MD5: ccab9559a391e515df7109bc3fac8cab
SHA1: c2e4f9fbf35d0ef49db3ad64f4341aae62a724b2
SHA256: fecdd24d0d56e8f2eb45665a3a02dc44394ca795d510a3d51046eea19bd347da
SSDeep: 12288:dqTnQVSvi3RD8Daw9bINe9elaoSFZOhxmXnBcP8H:8TnBCRD8ewSQe ZOaBcPI
Size: 428368 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-05-21 18:24:17
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:412
Explorer.EXE:1684

Mutexes

The following mutexes were created/opened:

c:!documents and settings!adm!local settings!history!history.ie5!mshist012014080320140804!
_!SHMSFTHISTORY!_
{1B655094-FE2A-433c-A877-FF9793445069}
CTF.TMD.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Layouts.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Asm.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.Compart.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
CTF.LBES.MutexDefaultS-1-5-21-1844237615-1960408961-1801674531-1003
RasPbFile
WininetProxyRegistryMutex
WininetConnectionMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
ShimCacheMutex
wmiprvse.exeM_480_
vmupgradehelper.exeM_316_
vmtoolsd.exeM_128_
jqs.exeM_1972_
spoolsv.exeM_1448_
svchost.exeM_1116_
svchost.exeM_960_
vmacthlp.exeM_936_
lsass.exeM_776_
services.exeM_764_
winlogon.exeM_720_
csrss.exeM_696_
smss.exeM_624_
%original file name%.exeM_412_
uxJLpe1m
ZonesLockedCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex

File activity

The process %original file name%.exe:412 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[1].txt (3911 bytes)
%WinDir%\system.ini (72 bytes)
C:\aschvw.exe (103 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (1678 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA2VQNYT.gif (35 bytes)
C:\autorun.inf (241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].txt (4048 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\nr-411.min[1].js (14 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAKF9BEI.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (6948 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (2273 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\loading[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\blank[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sd_100978_3a9ca[1].jpg (1222 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sd_sprite[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[1].htm (2241 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pubads_impl_45[1].js (1928 bytes)
%System%\wbem\Logs\wbemprox.log (152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_100624_634cd[1].jpg (7290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sd_100624_634cd[1].jpg (4889 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gradientbg[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[1].txt (1479 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\thumbnail_1379925746-100x100[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\campaign-100978,100624[1] (2418 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (7175 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_100978_3a9ca[1].jpg (1226 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CACT65LU.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA2BKXY5.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAIVKF67.gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\96f1f-03266[1].js (11373 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (1336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gfgm.exe (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAS7IL4F.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fec0e-253a4[1].css (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cc92a7d66e[1].setToken (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cc92a7d66e[1].setToken (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\campaign-100978,100624[1].htm (1191 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (26508 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fec0e-253a4[2].css (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pubads_impl_45[2].js (3154 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_icon_100978_c55d5[1].jpg (829 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (368 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (253 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAEFK5UN.gif (35 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAKF9BEI.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\gfgm.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAEFK5UN.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAS7IL4F.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fec0e-253a4[1].css (0 bytes)
%Documents and Settings%\%current user%\Cookies\[email protected][2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041020140411\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAIVKF67.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA2VQNYT.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CACT65LU.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\cc92a7d66e[1].b2946c1&to=NQcAZUJXXUdWAEZdVwxNN0NZGVtAUwxRRxcLDAZUSBhDXEc= (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pubads_impl_45[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA2BKXY5.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041020140411 (0 bytes)

Registry activity

The process %original file name%.exe:412 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a1_0" = "808124862"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas\695404737]
"35845605" = "267"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Softonic\Universal Downloader]
"uuid" = "7C3AFAD9-A775-4913-A56B-BCB7541F1BBE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080320140804]
"CachePrefix" = ":2014080320140804:"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas\695404737]
"50183847" = "23E4F7F25F8A545EF07859773043475EDD1D103E2D9C27F1F3A268ED09F30DE884DB9D92FD831B72EEF599E8C233EB23FBE7145BFA46281679ED385593CEE8869548167F08C5681A4B967232DBC5E0E01EC06026FCE8B24FCB589B28C073413E3C9C326851C4731397E851C96D85B6EDDDAA4E25FA227776D385991927AE94FC"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080320140804]
"CacheLimit" = "8192"
"CacheOptions" = "11"

[HKCU\Software\Aas\695404737]
"43014726" = "0800687474703A2F2F616C7468617772792E6F72672F696D616765732F78732E6A706700687474703A2F2F7777772E6361726565726465736B2E6F72672F696D616765732F78732E6A706700687474703A2F2F6172746875722E6E697269612E62697A2F78732E6A706700687474703A2F2F616D73616D65782E636F6D2F78732E6A706700687474703A2F2F6170706C652D7069652E696E2F696D616765732F78732E6A706700687474703A2F2F61686D65646979652E6E65742F78732E6A706700687474703A2F2F67322E6172726F776869746563682E636F6D2F78732E6A706700687474703A2F2F616D7079617A696C696D2E636F6D2E74722F696D616765732F7873322E6A7067"

[HKCU\Software\Aas]
"a3_0" = "17001001"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080320140804]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014080320140804\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas\695404737]
"14338242" = "0"
"7169121" = "136"

"21507363" = "0"
"28676484" = "35"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014080320140804]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 AB B4 0B 2C 08 0C 54 C4 0E 6B 7F B0 7F 0F 22"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Aas]
"a2_0" = "6789"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_0" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

Task Manager is disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr" = "1"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041020140411]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name: Softonic
Product Name: Softonic Downloader
Product Version: 1.41.0.0
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: SoftonicDownloader.exe
Internal Name: SoftonicDownloader.exe
File Version: 1.41.0.0
File Description: Softonic Downloader
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://beacon-6.newrelic.com/1/cc92a7d66e?a=2337116&ap=279&fe=1657&dc=782&v=411.b2946c1&to=NQcAZUJXXUdWAEZdVwxNN0NZGVtAUwxRRxcLDAZUSBhDXEc=&f=["err"]&jsonp=NREUM.setToken	50.31.164.192
hxxp://46.28.209.70/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005
hxxp://46.28.209.70/en/css/generated/fec0e-253a4.css
hxxp://46.28.209.70/shared/img/universaldownloader/gradientbg.png
hxxp://46.28.209.70/shared/img/universaldownloader/loading.gif
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://46.28.209.70/shared/img/universaldownloader/sd_sprite.png
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100978/sd_100978_3a9ca.jpeg	46.28.209.52
hxxp://screenshots.en.sftcdn.net/en/scrn/69668000/69668133/thumbnail_1379925746-100x100.png	46.28.209.52
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100978/sd_icon_100978_c55d5.jpeg	46.28.209.52
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100624/sd_100624_634cd.jpg	46.28.209.52
hxxp://pagead46.l.doubleclick.net/gpt/pubads_impl_45.js
hxxp://pagead46.l.doubleclick.net/pagead/show_companion_ad.js
hxxp://173.194.113.198/__utm.gif?utmwv=5.4.6&utms=4&utmn=2100908754&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=-&utmp=/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005&utmht=1407050008262&utmac=UA-48247475-1&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://173.194.113.198/__utm.gif?utmwv=5.4.6&utms=5&utmn=379054602&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1407050008418&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://173.194.113.198/__utm.gif?utmwv=5.4.6&utms=6&utmn=1030384432&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1407050008434&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://173.194.113.198/__utm.gif?utmwv=5.4.6&utms=7&utmn=581728098&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1407050008512&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://173.194.113.198/__utm.gif?utmwv=5.4.6&utms=8&utmn=67440648&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1407050008543&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://173.194.113.198/__utm.gif?utmwv=5.4.6&utms=9&utmn=1332536737&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/C100978--load1&utmht=1407050008606&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://173.194.113.198/__utm.gif?utmwv=5.4.6&utms=10&utmn=1104140846&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/C100624--load2&utmht=1407050008637&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100978/sd_100978_3a9ca.jpeg?v=0.9312210704230921	46.28.209.52
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100624/sd_100624_634cd.jpg?v=0.4879445294363033	46.28.209.52
hxxp://beacon-6.newrelic.com/1/cc92a7d66e?a=2337116&ap=159&fe=1812&dc=812&v=411.b2946c1&to=NQcAZUJXXUdWAEZdVwxNN0NZGVtAUwxRRxcLDAZUSBhDXEc=&f=["err"]&jsonp=NREUM.setToken	50.31.164.192
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=7&utmn=581728098&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1407050008512&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005
hxxp://www.googletagservices.com/tag/js/gpt.js	173.194.113.217
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=10&utmn=1104140846&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/C100624--load2&utmht=1407050008637&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://static.sd.en.softonic.com/shared/img/universaldownloader/gradientbg.png
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=8&utmn=67440648&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1407050008543&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://static.sd.en.softonic.com/shared/img/universaldownloader/sd_sprite.png
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=4&utmn=2100908754&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=-&utmp=/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005&utmht=1407050008262&utmac=UA-48247475-1&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=9&utmn=1332536737&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/C100978--load1&utmht=1407050008606&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://pagead2.googlesyndication.com/pagead/show_companion_ad.js	173.194.113.218
hxxp://static.sd.en.softonic.com/shared/img/universaldownloader/loading.gif
hxxp://static.sd.en.softonic.com/en/css/generated/fec0e-253a4.css
hxxp://partner.googleadservices.com/gpt/pubads_impl_45.js	173.194.113.218
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=5&utmn=379054602&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1407050008418&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=6&utmn=1030384432&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1407050008434&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
bam.nr-data.net	50.31.164.166

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /en/css/generated/fec0e-253a4.css HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: static.sd.en.softonic.com

Connection: Keep-Alive

Cookie: PHPSESSID=c3b46d7ed2da7b349269a42c8c378a2b; blang=en_US; country=UA; ucountry=EU; entry=Direct; UACR_69668133=false; UACA_69668133=false; UD1_POSITION_69668133=; _FCen=101103||.100624|1|1407050006.100516||.100978|1|1407050006

HTTP/1.1 200 OK

Date: Sun, 03 Aug 2014 07:13:27 GMT

Server: Apache

Last-Modified: Thu, 24 Jul 2014 11:04:06 GMT

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Tue, 02 Sep 2014 07:13:27 GMT

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 5031

Keep-Alive: timeout=3, max=9

Connection: Keep-Alive

Content-Type: text/css
...........<k..Fr.. ..,[email protected].!@...%@........H..vv,...._..%..:
...%......U....R7.....]4......._3..f.4.u.g.h..'|.!.]W.=.....P.[Z......
........)./.6..n.p...mx..2..,<$.a..F.a..&.a.V5.we}.w....S.....[..%5
%a.n.2....li...v.G....g.2^Ud...=|...F.....2.W_/-....)k@9J.<'UC...J.
.T$e..............P`.,W...SR.YY.i.......].(~!.yW.m../9]..=....g...t...
.s.5...^$..pF*D$...2.....O...F.I...-..rC..4.uIv-..)...Z~.p!.M......c..
..i.=o..N..#E.$m./.\.Z$3.a. .Ss...o.x..c................v%.,^...M..V_.
&.dy..,..vK...., ...............q|.CUgE...}...".Y.....7.;`....0|c.1;Ve
......r.!~v.....`.._.`..*.O`T..Zt......[.#...!.<..&k...Z....Ac.|..e
....\.J..... .i <....A..."7"_.(../t_....).[M7....._~...3...)...u.3.
x.....WB .dCs.....d.F...Y....=Hb...._`...HF.........h./\.A....dxs.Y.Q\
..oM......Z...,%...G8.....)..?.d:O.....x.5.3.8...}...>...........k.
....?[0......~pl.....L...3..g.....l..i..x..P.-k..Dre1...x&x".~.!1..~..
.a.t...i.<...*....Y=.X...W.T..T..s......O.vy..?.{j.x......S.....o..
"/. ........AU...1.f..4....eT...6x.d7....8.y.]J(....}.._{n...RJ..7SJ..
"H..k'l...Z..v......l.}...`..........j......&....IVDh...`.:.b.S...;...
|6....q2A..p.G..^j|.......Zth..<..(,..d>.....Q.<W..D.....>
|..iel~.....e.....&. >[email protected]....".[`...........>
. ..H.k|....)q)..J.C..\.3.....X)..g..Q.B...TPCA.....uCI~f...9.)[u.x..6
S$...ii.o....K~..bK.".......e..Z.J.:........;(...Pg#...........L..B..!
......Rfl.i))[email protected] f.^V.C...._...-.H.."L...... <...
....]I..........<.F.!sVV2..[O.A....z.P..".([email protected].
<<< skipped >>>

GET /shared/img/universaldownloader/gradientbg.png HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: static.sd.en.softonic.com

Connection: Keep-Alive

Cookie: PHPSESSID=c3b46d7ed2da7b349269a42c8c378a2b; blang=en_US; country=UA; ucountry=EU; entry=Direct; UACR_69668133=false; UACA_69668133=false; UD1_POSITION_69668133=; _FCen=101103||.100624|1|1407050006.100516||.100978|1|1407050006

HTTP/1.1 200 OK

Date: Sun, 03 Aug 2014 07:13:27 GMT

Server: Apache

Last-Modified: Tue, 11 Feb 2014 08:39:16 GMT

Accept-Ranges: bytes

Content-Length: 2958

Cache-Control: max-age=172800

Expires: Tue, 05 Aug 2014 07:13:27 GMT

Keep-Alive: timeout=3, max=8

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...)...........\.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE...........................................................
......................................................................
...........................O *E...4tRNS...............................
.....................KW"e...HIDATx....v.9..Q{.%y......I.3.\...m..`..u.
s1.s.D...Q,. ..`(..S....O.....SJ........8...=.LR.[.&......:.eJY..oI:./
...$..BJ.#KS.sH2..%.{F..='..?HR./..6.X......)./R.. ..6.....F..g.[.I.&l
t;.l..2$...42.....S.....>..........h2..f..3.........<...X&r....T
..gg.-...t.....em<b.V&.g.c....6E,.-..qF6. ...o.Q.$S...(./y...DD..w.
.:iQ .c....3.&.TcCT.t,UE.E..HP.R.s.......V.`...%...'6.`...g..UIf(..K..
..uF2..r......T.!..]fLWF..\lU$....=c:2#.`....<...E". .".. qU.7P.[..
c.}.J.q.N.*..:g)%...!.. ..,[email protected]..,9.:l....c....<...
G.8...O......?.....5..'}.....TB..#.... Uxq..\..Y....1.P ..P.........Cd
a...g.....V'....G.:..uW..2.X......a2!.....L..2...mb...f:.i. z........S
...u)d8dC.R..q.`..N.^.~.q.......].....U.....%..p1&..b5..K..q..h...D...
...0...b..?M`...ak..2}J.7....l..<........7\...g!.Jf.0k.......){.-[.
f...M.. ..`.hY}..]....Z...z`.J.eb.........Vl..s...p.Zi.*..kd~..Q...l.@
......(l.v.L%:..|.c....,..Tg.....I..7[.-#,.....j#...B.`..b.m`..[....g.
.<Gs......".5c.R.4QC.5.][email protected]....
%0.m./....z{{~.y...........gz.zz.........??{..g~....D...............z.
_.......k.}...^?v..w.O..........t.x...~..x..}.........................
..............=..m...]Ew7...._....j_.j.....~.&....\7....~.....Pw..
<<< skipped >>>

GET /shared/img/universaldownloader/loading.gif HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: static.sd.en.softonic.com

Connection: Keep-Alive

Cookie: PHPSESSID=c3b46d7ed2da7b349269a42c8c378a2b; blang=en_US; country=UA; ucountry=EU; entry=Direct; UACR_69668133=false; UACA_69668133=false; UD1_POSITION_69668133=; _FCen=101103||.100624|1|1407050006.100516||.100978|1|1407050006

HTTP/1.1 200 OK

Date: Sun, 03 Aug 2014 07:13:28 GMT

Server: Apache

Last-Modified: Tue, 11 Feb 2014 08:39:16 GMT

Accept-Ranges: bytes

Content-Length: 1553

Cache-Control: max-age=172800

Expires: Tue, 05 Aug 2014 07:13:28 GMT

Keep-Alive: timeout=3, max=7

Connection: Keep-Alive

Content-Type: image/gif
GIF89a................................................................
......................................................................
......................................................................
......................................................................
......................................................~..}..|..z..y..x
..t..v..s..r..q..p..m..o..l..k..j..............!..NETSCAPE2.0.....!...
..|.,............|..;\r....bvwz.....-lqK'......|.[p9.....4lE.....Nj#..
...^g.....[c.....G_......[8..!..IV*..'..|#OP1......).. @JGB=93)...$3&l
t;9 ......!.....|.,..........y.|.|4RhjW:...)Vilortvd1.&]eA..&Lwt.N`..|
<.-[;...|AX....NU....JQ....8M.....%I.....|8C ......<=%.........1
73/*&!....% '.....!.....|.,..........w.|.|-EY[L3..!GX[_cgjZ..LS6.Cmj..
?M)..6r`."I0..Iu:3E...&xZ<A...zr9=.. 8....5!....*0....... *........
..!$!................!.....|.,..........w.|.|$9IM@,...8GJOSWZM&..;A..:
_]).1<...0dU|.7$..Aj4&3..mR,0..pi(...qk.)..&uX.$..Mw;|....{g.|.....
..|2....................!.....|.,..........z.|.|.(591#...'258=AE<..
.)-....-KI ..)...&PE|."...5W,......ZD...._X....c[....fL....Dk4|....9o\
......'Jsl......zxa.....[;....!.....|.,..........x.|.|..$'#......"&*.2
-......... 77.......=5|.....(C#......G6....LG....QJ...|U?....:Z,|...1_
M.N'|.Be]&.fyxtrokV)..;YljS....!.....|.,..........w.|.|...............
............$%........*&|......0......3)..95..=9[z...B1<wL./G#.ct8.
)M>./mrF.7TL...]nkfc_ZH!.5O_[G....!.....|.,..........v.|.|........|
.........1.......gz.|...|;wM.|...Xv'..!.lt..&"jr.|*'So../#5lD.#3.|
<<< skipped >>>

gn_reranked_priority":null,"special_condition_id":"1271%
22,"special_condition_type":"ns","met":false,"
condition_name":"client_condition"}]],["campaigns_
rpms_prefetch",[{"campaign_id":"101112","default
_priority":364,"priority_1":"371.00","priority_2%2
2:"333.00","reranked_default_priority":null,"reranke
d_priority_1":null,"reranked_priority_2":null},{"c
ampaign_id":"33121","default_priority":1,"priority
_1":null,"priority_2":null,"reranked_default_priority%
22:null,"reranked_priority_1":null,"reranked_priority_2%
22:null},{"campaign_id":"41252","default_priorit
y":194,"priority_1":"203.00","priority_2":"1
91.00","reranked_default_priority":null,"reranked_priori
ty_1":null,"reranked_priority_2":null},{"campaign_
id":"100509","default_priority":2292,"priority_1%2
2:"2268.00","priority_2":"2294.00","reranked_def
ault_priority":null,"reranked_priority_1":null,"rerank
ed_priority_2":null},{"campaign_id":"100516","
default_priority":1126,"priority_1":"1057.00","pri
ority_2":"1129.00","reranked_default_priority":null,
"reranked_priority_1":null,"reranked_priority_2":null}
,{"campaign_id":"100579","default_priority":
<<< skipped >>>
HTTP/1.1 200 OK

Date: Sun, 03 Aug 2014 07:13:26 GMT

Server: Apache

Set-Cookie: softonic_en-admin=deleted; expires=Sat, 03-Aug-2013 07:13:26 GMT; path=/; domain=softonic.com

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 35

Keep-Alive: timeout=3, max=9

Connection: Keep-Alive

Content-Type: application/json; charset=utf-8
...........V*.I,)-V.R..V.....l.........


GET /universaldownloader/campaign-100978,100624?sd_timestamp=1407050005 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: remo-repair-word.sd.en.softonic.com

Connection: Keep-Alive

Cookie: PHPSESSID=c3b46d7ed2da7b349269a42c8c378a2b; blang=en_US; country=UA; ucountry=EU; entry=Direct; UACR_69668133=false; UACA_69668133=false; UD1_POSITION_69668133=; __utma=211808150.1548078679.1407050006.1407050006.1407050006.1; __utmb=211808150.3.10.1407050006; __utmc=211808150; __utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); NREUM=s=1407050007106&r=257951&p=0; _FCen=101103||.100624|1|1407050006.100516||.100978|1|1407050006

HTTP/1.1 200 OK

Date: Sun, 03 Aug 2014 07:13:27 GMT

Server: Apache

Set-Cookie: softonic_en-admin=deleted; expires=Sat, 03-Aug-2013 07:13:26 GMT; path=/; domain=softonic.com

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 16388

Keep-Alive: timeout=3, max=8

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
.............V...(.;y...,.w.;.bb....-...ax.R....".....~.3...{....M....
.n]l.Hf....1.%XRwuuu...z.....f..d[..CK99.8..T2.b...Y,n.....Z..J.PRZ.f.
f`:.f...G.%3...^,..........[....U...g>..,...Y{...|.Z..H.S^YY..3....
F....f.{..7.....w...n..c.52.{..7....f....m8........?.....1. X.f0..;v..
7.?..Q.....Y..|.~{.].lm..F.qu..........L.5z#[..f...v...V.,\....ve_...i
..4.w.;{p./.....W..sU....ee..x..`..J...W.z.c......N...UG.{...S.J.|.<
;[email protected]=%>.......s.,...........`.y.6...r.s!......U..1Z.....6.1..5
...Z.....'...............>.$.....G..].4...Y.F.X..1...8.MC.(.......;
[email protected]>..........c ;eV.$]..c.=....n?>.....J|..i2>M.T..w....(.(
..l.y^F.......rf...?...t....:..,..^......:Y............Y..........>
k.?~ddK..r<......(.a..UL..h..&*...........7,[email protected].....}..
[email protected]*.wv1...dk9`.!{.M..3.)..C....\..4.0..Z..95...$.-.N`.l
.....7..x......G]..A..}.....fL[1...A..S.l...H.}.4?0...|l.......p.....@
....1?..K^.\...\..O..C...9$C).h..@..< ...HU......m...q...b$...[....
l...Y/..h..........J8`>>.......i....g.O.........TI..lA....B}Q...
.b...r..g.j[.........].V..2 .......L...t.....U3..:w,y.Z..3 D.|..<..
.rt.Y9K..L.[....=......E>.!..wo..h.uh6.G'.^5..fa....6.r.....8.Vsf..
)$.g...a.W.....nU........O.!......3e&.??....=....M......0..7.....j..e.
...=....3..@\e..c.....k....LE....i..8...h.$72...#d9...r.'...i....Mf...
...l.Q.. ).......p......j7...$Jl9?..._.u..vb.....h.|;....uo.`........i
= .jsj.E...... ..G.0m...T.d..0..x.........h...?.2..v.........$..I.s...
`*x....N...p....$R@4.....!.#h..f.8s...N.........[..r.c{...a.....}.
<<< skipped >>>

GET /campaign/scrn/100000/100978/sd_100978_3a9ca.jpeg HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Mon, 12 May 2014 14:27:08 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 20788

Accept-Ranges: bytes

Date: Sun, 03 Aug 2014 07:13:28 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 563008

Expires: Tue, 05 Aug 2014 07:13:28 GMT
......JFIF.....`.`......Exif..MM.*.............~hXXp://ns.adobe.com/xa
p/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>..&l
t;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 
61.134777, 2010/02/12-17:32:00        ">...<rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">....<rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8C64BE78239DE2
11A12E9F92D737954D" xmpMM:DocumentID="xmp.did:D4B963CFAC1011E281CA9D1E
951754BA" xmpMM:InstanceID="xmp.iid:D4B963CEAC1011E281CA9D1E951754BA" 
xmp:CreatorTool="Adobe Photoshop CS5 Windows">.....<xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:6FF3D61707ACE211B156EAA95A300FA3" stRe
f:documentID="xmp.did:8C64BE78239DE211A12E9F92D737954D"/>....</r
df:Description>...</rdf:RDF>..</x:xmpmeta>..<?xpacke
t end='w'?>...C....................................................
................C.....................................................
....................,.."..........................................N...
......................!....1A"Q..aq.....#2..W.....%BG.'7...4Rb..&35e..
....................................0.........................!1..AQ".
2a.#..$q.................?...C......S...a....u"..[7V7#n...j.rj.&......
 ..2......c^.....6.......iR[m...Iz.oWD....~..J,.....=....@.*...v...H..
..SQ.2.Q.cI\..]...f...B}.....GAN.3$Q.......ZkO.......P6..p.k..b...
<<< skipped >>>

GET /campaign/scrn/100000/100624/sd_100624_634cd.jpg HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 11 Feb 2014 10:50:08 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 55463

Accept-Ranges: bytes

Date: Sun, 03 Aug 2014 07:13:28 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 59620

Expires: Tue, 05 Aug 2014 07:13:28 GMT
......JFIF.....%.%.....C..............................................
......................C...............................................
..........................|...........................................
...p...........................!..1A...Qaq.."T.....2RSV..........$&'38
Urw...#46BXfv....%(CDFHWb.....)5gsu..7G...............................
.........c........................!..1.AQ..."aq2R......#ST......3BU...
..$%&4Cbdst..56Dceru.....EVv....FW...............?........T.I$.e.QC...
..&9.s...)K..a....uy.#G.GH...I$..#...wwb..T.....$.U*... ;.*"".wv8UEPY.
..*....k...7..2....~z..b..-...2].R..%.N....(.n'HT..L.....w.......q....
.p..qF..Xh.\>...{.....0..i,!...qum..n.#0W..k?#<x.i...7...>..H
.......h......4g.....8..P..........x..........)Z...fr......V.*H*S.....
C..._;."..t....[.......Oxv.F.....u[..)5.v.kM.[.....V.5).....%..v..nVT.
.o'1.v.5..x.m.A.Egx#.....Yf{<H.f...\F.r.p%..d..X.W..txG..Y..]#.R\.0
.bW.>.....>.....;....;...I.DY...Lx..6.....,/...u8..CZjCO....}..`
..Htt.Q....]Ar[..\.P..x......uk. ".R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R
.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R......0...[Fh.Xh...B
.&F......;..."..v..u...T ...............?.V.......]s[..z.W..v.........
...X.m..0.pJ.E=.i........'.Q<.ym......h.W.X..mB.^......8.C..7.O.*Ij
...{ k...Z7.....t8......n....`.E....)i8....d..HD...4u..c..8<..x....
)......M...3.........e.....=...M*..-D.........q.v1...8E.t..c.$P...._p.
...^J...P..2.5Mf...%./.,..F..hu[[H...[U.....-.... ....vx....T(..s.H...
.*........I.....=..&..4..,h..$T.p...q...s.)..._>.. )...=..i...w
<<< skipped >>>

GET /campaign/scrn/100000/100624/sd_100624_634cd.jpg?v=0.4879445294363033 HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 11 Feb 2014 10:50:08 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 55463

Accept-Ranges: bytes

Date: Sun, 03 Aug 2014 07:13:28 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: MISS

X-Cache-Hits: 0

Expires: Tue, 05 Aug 2014 07:13:28 GMT
......JFIF.....%.%.....C..............................................
......................C...............................................
..........................|...........................................
...p...........................!..1A...Qaq.."T.....2RSV..........$&'38
Urw...#46BXfv....%(CDFHWb.....)5gsu..7G...............................
.........c........................!..1.AQ..."aq2R......#ST......3BU...
..$%&4Cbdst..56Dceru.....EVv....FW...............?........T.I$.e.QC...
..&9.s...)K..a....uy.#G.GH...I$..#...wwb..T.....$.U*... ;.*"".wv8UEPY.
..*....k...7..2....~z..b..-...2].R..%.N....(.n'HT..L.....w.......q....
.p..qF..Xh.\>...{.....0..i,!...qum..n.#0W..k?#<x.i...7...>..H
.......h......4g.....8..P..........x..........)Z...fr......V.*H*S.....
C..._;."..t....[.......Oxv.F.....u[..)5.v.kM.[.....V.5).....%..v..nVT.
.o'1.v.5..x.m.A.Egx#.....Yf{<H.f...\F.r.p%..d..X.W..txG..Y..]#.R\.0
.bW.>.....>.....;....;...I.DY...Lx..6.....,/...u8..CZjCO....}..`
..Htt.Q....]Ar[..\.P..x......uk. ".R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R
.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R......0...[Fh.Xh...B
.&F......;..."..v..u...T ...............?.V.......]s[..z.W..v.........
...X.m..0.pJ.E=.i........'.Q<.ym......h.W.X..mB.^......8.C..7.O.*Ij
...{ k...Z7.....t8......n....`.E....)i8....d..HD...4u..c..8<..x....
)......M...3.........e.....=...M*..-D.........q.v1...8E.t..c.$P...._p.
...^J...P..2.5Mf...%./.,..F..hu[[H...[U.....-.... ....vx....T(..s.H...
.*........I.....=..&..4..,h..$T.p...q...s.)..._>.. )...=..i...w
<<< skipped >>>

GET /pagead/show_companion_ad.js HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 635714710514761700

Date: Sun, 03 Aug 2014 06:50:07 GMT

Expires: Sun, 03 Aug 2014 07:50:07 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 44196

X-XSS-Protection: 1; mode=block

Age: 1401

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic
............iW...(.._.:.D..c..$._.NB..1...K...).........A...9...~x....
y......x>.f....~.x...;...6tU.g..F..t.z3....5........g...s.j2..g.Q5,
'p.....]....*|......Z..?.=<.!.....f..x<51.:^u........b..~<3-.
......[..2l...m...l...X0_...k../38...f..d...H.)F.U.A......E.....fk....
.~...U....1..G..p].. ....}..d..N.{.7cx.0.|.S.DdZ..l'pylu2....fu6n...Q.
.x...E...=X......6.$....e.Qw0..,.1...h.!9&5..|.Fq....Z.. .D.R...h:.?L.
Pq4....] O0.^.a.'G....|.....Y...R....Cr..E4H.U.;.C..b..*[email protected]...`
..m(&.uC.".,*.DJsr.|...(.G..x.V~.....i..lZ..P...........\...tY........
.8.Uo2...^...g...K8.%0Q.bIX.5........t.x.v...*'f..8ti.h..A8..N.a[r.Ws.
5......5....C.X...D..f.(.Z..M..%..I......q*..7.k..D..L...........7.j0.
a'7.........."g..{v...ic.e..../...W'..W2....c..Y....o.UG......V.@.....
.DO|-.......n.`...eh5..*H....7.....iF.T..T.1.*.y0.O].R|/..vW.......P.u
.2h....0yt^...u.M...`..R\..ON..3.......k......6....o..c..mVgQ..4.j....
.(X....9.....yyu...\U.'....[X..}Y.x..X.G.l.o......U..,......P..6.EY~x.
.3.Z..e....*L....{.}......V.........;....E}.....1...wj..^........bu...
b..1.B...r........e1..qw.yaR.V...... ..:.f.l.w^...5....R[U^>.....#t
....-j.}../..G?..,.o!%;.&..P.{....p......q...u.Q.L.1F...3.'.....z.).. 
.h...3OB..;.A....u....^.W .{..;.E!..B.t|..........u?....I!..].V(.N.%.&
lt; 1...^........G...~.......}.. .......|^.... .q{.]..^q..F8.........H
o.-..]9/.x....P..{..F........i.&..]..W.i.'Ls.a....o...Te.J...MN.G..{..
..k#.....%B._HoU..7...5....'D...3*~5..p..uX7..{.... ..x:..C..@[email protected].
.9......\.b.......?Mf... .s6.>y..8w.....$........V9.P..\7/.v..;
<<< skipped >>>

GET /gpt/pubads_impl_45.js HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: partner.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Last-Modified: Wed, 16 Jul 2014 15:23:21 GMT

Date: Thu, 31 Jul 2014 18:28:19 GMT

Expires: Fri, 31 Jul 2015 18:28:19 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 31222

X-XSS-Protection: 1; mode=block

Age: 218709

Cache-Control: public, max-age=31536000

Alternate-Protocol: 80:quic
......n.....ww.F.8..>..'W...E.%1 ...\...F1:.`AB.&@.[....l....?...K.
.....Nq..,......]....}..Q..ehR..m)..r.{1....^..5.<...Y. %..(,..b...
 K]g....p.0. .y..n6..>.1...._{.-.c...y.R%*.n.`;q(c.....c..b..Xf.a;.
...E............z...T.*..;........XB@..=..a1..wV.D..L$.^../&Y,..BG.bY\
..O.b......5'.....6..t...{...fq2j]......*{...Y.I.vU.l.y.....L..*...]./
.^.5.y..T...r.\..i'RZP/..U.J...U^........}.Dc....N..=......\...zlW.fC.
:.d....l.%gN...<........F......;.....2.].....n9.m.XL.]....0........
|^)J%aU..W.......r.t.....rj.......uNs.....".H/.n.:.?T....V.|....Z....W
q8..z...l.......\.. Z..L...t..%.p.zm....pZf....n<O...2...}.{...{..D
c.>..h...77..h........e..zz%.*\..x,...q.3.f....^..W"../.Eqsc.\.K;-.
..).... 60..a..5p=/......y../.a..O/....?.7...ZWuh7..'..2........e>.
...i.s.b..../C.).V.z.R...:[email protected].]Y..&....uxI..%L.p.... .i........
.<...x...).;........1[...r. \.k.c."..P.j;r.pp.N9...`jO..OE.<Y..|
J...a..g.........W.3...a..yA..0....V.l.T...R,&8........p...J_mL.......
..8.g..Gn..`"xX.......E.W]=..F..sO....72..y....s..y......u............
.W..F.K*...zv.l...}...~........._.~/....^./V..;_..........!{......s..p
..|.].=...........Z..*P3....y.a....0..?.q....j.K...d"0.:Iv.X7.....Y.@.
..0...^v..N)!d..k..../..n.......,\....8.".6n.&;...7....qSu...r>}..&
lt;...I.:...fk&./>.~.......`j.-...(.$....;....q;..[.&.6L.p4.....w..
.....r.@..._fE<r. ...90...p.}'.....D.;....q.u...........I..Y.......
Wf..........L....8..q..pO..}.r.......S.;....C..}F...g..3.....>..Y.g
..W...._.C.o..:. ....g..bk.(|..'.v....G.....F...Y.g..KMm.._....)W.
<<< skipped >>>

GET /tag/js/gpt.js HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: VVV.googletagservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 1811280269061427138

Date: Sun, 03 Aug 2014 06:19:24 GMT

Expires: Sun, 03 Aug 2014 07:19:24 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 13017

X-XSS-Protection: 1; mode=block

Age: 3244

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic
...........}kw.........o.}j..l.%[email protected]............../......Y..
[..F.h43...p1..$.... .4Bw.e.I.^z:.9?.0[$..U<...M.cK........v.....M.
....!.,...x.........8..&..u.n.... .......{X..Djk..Y.u...4K&.Q..(....3A
A..d........$m.0"......b.....&..p6........p2..k3.M.....r..y.d.... ...G
..Y.a[...T.F..T.....Z...F..J..WN..zk.Fi.......([email protected]."..AQ..t.5\({.
..A.......z..>[email protected]^....Sb1.|.....8.B6 .~.....t....w..|..Zl>.
nm....]..`.fY...TK. l2'.'.u. I......H......x.4..y."#.I...;.g.%..._)...
P.Y:..3.6....&..9.e.....#K7.v.$..c....l..l.....vZ.......X6...<.`..9
..L..*.pJ..iX..........y...?.X.m.=.....n..x..4Y.,N<.9o.:.;..g.<.
..\....t2I...&..s....(fY>....5{ms......W.1..].tG.~1p.....iW...c.m..
>.z}......K<..q....{....`....v'.:..)-..5e.....h..g.A....`^b[.V{.
r..{I..z.T....T.....L.......s...`{.....q..K$.:Q...L.< U..b.2.6D.5..
\..qo....`..."....^w........]xo...i.H..f...q.J../6....i....Y....B.* ..
.F.n...k......REq.8,...%....N.=...n[.xZ.#C..$2AWi0....Yz|=;. ..8 ..M_.
p.....D.#....X..Fq<......l.....&,*d.)...G%..2m.......haK.E.. ......
..$..Y...I..s8........,c|L .f..........R{Wg..7!...l..`G.%.....H..xj.X.
......ik....(!...ek.f..@..!_$.Z.......$...ar..-..?.x.8..........t._.c.
......x....9......w.........EL...)[email protected]...
.\..4....1.......`.e..x..{........>[email protected]..[.....%.AS...V...jX
g.e.....0{..)..aP....."..(]U...{Y^.aN.4e.4..,.......Wd.:D.9...........
..z/...GD.Fq...U-%.`.U`C.v.^..* ...M. ..t.....[..H...0L..j.d..1.......
...l...G..P.v-R,..).Xd.z.fGi.. .......6K)W[V.am..3...x.T.1i6m..Y..
<<< skipped >>>

GET /1/cc92a7d66e?a=2337116&ap=279&fe=1657&dc=782&v=411.b2946c1&to=NQcAZUJXXUdWAEZdVwxNN0NZGVtAUwxRRxcLDAZUSBhDXEc=&f=["err"]&jsonp=NREUM.setToken HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: beacon-6.newrelic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Set-Cookie: JSESSIONID=b0668e1c80cd0e0f;Path=/

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Content-Type: text/javascript;charset=ISO-8859-1

Content-Length: 21
NREUM.setToken(null).....


GET /1/cc92a7d66e?a=2337116&ap=159&fe=1812&dc=812&v=411.b2946c1&to=NQcAZUJXXUdWAEZdVwxNN0NZGVtAUwxRRxcLDAZUSBhDXEc=&f=["err"]&jsonp=NREUM.setToken HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: beacon-6.newrelic.com

Connection: Keep-Alive

Cookie: JSESSIONID=b0668e1c80cd0e0f

HTTP/1.1 200 OK

Content-Type: text/javascript;charset=ISO-8859-1

Content-Length: 21
NREUM.setToken(null)...

GET /__utm.gif?utmwv=5.4.6&utms=4&utmn=2100908754&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=-&utmp=/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005&utmht=1407050008262&utmac=UA-48247475-1&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~ HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 31 Jul 2014 18:28:26 GMT

Server: Golfe2

Content-Length: 35

Age: 218702

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=5&utmn=379054602&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1407050008418&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 31 Jul 2014 18:28:26 GMT

Server: Golfe2

Content-Length: 35

Age: 218702

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=6&utmn=1030384432&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1407050008434&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 31 Jul 2014 18:28:26 GMT

Server: Golfe2

Content-Length: 35

Age: 218702

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=7&utmn=581728098&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1407050008512&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 31 Jul 2014 18:28:26 GMT

Server: Golfe2

Content-Length: 35

Age: 218702

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=8&utmn=67440648&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1407050008543&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 31 Jul 2014 18:28:26 GMT

Server: Golfe2

Content-Length: 35

Age: 218702

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=9&utmn=1332536737&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/C100978--load1&utmht=1407050008606&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 31 Jul 2014 18:28:26 GMT

Server: Golfe2

Content-Length: 35

Age: 218702

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=10&utmn=1104140846&utmhn=remo-repair-word.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Remo Repair Word installation assistant&utmhid=1868926086&utmr=http://unknown_browser_unknown_version&utmp=/C100624--load2&utmht=1407050008637&utmac=UA-152357-4&utmcc=__utma=211808150.1548078679.1407050006.1407050006.1407050006.1;+__utmz=211808150.1407050006.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 31 Jul 2014 18:28:26 GMT

Server: Golfe2

Content-Length: 35

Age: 218702

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;..

GET /shared/img/universaldownloader/sd_sprite.png HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: static.sd.en.softonic.com

Connection: Keep-Alive

Cookie: PHPSESSID=c3b46d7ed2da7b349269a42c8c378a2b; blang=en_US; country=UA; ucountry=EU; entry=Direct; UACR_69668133=false; UACA_69668133=false; UD1_POSITION_69668133=; _FCen=101103||.100624|1|1407050006.100516||.100978|1|1407050006

HTTP/1.1 200 OK

Date: Sun, 03 Aug 2014 07:13:28 GMT

Server: Apache

Last-Modified: Thu, 29 May 2014 08:56:36 GMT

Accept-Ranges: bytes

Content-Length: 7892

Cache-Control: max-age=172800

Expires: Tue, 05 Aug 2014 07:13:28 GMT

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.......\.....ld......sBIT.....O.....PLTE..............
......................................................................
...............................................h......................
.f.....n........Dw.I..............U..}..,...v..\. g...........x.a...R.
.............>....:n........M..].T*..:.....m....tV.....]........7..
..Q..P..O)....P.i...O..N..N..M....sJ..M..K..L..L..J..J..JJz...I..I..H.
.I..H..Istv..H..G..H..G..G..G..F..F.x.go...F..F..E..E..D..D..D..B..C/v
...B:[email protected]..>/g..m..p..i...<..=.z:.g.;b..z:[email protected]?[ZW
.5>.u8.4<.s7.b..3;.1:.09{O$./8.p5..7.-6.[..m4&Q..,5. 3.k3(X..*2.
)1.R..(0.'/.%,.T..f1.e1.&..$,.$,.%-.# .# ."*.#,."*.!)." .!(.!*.!). (..
'. (..&. '.I...'..&..%..&..%..%..$..$.."..#..#..".."..!..!....9.899...
................*................>.j.....tRNS......................
......................................................................
......................................................................
......................................................................
.............~T.....pHYs...........~.....tEXtSoftware.Adobe Fireworks 
CS6.......gIDATx...._[.^..'.LhC...4.t.K....H.w0......^.)w.i..T...q..w.
.bq..*U.2j]..hU...^.}).\.......,.@......._..!0.u>[email protected]\..
fUHC....c.X;4.c..I...m..c...d.B.2...}. ..- ...A....,.:p51.4.Ig..:.}...
...r......WXw..........z. 3v..^.....2......5.Bw.;...M.......ffx..Ac...
....jf...F53.K...y...^.(h..M].>....................y.o.:...m.-.2C..
..................(.Jro.P............wqo....7....<...7*.z......
<<< skipped >>>

GET /en/scrn/69668000/69668133/thumbnail_1379925746-100x100.png HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Fri, 18 Oct 2013 11:21:37 GMT

Cache-Control: max-age=172800

Content-Type: image/png

Content-Length: 7455

Accept-Ranges: bytes

Date: Sun, 03 Aug 2014 07:13:28 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: MISS

X-Cache-Hits: 0

Expires: Tue, 05 Aug 2014 07:13:28 GMT
.PNG........IHDR...d...d.....p..T...'iCCPicc..x...wTT.....wz..0.R.....
.{.^Ea..`(..34.!...ED."HP...P$VD...T..$.(1.ET,oF...........o........Z.
.../...K......<....Qt.....`.).LVF._.{.......!r._...zX..p..3.N....Y.
|.......9.,...8%K........,f.%f.(A...9a..>.,.....<...9..S.b....L!
G.....3..,....F.0. .7..T.3...Il.pX."6.1...."....H._q.W,.d...rIK..s...t
.......A..d.p....& ..g.].R........Y2...EE.4...4432..P.u.oJ..Ez...g....
......`..j...-....-....b.8....o.....M</..A...qVV....2.....O.....g$&
gt;....]9.La..... -%M..g.3Y.........u..A.x....E.....K.......i<:....
............Pc...u*@~..(.. ...]..o..0 ~y.*..s..7.g...%...9.%(....3....
....H.*[email protected]`[email protected]'8...K....
n..`.L.g`......a!2D..!.H.... .d..A.P....B....By.f..*...z....:....@..]h
...~....L.............C.Up........p%....;...5.6<.?.........."....G.
.x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G..
.....t...].nB../.o.'..1.......xb"1I.....>L...f.3...b..X}..........*
.Q.Y..v...G....p..(............&q.x).&....g.s...F|7.:~..@.&h...!.$.&B%
..p.....H$.....D.q#..x.x.8F|K.!..\H.$!i........%.L.";......r3.......E.
H.K.-.A.F.CbH..$^RS.Ir.d.d......3Rx)-).)..z....R#Rs..iSi..T...#.W..d.2
Z2n2l....2.d.).E..BaQ6S.).).T.U..EM..S...Pgeed....f.......!4-..-.VJ;N.
..[...i.g..%.K....-.s.........{'O.w.O..%.).P........._....R.R....EK./.
.. .).).U<...8.......T.tAiF......\.|FyZ..b..U)W9....Kw... ...YUEUOU
.j.......Z.Z.Z..Cu.:C=^.\.G}VCE.O#O.E..&^.....W.Os^K[ \k.V.......v.v..
..........[..].n..>..z...^.^..u}X.R...O...m`m.3h0.1$.:.f.......
<<< skipped >>>

GET /campaign/scrn/100000/100978/sd_icon_100978_c55d5.jpeg HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Mon, 12 May 2014 14:29:14 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 829

Accept-Ranges: bytes

Date: Sun, 03 Aug 2014 07:13:28 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 601405

Expires: Tue, 05 Aug 2014 07:13:28 GMT
......JFIF.....H.H.....C..............................................
......................C...............................................
................................................................./....
......................!.......1U..."AQg...............................
..6.........................!Q..1.....ASa..."#Rcd..................?.}
.-..$.}#.q..;..o....vgi3.>X...H.JW.9....?!..N.......a.yo....6......
...|........S]..v.j.F.V.(x..s.Q9$..7......>..Re*.....~.w_:.V..D..jv
.0k...vE.L....f....j..*[email protected].:.kl2`*....*.d.X5.f._.;1K...j.yYn.7
..&W..D.l...b....r.X.E...@@&....Jp.i\.B.........4S.[.......V.....q%...
.....[z.]....71.............>]3Z...y.e..p...e.}......3.S..{...GN..;
...2.Cg7D..`....M.h..6....J5?(.S..%u...;.....0e.I)...j...E.O|3../...l.
-W]..p....s0v.4.d...bB......H.....f.. .X?R...V...r..:e$....z....e...font>....


GET /campaign/scrn/100000/100978/sd_100978_3a9ca.jpeg?v=0.9312210704230921 HTTP/1.1

Accept: */*

Referer: hXXp://remo-repair-word.sd.en.softonic.com/universaldownloader/campaign-100978,100624?sd_timestamp=1407050005

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.0

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Mon, 12 May 2014 14:27:08 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 20788

Accept-Ranges: bytes

Date: Sun, 03 Aug 2014 07:13:28 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: MISS

X-Cache-Hits: 0

Expires: Tue, 05 Aug 2014 07:13:28 GMT
......JFIF.....`.`......Exif..MM.*.............~hXXp://ns.adobe.com/xa
p/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?>..&l
t;x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 
61.134777, 2010/02/12-17:32:00        ">...<rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">....<rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8C64BE78239DE2
11A12E9F92D737954D" xmpMM:DocumentID="xmp.did:D4B963CFAC1011E281CA9D1E
951754BA" xmpMM:InstanceID="xmp.iid:D4B963CEAC1011E281CA9D1E951754BA" 
xmp:CreatorTool="Adobe Photoshop CS5 Windows">.....<xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:6FF3D61707ACE211B156EAA95A300FA3" stRe
f:documentID="xmp.did:8C64BE78239DE211A12E9F92D737954D"/>....</r
df:Description>...</rdf:RDF>..</x:xmpmeta>..<?xpacke
t end='w'?>...C....................................................
................C.....................................................
....................,.."..........................................N...
......................!....1A"Q..aq.....#2..W.....%BG.'7...4Rb..&35e..
....................................0.........................!1..AQ".
2a.#..$q.................?...C......S...a....u"..[7V7#n...j.rj.&......
 ..2......c^.....6.......iR[m...Iz.oWD....~..J,.....=....@.*...v...H..
..SQ.2.Q.cI\..]...f...B}.....GAN.3$Q.......ZkO.......P6..p.k..b...
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

`.rsrc

F%Xbj

PSSSSSSh

PSSSSh

F><.tN<[tJ<\tF<*tB<|t><^t:<$t6

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

88888888888888888

%u$Vj%

t.Gj:W

SSh,wK

xSSSh

FTPjKS

FtPj;S

C.PjRV

%s:%d

WARNING: failed to save cookies in %s

About to connect() to %s%s port %d (#%d)

Connected to %s (%s) port %d (#%d)

 malformed

:]://%[^

[^:]:%[^

Protocol %s not supported or disabled in libcurl

http_proxy

%5[^:@]:%5[^@]

%5[^:]:%5[^

:%5[^@]

Port number too large: %lu

%s://%s%s%s:%d%s%s

ftps

[%*39[0123456789abcdefABCDEF:.%]%c

Couldn't find host %s in the _netrc file; using defaults

[email protected]

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

Connection #%d seems to be dead!

Connection (#%d) was killed to make room (holds %d)

Re-using existing connection! (#%ld) with host %s

%s://%s

Connection #%ld to host %s left intact

operation aborted by callback

HTTP/

ioctl callback returned error %d

the ioctl callback returned %d

seek callback returned error %d

The requested URL returned error: %d

HTTP/1.0 connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.0 proxy connection set to keep alive!

HTTP 1.0, assume close after body

HTTP =

HTTP/%d.%d =

No URL set!

[^?&/:]://%c

Violate RFC 2616/10.3.2 and switch from POST to GET

Disables POST, goes with %s

Issue another request to this URL: '%s'

Maximum (%d) redirects followed

Received problem %d in the chunky parser

HTTP server doesn't seem to support byte ranges. Cannot resume.

Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)

Leftovers after chunking. Rewinding %d bytes

Operation timed out after %ld milliseconds with %lld bytes received

Operation timed out after %ld milliseconds with %lld out of %lld bytes received

unspecified error %d

%s cookie %s="%s" for domain %s, path %s, expire %d

#HttpOnly_

httponly

I99[^;

skipped cookie with bad tailmatch domain: %s

skipped cookie with illegal dotcount domain: %s

23[^;=]=I99[^;

%s%s%s

# Fatal libcurl error

# Netscape HTTP Cookie File

# http://curl.haxx.se/rfc/cookie_spec.html

# This file was generated by libcurl! Edit at your own risk.

[%s %s %s]

Send failure: %s

Failed writing body (%d != %d)

bind failure: %s

Local port: %d

Bind to local port %d failed, trying next

couldn't find my own IP address (%s)

Bind local address to %s

Couldn't bind to '%s'

TCP_NODELAY set

Could not set TCP_NODELAY: %s

Failed to connect to %s: %s

Trying %s...

Resolving host timed out: %s

Could not resolve host: %s; %s

Could not resolve proxy: %s; %s

Could not resolve host: %s

gethostbyname(2) failed for %s:%d; %s

init_resolve_thread() failed for %s; %s

TFTP

set timeouts for state %d; Total %d, retry %d maxtry %d

tftp_rx: giving up waiting for block %d

Received unexpected DATA packet block %d

Timeout waiting for block %d ACK. Retries = %d

tftp_rx: internal error

tftp_tx: giving up waiting for block %d ack

Received ACK for block %d, expecting %d

tftp_tx: internal error

bind() failed; %s

tftp_send_first: internal error

%s%c%s%c

TFTP finished

Can't get the size of %s

Can't open %s for writing

Last-Modified: %s, d %s M d:d:d GMT

Couldn't open file %s

There are more than %d entries

LDAP remote: %s

LDAP local: ldap_simple_bind_s %s

LDAP local: Cannot connect to %s:%d

LDAP local: trying to establish %s connection

LDAP local: %s

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

CLIENT libcurl 7.19.0

MATCH %s %s %s

DEFINE %s %s

insufficient winsock version to support telnet

WSAStartup failed (%d)

%s %d %d

%s %s %d

%s %s %s

%s IAC %d

%s IAC %s

Sending data failed (%d)

%d (unknown)

%s (unsupported)

%s IAC SB

Syntax error in telnet option: %s

Unknown telnet option %s

7[^= ]%*[ =]%5s

USER,%s

%c%c%c%c%s%c%c

%c%s%c%s

7[^,],7s

%c%c%c%c

FreeLibrary(wsock2) failed (%d)

WSACloseEvent failed (%d)

WSACreateEvent failed (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to load WS2_32.DLL (%d)

WS2_32.DLL

Excessive FTP response line length received, %zd bytes. Stripping

FTP response reading failed

FTP response aborted due to select/poll error: %d

FTP response timeout

Failed FTP upload: 

RETR response: d

Connecting to %s (%s) port %d

Uploading to a URL without a file name!

FTPS not supported!

USER %s

socket(2) failed (%s)

PORT %d,%d,%d,%d,%d,%d

Telling server to connect to %d.%d.%d.%d:%d

Failed to resolve host name %s

getsockname() failed: %s

Connect data stream passively

REST %d

SIZE %s

STOR %s

APPE %s

Bad PASV/EPSV response: d

Can't resolve new host %s:%d

%d.%d.%d.%d

Skips %d.%d.%d.%d for data connection, uses %s instead

%d,%d,%d,%d,%d,%d

%c%c%c%u%c

Failed to do PORT

Got a d response code instead of the assumed 200

RETR %s

ftp server doesn't support SIZE

PBSZ %d

Access denied: d

ACCT %s

PASS %s

ACCT rejected by server: d

QUOT string not accepted: %s

TYPE %c

MDTM %s

ddd d:d:d GMT

dddddd

unsupported MDTM reply format

server did not report OK, got %d

Remembering we are in dir "%s"

CWD %s

Failed to MKD dir: d

MKD %s

QUOT command failed with d

Entry path is '%s'

PROT %c

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

AUTH %s

Got a d ftp-server response when 220 was expected

%sAuthorization: Basic %s

%s:%s

Server auth using %s with user '%s'

Proxy auth using %s with user '%s'

Failed sending HTTP POST request

Content-Type: application/x-www-form-urlencoded

Internal HTTP POST error!

Failed sending HTTP request

If-Unmodified-Since: %s

Last-Modified: %s

If-Modified-Since: %s

%s, d %s M d:d:d GMT

%s%s=%s

%s %s%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

Content-Range: bytes %s/%lld

Content-Range: bytes %s%lld/%lld

Range: bytes=%s

;type=%c

ftps://

ftp://

Host: %s%s%s:%d

Host: %s%s%s

Accept-Encoding: %s

Referer: %s

Received HTTP code %d from proxy after CONNECT

%d bytes of chunk left

HTTP/1.%d %d

Read %d bytes of chunk, continue

CONNECT %s:%d HTTP/1.0

%s%s%s%s

Host: %s

Establish HTTP proxy tunnel to %s:%d

Internal error removing splay node = %d

Internal error clearing splay node = %d

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

Failed to resolve "%s" for SOCKS4 connect.

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

SOCKS5 GSSAPI per-message authentication is not supported.

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Failed to resolve "%s" for SOCKS5 connect.

User was rejected by the SOCKS5 server (%d %d).

SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]

--:--:--

= %s = %s = %s %s %s %s %s %s %s

password

login

Operation too slow. Less than %d bytes/sec transfered the last %d seconds

%s, algorithm="%s"

%s, opaque="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"

%s:%s:x:%s:%s:%s

%s:%s:%s

%5[^=]=23[^

%5[^=]="23[^"]"

d:d:d

Error in the SSH layer

Caller must register CURLOPT_CONV_ callback options

TFTP: No such user

TFTP: Unknown transfer ID

TFTP: Illegal operation

TFTP: Access Violation

TFTP: File Not Found

Login denied

Issuer check against peer certificate failed

Invalid LDAP URL

Unrecognized HTTP Content-Encoding

Problem with the SSL CA cert (path? access rights?)

Peer certificate cannot be authenticated with known CA certificates

Problem with the local SSL certificate

SSL peer certificate or SSH md5 fingerprint was not OK

A libcurl function was given a bad argument

Operation was aborted by an application callback

FTP: command REST failed

FTP: command PORT failed

HTTP response code said error

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't set file type

FTP: can't figure out the host in the PASV response

FTP: unknown 227 response format

FTP: unknown PASV reply

FTP: unknown PASS reply

FTP: weird server reply

URL using bad/illegal format or missing URL

Unsupported protocol

Winsock version not supported

Protocol family not supported

Address family not supported

Operation not supported

Socket is unsupported

Protocol is unsupported

Protocol option is unsupported

Unknown error %d (%#x)

%c%c==

%c%c%c=

.html

.jpeg

--%s--

Content-Type: %s

; filename="%s"

Content-Disposition: attachment; filename="%s"

Content-Type: multipart/mixed, boundary=%s

%s; boundary=%s

()$^.* ?[]|\-{},:=!

:/-_.!~*'()

xxxxx

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

GetProcessWindowStation

portuguese-brazilian

operator

()$^.* ?[]|\-{},:=!

Kernel32.DLL

invalid map key

User-Agent: %s

http/

NOINT_MSG

urls_to_restore_on_startup

startup_urls

search_url

keyword

zcÁ

.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@

.?AV?$TSpecificFunctor@VWindowsAPI@@@@

.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@

.?AVChromeBrowserHandler@Browser@Lib@Softonic@@

.?AVWindowsAPI@@

.?AUDWebBrowserEvents2@@

.?AUIHttpNegotiate@@

.?AVCustomIHttpNegotiate@@

.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@

.?AVCurlMultiDownloadJob@@

c:\%original file name%.exe

GetCPInfo

GetProcessHeap

PeekNamedPipe

RegCloseKey

RegEnumKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegDeleteKeyW

RegQueryInfoKeyW

ShellExecuteW

ShellExecuteExW

URLDownloadToFileW

UrlMkGetSessionOption

UrlMkSetSessionOption

GetAsyncKeyState

GetKeyState

EnumChildWindows

EnumDesktopWindows

InternetOpenUrlA

.text

`.rdata

@.data

.rsrc

Universal Downloader Download Helper.

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

GDI32.dll

gdiplus.dll

IPHLPAPI.DLL

ole32.dll

OLEAUT32.dll

PSAPI.DLL

RPCRT4.dll

SHELL32.dll

SHLWAPI.dll

urlmon.dll

USER32.dll

VERSION.dll

WININET.dll

WLDAP32.dll

WSOCK32.dll

[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]http://remo-repair-word.sd.en.softonic.com/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]No Internet connection detected[ENDVALUE][KEY]NOINT_MSG[VALUE]Softonic Downloader needs an internet connection to function. Please connect and try again.[ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]START_HIDDEN[VALUE]true[ENDVALUE][KEY]LOADING_DIALOG_TEXT[VALUE]Please wait...[ENDVALUE][KEY]LOADING_DIALOG_TITLE[VALUE]Download and installation process for Remo Repair Word[ENDVALUE][KEY]MIN_BUTTON_SIZE_X[VALUE]18[ENDVALUE][KEY]MIN_BUTTON_SIZE_Y[VALUE]17[ENDVALUE][KEY]MIN_PROGRAM_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRAM_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_X[VALUE]222[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_Y[VALUE]20[END?[

SHELL32.DLL

ShellExecuteA

%original file name%.exe

http://althawry.org/images/xs.jpg

http://www.careerdesk.org/images/xs.jpg

http://arthur.niria.biz/xs.jpg

http://amsamex.com/xs.jpg

http://apple-pie.in/images/xs.jpg

http://ahmediye.net/xs.jpg

http://g2.arrowhitech.com/xs.jpg

http://ampyazilim.com.tr/images/xs2.jpg

sso.com.br/s.jpg

http://karakurtltd.com/img/xs.jpg

http://www.jvmonline.com/s.jpg

http://alicanhotel.com/images/logof.gif

http://limkokwing-tomorrow.org/images/s.jpg

http://68.168.222.206/logos.gif

http://academicoverseas.net/images/xs2.jpg

8.222.206/logos.gif

uCo9%f

%F`;O

http://89.11

.info/home.gifI

W.text

L32.dll

^p.At%

rnl.exe?

= =$=(=,=0=4=8=<=@

rv:1.9.2.3)

.NEtCLR

.klkjw:9fqwiBu

f3a.sysB

D6c.pBTab

drfig%s:*:

0}.T&?%x=

~UrlA'W

\'Web%

HTTP)s'PJ

o.ENHCD

KPCKwWEBWUPD

>*?456789:;<=

!"#$%&'()* ,-./01230 0

MSVCRT.dll

WS2_32.dll

SHFileOperationA

G[%s] %s

[%d][%s|%s][%s][%s]

[%d][%s|%s][%s][%s][%s]

Glog.txt

GKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

mscoree.dll

WUSER32.DLL

.temp

Kd-d-d

[%d] [%lld|%lld]

1.41.0

Got Elevation URL. [%s]

New URL was not valid.

gReceived message %s

xxxxxxxxxxx

explorer.exe "

[%d %d]

Gchrome

firefox

0.0.0.0

Web View

Web Host

%d|%d|%d

errorUrl

%s(%s)

%s --> (%s)

.swf?

.jpg?

.gif?

.png?

Value: %d

%s\*.*

%s\%s

Proxy by URL are not supported.

Automatic proxy discovery are not supported.

http=

https=

Cftp://

- URL:

[%d] Starting thread...

[%d] Thread Creation OK!

[%d] Error creating thread! trying again...

[%d] Thread started...

Ahttp/

%d - [%d][%lld/%lld][%lld]

Software\Classes\http\shell\open\command\

http\shell\open\command\

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\

chrome.exe

iexplore.exe

firefox.exe

opera.exe

opera

safari.ex

browser.startup.homepage

browser.search.order.1

browser.search.order.2

browser.search.order.3

prefs.js

\"(.)*.;

browser.search.selectedEngine

browser.search.defaultenginename

browser.search.useDBForOrder

user_pref("browser.search.useDBForOrder", "false");

browser.search.useDBForOrder", "false");

browser.search.useDBForOrder.*

%s*.*

Software\Mozilla\Mozilla Firefox\

\Google\Chrome

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

PathToExe

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

\search-metadata.json

json_value.cpp

ljson_reader.cpp

log.txt

Assertion failed: %s, file %s, line %d

Yx7^ycreyrc7txyyrtc~xy7srcrtcrs

EXXCKDrtbe~cnTrycre%DR[RTC7=7QEXZ7Vyc~A~ebdGexsbtcS~dg{vnYvzr

Reexe7Xgry~yp7Q~{r5

ervs7c~zrxbc7srcrtcrs67S~dvu{~yp7`xe|re9@xe|reZvyvpre--ErVdd~py@xe|re

@Z-@CD?>-7@xe|re72s7dcxggrs7sbr7tvytr{7?qv~{d-72s>Xare{vg7srcrtcrs9

@Z--ST?>-7Reexe7`e~c~yp7cx7q~{r97L2{{sk2{{sJ@xe|re7L2sJ7q~y~d

@xe|reZvyvpre--D~mr_rvsreTv{{uvt|SrubpTZS]--D?>-7Sx`y{xvs7Reexe9@xe|reZvyvpre--_rvsreTv{{uvt|SrubpbsSx`y{xvs9czg@xe|reZvyvpre--D~mr_rvsreTv{{uvt|

Tbe{Zb{c~Sx`y{xvs]xu@~y$%Sx`y{xvs]xu7L2sJ

TZS]--D?>-7Prc7Q~{r7D~mr@$%S]--PQD?>-7Gvevzrcre7reexe

LTZS]--PED?>J7D~mr7\X-7BE[7ReexeLTZS]--PED?>J7D~mr7\X-7By|yx`y7reexeTZS]--D?>-7Reexe7xucvy~yp7q~{r7d~mr

rs7Raryc999@$%S]--DPD?>-7Erdb{c-72{{sTZS]--D?>-7Sx`y{xvs7Tvytr{{rs7un7zvo7txydrtbc~ar7txyyrtc~xyd9

@$%S]--PQD?>-7Sxyr-72{{s;72s@$%S]--D?>-7Dcvec

Sx`y{xvs7Tvytr{{rs7un7zvo7txydrtbc~ar7txyyrtc~xyd9@~y$%Sx`y{xvs]xu--Dcvec?>

rs7L2{{sJ9Sx`y{xvs~yp7L2dJ7cx7L2dJKyTbe{Zb{c~Sx`y{xvs]xu--Sx`y{xvsGvbdrs@$%S]--PQD?>-7Prcc~yp7q~{r7D~mr

@$%S]--PQD?>-7QCG7Yxc7dbggxecrs

@$%S]--DPD?>-7Dcvec

@$%S]--D?>-7Q~{r7D~mr7Tvt

@$%S]--D?>-7PrcQ~{rD~mr7erdb{c-72{{s;72s;72s@$%S]--D?>-7\X;7Bydbggxecrs7gexcxtx{Greqxez~yp7^ycreyrcXgry

@$%S]--D?>-7Dcrg7&@$%S]--D?>-7Dcrg7%^ycreyrcXgryBe{V@$%S]--D?>-7Q~{r7Tervc~xy7Reexe

Reexe7`e~cc~yp7cx7q~{r@$%S]--D?>-7Sx`y{xvs7X\9

@$%S]--D?>-7Sx`y{xvs7reexe;7txyyrtc~xy7{xdc9@$%S]--D?>-7Sx`y{xvs7reexe;7be{7yxc7qxbys9@$%S]--D?>-7Sx`y{xvs7tvytr{{rs9

@$%S]--D?>-7Sx`y{xvs7gvbdrs9Vss~yp7]xu7`~c

@$%S]--D?>-7Sx`y{xvs7reexe;7BE[7yxc7qxbys7?%>9Sx`y{xvsZvyvpre--Sx`y{xvsReexe@$%S]--D?>-7Sx`y{xvs7reexe;7^ycreyrc7xgry7reexe9Tbdcxz^_ccgYrpxc~vcr--XyErdgxydrSx`y{xvsZvyvpre

7reexe7?2s>

7reexe7?2s>5Dg{vd

Srcrtc~yp7Gexon7Drcc~ypd9995Kdsr{raBE[9czg@~ysx`dBc~{d--Prc^RGexonDrcc~ypd@~ysx`dBc~{d--XgryBE[XySrqvb{cUex`dre

Srcrtcrs7S^DG^SHYR@@^YSX@$Rotrgc~xy7~y7S^DG^SHYR@@^YSX@$S^DG^SHURQXERYVA^PVCR%7qexz7xbcd~sr7zv~y7c

S^DG^SHURQXERYVA^PVCR%-7Yva~pvc~yp7cx-`vXyS~ecnRo~cSrcrtcrs

^d7vy7^QEVZR;7xz~c~yp7XySxtbzrycTxzg{rcrS^DG^SHSXTBZRYCTXZG[RCR-druHrocreyv{HtxycrycS^DG^SHYVA^PVCRREEXE7~y-Raryc_vys{re--Ryvu{rT{~t|C~zr[vgdr]D::)T<<]D::)T<
@~y$%Uex`dreA~r`@~y$%Uex`dreA~r`--Erp~dcreVG^
?ree>7l7ercbey70Reexe-707<7ree,7j7j 8dte~gc)@~y$%Uex`dreA~r`--Tv{{]Dte~gc
@~y$%Uex`dreA~r`--TervcrRzurssrsUex`dre
ervs7srcrtcrsT<<:)]vavDte~gc
`vDrcAv{br`vPrcAv{br`vPrcErtxzzrysvu{rd
`vRyvu{rSxtbzrycTxzg{rcr`vRyvu{rGveryc[~y|UvyyreGexcrtc~xy`vR{ravcrGrez~dd~xyd`vPrcSrqvb{cUex`dreRo
LRys[xpJReexe7txsr-72srog{xere9ror8dr{rtc;75L2ZVT_^YRH^S2J
Uex`dreTxycex{--]vavDte~gcReexe
Reexe9`vXySx`y{xvsQ~y~d
rs`vXySx`y{xvsReexe
Erdb{c`vXy]vavDte~gcReexe
Reexe
Reexe7?txsr7%>Reexe7?txsr7$>^y~cRevd~yp7t}veT{rvy7Ro~cKds}veq~{r9cocYx7^ycreyrc7txyyrtc~xy7srcrtcrs
vys{rs7Reexe7xy7Zdp-7'o2o@~y$%Zv~yQxez--SxtbzrycTxzg{rcr
BB^SGexp~s^ydcv{{7gextrdd7qv~{rs97Reexe7txsr-72sKy'''''''':'''':'''':'''':'''''''''''$crzg9czgDxqc`verKZ~texdxqcK@~ysx`dKD
LRys[xpJReexe7txsr-72sDxqc`verKZ~texdxqcK^ycreyrc7Rog{xereK
Reexe-7@exyp7ercbey7cngr;7rogrtcrs7dce~yp9@~ysx`dBc~{d--EbyVgg{~tvc~xyzd~rort9ror78~75Ebyy~yp7L2dJ7`~c
@~ysx`dBc~{d--Prc^RGexonDrcc~ypdSrcrtc~yp7Gexon7Drcc~ypd9995@~ysx`dBc~{d--XgryBE[XySrqvb{cUex`dre
cebr`vXySxtbzrycTxzg{rcr`vXyS~ecnRo~cSrcrtcrs
?ree>7l7ercbey70Reexe-707<7ree,7j7j 8dte~gc)@~y$%Uex`dreA~r`@~y$%Uex`dreA~r`--Erp~dcreVG^
@~y$%Uex`dreA~r`--Tv{{]Dte~gc
Srcrtcrs7S^DG^SHYR@@^YSX@$Rotrgc~xy7~y7S^DG^SHYR@@^YSX@$Tbe{Bc~{d--Txyq~pberGexon
^d7vy7^QEVZR;7xz~c~yp7XySxtbzrycTxzg{rcrS^DG^SHSXTBZRYCTXZG[RCR-druHrocreyv{HtxycrycS^DG^SHYVA^PVCRREEXE7~y-Raryc_vys{re--Ryvu{rT{~t|C~zr[vgdrL2sJ7Urp~yy~yp7sx`y{xvs999Vgg{n~yp7gexon7drcc~ypd999L2dJL2sJTbe{Sx`y{xvs]xu--EbyQ~y~d
LTZS]--PED?>J7D~mr7\X-7BE[7ReexeLTZS]--PED?>J7D~mr7\X-7By|yx`y7reexeTZS]--D?>-7Prc7Q~{r7D~mrTZS]--D?>-7Reexe7xucvy~yp7q~{r7d~mr
TZS]--D?>-7Sx`y{xvs7Reexe9Sx`y{xvs7Tvytr{{rs7un7zvo7txydrtbc~ar7txyyrtc~xyd9bsSx`y{xvs9czgTZS]--D?>-7Sx`y{xvs7Tvytr{{rs7un7bdre9Sx`y{xvs7Tvytr{{rs7un7bdre9
EXXCKDrtbe~cnTrycre%SECvpZvyvpre--@evgQ~{rDxzrxyr7s~s7c
]D::)T<<@~y$%Sx`y{xvs]xu7L2sJ
r7q~{r6@$%S]--PQD?>-7Gvevzrcre7reexe
Q~{r7v{ervsn7xgry97@v~c~yp72s7zd@$%S]--PQD?>-7Prcc~yp7q~{r7D~mr
@$%S]--PQD?>-7Sxyr-72{{s;72scrzg9czg@$%S]--DPD?>-7Dcvec
@$%S]--DPD?>-7Erdb{c-72{{s@$%S]--D?>-7Dcvec
@~y$%Sx`y{xvs]xu--Dcvec?>
Xucv~y~yp7Q~{rD~mr@$%S]--D?>-7Q~{r7D~mr7Tvt
@$%S]--D?>-7PrcQ~{rD~mr7erdb{c-72{{s;72s;72s@$%S]--D?>-7\X;7Bydbggxecrs7gexcxtx{Sx`y{xvs~yp7L2dJ7cx7L2dJKyGreqxez~yp7^ycreyrcXgry
Reexe7`e~cc~yp7cx7q~{r@$%S]--D?>-7Sx`y{xvs7X\9@$%S]--D?>-7Sx`y{xvs7reexe;7txyyrtc~xy7{xdc9@$%S]--D?>-7Sx`y{xvs7reexe;7be{7yxc7qxbys9@$%S]--D?>-7Sx`y{xvs7tvytr{{rs9
@$%S]--D?>-7Sx`y{xvs7reexe;7BE[7yxc7qxbys7?%>9Sx`y{xvsZvyvpre--Sx`y{xvsReexe@$%S]--D?>-7Sx`y{xvs7reexe;7^ycreyrc7xgry7reexe9Sx`y{xvsZvyvpre
DqcDS[xt|@~yDcvysves7rortbc~xy7X\5Reexe-7@exyp7ercbey7cngr;7rogrtcrs7dce~yp9
Reexe7?txsr7$>^y~cRevd~yp7t}veT{rvy7Ro~cKds}veq~{r9coc:v{{x`]D^y}rtc~xy
1.41.0.0
SoftonicDownloader.exe

%original file name%.exe_412_rwx_00401000_000EE000:


PSSSSSSh
PSSSSh
F><.tN<[tJ<\tF<*tB<|t><^t:<$t6
II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH
88888888888888888
%u$Vj%
t.Gj:W
SSh,wK
xSSSh
FTPjKS
FtPj;S
C.PjRV
%s:%d
WARNING: failed to save cookies in %s
About to connect() to %s%s port %d (#%d)
Connected to %s (%s) port %d (#%d)
 malformed
:]://%[^
[^:]:%[^
Protocol %s not supported or disabled in libcurl
http_proxy
%5[^:@]:%5[^@]
%5[^:]:%5[^
:%5[^@]
Port number too large: %lu
%s://%s%s%s:%d%s%s
ftps
[%*39[0123456789abcdefABCDEF:.%]%c
Couldn't find host %s in the _netrc file; using defaults
[email protected]
Couldn't resolve host '%s'
Couldn't resolve proxy '%s'
Connection #%d seems to be dead!
Connection (#%d) was killed to make room (holds %d)
Re-using existing connection! (#%ld) with host %s
%s://%s
Connection #%ld to host %s left intact
operation aborted by callback
HTTP/
ioctl callback returned error %d
the ioctl callback returned %d
seek callback returned error %d
The requested URL returned error: %d
HTTP/1.0 connection set to keep alive!
HTTP/1.1 proxy connection set close!
HTTP/1.0 proxy connection set to keep alive!
HTTP 1.0, assume close after body
HTTP =
HTTP/%d.%d =
No URL set!
[^?&/:]://%c
Violate RFC 2616/10.3.2 and switch from POST to GET
Disables POST, goes with %s
Issue another request to this URL: '%s'
Maximum (%d) redirects followed
Received problem %d in the chunky parser
HTTP server doesn't seem to support byte ranges. Cannot resume.
Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)
Leftovers after chunking. Rewinding %d bytes
Operation timed out after %ld milliseconds with %lld bytes received
Operation timed out after %ld milliseconds with %lld out of %lld bytes received
unspecified error %d
%s cookie %s="%s" for domain %s, path %s, expire %d
#HttpOnly_
httponly
I99[^;
skipped cookie with bad tailmatch domain: %s
skipped cookie with illegal dotcount domain: %s
23[^;=]=I99[^;
%s%s%s
# Fatal libcurl error
# Netscape HTTP Cookie File
# http://curl.haxx.se/rfc/cookie_spec.html
# This file was generated by libcurl! Edit at your own risk.
[%s %s %s]
Send failure: %s
Failed writing body (%d != %d)
bind failure: %s
Local port: %d
Bind to local port %d failed, trying next
couldn't find my own IP address (%s)
Bind local address to %s
Couldn't bind to '%s'
TCP_NODELAY set
Could not set TCP_NODELAY: %s
Failed to connect to %s: %s
Trying %s...
Resolving host timed out: %s
Could not resolve host: %s; %s
Could not resolve proxy: %s; %s
Could not resolve host: %s
gethostbyname(2) failed for %s:%d; %s
init_resolve_thread() failed for %s; %s
TFTP
set timeouts for state %d; Total %d, retry %d maxtry %d
tftp_rx: giving up waiting for block %d
Received unexpected DATA packet block %d
Timeout waiting for block %d ACK. Retries = %d
tftp_rx: internal error
tftp_tx: giving up waiting for block %d ack
Received ACK for block %d, expecting %d
tftp_tx: internal error
bind() failed; %s
tftp_send_first: internal error
%s%c%s%c
TFTP finished
Can't get the size of %s
Can't open %s for writing
Last-Modified: %s, d %s M d:d:d GMT
Couldn't open file %s
There are more than %d entries
LDAP remote: %s
LDAP local: ldap_simple_bind_s %s
LDAP local: Cannot connect to %s:%d
LDAP local: trying to establish %s connection
LDAP local: %s
LDAP local: LDAP Vendor = %s ; LDAP Version = %d
CLIENT libcurl 7.19.0
MATCH %s %s %s
DEFINE %s %s
insufficient winsock version to support telnet
WSAStartup failed (%d)
%s %d %d
%s %s %d
%s %s %s
%s IAC %d
%s IAC %s
Sending data failed (%d)
%d (unknown)
%s (unsupported)
%s IAC SB
Syntax error in telnet option: %s
Unknown telnet option %s
7[^= ]%*[ =]%5s
USER,%s
%c%c%c%c%s%c%c
%c%s%c%s
7[^,],7s
%c%c%c%c
FreeLibrary(wsock2) failed (%d)
WSACloseEvent failed (%d)
WSACreateEvent failed (%d)
failed to find WSAEnumNetworkEvents function (%d)
failed to find WSAEventSelect function (%d)
failed to find WSACloseEvent function (%d)
failed to find WSACreateEvent function (%d)
failed to load WS2_32.DLL (%d)
WS2_32.DLL
Excessive FTP response line length received, %zd bytes. Stripping
FTP response reading failed
FTP response aborted due to select/poll error: %d
FTP response timeout
Failed FTP upload: 
RETR response: d
Connecting to %s (%s) port %d
Uploading to a URL without a file name!
FTPS not supported!
USER %s
socket(2) failed (%s)
PORT %d,%d,%d,%d,%d,%d
Telling server to connect to %d.%d.%d.%d:%d
Failed to resolve host name %s
getsockname() failed: %s
Connect data stream passively
REST %d
SIZE %s
STOR %s
APPE %s
Bad PASV/EPSV response: d
Can't resolve new host %s:%d
%d.%d.%d.%d
Skips %d.%d.%d.%d for data connection, uses %s instead
%d,%d,%d,%d,%d,%d
%c%c%c%u%c
Failed to do PORT
Got a d response code instead of the assumed 200
RETR %s
ftp server doesn't support SIZE
PBSZ %d
Access denied: d
ACCT %s
PASS %s
ACCT rejected by server: d
QUOT string not accepted: %s
TYPE %c
MDTM %s
ddd d:d:d GMT
dddddd
unsupported MDTM reply format
server did not report OK, got %d
Remembering we are in dir "%s"
CWD %s
Failed to MKD dir: d
MKD %s
QUOT command failed with d
Entry path is '%s'
PROT %c
unsupported parameter to CURLOPT_FTPSSLAUTH: %d
AUTH %s
Got a d ftp-server response when 220 was expected
%sAuthorization: Basic %s
%s:%s
Server auth using %s with user '%s'
Proxy auth using %s with user '%s'
Failed sending HTTP POST request
Content-Type: application/x-www-form-urlencoded
Internal HTTP POST error!
Failed sending HTTP request
If-Unmodified-Since: %s
Last-Modified: %s
If-Modified-Since: %s
%s, d %s M d:d:d GMT
%s%s=%s
%s %s%s HTTP/%s
%s%s%s%s%s%s%s%s%s%s%s
Content-Range: bytes %s/%lld
Content-Range: bytes %s%lld/%lld
Range: bytes=%s
;type=%c
ftps://
ftp://
Host: %s%s%s:%d
Host: %s%s%s
Accept-Encoding: %s
Referer: %s
Received HTTP code %d from proxy after CONNECT
%d bytes of chunk left
HTTP/1.%d %d
Read %d bytes of chunk, continue
CONNECT %s:%d HTTP/1.0
%s%s%s%s
Host: %s
Establish HTTP proxy tunnel to %s:%d
Internal error removing splay node = %d
Internal error clearing splay node = %d
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.
Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.
Failed to resolve "%s" for SOCKS4 connect.
No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)
SOCKS5 GSSAPI per-message authentication is not supported.
Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)
Failed to resolve "%s" for SOCKS5 connect.
User was rejected by the SOCKS5 server (%d %d).
SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]
--:--:--
= %s = %s = %s %s %s %s %s %s %s
password
login
Operation too slow. Less than %d bytes/sec transfered the last %d seconds
%s, algorithm="%s"
%s, opaque="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"
%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"
%s:%s:x:%s:%s:%s
%s:%s:%s
%5[^=]=23[^
%5[^=]="23[^"]"
d:d:d
Error in the SSH layer
Caller must register CURLOPT_CONV_ callback options
TFTP: No such user
TFTP: Unknown transfer ID
TFTP: Illegal operation
TFTP: Access Violation
TFTP: File Not Found
Login denied
Issuer check against peer certificate failed
Invalid LDAP URL
Unrecognized HTTP Content-Encoding
Problem with the SSL CA cert (path? access rights?)
Peer certificate cannot be authenticated with known CA certificates
Problem with the local SSL certificate
SSL peer certificate or SSH md5 fingerprint was not OK
A libcurl function was given a bad argument
Operation was aborted by an application callback
FTP: command REST failed
FTP: command PORT failed
HTTP response code said error
FTP: couldn't retrieve (RETR failed) the specified file
FTP: couldn't set file type
FTP: can't figure out the host in the PASV response
FTP: unknown 227 response format
FTP: unknown PASV reply
FTP: unknown PASS reply
FTP: weird server reply
URL using bad/illegal format or missing URL
Unsupported protocol
Winsock version not supported
Protocol family not supported
Address family not supported
Operation not supported
Socket is unsupported
Protocol is unsupported
Protocol option is unsupported
Unknown error %d (%#x)
%c%c==
%c%c%c=
.html
.jpeg
--%s--
Content-Type: %s
; filename="%s"
Content-Disposition: attachment; filename="%s"
Content-Type: multipart/mixed, boundary=%s
%s; boundary=%s
()$^.* ?[]|\-{},:=!
:/-_.!~*'()
xxxxx
Visual C   CRT: Not enough memory to complete call to strerror.
Broken pipe
Inappropriate I/O control operation
Operation not permitted
GetProcessWindowStation
portuguese-brazilian
operator
()$^.* ?[]|\-{},:=!
Kernel32.DLL
invalid map key
User-Agent: %s
http/
NOINT_MSG
urls_to_restore_on_startup
startup_urls
search_url
keyword
zcÁ
.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@
.?AV?$TSpecificFunctor@VWindowsAPI@@@@
.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@
.?AVChromeBrowserHandler@Browser@Lib@Softonic@@
.?AVWindowsAPI@@
.?AUDWebBrowserEvents2@@
.?AUIHttpNegotiate@@
.?AVCustomIHttpNegotiate@@
.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@
.?AVCurlMultiDownloadJob@@
c:\%original file name%.exe
GetCPInfo
GetProcessHeap
PeekNamedPipe
RegCloseKey
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
ShellExecuteW
ShellExecuteExW
URLDownloadToFileW
UrlMkGetSessionOption
UrlMkSetSessionOption
GetAsyncKeyState
GetKeyState
EnumChildWindows
EnumDesktopWindows
InternetOpenUrlA
.text
`.rdata
@.data
.rsrc
G[%s] %s
[%d][%s|%s][%s][%s]
[%d][%s|%s][%s][%s][%s]
Glog.txt
GKERNEL32.DLL
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
mscoree.dll
WUSER32.DLL
.temp
Kd-d-d
[%d] [%lld|%lld]
1.41.0
Got Elevation URL. [%s]
New URL was not valid.
gReceived message %s
xxxxxxxxxxx
explorer.exe "
[%d %d]
Gchrome
firefox
0.0.0.0
Web View
Web Host
%d|%d|%d
errorUrl
%s(%s)
%s --> (%s)
.swf?
.jpg?
.gif?
.png?
Value: %d
%s\*.*
%s\%s
Proxy by URL are not supported.
Automatic proxy discovery are not supported.
http=
https=
Cftp://
- URL:
[%d] Starting thread...
[%d] Thread Creation OK!
[%d] Error creating thread! trying again...
[%d] Thread started...
Ahttp/
%d - [%d][%lld/%lld][%lld]
Software\Classes\http\shell\open\command\
http\shell\open\command\
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\
Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\
chrome.exe
iexplore.exe
firefox.exe
opera.exe
opera
safari.ex
browser.startup.homepage
browser.search.order.1
browser.search.order.2
browser.search.order.3
prefs.js
\"(.)*.;
browser.search.selectedEngine
browser.search.defaultenginename
browser.search.useDBForOrder
user_pref("browser.search.useDBForOrder", "false");
browser.search.useDBForOrder", "false");
browser.search.useDBForOrder.*
%s*.*
Software\Mozilla\Mozilla Firefox\
\Google\Chrome
SOFTWARE\Mozilla\Mozilla Firefox
SOFTWARE\Mozilla\Mozilla Firefox\
PathToExe
\Mozilla\Firefox\profiles.ini
\Mozilla\Firefox\
\search-metadata.json
json_value.cpp
ljson_reader.cpp
log.txt
Assertion failed: %s, file %s, line %d
Yx7^ycreyrc7txyyrtc~xy7srcrtcrs
EXXCKDrtbe~cnTrycre%DR[RTC7=7QEXZ7Vyc~A~ebdGexsbtcS~dg{vnYvzr
Reexe7Xgry~yp7Q~{r5
ervs7c~zrxbc7srcrtcrs67S~dvu{~yp7`xe|re9@xe|reZvyvpre--ErVdd~py@xe|re
@Z-@CD?>-7@xe|re72s7dcxggrs7sbr7tvytr{7?qv~{d-72s>Xare{vg7srcrtcrs9
@Z--ST?>-7Reexe7`e~c~yp7cx7q~{r97L2{{sk2{{sJ@xe|re7L2sJ7q~y~d
@xe|reZvyvpre--D~mr_rvsreTv{{uvt|SrubpTZS]--D?>-7Sx`y{xvs7Reexe9@xe|reZvyvpre--_rvsreTv{{uvt|SrubpbsSx`y{xvs9czg@xe|reZvyvpre--D~mr_rvsreTv{{uvt|
Tbe{Zb{c~Sx`y{xvs]xu@~y$%Sx`y{xvs]xu7L2sJ
TZS]--D?>-7Prc7Q~{r7D~mr@$%S]--PQD?>-7Gvevzrcre7reexe
LTZS]--PED?>J7D~mr7\X-7BE[7ReexeLTZS]--PED?>J7D~mr7\X-7By|yx`y7reexeTZS]--D?>-7Reexe7xucvy~yp7q~{r7d~mr
rs7Raryc999@$%S]--DPD?>-7Erdb{c-72{{sTZS]--D?>-7Sx`y{xvs7Tvytr{{rs7un7zvo7txydrtbc~ar7txyyrtc~xyd9
@$%S]--PQD?>-7Sxyr-72{{s;72s@$%S]--D?>-7Dcvec
Sx`y{xvs7Tvytr{{rs7un7zvo7txydrtbc~ar7txyyrtc~xyd9@~y$%Sx`y{xvs]xu--Dcvec?>
rs7L2{{sJ9Sx`y{xvs~yp7L2dJ7cx7L2dJKyTbe{Zb{c~Sx`y{xvs]xu--Sx`y{xvsGvbdrs@$%S]--PQD?>-7Prcc~yp7q~{r7D~mr
@$%S]--PQD?>-7QCG7Yxc7dbggxecrs
@$%S]--DPD?>-7Dcvec
@$%S]--D?>-7Q~{r7D~mr7Tvt
@$%S]--D?>-7PrcQ~{rD~mr7erdb{c-72{{s;72s;72s@$%S]--D?>-7\X;7Bydbggxecrs7gexcxtx{Greqxez~yp7^ycreyrcXgry
@$%S]--D?>-7Dcrg7&@$%S]--D?>-7Dcrg7%^ycreyrcXgryBe{V@$%S]--D?>-7Q~{r7Tervc~xy7Reexe
Reexe7`e~cc~yp7cx7q~{r@$%S]--D?>-7Sx`y{xvs7X\9
@$%S]--D?>-7Sx`y{xvs7reexe;7txyyrtc~xy7{xdc9@$%S]--D?>-7Sx`y{xvs7reexe;7be{7yxc7qxbys9@$%S]--D?>-7Sx`y{xvs7tvytr{{rs9
@$%S]--D?>-7Sx`y{xvs7gvbdrs9Vss~yp7]xu7`~c
@$%S]--D?>-7Sx`y{xvs7reexe;7BE[7yxc7qxbys7?%>9Sx`y{xvsZvyvpre--Sx`y{xvsReexe@$%S]--D?>-7Sx`y{xvs7reexe;7^ycreyrc7xgry7reexe9Tbdcxz^_ccgYrpxc~vcr--XyErdgxydrSx`y{xvsZvyvpre
7reexe7?2s>
7reexe7?2s>5Dg{vd
Srcrtc~yp7Gexon7Drcc~ypd9995Kdsr{raBE[9czg@~ysx`dBc~{d--Prc^RGexonDrcc~ypd@~ysx`dBc~{d--XgryBE[XySrqvb{cUex`dre
Srcrtcrs7S^DG^SHYR@@^YSX@$Rotrgc~xy7~y7S^DG^SHYR@@^YSX@$S^DG^SHURQXERYVA^PVCR%7qexz7xbcd~sr7zv~y7c
S^DG^SHURQXERYVA^PVCR%-7Yva~pvc~yp7cx-`vXyS~ecnRo~cSrcrtcrs
^d7vy7^QEVZR;7xz~c~yp7XySxtbzrycTxzg{rcrS^DG^SHSXTBZRYCTXZG[RCR-druHrocreyv{HtxycrycS^DG^SHYVA^PVCRREEXE7~y-Raryc_vys{re--Ryvu{rT{~t|C~zr[vgdr]D::)T<<]D::)T<
@~y$%Uex`dreA~r`@~y$%Uex`dreA~r`--Erp~dcreVG^
?ree>7l7ercbey70Reexe-707<7ree,7j7j 8dte~gc)@~y$%Uex`dreA~r`--Tv{{]Dte~gc
@~y$%Uex`dreA~r`--TervcrRzurssrsUex`dre
ervs7srcrtcrsT<<:)]vavDte~gc
`vDrcAv{br`vPrcAv{br`vPrcErtxzzrysvu{rd
`vRyvu{rSxtbzrycTxzg{rcr`vRyvu{rGveryc[~y|UvyyreGexcrtc~xy`vR{ravcrGrez~dd~xyd`vPrcSrqvb{cUex`dreRo
LRys[xpJReexe7txsr-72srog{xere9ror8dr{rtc;75L2ZVT_^YRH^S2J
Uex`dreTxycex{--]vavDte~gcReexe
Reexe9`vXySx`y{xvsQ~y~d
rs`vXySx`y{xvsReexe
Erdb{c`vXy]vavDte~gcReexe
Reexe
Reexe7?txsr7%>Reexe7?txsr7$>^y~cRevd~yp7t}veT{rvy7Ro~cKds}veq~{r9cocYx7^ycreyrc7txyyrtc~xy7srcrtcrs
vys{rs7Reexe7xy7Zdp-7'o2o@~y$%Zv~yQxez--SxtbzrycTxzg{rcr
BB^SGexp~s^ydcv{{7gextrdd7qv~{rs97Reexe7txsr-72sKy'''''''':'''':'''':'''':'''''''''''$crzg9czgDxqc`verKZ~texdxqcK@~ysx`dKD
LRys[xpJReexe7txsr-72sDxqc`verKZ~texdxqcK^ycreyrc7Rog{xereK
Reexe-7@exyp7ercbey7cngr;7rogrtcrs7dce~yp9@~ysx`dBc~{d--EbyVgg{~tvc~xyzd~rort9ror78~75Ebyy~yp7L2dJ7`~c
@~ysx`dBc~{d--Prc^RGexonDrcc~ypdSrcrtc~yp7Gexon7Drcc~ypd9995@~ysx`dBc~{d--XgryBE[XySrqvb{cUex`dre
cebr`vXySxtbzrycTxzg{rcr`vXyS~ecnRo~cSrcrtcrs
?ree>7l7ercbey70Reexe-707<7ree,7j7j 8dte~gc)@~y$%Uex`dreA~r`@~y$%Uex`dreA~r`--Erp~dcreVG^
@~y$%Uex`dreA~r`--Tv{{]Dte~gc
Srcrtcrs7S^DG^SHYR@@^YSX@$Rotrgc~xy7~y7S^DG^SHYR@@^YSX@$Tbe{Bc~{d--Txyq~pberGexon
^d7vy7^QEVZR;7xz~c~yp7XySxtbzrycTxzg{rcrS^DG^SHSXTBZRYCTXZG[RCR-druHrocreyv{HtxycrycS^DG^SHYVA^PVCRREEXE7~y-Raryc_vys{re--Ryvu{rT{~t|C~zr[vgdrL2sJ7Urp~yy~yp7sx`y{xvs999Vgg{n~yp7gexon7drcc~ypd999L2dJL2sJTbe{Sx`y{xvs]xu--EbyQ~y~d
LTZS]--PED?>J7D~mr7\X-7BE[7ReexeLTZS]--PED?>J7D~mr7\X-7By|yx`y7reexeTZS]--D?>-7Prc7Q~{r7D~mrTZS]--D?>-7Reexe7xucvy~yp7q~{r7d~mr
TZS]--D?>-7Sx`y{xvs7Reexe9Sx`y{xvs7Tvytr{{rs7un7zvo7txydrtbc~ar7txyyrtc~xyd9bsSx`y{xvs9czgTZS]--D?>-7Sx`y{xvs7Tvytr{{rs7un7bdre9Sx`y{xvs7Tvytr{{rs7un7bdre9
EXXCKDrtbe~cnTrycre%SECvpZvyvpre--@evgQ~{rDxzrxyr7s~s7c
]D::)T<<@~y$%Sx`y{xvs]xu7L2sJ
r7q~{r6@$%S]--PQD?>-7Gvevzrcre7reexe
Q~{r7v{ervsn7xgry97@v~c~yp72s7zd@$%S]--PQD?>-7Prcc~yp7q~{r7D~mr
@$%S]--PQD?>-7Sxyr-72{{s;72scrzg9czg@$%S]--DPD?>-7Dcvec
@$%S]--DPD?>-7Erdb{c-72{{s@$%S]--D?>-7Dcvec
@~y$%Sx`y{xvs]xu--Dcvec?>
Xucv~y~yp7Q~{rD~mr@$%S]--D?>-7Q~{r7D~mr7Tvt
@$%S]--D?>-7PrcQ~{rD~mr7erdb{c-72{{s;72s;72s@$%S]--D?>-7\X;7Bydbggxecrs7gexcxtx{Sx`y{xvs~yp7L2dJ7cx7L2dJKyGreqxez~yp7^ycreyrcXgry
Reexe7`e~cc~yp7cx7q~{r@$%S]--D?>-7Sx`y{xvs7X\9@$%S]--D?>-7Sx`y{xvs7reexe;7txyyrtc~xy7{xdc9@$%S]--D?>-7Sx`y{xvs7reexe;7be{7yxc7qxbys9@$%S]--D?>-7Sx`y{xvs7tvytr{{rs9
@$%S]--D?>-7Sx`y{xvs7reexe;7BE[7yxc7qxbys7?%>9Sx`y{xvsZvyvpre--Sx`y{xvsReexe@$%S]--D?>-7Sx`y{xvs7reexe;7^ycreyrc7xgry7reexe9Sx`y{xvsZvyvpre
DqcDS[xt|@~yDcvysves7rortbc~xy7X\5Reexe-7@exyp7ercbey7cngr;7rogrtcrs7dce~yp9
Reexe7?txsr7$>^y~cRevd~yp7t}veT{rvy7Ro~cKds}veq~{r9coc:v{{x`]D^y}rtc~xy

%original file name%.exe_412_rwx_004F3000_00001000:


Universal Downloader Download Helper.
KERNEL32.DLL
ADVAPI32.dll
COMCTL32.dll
GDI32.dll
gdiplus.dll
IPHLPAPI.DLL
ole32.dll
OLEAUT32.dll
PSAPI.DLL
RPCRT4.dll
SHELL32.dll
SHLWAPI.dll
urlmon.dll
USER32.dll
VERSION.dll
WININET.dll
WLDAP32.dll
WSOCK32.dll
URLDownloadToFileW
[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]http://remo-repair-word.sd.en.softonic.com/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]No Internet connection detected[ENDVALUE][KEY]NOINT_MSG[VALUE]Softonic Downloader needs an internet connection to function. Please connect and try again.[ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]START_HIDDEN[VALUE]true[ENDVALUE][KEY]LOADING_DIALOG_TEXT[VALUE]Please wait...[ENDVALUE][KEY]LOADING_DIALOG_TITLE[VALUE]Download and installation process for Remo Repair Word[ENDVALUE][KEY]MIN_BUTTON_SIZE_X[VALUE]18[ENDVALUE][KEY]MIN_BUTTON_SIZE_Y[VALUE]17[ENDVALUE][KEY]MIN_PROGRAM_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRAM_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_X[VALUE]222[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_Y[VALUE]20[END
1.41.0.0
SoftonicDownloader.exe

%original file name%.exe_412_rwx_004F5000_00010000:


SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
%original file name%.exe
.rsrc
c:\%original file name%.exe
http://althawry.org/images/xs.jpg
http://www.careerdesk.org/images/xs.jpg
http://arthur.niria.biz/xs.jpg
http://amsamex.com/xs.jpg
http://apple-pie.in/images/xs.jpg
http://ahmediye.net/xs.jpg
http://g2.arrowhitech.com/xs.jpg
http://ampyazilim.com.tr/images/xs2.jpg
sso.com.br/s.jpg
http://karakurtltd.com/img/xs.jpg
http://www.jvmonline.com/s.jpg
http://alicanhotel.com/images/logof.gif
http://limkokwing-tomorrow.org/images/s.jpg
http://68.168.222.206/logos.gif
http://academicoverseas.net/images/xs2.jpg
8.222.206/logos.gif
uCo9%f
%F`;O
http://89.11
.info/home.gifI
W.text
L32.dll
^p.At%
rnl.exe?
= =$=(=,=0=4=8=<=@
rv:1.9.2.3)
.NEtCLR
.klkjw:9fqwiBu
f3a.sysB
D6c.pBTab
drfig%s:*:
0}.T&?%x=
~UrlA'W
\'Web%
HTTP)s'PJ
o.ENHCD
KPCKwWEBWUPD
>*?456789:;<=
!"#$%&'()* ,-./01230 0
ADVAPI32.dll
MSVCRT.dll
SHELL32.dll
USER32.dll
WS2_32.dll
RegCloseKey
SHFileOperationA

%original file name%.exe_412_rwx_00B10000_0108E000:


c:\windows
http://althawry.org/images/xs.jpg
http://www.careerdesk.org/images/xs.jpg
http://arthur.niria.biz/xs.jpg
http://amsamex.com/xs.jpg
http://apple-pie.in/images/xs.jpg
http://ahmediye.net/xs.jpg
http://g2.arrowhitech.com/xs.jpg
http://ampyazilim.com.tr/images/xs2.jpg
%System%\drivers\hehnnn.sys
13010464916
.rsrc
.text
SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
KERNEL32.dll
USER32.dll
h.rdata
H.data
.reloc
ntoskrnl.exe
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731)
Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Software\Microsoft\Windows\CurrentVersion\Internet Settings
Software\Microsoft\Windows\CurrentVersion
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Software\Microsoft\Windows\CurrentVersion\policies\system
Software\Microsoft\Windows\ShellNoRoam\MUICache
%s:*:Enabled:ipsec
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
GdiPlus.dll
http://
ipfltdrv.sys
www.microsoft.com
?%x=%d
&%x=%d
SYSTEM.INI
USER32.DLL
.%c%s
\\.\amsint32
NTDLL.DLL
autorun.inf
ADVAPI32.DLL
win%s.exe
%s.exe
WININET.DLL
InternetOpenUrlA
avast! Web Scanner
Avira AntiVir Premium WebGuard
cmdGuard
cmdAgent
Eset HTTP Server
ProtoPort Firewall service
SpIDer FS Monitor for Windows NT
Symantec Password Validation
WebrootDesktopFirewallDataService
WebrootFirewall
%d%d.tmp
SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
%s\%s
%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats
Software\Microsoft\Windows\CurrentVersion\Ext\Stats
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
Explorer.exe
A2CMD.
ASHWEBSV.
AVGCC.AVGCHSVX.
DRWEB
DWEBLLIO
DWEBIO
FSGUIEXE.
MCVSSHLD.
NPFMSG.
SYMSPORT.
WEBSCANX.
.adata
M_%d_
%c%d_%d
?456789:;<=
!"#$%&'()* ,-./0123
GetProcessHeap
GetWindowsDirectoryA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyA
RegCloseKey
SHFileOperationA
&3&3&3&389
.rdata
.data
rnl.exe?
= =$=(=,=0=4=8=<=@
rv:1.9.2.3)
.NEtCLR
.klkjw:9fqwiBu
f3a.sysB
D6c.pBTab
drfig%s:*:
0}.T&?%x=
~UrlA'W
\'Web%
HTTP)s'PJ
o.ENHCD
KPCKwWEBWUPD
>*?456789:;<=
!"#$%&'()* ,-./01230 0
ADVAPI32.dll
MSVCRT.dll
SHELL32.dll
WS2_32.dll

%original file name%.exe_412_rwx_023B0000_00002000:


SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.rsrc

Explorer.EXE_1684_rwx_00EE0000_00002000:


SHELL32.DLL
ShellExecuteA
KERNEL32.DLL
.rsrc

%original file name%.exe_412_rwx_024C0000_00001000:


|%original file name%.exeM_412_

Explorer.EXE_1684_rwx_00EF0000_00001000:


|explorer.exeM_1684_

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\f[1].txt (3911 bytes)
   %WinDir%\system.ini (72 bytes)
   C:\aschvw.exe (103 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@softonic[2].txt (1678 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA2VQNYT.gif (35 bytes)
   C:\autorun.inf (241 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].txt (4048 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\nr-411.min[1].js (14 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAKF9BEI.gif (35 bytes)
   %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (6948 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@softonic[1].txt (2273 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\loading[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\blank[1].gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sd_100978_3a9ca[1].jpg (1222 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sd_sprite[1].png (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[1].htm (2241 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pubads_impl_45[1].js (1928 bytes)
   %System%\wbem\Logs\wbemprox.log (152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_100624_634cd[1].jpg (7290 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sd_100624_634cd[1].jpg (4889 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\gradientbg[1].png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[1].txt (1479 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\thumbnail_1379925746-100x100[1].png (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\campaign-100978,100624[1] (2418 bytes)
   %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (7175 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_100978_3a9ca[1].jpg (1226 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CACT65LU.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA2BKXY5.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAIVKF67.gif (35 bytes)
   %Documents and Settings%\%current user%\Cookies\[email protected][1].txt (232 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\96f1f-03266[1].js (11373 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (1336 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\gfgm.exe (741 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAS7IL4F.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fec0e-253a4[1].css (5 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\cc92a7d66e[1].setToken (21 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\cc92a7d66e[1].setToken (21 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\campaign-100978,100624[1].htm (1191 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (26508 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\fec0e-253a4[2].css (21 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\pubads_impl_45[2].js (3154 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_icon_100978_c55d5[1].jpg (829 bytes)
   %Program Files%\Common Files\Java\Java Update\jusched.exe (368 bytes)
   %Documents and Settings%\%current user%\Cookies\[email protected][2].txt (253 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAEFK5UN.gif (35 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.