary: Accept-EncodingTW-CDN: FTData Raw: 1f 8b 08 00 00 00 00 00 00 03 dc bd e9 7a db 48 92 28 fa ff 3c 05 85 9e 51 01 4d 08 22 29 c9 0b 58 28 8e cb 56 4d 7b c6 db 58 72 f7 37 23 ab f5 41 44 52 44 19 04 d8 58 24 ab 24 9e 87 b8 0f 75 9f eb 46 44 66 02 99 40 82 92 ab aa bb cf b9 33 d5 32 01 e4 9e 91 91 b1 c7 4f 55 3a 2f e3 2c dd dd fd 49 fc f2 d6 79 56 66 e5 ed 9a 99 de 79 97 71 1a ed ee da fb f6 db 93 d7 c7 03 fb ec c9 d3 67 cf cf ef c7 a3 fb f1 d8 71 ee 4f f3 38 62 69 b9 ef 95 ac 28 ed 34 bc 8e af c2 32 cb bd aa 60 f9 8b 2b f8 e2 dc df db 37 d0 44 76 e3 5d 5c 94 37 65 99 ef ee ea cf de 4d 1c 5d b1 b2 e8 7b ef 25 59 18 b1 a8 fe dc fd b8 e5 93 ed b8 bf b1 f7 38 8d cb fb fb 85 58 18 bb 74 ee e4 ef 01 b3 19 3c 65 b9 7d 1d e6 83 d4 8d dd 2c 60 67 a3 73 b7 80 7f c6 e7 6e 18 8c dc 79 70 76 3e 0d bf cf bc 84 a5 57 e5 72 1a 0e 87 4e 1c 64 67 e1 b9 9b 9f c5 e7 bb bb 73 6f 5d 15 4b 1b 1f a0 aa 43 6f 83 d1 14 5b 4d 07 71 3a 28 9c f7 97 3f b3 79 a9 ec c8 32 2c de df a4 1f f2 6c cd f2 f2 d6 9b 87 49 62 17 6e ea c0 2e 95 67 e9 79 50 c0 1f 87 5a a8 76 77 2b 18 e3 74 2e bb 77 e6 5e b1 8c 17 a5 ed d8 ce 86 46 1d dc 6d dc 3c b8 1b f9 a3 cd b4 9e 58 8c 13 8b 17 76 7a c6 ce 9d 9c 95 55 9e 0e f0 b7 c7 be ae b3 bc 2c a6 58 35 0f f0 55 70 17 fb cc 4d fc 9d b1 2b 3e fa 77 9b cd 54 54 2a b1 12 0d 30 97 75 dd dc 6d 7e c7 30 61 2f 09 76 46 cd bb 4d ec b1 40 5d 6e ec 8b c1 32 ba 69 90 9f 95 e7 53 18 d7 68 27 08 52 07 07 e8 30 be 7e e9 d9 04 e6 cc 92 82 51 f9 2c 48 d9 cd 00 96 68 15 17 cc ae 5b 63 d0 e1 1d 6f 26 38 83 87 f3 0d d4 69 1a 08 32 87 66 56 c0 d6 45 d9 bc 5a 01 fc 7a 00 04 c7 09 c3 9f c5 8f b7 a7 e1 d5 bb 70 c5 6c 6b c9 c2 c8 72 70 b3 ab a6 e8 3c 67 61 c9 44 69 db 2a e6 79 bc 2e 2d 67 5a 79 f3 65 98 17 ac 0c ac aa 5c ec 3d b3 dc ca 2b e3 15 cb aa 32 18 4f 46 6e ec a5 73 d8 29 0f 4a bc 00 d0 Data Ascii: zH(<QM")X(VM{Xr7#ADRDX$$uFDf@32OU:/,IyVfyqgqO8bi(42`+7Dv]\7eM]{%Y8Xt<e},`gsnypv>WrNdgso]KCo[Mq:(?y2,lIbn.gyPZvw+t.w^Fm<XvzU,X5UpM+>wTT*0um~0a/vFM@]n2iSh'R0~Q,Hh[co&8i2fVEZzplkrp<gaDi*y.-gZye\=+
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: keep-aliveContent-Length: 9760server: openrestycontent-type: text/html; charset=utf-8access-control-allow-origin: *cache-control: public, max-age=300x-service: routercontent-encoding: gzipAge: 0Date: Wed, 13 Nov 2024 14:51:27 GMTVary: Accept-Encoding,Cross-Origin-Resource-Policy: cross-originData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d fb 77 db 36 b3 e0 ef fe 2b 50 b7 5f 25 bb 12 65 3b 8f 26 72 9c de 34 76 5a ef 36 71 d6 76 6f ee 1e c7 9f 43 91 90 84 86 22 55 82 b4 ad e6 f3 fd db ef 3c 00 12 20 e9 47 ba e7 9e b3 7b ce ba 8d 4c 11 83 01 30 98 17 06 03 f8 c5 37 fb 47 af 4f ff f7 fb 03 31 2f 16 c9 cb b5 17 f6 97 0c e3 97 6b 02 7e 5e 2c 64 11 8a 68 1e e6 5a 16 7b eb bf 9f be 19 3e 5b 77 8b d2 70 21 f7 d6 2f 95 bc 5a 66 79 b1 2e a2 2c 2d 64 0a a0 57 2a 2e e6 7b b1 bc 54 91 1c d2 97 81 50 a9 2a 54 98 0c 75 14 26 72 6f db 20 62 6c ba 58 25 f2 a5 18 6d 8a 63 09 6d 05 89 d4 7a 4d 6c 8a f7 79 b6 d4 a2 c8 c4 41 ae 22 f1 56 ae 64 2e fa 0b fc 75 25 27 41 94 2d 36 c4 34 cb c5 5c 69 f1 fa e4 44 e4 58 59 4c 55 22 03 f1 41 f6 72 29 4a ad d2 99 08 53 11 c6 e1 b2 90 b1 b8 94 b9 56 59 2a e6 12 4a 85 28 e6 61 21 a2 b2 d0 22 2b 0b a1 b3 85 14 d9 14 de 4a 83 eb d7 d3 b7 bf 09 99 c8 05 0c 4b 8b 2b 29 ae 54 92 88 54 02 1a f8 04 7c 84 a7 af 02 19 0c 44 3c 4d 07 42 87 8b e5 40 c8 22 da 08 70 04 c3 ff 77 7f c4 e6 68 8d 78 63 b0 26 26 59 bc 12 5f 70 b2 16 61 3e 53 e9 58 6c ed e2 b7 65 18 c7 40 61 fe 7a 03 e0 db 00 3c df c1 8f 47 f8 f1 18 3f 9e e0 c7 53 f8 58 22 a6 24 8b 3e ff 59 66 85 c4 17 39 7e 86 f8 6f 32 c9 f1 57 94 67 e9 6a 81 4f 71 0c 53 a0 e1 29 52 04 1b 65 31 fe 8a 25 f6 07 49 bd 26 24 02 aa c5 0c 3e ff 84 7f 08 4c e4 87 5f 8b 30 41 38 5d e4 ea b3 e4 87 2c 45 40 5d 4e e8 13 a1 8a 02 3e 2e 43 6c 38 8e f1 83 50 e3 cb 44 c1 47 86 5f 4b fc 98 2a 99 c4 c0 0f f8 98 e5 d8 6a 12 4e a8 23 89 9c c9 14 eb 4e ca a2 c8 b0 53 45 38 49 a8 bf c0 70 8a df 20 f5 f0 f7 34 cb 10 45 81 22 86 bf 73 fa 82 1f f1 bd c4 15 30 07 79 2c 73 fb 6d 0a b2 36 bc 92 6a 36 2f c6 22 85 4e 85 49 fd 9e e4 a9 e3 b5 fa 0b de 6e 6f 6d fd 83 de 25 2a 95 c3 b9 41 b1 5d 83 4d c3 85 4a 56 63 90 58 e0 6e 55 f0 cc d2 b0 b8 97 dc 91 61 94 25 49 b8 d4 80 d1 3e 39 dd 1c ea 65 18 b9 9c 61 88 c9 18 12 a5 9d 4e a6 92 41 fe 1c 4f 24 90 17 89 f7 e7 38 9c 16 32 f7 f8 a5 2e 75 de 11 18 23 35 da 67 2c d6 d7 0d 33 02 ef 72 51 06 f2 3a 4d b2 ab 21 8c 4a 03 8b 25 b7 13 05 68 3a f9 ac 8a 61 21 af b9 6c 18 c6 7f 94 ba 70 40 f0 67 b8 d0 f7 81 e0 cf ad 20 d0 bd 70 3c cd a2 52 9b 1e 96 05 4e c7 18 f8 41 a5 22 ce 0a 50 56 16 6c 8e dd 47 91 18 87 51 a1 2e 65 a3 86 21 70 98 17 2a 22 ce 0b b5 32 a2 52 84 2a d1 c4 bf b3 9a 1d e1 4b 49 64 44 76 24 c4 c8 8f fc 30 cb 33 92 8c 34 bc 44 29 91 11 d6 e1 f6 62 a5 97 49 08 04 24 ea 9b 36 cb 58 65 c4 eb e9 65 88 0d 5d 42 cb 59 03 5e a5 c4 68 b6 9a 10 9b 8d 22 7e f9 57 96 2d 98 0d 2d e2 71 9a 15 fd 33 9c 56 98 31 7d be d1 c0 5b 33 4e 25 d3 0c e1 4c eb 8f 4f 3a 58 dd 48 57 a6 15 8e 6e 0c aa 3e 09 91 ae f4 1a 48 0d 74 04 3b 15 26 6a 06 85 93 50 4
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: keep-aliveContent-Length: 9760server: openrestycontent-type: text/html; charset=utf-8access-control-allow-origin: *cache-control: public, max-age=300x-service: routercontent-encoding: gzipAge: 0Date: Wed, 13 Nov 2024 14:51:27 GMTVary: Accept-Encoding,Cross-Origin-Resource-Policy: cross-originData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d fb 77 db 36 b3 e0 ef fe 2b 50 b7 5f 25 bb 12 65 3b 8f 26 72 9c de 34 76 5a ef 36 71 d6 76 6f ee 1e c7 9f 43 91 90 84 86 22 55 82 b4 ad e6 f3 fd db ef 3c 00 12 20 e9 47 ba e7 9e b3 7b ce ba 8d 4c 11 83 01 30 98 17 06 03 f8 c5 37 fb 47 af 4f ff f7 fb 03 31 2f 16 c9 cb b5 17 f6 97 0c e3 97 6b 02 7e 5e 2c 64 11 8a 68 1e e6 5a 16 7b eb bf 9f be 19 3e 5b 77 8b d2 70 21 f7 d6 2f 95 bc 5a 66 79 b1 2e a2 2c 2d 64 0a a0 57 2a 2e e6 7b b1 bc 54 91 1c d2 97 81 50 a9 2a 54 98 0c 75 14 26 72 6f db 20 62 6c ba 58 25 f2 a5 18 6d 8a 63 09 6d 05 89 d4 7a 4d 6c 8a f7 79 b6 d4 a2 c8 c4 41 ae 22 f1 56 ae 64 2e fa 0b fc 75 25 27 41 94 2d 36 c4 34 cb c5 5c 69 f1 fa e4 44 e4 58 59 4c 55 22 03 f1 41 f6 72 29 4a ad d2 99 08 53 11 c6 e1 b2 90 b1 b8 94 b9 56 59 2a e6 12 4a 85 28 e6 61 21 a2 b2 d0 22 2b 0b a1 b3 85 14 d9 14 de 4a 83 eb d7 d3 b7 bf 09 99 c8 05 0c 4b 8b 2b 29 ae 54 92 88 54 02 1a f8 04 7c 84 a7 af 02 19 0c 44 3c 4d 07 42 87 8b e5 40 c8 22 da 08 70 04 c3 ff 77 7f c4 e6 68 8d 78 63 b0 26 26 59 bc 12 5f 70 b2 16 61 3e 53 e9 58 6c ed e2 b7 65 18 c7 40 61 fe 7a 03 e0 db 00 3c df c1 8f 47 f8 f1 18 3f 9e e0 c7 53 f8 58 22 a6 24 8b 3e ff 59 66 85 c4 17 39 7e 86 f8 6f 32 c9 f1 57 94 67 e9 6a 81 4f 71 0c 53 a0 e1 29 52 04 1b 65 31 fe 8a 25 f6 07 49 bd 26 24 02 aa c5 0c 3e ff 84 7f 08 4c e4 87 5f 8b 30 41 38 5d e4 ea b3 e4 87 2c 45 40 5d 4e e8 13 a1 8a 02 3e 2e 43 6c 38 8e f1 83 50 e3 cb 44 c1 47 86 5f 4b fc 98 2a 99 c4 c0 0f f8 98 e5 d8 6a 12 4e a8 23 89 9c c9 14 eb 4e ca a2 c8 b0 53 45 38 49 a8 bf c0 70 8a df 20 f5 f0 f7 34 cb 10 45 81 22 86 bf 73 fa 82 1f f1 bd c4 15 30 07 79 2c 73 fb 6d 0a b2 36 bc 92 6a 36 2f c6 22 85 4e 85 49 fd 9e e4 a9 e3 b5 fa 0b de 6e 6f 6d fd 83 de 25 2a 95 c3 b9 41 b1 5d 83 4d c3 85 4a 56 63 90 58 e0 6e 55 f0 cc d2 b0 b8 97 dc 91 61 94 25 49 b8 d4 80 d1 3e 39 dd 1c ea 65 18 b9 9c 61 88 c9 18 12 a5 9d 4e a6 92 41 fe 1c 4f 24 90 17 89 f7 e7 38 9c 16 32 f7 f8 a5 2e 75 de 11 18 23 35 da 67 2c d6 d7 0d 33 02 ef 72 51 06 f2 3a 4d b2 ab 21 8c 4a 03 8b 25 b7 13 05 68 3a f9 ac 8a 61 21 af b9 6c 18 c6 7f 94 ba 70 40 f0 67 b8 d0 f7 81 e0 cf ad 20 d0 bd 70 3c cd a2 52 9b 1e 96 05 4e c7 18 f8 41 a5 22 ce 0a 50 56 16 6c 8e dd 47 91 18 87 51 a1 2e 65 a3 86 21 70 98 17 2a 22 ce 0b b5 32 a2 52 84 2a d1 c4 bf b3 9a 1d e1 4b 49 64 44 76 24 c4 c8 8f fc 30 cb 33 92 8c 34 bc 44 29 91 11 d6 e1 f6 62 a5 97 49 08 04 24 ea 9b 36 cb 58 65 c4 eb e9 65 88 0d 5d 42 cb 59 03 5e a5 c4 68 b6 9a 10 9b 8d 22 7e f9 57 96 2d 98 0d 2d e2 71 9a 15 fd 33 9c 56 98 31 7d be d1 c0 5b 33 4e 25 d3 0c e1 4c eb 8f 4f 3a 58 dd 48 57 a6 15 8e 6e 0c aa 3e 09 91 ae f4 1a 48 0d 74 04 3b 15 26 6a 06 85 93 50 4
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKConnection: keep-aliveContent-Length: 9760server: openrestycontent-type: text/html; charset=utf-8access-control-allow-origin: *cache-control: public, max-age=300x-service: routercontent-encoding: gzipAge: 0Date: Wed, 13 Nov 2024 14:51:27 GMTVary: Accept-Encoding,Cross-Origin-Resource-Policy: cross-originData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 7d fb 77 db 36 b3 e0 ef fe 2b 50 b7 5f 25 bb 12 65 3b 8f 26 72 9c de 34 76 5a ef 36 71 d6 76 6f ee 1e c7 9f 43 91 90 84 86 22 55 82 b4 ad e6 f3 fd db ef 3c 00 12 20 e9 47 ba e7 9e b3 7b ce ba 8d 4c 11 83 01 30 98 17 06 03 f8 c5 37 fb 47 af 4f ff f7 fb 03 31 2f 16 c9 cb b5 17 f6 97 0c e3 97 6b 02 7e 5e 2c 64 11 8a 68 1e e6 5a 16 7b eb bf 9f be 19 3e 5b 77 8b d2 70 21 f7 d6 2f 95 bc 5a 66 79 b1 2e a2 2c 2d 64 0a a0 57 2a 2e e6 7b b1 bc 54 91 1c d2 97 81 50 a9 2a 54 98 0c 75 14 26 72 6f db 20 62 6c ba 58 25 f2 a5 18 6d 8a 63 09 6d 05 89 d4 7a 4d 6c 8a f7 79 b6 d4 a2 c8 c4 41 ae 22 f1 56 ae 64 2e fa 0b fc 75 25 27 41 94 2d 36 c4 34 cb c5 5c 69 f1 fa e4 44 e4 58 59 4c 55 22 03 f1 41 f6 72 29 4a ad d2 99 08 53 11 c6 e1 b2 90 b1 b8 94 b9 56 59 2a e6 12 4a 85 28 e6 61 21 a2 b2 d0 22 2b 0b a1 b3 85 14 d9 14 de 4a 83 eb d7 d3 b7 bf 09 99 c8 05 0c 4b 8b 2b 29 ae 54 92 88 54 02 1a f8 04 7c 84 a7 af 02 19 0c 44 3c 4d 07 42 87 8b e5 40 c8 22 da 08 70 04 c3 ff 77 7f c4 e6 68 8d 78 63 b0 26 26 59 bc 12 5f 70 b2 16 61 3e 53 e9 58 6c ed e2 b7 65 18 c7 40 61 fe 7a 03 e0 db 00 3c df c1 8f 47 f8 f1 18 3f 9e e0 c7 53 f8 58 22 a6 24 8b 3e ff 59 66 85 c4 17 39 7e 86 f8 6f 32 c9 f1 57 94 67 e9 6a 81 4f 71 0c 53 a0 e1 29 52 04 1b 65 31 fe 8a 25 f6 07 49 bd 26 24 02 aa c5 0c 3e ff 84 7f 08 4c e4 87 5f 8b 30 41 38 5d e4 ea b3 e4 87 2c 45 40 5d 4e e8 13 a1 8a 02 3e 2e 43 6c 38 8e f1 83 50 e3 cb 44 c1 47 86 5f 4b fc 98 2a 99 c4 c0 0f f8 98 e5 d8 6a 12 4e a8 23 89 9c c9 14 eb 4e ca a2 c8 b0 53 45 38 49 a8 bf c0 70 8a df 20 f5 f0 f7 34 cb 10 45 81 22 86 bf 73 fa 82 1f f1 bd c4 15 30 07 79 2c 73 fb 6d 0a b2 36 bc 92 6a 36 2f c6 22 85 4e 85 49 fd 9e e4 a9 e3 b5 fa 0b de 6e 6f 6d fd 83 de 25 2a 95 c3 b9 41 b1 5d 83 4d c3 85 4a 56 63 90 58 e0 6e 55 f0 cc d2 b0 b8 97 dc 91 61 94 25 49 b8 d4 80 d1 3e 39 dd 1c ea 65 18 b9 9c 61 88 c9 18 12 a5 9d 4e a6 92 41 fe 1c 4f 24 90 17 89 f7 e7 38 9c 16 32 f7 f8 a5 2e 75 de 11 18 23 35 da 67 2c d6 d7 0d 33 02 ef 72 51 06 f2 3a 4d b2 ab 21 8c 4a 03 8b 25 b7 13 05 68 3a f9 ac 8a 61 21 af b9 6c 18 c6 7f 94 ba 70 40 f0 67 b8 d0 f7 81 e0 cf ad 20 d0 bd 70 3c cd a2 52 9b 1e 96 05 4e c7 18 f8 41 a5 22 ce 0a 50 56 16 6c 8e dd 47 91 18 87 51 a1 2e 65 a3 86 21 70 98 17 2a 22 ce 0b b5 32 a2 52 84 2a d1 c4 bf b3 9a 1d e1 4b 49 64 44 76 24 c4 c8 8f fc 30 cb 33 92 8c 34 bc 44 29 91 11 d6 e1 f6 62 a5 97 49 08 04 24 ea 9b 36 cb 58 65 c4 eb e9 65 88 0d 5d 42 cb 59 03 5e a5 c4 68 b6 9a 10 9b 8d 22 7e f9 57 96 2d 98 0d 2d e2 71 9a 15 fd 33 9c 56 98 31 7d be d1 c0 5b 33 4e 25 d3 0c e1 4c eb 8f 4f 3a 58 dd 48 57 a6 15 8e 6e 0c aa 3e 09 91 ae f4 1a 48 0d 74 04 3b 15 26 6a 06 85 93 50 4

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9 HTTP/1.1Host: software.oldversion.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.oldversion.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/rss-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/facebook-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/twitter-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/google-plus-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/rss-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/facebook-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/stats.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/twitter-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/css/screen.css?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,*/*;q=0.1Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/google-plus-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/colorbox/colorbox.css?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,*/*;q=0.1Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/plugins.min.js?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/main.js?1601376039 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/poll_popup.js?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/colorbox/jquery.colorbox.js?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/stats.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/assets/ov-mascot.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/css/base.css HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,*/*;q=0.1Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/assets/ov-mascot.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/mac.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/boxes/box1-bg.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/android.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/header/find-btn.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/boxes/box1-bg.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/mac.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/content/content-bg.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/colorbox/jquery.colorbox.js?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/header/header-bg.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/poll_popup.js?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/navigation/divider.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/header/find-btn.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/header/search-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/plugins.min.js?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/windows.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/main.js?1601376039 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/games.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/content/content-bg.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/linux.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/android.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/img/icons/category-icons.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/navigation/upload-bg.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/header/header-bg.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/header/down-arrow.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/navigation/divider.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/img/lng/en.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/header/logo.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/header/search-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/colorbox/img/loading.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/colorbox/colorbox.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/colorbox/img/controls.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/colorbox/colorbox.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/windows.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/games.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/linux.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/list2-li-bg.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/sociable.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/navigation/upload-bg.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/footer/logo.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/header/down-arrow.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/footer/footer-menu-li-bg.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/img/lng/en.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/img/icons/category-icons.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/header/logo.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/colorbox/img/loading.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/colorbox/img/controls.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/list2-li-bg.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/ajax-loader.gif HTTP/1.1Host: www.oldversion.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=e91v0d3c58c8d1ssd8hs5o1804
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/sociable.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/footer/logo.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/footer/footer-menu-li-bg.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_skype-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_utorrent-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_yahoo-messenger-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_manycam_icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_bearshare-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_directx.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.oldversion.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=e91v0d3c58c8d1ssd8hs5o1804; _ga_KX2D9NL90X=GS1.1.1731509464.1.0.1731509464.0.0.0; _ga=GA1.1.1079811112.1731509465
Source: global traffic	HTTP traffic detected: GET /icons/_msn-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_mozilla-firefox-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_976__virtualbox.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_skype-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_yahoo-messenger-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_directx.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_7zip-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_manycam_icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_winrar-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_bearshare-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_ccleaner-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_utorrent-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/ajax-loader.gif HTTP/1.1Host: www.oldversion.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=e91v0d3c58c8d1ssd8hs5o1804; _ga_KX2D9NL90X=GS1.1.1731509464.1.0.1731509464.0.0.0; _ga=GA1.1.1079811112.1731509465
Source: global traffic	HTTP traffic detected: GET /icons/_painticon1.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_winamp-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_mozilla-firefox-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_msn-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_daemon-tools-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_7zip-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_winrar-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_976__virtualbox.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_ccleaner-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_winamp-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_painticon1.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_daemon-tools-icon.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.oldversion.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=e91v0d3c58c8d1ssd8hs5o1804; _ga_KX2D9NL90X=GS1.1.1731509464.1.0.1731509464.0.0.0; _ga=GA1.1.1079811112.1731509465
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.oldversion.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=e91v0d3c58c8d1ssd8hs5o1804; _ga_KX2D9NL90X=GS1.1.1731509464.1.0.1731509464.0.0.0; _ga=GA1.1.1079811112.1731509465
Source: global traffic	HTTP traffic detected: GET /windows/pdfcreator/ HTTP/1.1Host: www.oldversion.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=e91v0d3c58c8d1ssd8hs5o1804; _ga_KX2D9NL90X=GS1.1.1731509464.1.0.1731509464.0.0.0; _ga=GA1.1.1079811112.1731509465
Source: global traffic	HTTP traffic detected: GET /icons/_pdfcreator.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgets.js HTTP/1.1Host: platform.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/popup.js?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/upload-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/download-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/main.js?1601376039 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveIf-Modified-Since: Tue, 29 Sep 2020 10:11:02 GMTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36If-None-Match: "2b35a8cfef5ed5bb1f76ae03d6ba11ee"Accept: */*Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/upload-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/popup.js?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/download-icon.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /icons/_pdfcreator.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /widgets.js HTTP/1.1Host: platform.twitter.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/button1.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/button4-bg.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/content/rating.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/tested.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/content/main/th-bg.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/content/dsc-arrow.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /embed.js HTTP/1.1Host: oldversion.disqus.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/content/box3-bg.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://assets.oldversion.s3.amazonaws.com/bundles/oldversionsite/css/screen.css?1523571789Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/icons/tested.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/button1.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/content/dsc-arrow.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/content/main/th-bg.gif HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/content/rating.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/buttons/button4-bg.png HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/images/theme/content/box3-bg.jpg HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: developers.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ads-iframe/taboola/?position=top&shortname=oldversion&experiment=network_default&variant=fallthrough&service=dynamic&anchorColor=%230000ee&colorScheme=light&sourceUrl=http%3A%2F%2Fwww.oldversion.com%2Fwindows%2Fpdfcreator%2F&typeface=sans-serif&disqus_version=current HTTP/1.1Host: tempest.services.disqus.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /sync?c=72&r=2&j=TRC.getRTUS HTTP/1.1Host: gum.criteo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://tempest.services.disqus.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /windows/pdfcreator-1-6-2 HTTP/1.1Host: www.oldversion.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://www.oldversion.com/windows/pdfcreator/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=e91v0d3c58c8d1ssd8hs5o1804; _ga=GA1.1.1079811112.1731509465; _ga_KX2D9NL90X=GS1.1.1731509464.1.1.1731509484.0.0.0
Source: global traffic	HTTP traffic detected: GET /sync?c=72&r=2&j=TRC.getRTUS HTTP/1.1Host: gum.criteo.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /lite-unit/5.0.9/UnitWidgetItemDesktop.min.js HTTP/1.1Host: vidstat.taboola.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://tempest.services.disqus.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/plupload/plupload.full.js?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/software-version.js?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/main.js?1601376039 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveIf-Modified-Since: Tue, 29 Sep 2020 10:11:02 GMTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36If-None-Match: "2b35a8cfef5ed5bb1f76ae03d6ba11ee"Accept: */*Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /disqus-oldversion/trc/3/json?llvl=2&tim=09%3A51%3A29.181&lti=trecs&pubit=n&t=1&data=%7B%22id%22%3A%2250480%22%2C%22sd%22%3A%22%22%2C%22ui%22%3A%22%22%2C%22ii%22%3A%22%2Fwindows%2Fpdfcreator%22%2C%22it%22%3A%22text%22%2C%22vi%22%3A1731509489182%2C%22cv%22%3A%2220241113-6-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22http%3A%2F%2Fwww.oldversion.com%2Fwindows%2Fpdfcreator%2F%22%2C%22qs%22%3A%22%3Fposition%3Dtop%26shortname%3Doldversion%26experiment%3Dnetwork_default%26variant%3Dfallthrough%26service%3Ddynamic%26anchorColor%3D%25230000ee%26colorScheme%3Dlight%26sourceUrl%3Dhttp%253A%252F%252Fwww.oldversion.com%252Fwindows%252Fpdfcreator%252F%26typeface%3Dsans-serif%26disqus_version%3Dcurrent%22%2C%22bv%22%3A%220%22%2C%22btv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%2C%22en%22%5D%2C%22cos%22%3A%224g%22%2C%22e%22%3A%22http%3A%2F%2Fwww.oldversion.com%2F%22%2C%22bu%22%3A%22http%3A%2F%2Ftempest.services.disqus.com%2Fads-iframe%2Ftaboola%2F%3Fposition%3Dtop%26shortname%3Doldversion%26experiment%3Dnetwork_default%26variant%3Dfallthrough%26service%3Ddynamic%26anchorColor%3D%25230000ee%26colorScheme%3Dlight%26sourceUrl%3Dhttp%253A%252F%252Fwww.oldversion.com%252Fwindows%252Fpdfcreator%252F%26typeface%3Dsans-serif%26disqus_version%3Dcurrent%22%2C%22vpi%22%3A%22%2Fads-iframe%2Ftaboola%22%2C%22bad%22%3A-1%2C%22sw%22%3A1280%2C%22sh%22%3A984%2C%22bw%22%3A730%2C%22bh%22%3A0%2C%22dw%22%3A730%2C%22dh%22%3A27%2C%22sde%22%3A%221.000%22%2C%22lt%22%3A%22trecs%22%2C%22nsid%22%3A%22disqus-network%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22uip%22%3A%22%7B%5C%22domain%5C%22%3A%20%5C%22http%3A%2F%2Fwww.oldversion.com%5C%22%2C%20%5C%22experiment%5C%22%3A%20%5C%22network_default%5C%22%2C%20%5C%22position%5C%22%3A%20%5C%22top%5C%22%2C%20%5C%22shortname%5C%22%3A%20%5C%22oldversion%5C%22%2C%20%5C%22variant%5C%22%3A%20%5C%22fallthrough%5C%22%7D%22%2C%22orig_uip%22%3A%22%7B%5C%22domain%5C%22%3A%20%5C%22http%3A%2F%2Fwww.oldversion.com%5C%22%2C%20%5C%22experiment%5C%22%3A%20%5C%22network_default%5C%22%2C%20%5C%22position%5C%22%3A%20%5C%22top%5C%22%2C%20%5C%22shortname%5C%22%3A%20%5C%22oldversion%5C%22%2C%20%5C%22variant%5C%22%3A%20%5C%22fallthrough%5C%22%7D%22%2C%22s%22%3A6%2C%22uim%22%3A%22thumbnails-a%3Apub%3Ddisqus-network%3Aabp%3D0%22%2C%22cd%22%3A27%2C%22mw%22%3A0%2C%22amw%22%3A700%7D%5D%2C%22plf%22%3A%7B%22ack_exm%22%3Atrue%2C%22ack_vig%22%3Atrue%7D%2C%22cacheKey%22%3A%22text%3D%2Fwindows%2Fpdfcreator%2C%7B%5C%22domain%5C%22%3A%20%5C%22http%3A%2F%2Fwww.oldversion.com%5C%22%2C%20%5C%22experiment%5C%22%3A%20%5C%22network_default%5C%22%2C%20%5C%22position%5C%22%3A%20%5C%22top%5C%22%2C%20%5C%22shortname%5C%22%3A%20%5C%22oldversion%5C%22%2C%20%5C%22variant%5C%22%3A%20%5C%22fallthrough%5C%22%7D%3Dthumbnails-a%3Apub%3Ddisqus-network%3Aabp%3D0%22%2C%22_cn%22%3A%22tions_1%22%2C%22lbt%22%3A1731493081381%2C%22wc%22%3Atrue%7D HTTP/1.1Host: trc.taboola.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gec
Source: global traffic	HTTP traffic detected: GET /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_350%2Cw_420%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/4099a4d458d938d1b3f2b551cc256847.png HTTP/1.1Host: images.taboola.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://tempest.services.disqus.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_350%2Cw_420%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/IMAGE_UPSCALER/EIU/eec77092-b6e0-4a9d-aa76-b9dafa71cb5b__ITQi2dG9.jpg HTTP/1.1Host: images.taboola.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://tempest.services.disqus.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/8a3be41467355311fb0cb37eaf1acaa1.jpg HTTP/1.1Host: images.taboola.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://tempest.services.disqus.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/e9ec3f16072be4fb9fc585159bf7a5ad.webp HTTP/1.1Host: images.taboola.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://tempest.services.disqus.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /taboola/image/fetch/c_crop%2Cf_jpg%2Cq_auto%2Ce_sharpen%2Car_1.2000%2Cw_540%2Cx_60%2Cy_0/c_fill%2Cw_280%2Ch_234/http%3A//cdn.taboola.com/libtrc/static/thumbnails/9ab28b7388d8032c7e1cfd18025766b1.jpg HTTP/1.1Host: images.taboola.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://tempest.services.disqus.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /taboola/image/fetch/f_jpg%2Cq_auto%2Ch_50%2Cw_100%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/2a47d25cb885be7ab2fcd9d18b4a5508.jpg HTTP/1.1Host: images.taboola.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Referer: http://tempest.services.disqus.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/software-version.js?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/plupload/plupload.full.js?1523571789 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /bundles/oldversionsite/js/main.js?1601376039 HTTP/1.1Host: assets.oldversion.s3.amazonaws.comConnection: keep-aliveIf-Modified-Since: Tue, 29 Sep 2020 10:11:02 GMTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36If-None-Match: "2b35a8cfef5ed5bb1f76ae03d6ba11ee"Accept: */*Referer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pdfcreator/update-info.txt HTTP/1.0Host: update.pdfforge.orgUser-Agent: InnoTools_Downloader
Source: global traffic	HTTP traffic detected: GET /download/pdfarchitect/PDFArchitect-stable?download HTTP/1.0Host: download.pdfforge.orgUser-Agent: InnoTools_Downloader
Source: global traffic	HTTP traffic detected: GET /check.php?product=1&version=1.6.2&ud=0&lang=en&b=6 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: piwik.pdfforge.orgConnection: Keep-Alive

Performs DNS lookups

Source: global traffic	DNS traffic detected: DNS query: software.oldversion.com
Source: global traffic	DNS traffic detected: DNS query: www.oldversion.com
Source: global traffic	DNS traffic detected: DNS query: assets.oldversion.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: www.facebook.com
Source: global traffic	DNS traffic detected: DNS query: static.xx.fbcdn.net
Source: global traffic	DNS traffic detected: DNS query: platform.twitter.com
Source: global traffic	DNS traffic detected: DNS query: oldversion.disqus.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: developers.google.com
Source: global traffic	DNS traffic detected: DNS query: disqus.com
Source: global traffic	DNS traffic detected: DNS query: c.disquscdn.com
Source: global traffic	DNS traffic detected: DNS query: syndication.twitter.com
Source: global traffic	DNS traffic detected: DNS query: referrer.disqus.com
Source: global traffic	DNS traffic detected: DNS query: tempest.services.disqus.com
Source: global traffic	DNS traffic detected: DNS query: cdn.taboola.com
Source: global traffic	DNS traffic detected: DNS query: gum.criteo.com
Source: global traffic	DNS traffic detected: DNS query: trc.taboola.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: 8proof.com
Source: global traffic	DNS traffic detected: DNS query: vidstat.taboola.com
Source: global traffic	DNS traffic detected: DNS query: images.taboola.com
Source: global traffic	DNS traffic detected: DNS query: beacon.taboola.com
Source: global traffic	DNS traffic detected: DNS query: la-trc-events.taboola.com
Source: global traffic	DNS traffic detected: DNS query: cms.quantserve.com
Source: global traffic	DNS traffic detected: DNS query: dclk-match.dotomi.com
Source: global traffic	DNS traffic detected: DNS query: pm.w55c.net
Source: global traffic	DNS traffic detected: DNS query: match.adsrvr.org
Source: global traffic	DNS traffic detected: DNS query: dis.criteo.com
Source: global traffic	DNS traffic detected: DNS query: dsp.adkernel.com
Source: global traffic	DNS traffic detected: DNS query: www.temu.com
Source: global traffic	DNS traffic detected: DNS query: cm.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: fundingchoicesmessages.google.com
Source: global traffic	DNS traffic detected: DNS query: widget.us.criteo.com
Source: global traffic	DNS traffic detected: DNS query: a.tribalfusion.com
Source: global traffic	DNS traffic detected: DNS query: pr-bh.ybp.yahoo.com
Source: global traffic	DNS traffic detected: DNS query: b1sync.zemanta.com
Source: global traffic	DNS traffic detected: DNS query: gw-iad-bid.ymmobi.com
Source: global traffic	DNS traffic detected: DNS query: onetag-sys.com
Source: global traffic	DNS traffic detected: DNS query: s.tribalfusion.com
Source: global traffic	DNS traffic detected: DNS query: dsum-sec.casalemedia.com
Source: global traffic	DNS traffic detected: DNS query: ib.adnxs.com
Source: global traffic	DNS traffic detected: DNS query: us-u.openx.net
Source: global traffic	DNS traffic detected: DNS query: sync.teads.tv
Source: global traffic	DNS traffic detected: DNS query: ad.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: servedby.flashtalking.com
Source: global traffic	DNS traffic detected: DNS query: tr.blismedia.com
Source: global traffic	DNS traffic detected: DNS query: ajs-assets.ftstatic.com
Source: global traffic	DNS traffic detected: DNS query: agen-assets.ftstatic.com
Source: global traffic	DNS traffic detected: DNS query: d9.flashtalking.com
Source: global traffic	DNS traffic detected: DNS query: js.ad-score.com
Source: global traffic	DNS traffic detected: DNS query: cdn.flashtalking.com
Source: global traffic	DNS traffic detected: DNS query: secure.flashtalking.com
Source: global traffic	DNS traffic detected: DNS query: ad-events.flashtalking.com
Source: global traffic	DNS traffic detected: DNS query: stat.flashtalking.com
Source: global traffic	DNS traffic detected: DNS query: data.ad-score.com
Source: global traffic	DNS traffic detected: DNS query: update.pdfforge.org
Source: global traffic	DNS traffic detected: DNS query: api.opencandy.com
Source: global traffic	DNS traffic detected: DNS query: download.pdfforge.org
Source: global traffic	DNS traffic detected: DNS query: piwik.pdfforge.org
Source: global traffic	DNS traffic detected: DNS query: www.pdfforge.org
Source: global traffic	DNS traffic detected: DNS query: brand-assets.capterra.com
Source: global traffic	DNS traffic detected: DNS query: static.cloudflareinsights.com
Source: global traffic	DNS traffic detected: DNS query: avqtools.avanquest.com
Source: global traffic	DNS traffic detected: DNS query: b.sf-syn.com
Source: global traffic	DNS traffic detected: DNS query: avqgate.avanquest.com
Source: global traffic	DNS traffic detected: DNS query: qti.avanquest.com
Source: global traffic	DNS traffic detected: DNS query: public.profitwell.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-scripts.com
Source: global traffic	DNS traffic detected: DNS query: avqservice.avanquest.com
Source: global traffic	DNS traffic detected: DNS query: gate.upclick.com
Source: global traffic	DNS traffic detected: DNS query: js.hubspotfeedback.com
Source: global traffic	DNS traffic detected: DNS query: js.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: js.hs-banner.com
Source: global traffic	DNS traffic detected: DNS query: js.hsadspixel.net
Source: global traffic	DNS traffic detected: DNS query: js.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: js.hs-analytics.net
Source: global traffic	DNS traffic detected: DNS query: cgate.pdfarchitect.org
Source: global traffic	DNS traffic detected: DNS query: forms.hscollectedforms.net
Source: global traffic	DNS traffic detected: DNS query: app.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: cta-service-cms2.hubspot.com
Source: global traffic	DNS traffic detected: DNS query: api.hubapi.com
Source: global traffic	DNS traffic detected: DNS query: forms.hsforms.com
Source: global traffic	DNS traffic detected: DNS query: static.hsappstatic.net
Source: global traffic	DNS traffic detected: DNS query: perf-na1.hsforms.com
Source: global traffic	DNS traffic detected: DNS query: feedback.hubapi.com
Source: global traffic	DNS traffic detected: DNS query: td.doubleclick.net

Posts data to webserver

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Host: www.oldversion.comConnection: keep-aliveContent-Length: 5Accept: text/html, */*; q=0.01X-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencodedOrigin: http://www.oldversion.comReferer: http://www.oldversion.com/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: PHPSESSID=e91v0d3c58c8d1ssd8hs5o1804Data Raw: 61 70 69 3d 31 Data Ascii: api=1

Uses HTTPS

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50303 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 50335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 50277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50337
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50330
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 50339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 50317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50303
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50305
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50308
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50307
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50309
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50300
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50301
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50317
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50319
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50312
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50329
Source: unknown	Network traffic detected: HTTP traffic on port 50245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50320
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 50290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50295
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50308 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50259
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50257
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 50318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50264
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50268
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50279
Source: unknown	Network traffic detected: HTTP traffic on port 50242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50281
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50282
Source: unknown	Network traffic detected: HTTP traffic on port 50203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50285
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50290
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50291
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50294
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50293
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 50229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 50326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.18:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.242.255.91:443 -> 192.168.2.18:50202 version: TLS 1.2

System Summary

Creates files inside the system directory

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\SysWOW64\is-SC9CG.tmp
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\system32\spool\DRIVERS\x64\is-9CTLT.tmp
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\system32\spool\DRIVERS\x64\is-NLIB5.tmp
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\system32\spool\DRIVERS\x64\is-QADKP.tmp
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\system32\spool\DRIVERS\x64\is-NA213.tmp
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\system32\spool\DRIVERS\x64\is-31BBU.tmp
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\system32\spool\DRIVERS\x64\is-88J4C.tmp
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\system32\is-HTIO6.tmp
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\SysWOW64\is-M7ASJ.tmp
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\SysWOW64\is-C1K9V.tmp
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\SysWOW64\is-MJV10.tmp

Deletes files inside the Windows folder

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

File deleted: C:\Windows\System32\spool\drivers\x64\PDFCREAT.PPD

Classification label

Source: classification engine

Classification label: mal56.phis.expl.win@73/636@327/463

Creates files inside the program directory

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

File created: C:\Program Files (x86)\PDFCreator

Creates files inside the user directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Creates mutexes

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\223CEB62-A2BC-4E33-BA9B-FCAC6DAAB1BE
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Mutant created: \Sessions\1\BaseNamedObjects\Global\426F00E8-A1B3-4EB2-8FF8-0950920F5D6E
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\71C6E2D5-E762-40BC-9CB6-B3C757FD699C

Creates temporary files

Source: C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe

File created: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp

Parts of this applications are using Borland Delphi (Probably coded in Delphi)

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Reads ini files

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

File read: C:\Windows\win.ini

Reads software policies

Source: C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Reads the Windows registered organization settings

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Runs a DLL by calling functions

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

Process created: C:\Windows\SysWOW64\rundll32.exe RunDll32.exe "C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\OCSetupHlp.dll",_OCPRD68OpenCandy2@16 3080,C7E337D01987456CB2DEEBF3331DFBF1,77796C64D81041E9BD380D5D23571076

Spawns processes

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1736,i,1698038350045694038,10913271343233087969,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1736,i,1698038350045694038,10913271343233087969,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4452 --field-trial-handle=1736,i,1698038350045694038,10913271343233087969,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4452 --field-trial-handle=1736,i,1698038350045694038,10913271343233087969,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe "C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe"
Source: C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp "C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp" /SL5="$4032E,16929848,54272,C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe "C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe" /verysilent /URL=http://update.pdfforge.org/pdfcreator/update-info.txt /Filename="C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\update-info.txt" /TimeOut=7000
Source: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe	Process created: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp "C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp" /SL5="$602D4,259588,54272,C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe" /verysilent /URL=http://update.pdfforge.org/pdfcreator/update-info.txt /Filename="C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\update-info.txt" /TimeOut=7000
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe "C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe"
Source: C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp "C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp" /SL5="$4032E,16929848,54272,C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\rundll32.exe RunDll32.exe "C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\OCSetupHlp.dll",_OCPRD68OpenCandy2@16 3080,C7E337D01987456CB2DEEBF3331DFBF1,77796C64D81041E9BD380D5D23571076
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\rundll32.exe RunDll32.exe "C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\OCSetupHlp.dll",_OCPRD68OpenCandy2@16 3080,F626BBADED6942A9A9B032075D5E2FE6,8AB43B5E98014CC39B6961D0B89FD081
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe "C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe" /verysilent /URL=http://update.pdfforge.org/pdfcreator/update-info.txt /Filename="C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\update-info.txt" /TimeOut=7000
Source: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe	Process created: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp "C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp" /SL5="$602D4,259588,54272,C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe" /verysilent /URL=http://update.pdfforge.org/pdfcreator/update-info.txt /Filename="C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\update-info.txt" /TimeOut=7000
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSVBVM60.DLL"
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSCOMCT2.OCX"
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSCOMCTL.OCX"
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSMAPI32.OCX"
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Program Files (x86)\PDFCreator\PDFCreator.exe "C:\Program Files (x86)\PDFCreator\PDFCreator.exe" /RegServer
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Program Files (x86)\PDFCreator\PlugIns\pdfforge\pdfforge.dll" /codebase
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\PDFArchitect_latest_setup.msi" /quiet CREATE_DESKTOP_SHORTCUT=1 APPLICATION_LANGUAGE=0
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\InstallCheck.exe "C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\InstallCheck.exe" /verysilent /p=1 /v=1.6.2 /ud=0 /lc=en /b=6
Source: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\InstallCheck.exe	Process created: C:\Users\user\AppData\Local\Temp\is-RUHMQ.tmp\InstallCheck.tmp "C:\Users\user\AppData\Local\Temp\is-RUHMQ.tmp\InstallCheck.tmp" /SL5="$40378,54272,54272,C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\InstallCheck.exe" /verysilent /p=1 /v=1.6.2 /ud=0 /lc=en /b=6
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pdfforge.org/pdfcreator/welcome
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1888,i,5596884337790773879,16064160228794631098,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\rundll32.exe RunDll32.exe "C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\OCSetupHlp.dll",_OCPRD68OpenCandy2@16 3080,C7E337D01987456CB2DEEBF3331DFBF1,77796C64D81041E9BD380D5D23571076
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\rundll32.exe RunDll32.exe "C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\OCSetupHlp.dll",_OCPRD68OpenCandy2@16 3080,F626BBADED6942A9A9B032075D5E2FE6,8AB43B5E98014CC39B6961D0B89FD081
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSVBVM60.DLL"
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSCOMCT2.OCX"
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSCOMCTL.OCX"
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSMAPI32.OCX"
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Program Files (x86)\PDFCreator\PDFCreator.exe "C:\Program Files (x86)\PDFCreator\PDFCreator.exe" /RegServer
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Program Files (x86)\PDFCreator\PlugIns\pdfforge\pdfforge.dll" /codebase
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\PDFArchitect_latest_setup.msi" /quiet CREATE_DESKTOP_SHORTCUT=1 APPLICATION_LANGUAGE=0
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\InstallCheck.exe "C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\InstallCheck.exe" /verysilent /p=1 /v=1.6.2 /ud=0 /lc=en /b=6
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pdfforge.org/pdfcreator/welcome
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Tries to load missing DLLs

Source: C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: windows.shell.servicehostbuilder.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: ieframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: mlang.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll

Uses an in-process (OLE) Automation server

Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Writes ini files

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

File written: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\itd_english.ini

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

Window found: window name: TSelectLanguageForm

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation

Registers a DLL

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSVBVM60.DLL"

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Program Files (x86)\PDFCreator\is-QTTU2.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Program Files (x86)\PDFCreator\GS9.05\gs9.05\Bin\is-MKV9R.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\itdownload.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\System32\spool\drivers\x64\is-NA213.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\System32\spool\drivers\x64\is-31BBU.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\InstallCheck.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	File created: C:\Users\user\AppData\Local\Temp\is-LE6FM.tmp\_isetup\_setup64.tmp			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\3479d25a-e1b7-410f-9e42-4cf25451758e.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\System32\is-HTIO6.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Program Files (x86)\PDFCreator\languages\is-EFGDJ.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\SysWOW64\is-C1K9V.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\SysWOW64\is-M7ASJ.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\SysWOW64\is-SC9CG.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Program Files (x86)\PDFCreator\PlugIns\pdfforge\is-AF7BF.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Program Files (x86)\PDFCreator\Images2PDF\is-SDEP1.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	File created: C:\Users\user\AppData\Local\Temp\is-LE6FM.tmp\_isetup\_shfoldr.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\SysWOW64\is-MJV10.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Program Files (x86)\PDFCreator\is-IM6PC.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe	File created: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Program Files (x86)\PDFCreator\PlugIns\pdfforge\is-9QROA.tmp			Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 897116.crdownload			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\OCSetupHlp.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Program Files (x86)\PDFCreator\is-7MMLT.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Program Files (x86)\PDFCreator\Images2PDF\is-MB6P5.tmp			Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\System32\spool\drivers\x64\is-NA213.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\System32\spool\drivers\x64\is-31BBU.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\SysWOW64\is-MJV10.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\System32\is-HTIO6.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\SysWOW64\is-C1K9V.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\SysWOW64\is-M7ASJ.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\Windows\SysWOW64\is-SC9CG.tmp			Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

File created: C:\Program Files (x86)\PDFCreator\SetupLog.txt

Creates license or readme file

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp

File created: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\Program license - english - OC.rtf

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\PDFCreator.lnk
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\Licenses
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\Licenses\AFPL License.lnk
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\Licenses\GPL License.lnk
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\Licenses\FairPlay License.lnk
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\History.lnk
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\Images2PDF
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\Images2PDF\Images2PDF.lnk
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\Images2PDF\Images2PDF Console Application.lnk
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\Translation Tool.lnk
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\Donate PDFCreator.lnk
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\PDFCreator on the Web.lnk
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator\PDFCreator Help.lnk

Hooking and other Techniques for Hiding and Protection

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Downloads\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.exe	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PDFCreator\PlugIns\pdfforge\is-AF7BF.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PDFCreator\Images2PDF\is-SDEP1.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PDFCreator\is-QTTU2.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PDFCreator\GS9.05\gs9.05\Bin\is-MKV9R.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\itdownload.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\spool\drivers\x64\is-NA213.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-LE6FM.tmp\_isetup\_shfoldr.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\spool\drivers\x64\is-31BBU.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-MJV10.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PDFCreator\PlugIns\pdfforge\is-9QROA.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-LE6FM.tmp\_isetup\_setup64.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Windows\System32\is-HTIO6.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PDFCreator\languages\is-EFGDJ.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\OCSetupHlp.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-C1K9V.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PDFCreator\is-7MMLT.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-M7ASJ.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-SC9CG.tmp			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\PDFCreator\Images2PDF\is-MB6P5.tmp			Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp TID: 3744	Thread sleep count: 133 > 30
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp TID: 3744	Thread sleep count: 32 > 30

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\PDFArchitect_latest_setup.msi" /quiet CREATE_DESKTOP_SHORTCUT=1 APPLICATION_LANGUAGE=0
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://www.pdfforge.org/pdfcreator/welcome

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe

Process created: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp "c:\users\user\appdata\local\temp\is-7re49.tmp\downloadupdateinfo.tmp" /sl5="$602d4,259588,54272,c:\users\user\appdata\local\temp\is-59pr7.tmp\downloadupdateinfo.exe" /verysilent /url=http://update.pdfforge.org/pdfcreator/update-info.txt /filename="c:\users\user\appdata\local\temp\is-59pr7.tmp\update-info.txt" /timeout=7000

Source: C:\Users\user\AppData\Local\Temp\is-59PR7.tmp\DownloadUpdateInfo.exe

Process created: C:\Users\user\AppData\Local\Temp\is-7RE49.tmp\DownloadUpdateInfo.tmp "c:\users\user\appdata\local\temp\is-7re49.tmp\downloadupdateinfo.tmp" /sl5="$602d4,259588,54272,c:\users\user\appdata\local\temp\is-59pr7.tmp\downloadupdateinfo.exe" /verysilent /url=http://update.pdfforge.org/pdfcreator/update-info.txt /filename="c:\users\user\appdata\local\temp\is-59pr7.tmp\update-info.txt" /timeout=7000

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\is-OCNFT.tmp\pdfcreator-1-6-2-PDFCreator-1_6_2_setup.tmp	Queries volume information: C:\ VolumeInformation