MD5: f4b257a2d844c24fde4f811d93421a67
SHA1: e66d47752b9ee6c2bf0b79b9541d2cd79b0a7cd0
SHA256: 5f524943ada10e65eba1b0939782fc8fba24de7f009d44e2e8b1fcc3e00a62b2
SSDeep: 12288:FOYWcGakXIWXEQ5XG5iO3WTMASoSbDPlT88/8h:FOYSfIrEXG5iOmTMzlIKO
Size: 441680 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2014-07-23 11:08:19
Analyzed on: WindowsXP ESX SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):
No processes have been created.
The Trojan injects its code into the following process(es):

%original file name%.exe:2764
Explorer.EXE:1948

Mutexes

The following mutexes were created/opened:

c:!documents and settings!adm!local settings!history!history.ie5!mshist012014083020140831!
_!SHMSFTHISTORY!_
c:!documents and settings!adm!ietldcache!
!IETld!Mutex
!PrivacIE!SharedMemory!Mutex
RasPbFile
ZonesLockedCacheCounterMutex
ZoneAttributeCacheCounterMutex
ZonesCacheCounterMutex
ZonesCounterMutex
WininetConnectionMutex
WininetProxyRegistryMutex
WininetStartupMutex
c:!documents and settings!adm!local settings!history!history.ie5!
c:!documents and settings!adm!cookies!
c:!documents and settings!adm!local settings!temporary internet files!content.ie5!
_!MSFTHISTORY!_
ShimCacheMutex
%original file name%.exeM_2764_
wmiprvse.exeM_3704_
vmtoolsd.exeM_3132_
msiexec.exeM_3460_
jqs.exeM_480_
mscorsvw.exeM_424_
svchost.exeM_1096_
lsass.exeM_772_
svchost.exeM_928_
services.exeM_760_
spoolsv.exeM_1432_
winlogon.exeM_716_
csrss.exeM_692_
smss.exeM_644_
CTF.TimListCache.FMPDefaultS-1-5-21-796845957-1563985344-1801674531-1003MUTEX.DefaultS-1-5-21-796845957-1563985344-1801674531-1003
CTF.TMD.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003
CTF.Layouts.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003
CTF.Asm.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003
CTF.Compart.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003
CTF.LBES.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003
uxJLpe1m

File activity

The process %original file name%.exe:2764 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\L7XHTVXM.txt (111 bytes)
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Cookies\R3AX0AR2.txt (381 bytes)
%Documents and Settings%\%current user%\Cookies\H9UHGJ2H.txt (1329 bytes)
%Documents and Settings%\%current user%\Cookies\7Y6M6VWJ.txt (1335 bytes)
%Documents and Settings%\%current user%\Cookies\X90Y86O1.txt (913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\__utm[1].gif (245 bytes)
%Documents and Settings%\%current user%\Cookies\ITAKEHM8.txt (1335 bytes)
%Documents and Settings%\%current user%\Cookies\KIM8SJZ2.txt (1117 bytes)
%Documents and Settings%\%current user%\Cookies\5U98BYKM.txt (1335 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\f[1].txt (23945 bytes)
C:\autorun.inf (226 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\f[2].txt (93111 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\universaldownloader-prefetch[1].txt (11407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\loading[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\306e0-e381f[1].js (185532 bytes)
%Documents and Settings%\%current user%\Cookies\27KDM6JI.txt (709 bytes)
%Documents and Settings%\%current user%\Cookies\HDHM2L44.txt (147 bytes)
%Documents and Settings%\%current user%\Cookies\6Q7GUTIV.txt (1335 bytes)
%Documents and Settings%\%current user%\Cookies\LYY5Y7T1.txt (1335 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014083020140831\index.dat (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winqqjtl.exe (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\sd_101196_6142a[1].png (7322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\upgrade_flash_player2[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\sprite[1].png (7 bytes)
%Documents and Settings%\%current user%\Cookies\N13MPC7I.txt (1333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\gradientbg[1].png (2 bytes)
%Documents and Settings%\%current user%\Cookies\XB45OPSG.txt (1329 bytes)
%Documents and Settings%\%current user%\Cookies\P9CICZCB.txt (1333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\universaldownloader-track[1] (15 bytes)
C:\mljl.exe (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\sd_101294_ba965[1].png (842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\pubads_impl_47[1].js (60324 bytes)
%Documents and Settings%\%current user%\Cookies\9K25HFON.txt (709 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\2XXGE86N.txt (122 bytes)
%Documents and Settings%\%current user%\Cookies\21B7UTWC.txt (1335 bytes)
%Documents and Settings%\%current user%\Cookies\S0G8HX3Z.txt (1335 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\the-sims-2-41[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\campaign-101294,101196[1].txt (6570 bytes)
%System%\wbem\Logs\wbemprox.log (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (368 bytes)
%Documents and Settings%\%current user%\Cookies\PLFCBD6K.txt (1335 bytes)
%Documents and Settings%\%current user%\Cookies\66LWUU6U.txt (1335 bytes)
%Documents and Settings%\%current user%\Cookies\LP53XZEY.txt (1333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\fad58-b3118[1].css (13495 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\L7XHTVXM.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041520130416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\R3AX0AR2.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013040820130415 (0 bytes)
%Documents and Settings%\%current user%\Cookies\H9UHGJ2H.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\7Y6M6VWJ.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\X90Y86O1.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\__utm[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\ITAKEHM8.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\KIM8SJZ2.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\universaldownloader-prefetch[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\9K25HFON.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\HDHM2L44.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\6Q7GUTIV.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winqqjtl.exe (0 bytes)
%Documents and Settings%\%current user%\Cookies\LYY5Y7T1.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\N13MPC7I.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\27KDM6JI.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\XB45OPSG.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\P9CICZCB.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\universaldownloader-track[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\66LWUU6U.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\5U98BYKM.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\21B7UTWC.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041520130416 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013040820130415\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\PLFCBD6K.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\LP53XZEY.txt (0 bytes)

Registry activity

The process %original file name%.exe:2764 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a1_0" = "2245020606"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014083020140831]
"CachePrefix" = ":2014083020140831:"

[HKCU\Software\Aas\695404737]
"35845605" = "346"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas\695404737]
"50183847" = "5B68D29F5F257E60B647DC1827F5438DD92AAD1B81B3A1C6102C99131826B86429DC47A17661558ABD0B88DDDBFC8C493E11520205E0DD6E2B190FFE1E602DF47196BE3B95B876A40411FD1F49281AEC0373FF8649D483A9275B5B5EFC9412D9E9102DCB8E7DB7C56D7F098531F57995DF6F48E78C56E274F6496D19EFFCB523"
"43014726" = "0900687474703A2F2F676C616D66726F6D656173742E636F6D2F696D6167652F6C6F676F2E67696600687474703A2F2F656469726E656C692E6E65742F74722F6C6F676F2E67696600687474703A2F2F656D7261686B7563756B6B617064616E2E636F6D2F696D672F627574746F6E2E67696600687474703A2F2F676172646170616C6163652E69742F6C6F676F2E67696600687474703A2F2F686964726F7365727662697374726974612E726F2F696D616765732F6C6F676F2E67696600687474703A2F2F6261627973746F70686F7573652E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6D616264657369676E2E756E6C756761722E636F6D2F627574746F6E2E67696600687474703A2F2F646174616C696E6B736F6C2E636F6D2F6C6F676F2E67696600687474703A2F2F736E736F66742E686F73742D65642E6D652F696D616765732F6C6F676F732E676966"

[HKCU\Software\Aas]
"a3_0" = "17001001"
"a3_1" = "23989832"
"a1_1" = "4177335868"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Softonic\Universal Downloader]
"uuid" = "291514EA-E968-44B6-A174-BDA245756B30"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas\695404737]
"7169121" = "215"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas\695404737]
"21507363" = "0"
"28676484" = "35"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014083020140831]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014083020140831]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014083020140831"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 20 18 15 6D A1 18 8A 58 89 7C 89 4E DB 3F BA"

[HKCU\Software\Aas]
"a2_1" = "7175682"
"a2_0" = "8341"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_1" = "7169121"
"a4_0" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014083020140831]
"CacheRepair" = "0"
"CacheLimit" = "8192"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013041520130416]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013040820130415]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

VersionInfo

Company Name: Softonic
Product Name: Softonic Downloader
Product Version: 1.41.3.7
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: SoftonicDownloader.exe
Internal Name: SoftonicDownloader.exe
File Version: 1.41.3.7
File Description: Softonic Downloader
Comments:
Language: English (United States)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://46.28.209.70/js/generated/306e0-e381f.js
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=1&utmn=314903792&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=installation assistant&utmhid=1363439720&utmr=-&utmp=/36136/universaldownloader-prefetch&utmht=1409347129492&utmac=UA-48247475-1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://46.28.209.74/blank.gif?product=st_session&event=prefetch:session:create&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&ab_test=&download_date=1409347111&execution_date=1409347129805&client_timezone=3&api_version=1.41.3&id_machine=d8cc41db000000000000000c293bdf2f&id_user=291514EA-E968-44B6-A174-BDA245756B30&os=WindowsXP&default_browser=unknown&default_browser_version=0.0.0.0&default_browser_language=en&default_browser_used=0&default_browser_search_provider=&default_browser_homepage=&id_cob=200&id_file=36136&id_section=352&id_main_section=245
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=camp_rpm&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101366&default_rpm=1214&campaign_id=101296&default_rpm=5700&campaign_id=101294&default_rpm=6488&campaign_id=101197&default_rpm=5180&campaign_id=101196&default_rpm=6299&campaign_id=101068&default_rpm=4876&campaign_id=100733&default_rpm=9879&campaign_id=100624&default_rpm=2506&campaign_id=100516&default_rpm=1207&campaign_id=33482&default_rpm=1778&campaign_id=33121&default_rpm=1&campaign_id=101112&default_rpm=409&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&excluded=0&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&excluded=0&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1259&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-2&sc_type=ns&met=true&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1124&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1155&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1284&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1239&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1132&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1131&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1130&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=682&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=681&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=680&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=1281&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=1145&sc_type=ns&met=false&sd_flag=1
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=2&utmn=1782449156&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmt=event&utme=5(js_error*SDCaughtError*A not tracked http connection ID has triggered the callback - no error provided)&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=installation assistant&utmhid=1363439720&utmr=-&utmp=/36136/universaldownloader-prefetch&utmht=1409347130805&utmac=UA-48247475-1&utmni=1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=6AAgAAAAC~
hxxp://46.28.209.70/universaldownloader-track
hxxp://46.28.209.74/blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&id_campaign=101294&id_campaign=101196
hxxp://46.28.209.70/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129
hxxp://46.28.209.70/css/generated/fad58-b3118.css
hxxp://46.28.209.70/shared/img/sd_client/gradientbg.png
hxxp://screenshots.en.sftcdn.net/campaign/scrn/101000/101294/sd_101294_ba965.png	46.28.209.52
hxxp://screenshots.en.sftcdn.net/en/scrn/36000/36136/the-sims-2-41.jpg	46.28.209.52
hxxp://46.28.209.70/shared/img/sd_client/sprite.png
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://46.28.209.70/shared/img/sd_client/loading.gif
hxxp://screenshots.en.sftcdn.net/campaign/scrn/101000/101196/sd_101196_6142a.png	46.28.209.52
hxxp://pagead46.l.doubleclick.net/pagead/show_companion_ad.js
hxxp://pagead46.l.doubleclick.net/gpt/pubads_impl_47.js
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=3&utmn=1080540854&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=-&utmp=/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129&utmht=1409347133555&utmac=UA-48247475-1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=4&utmn=2116663174&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1409347133758&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=5&utmn=2044095020&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1409347133789&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=6&utmn=18490721&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1409347133852&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=7&utmn=1900154913&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1409347133883&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=8&utmn=1728605849&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/C101294--load1&utmht=1409347133930&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=9&utmn=731848023&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/C101196--load2&utmht=1409347133977&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://a1467.g.akamai.net/viewer/upgrade_flash_player2.gif
hxxp://softonic-analytics.net/blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&id_campaign=101294&id_campaign=101196
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1284&sc_type=ns&met=false&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=3&utmn=1080540854&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=-&utmp=/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129&utmht=1409347133555&utmac=UA-48247475-1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~	173.194.43.32
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=6&utmn=18490721&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1409347133852&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.43.32
hxxp://the-sims-2-trailer.sd.en.softonic.com/universaldownloader-track
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1131&sc_type=ns&met=false&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=8&utmn=1728605849&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/C101294--load1&utmht=1409347133930&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.43.32
hxxp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=1145&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-2&sc_type=ns&met=true&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=681&sc_type=ns&met=false&sd_flag=1
hxxp://static.sd-client.en.softonic.com/css/generated/fad58-b3118.css
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_rpm&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101366&default_rpm=1214&campaign_id=101296&default_rpm=5700&campaign_id=101294&default_rpm=6488&campaign_id=101197&default_rpm=5180&campaign_id=101196&default_rpm=6299&campaign_id=101068&default_rpm=4876&campaign_id=100733&default_rpm=9879&campaign_id=100624&default_rpm=2506&campaign_id=100516&default_rpm=1207&campaign_id=33482&default_rpm=1778&campaign_id=33121&default_rpm=1&campaign_id=101112&default_rpm=409&sd_flag=1
hxxp://admin.brightcove.com/viewer/upgrade_flash_player2.gif	67.132.183.56
hxxp://static.sd-client.en.softonic.com/js/generated/306e0-e381f.js
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=680&sc_type=ns&met=false&sd_flag=1
hxxp://static.sd-client.en.softonic.com/shared/img/sd_client/gradientbg.png
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&excluded=0&sd_flag=1
hxxp://static.sd-client.en.softonic.com/shared/img/sd_client/loading.gif
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=5&utmn=2044095020&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1409347133789&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.43.32
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1239&sc_type=ns&met=false&sd_flag=1
hxxp://static.sd-client.en.softonic.com/shared/img/sd_client/sprite.png
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=1&utmn=314903792&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=installation assistant&utmhid=1363439720&utmr=-&utmp=/36136/universaldownloader-prefetch&utmht=1409347129492&utmac=UA-48247475-1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~	173.194.43.32
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1259&sc_type=ns&met=false&sd_flag=1
hxxp://pagead2.googlesyndication.com/pagead/show_companion_ad.js	173.194.43.58
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1130&sc_type=ns&met=false&sd_flag=1
hxxp://www.googletagservices.com/tag/js/gpt.js	173.194.43.58
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1132&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1155&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_session&event=prefetch:session:create&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&ab_test=&download_date=1409347111&execution_date=1409347129805&client_timezone=3&api_version=1.41.3&id_machine=d8cc41db000000000000000c293bdf2f&id_user=291514EA-E968-44B6-A174-BDA245756B30&os=WindowsXP&default_browser=unknown&default_browser_version=0.0.0.0&default_browser_language=en&default_browser_used=0&default_browser_search_provider=&default_browser_homepage=&id_cob=200&id_file=36136&id_section=352&id_main_section=245
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=1281&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=7&utmn=1900154913&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1409347133883&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.43.32
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://partner.googleadservices.com/gpt/pubads_impl_47.js	173.194.43.58
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=682&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1124&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&excluded=0&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=2&utmn=1782449156&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmt=event&utme=5(js_error*SDCaughtError*A not tracked http connection ID has triggered the callback - no error provided)&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=installation assistant&utmhid=1363439720&utmr=-&utmp=/36136/universaldownloader-prefetch&utmht=1409347130805&utmac=UA-48247475-1&utmni=1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=6AAgAAAAC~	173.194.43.32
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=9&utmn=731848023&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/C101196--load2&utmht=1409347133977&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.43.32
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=4&utmn=2116663174&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1409347133758&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.43.32

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /viewer/upgrade_flash_player2.gif HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: admin.brightcove.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

ETag: "f523ab9a498518867f12ca24f39ed087:1354824905"

Last-Modified: Thu, 06 Dec 2012 20:11:57 GMT

Accept-Ranges: bytes

Content-Length: 14202

Content-Type: image/gif

Cache-Control: max-age=1200

Date: Sat, 30 Aug 2014 02:19:16 GMT

Connection: keep-alive
GIF89a:............rz}KKL..................() 568LMO...>@C......cgk
MPS246......rvz\_bilo.....................xz|...............{|}.......
....................................................................VZ
]......fjm............................................................
..................|[email protected]]_.............
.........................................kmn..........................
.[_`.........oww......>??......WXX.................................
[email protected] .Y0.fA.uS..a..q........................_..q..f..Y..k..{..t
............................................................44.--.)).5
4.PP.FF.ff.UU.MM.xx.nn................................................
...................................................zzzsssqqqllldddcccX
XXTTTJJJ<<<333...!.......,....:[email protected]......*\......#J.H.
....'....... C..I....(S.\.....0cvT([email protected].*]zS...P.J.
j..SM..D.g.@'[email protected]= 6R'MP.B...o'{...5 ....k..p.)...."
Y=...X.O.........C..M.....? D......c..M...GG,...........N.....W(_.....
..K.N......k........ ..D......._..}.U.X.o.*U.............(...)D...&...
.x..*...`)....).&h.'..p.'..(.'.&.......'.....$X.! ..r`........X..@.)..
D.i..H&........PF)..TVi..Xf...\v...`.)..dB...h....p...!.0q..}8bB.'....
..a..i...!~.1..w..g.&.P.....'...Z... .f!. R....z.#.8....0...&0......9.
..0A...f...'.p....i*....&.h:"h.j....L|zj........{......... ....[.B"...
........ ....q....;...<..........!...'..BX4....G,...Wl...g....w... 
.,... ...(..r...SN:.....4.,.0...s/..../...N9..`..H'...L7...H.#.<
<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1132&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1239&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=camp_rpm&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101366&default_rpm=1214&campaign_id=101296&default_rpm=5700&campaign_id=101294&default_rpm=6488&campaign_id=101197&default_rpm=5180&campaign_id=101196&default_rpm=6299&campaign_id=101068&default_rpm=4876&campaign_id=100733&default_rpm=9879&campaign_id=100624&default_rpm=2506&campaign_id=100516&default_rpm=1207&campaign_id=33482&default_rpm=1778&campaign_id=33121&default_rpm=1&campaign_id=101112&default_rpm=409&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:11 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:10 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Sat, 30 Aug 
2014 02:19:11 GMT..Server: Apache..Set-Cookie: softonic_analytics-admi
n=deleted; expires=Fri, 30-Aug-2013 02:19:10 GMT; path=/; domain=softo
nic-analytics.net..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-contr
ol: max-age=0, must-revalidate..Pragma: no-cache..Content-Length: 35..
Connection: close..Content-Type: image/gif..GIF89a.............,......
.....D..;..

GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&excluded=0&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

POST /universaldownloader-track HTTP/1.1

md5_hash: 71419f5f987b2bc03988deac36a046c9

Accept-Language: en-us

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader-prefetch

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

x-requested-with: XMLHttpRequest

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: the-sims-2-trailer.sd.en.softonic.com

Content-Length: 10491

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: __utma=102744260.36541216.1409347129.1409347129.1409347129.1; __utmb=102744260.1.10.1409347129; __utmc=102744260; __utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_36136=false; UACA_36136=false; UD1_POSITION_36136=; _FCen=100733||.101294|1|1409347129.101196|1|1409347129

id_session=787A7657-14AA-417C-81C1-FE4658283DE8&id_machine=d8cc41db000000000000000c293bdf2f&id_user=291514EA-E968-44B6-A174-BDA245756B30&id_file=36136&id_section=352&id_main_section=245&ab_test=&api_version=1.41.3×tamp=1409347129&download_browser=unknown_browser&download_browser_version=unknown_version&client_timezone=3&test_track=false&flavour=7&av_installed=&step=prefetch_events&events=[["special_conditions_evaluation",[{"campaign_id":"100733","campaign_priority":9879,"campaign_rera
HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: sd_client_en-admin=deleted; expires=Fri, 30-Aug-2013 02:19:12 GMT; path=/; domain=sd.en.softonic.com

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 35

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: application/json; charset=utf-8
...........V*.I,)-V.R..V.....l.........


GET /36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129 HTTP/1.1

Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: the-sims-2-trailer.sd.en.softonic.com

Connection: Keep-Alive

Cookie: __utma=102744260.36541216.1409347129.1409347129.1409347129.1; __utmb=102744260.2.9.1409347130805; __utmc=102744260; __utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_36136=false; UACA_36136=false; UD1_POSITION_36136=; _FCen=100733||.101294|1|1409347129.101196|1|1409347129

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:13 GMT

Server: Apache

Set-Cookie: sd_client_en-admin=deleted; expires=Fri, 30-Aug-2013 02:19:13 GMT; path=/; domain=sd.en.softonic.com

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 13382

Keep-Alive: timeout=3, max=9

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
...........}.r.H..o.)0.mK...%J...uZ.nR......"... . ......F..}.}.}..I63
...IQR._..F;.E.PGVfV.UY.w..9..~>.............\.T..m.J;........V)..n
....m...Ri.$...a...J...8...`P.^.....6._.a.e......;..~..|cN7...5.:.9.;.
.17...._.K....n...w..:l.;dZ..q.....u..qPM....n..$*b...u..Gl#.x....fzn.
.p#.z.k....z}.q.qN %..........=..,.<...L...7....p..@!..K....Ji..)..
^..uX......;=.l.gz.....P.*.............*..yIt.......P.....C([email protected]` ...
K..Z.i......0d#..t....x..(.Yp.;.E.....^..C...t..aG....E,..^.q.....=:m.
......Y...j..[.l...t..W..r....T/.*S.............\.G.)..).i::...0.\/..D
.y........C..1K.cL..Z....5........x^..d.....ff.... .'y..o...n....0G.ho
...D^....Y...f...........P{.. ......!.-:...C1R\.U..(p.(....{..X4.K....
Yt.K^....iod.s.E..y..........)B....C=T..6%.."..N..I.k....>........#
.......5.DC...8.v..k..L.d;I... .. V4..3S.B}^...HT.(D.\.q. ..4'.9....A.
.......%.._K.............ptM...h...>.Y...e.'...%.....;.E.84v.(..h.c
A.$G$...Y.'.n......A..i...ei........e....=.$,.`"..bIv.[V./...F.! .....
.(.$..\....`.c...\\...}._y....;...@.*H!...gx.....D/0......L.....]../.Y
...x...E........../.z..`M.!Bf.AwdYU6.[.^C..Ej..v........6....|..,.D...
[email protected].}.Z.C..V4.\..F.......=.6{.7.m.JQ.
.*.~...9Q...i.p....jZ...d........8[[Vv..=.d4I.XkVjM....f.X.........!.m
..,..........X*T.>...9..".......r...V7o..:..A...&..ab.cxZ.7...@....
...?.......X\.#>\.~^...h.4....|..T..Zc.P_.EQ.m..........t....2p.j..
.6.h.g.k..@.\..w.w......[.}G.3.F.F.$a.Wk.Z...!s.....J..:..z.f0x..MQ.Bu
.]Z..V..&-JSR..':....m.s.....L....~.....-W.....*..&:.........p.S..
<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=682&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /js/generated/306e0-e381f.js HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:09 GMT

Server: Apache

Last-Modified: Thu, 28 Aug 2014 14:31:15 GMT

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Mon, 29 Sep 2014 02:19:09 GMT

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/javascript
1faa...............z.H.8..?O!a.U..Q.lk!..'Kr.......b..AH.D...-.9.y..`.
Inl....jf...V.E .{FFFD...l-....t......{^s....l=[...I:i... ...$...>.
.........Co.o&..u.nv.I..b3.....}:....d..?....f.'...T..?z..K.i2........
 .}<..M.~6..`:..._.qr....G......h..8....W.a.....t.9..|s2MG......T..
K......<....t.O...xx1..G..8M..A....N.......t.S....B.&.....9.d....,.
.....8..........~...M....8=O.....8...t<.B..c..Fqv.....,....No...:y(
.>..x.s..I6.l.g}.F.BL.L.Y.O..i|......>.&....MR.qor.MF......-.C=.
...7'.s.Q..*...Q.&A.....\...<M........{.C..Y}.#..S/o...6........}.8
.....fy2q2d..e.\w...v..e8....a...p6=..F.ZN...&...)..h..GU.R.>.O.a&g
t;1..c...GJN{%u..6.Q.f.]\N..-lE...u.{..x..RX..!....M.u.O/...'........O
.....~>......v...4n...M.R.......Sk.**.b......i.z..W._....#2.....=S.
?...i2.F..wYw.C.m.Z.Wk..r:.5...n0o.0......<..z.d.4....V.&V...]M....
.....v..2......o...G.1...k1.m8.........l:.S...~. .[.......?.....4...].
./..G..8 mP......./..Fm....S.......w.8x.....([email protected]... roc..R.`..
.. G.X.......P...C...,......[Ot..qz9.......1...'..H-.....1....%...^...
..8_....".O.Gh......:t.'...r.kqbcz.MB...e..........i...(.T....k...a..x
J.w.>.M....3.B....s...6...(N...).r~A)?a.e<.x.....D.>P..#..B..
.....,..`..{..~.a.<.4..vO..9t"...Ex.m..>......}{v.P.T........)..
.L6....hk.o....o.`.".?.....~....`...Mj<..p.N....#Ch#.BD.....y.{.N..
....~._L/..p:<.....0...U<.}\5..E:5yR.)]..Y....W..fm....r....u..[
..!P...S).{........V.A.A.......~...a.H......zi.I[.i.\..........T.... .
...........wa...vw....)1.....j'[email protected]|A.o.....2]UAz.. ..Z
<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1259&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /campaign/scrn/101000/101294/sd_101294_ba965.png HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 12 Aug 2014 13:15:06 GMT

Cache-Control: max-age=172800

Content-Type: image/png

Content-Length: 15500

Accept-Ranges: bytes

Date: Sat, 30 Aug 2014 02:19:14 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 101

Expires: Mon, 01 Sep 2014 02:19:14 GMT
.PNG........IHDR.....................gAMA......a.....sRGB........ cHRM
..z&..............u0...`..:....p..Q<....bKGD..............pHYs.....
.....o.d....vpAg...............;lIDATx.....U.....x..b.;.I.v..#I..N.V..
[email protected].,.X.<[email protected]....}...|.Ng.}.
9..{.=.M.A.....0111.V.^....&&&&.*[email protected].......'.?...?..:q
.=....mV..sW.._.....l..;.n...^O...uv....~.E..)......>...o.M...K.2.&
gt;.......3..f}...s.......1.V. ........_.....v..Q..,j.....`.PF.U  ..C.
YS.#.....{.:l-....<.Ox....E.....E..&.....7%..}m..F<..d...B./5J.5
i}i.........dX..[......Xo.......K..V. ....iC-~.E..m..-N........X..._.\
..B...........e..{[.m.j~.).....g...7.....z...^G.sF..7.6l.......w>.{
....x....j..y.g......w.Q..{.. .....E.C.K...{....."@xSrl..s.C...a.(#...
0q.....F...~....O.FQ.E6.Q8..~~z~|.0....../=..r..5..j./.9..i....5.Z.x..
...........D..[....g..5..Vx.u.....D...a.EA....r.i..........k5.....9...
[email protected] .....l.b..??[>5Hz~...~~}..i.>....(cg.i...6....t
>...f....gT.<...... ..O.uX.MAh.@=...t....\./m.....L..}...oE...M.
...vd..,2...@..~5NjtTqe.FZ...W..l...{.... .....z.z..F.......6.2."..Z..
..mH/....Q...A.......Mif. ....vs....t....b..[E.....x..n....D.......).A
..:*/[email protected](..C...H.^.^..`..N.._.*..7%M...D........ j.r1.....nr..d
. .>.g...l...*k........p#..~.!.8XD}..~4. .!..8........4z....4.h....
.,R6.x.>..[.0...g.^2.......e.[.6o..%.,q} 0.......CY.7..j..9.k..#ec.
...M.H......o.....&..a..z?. [email protected].&.f....3.Gae
...b...k.`H.{5.z-..t.9n....g;J...&......(.t.e..I..L.......l.0.....
<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-2&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1124&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-2&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=1281&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /pagead/show_companion_ad.js HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 15469078727064674692

Date: Sat, 30 Aug 2014 01:46:25 GMT

Expires: Sat, 30 Aug 2014 02:46:25 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 45375

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 1970

Alternate-Protocol: 80:quic
............g{...0......u...%....^.V.'n...d/=..b...Kb..~g..`QV.>...
.zV,..t`0..3...Y.<2._..tu..z......Z...l>......je.q..s]..y..~..[.
'...4..U....qPs....h....rx..-........i`.F...Z4....jny........`..~43-.f
.%)C...~;.v<........k.`..T....n.sn....G......)z....u.c..g....Pj....
.9..I8.V.Z?2...=.g..x.......EM...N...Wc..0jY.S*D..z5..wxly2...Xgy6n...
Q......E.h...~.....5.........9....e..C/.BH.I..1..a............Th.$....
.&..N]o..k.....3........O....V..._j...4HN....q.*bGs..Q.6U...H..I.0;)r.
.lR...`8N.B...E...j....S.(.E..x.V~........lZ.. w...n...P.p,........u..
GmT...;...L....g...S8..0P.|N..5........t.x.v....'F..8ph.h...u*6.......
f...G..Z.j>".'[email protected](..7.k..D..L...........
o.U...N.w].''z5...IN.Q?=G......a.........y. .....1..(}w..w..G........@
......DW|-.M..........>...........o:.3.. 6..c............)...z. >
;..pu..U.5.._....0xt^..'u.N...`...\...O.......{.. ..:...6....7..>.O
6..0.b.k.{......GVm..#....l_.m\....3..k.-,..nW6^]....M6....D..v.Cw...Q
.x.(..5.E .....Q)W..V.........;..g..\.......{..A...:C.^Y.X....'o..V..S
y...X.7<............b.....mAe.cj.........r....p....n..pf.Vy..Q.n...
]..U....Q..]BG.xh....CY|r...sV0.....4..\@...3....fX*....fz.G.....0..|.
.<...m...N(..QD;.r;u......!.v...nX@./i.....A'......'...?5.f.....~. 
[.....}......%.< 1.a..ov..........~.....c.}.. '.....)|..{}....z....
^~..F0.........!.e.._h._.........co.....a....0..d....{e.......X.i..[..
[email protected]..|...2..H.t.J..../...~..6ff...=..h;@cF. .s........w....u.3
.M..}(`.H.H..]H.` G.........U.u......l....p...'w0...Ya.X....Z...4q
<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1155&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_session&event=prefetch:session:create&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&ab_test=&download_date=1409347111&execution_date=1409347129805&client_timezone=3&api_version=1.41.3&id_machine=d8cc41db000000000000000c293bdf2f&id_user=291514EA-E968-44B6-A174-BDA245756B30&os=WindowsXP&default_browser=unknown&default_browser_version=0.0.0.0&default_browser_language=en&default_browser_used=0&default_browser_search_provider=&default_browser_homepage=&id_cob=200&id_file=36136&id_section=352&id_main_section=245 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:11 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:10 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Sat, 30 Aug 
2014 02:19:11 GMT..Server: Apache..Set-Cookie: softonic_analytics-admi
n=deleted; expires=Fri, 30-Aug-2013 02:19:10 GMT; path=/; domain=softo
nic-analytics.net..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-contr
ol: max-age=0, must-revalidate..Pragma: no-cache..Content-Length: 35..
Connection: close..Content-Type: image/gif..GIF89a.............,......
.....D..;..

GET /blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&id_campaign=101294&id_campaign=101196 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=680&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /tag/js/gpt.js HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.googletagservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 14543961835398700302

Date: Sat, 30 Aug 2014 01:46:03 GMT

Expires: Sat, 30 Aug 2014 02:46:03 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 14500

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 1991

Alternate-Protocol: 80:quic
...........}iw.8.....GooF.....3cE.I..M.4M..~r(J^.5..4m../..........=g.
[email protected].~:.%...9...G.2.........}.r..A`..Oo..._c..o[..
"......?.....fI.f......8.......a....T.<...".......l..wi<....M&P.
.....>.f.....pU..-.F.....5[N.(...I.I4.....k9...h...v..,&#....B.Q...
'G.8.Y0........,..7.........bg.;......2...[.h.D5.:[..G)H........I,....
.;..B......WnP........O.S.E..y...*N...........I.f9....T.....U.......&g
t;.....rC.[|2O.qt....V.n....k...1..1.......F..j.}.b7p...b..l.......lrY
<........\.F..9.0._...x..4#..u9.....Os....N.9.U.wO.h. ..o.w.".r..G.
T6......4l.jU...ft....{....5........^.....4.g......KGWQ..C...>k..g.
.."d..(...k .Tb.C.V<....o.5...3.Yt].fJ..A..K..c.A.[.;.;..g....b1.7.
.....4...%.,N...9K3QP.%'.....mk..f..w.6_..l=...`p[...Qt......o.w{.o..O
..s.]9..v.y..^....u'.:.,),m.1e)....h...f....N...V....\..3.....\.4...B.
n..K.-~...`..z......&..).l.*........]..}7..D....\..q.......C.E.#]..|,.
...O.....;..4J....n..[.Q..O..z...<...,.../.._....Jf.....Q.g.(*....U
.....~K.}g....(.qo.....~...j....j7.{,K......,.U5..t.!K.\.N../......@..
...=...#.....p.....I.....m.......Kd.... .*|5...0#...z.1...b.A.....L.W.
$.fQ.)'......*.[N.....!....~..:[email protected]..`...{.-..,.qFR......{..
2`a..4....&."k..E)...`I.aE..|..?N.M.~(..W ..]...o..t....H...M...s.."..
........z.....=.y..}pI...9}@.b..B.}@..>...K...._..............>.
..}@3...4..>..#......0.1o....SL.......~N....>.........RP. .}..s.
...ro.$>,...E..,=.`.Mv{ ...I.(}.%.T~.VL..a]..x.. ....-..0'..2\...4.
...........VB...v.~..... /.....GD....u..V.F..:...{.]E.u@\...MA...b
<<< skipped >>>

GET /__utm.gif?utmwv=5.4.6&utms=1&utmn=314903792&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=installation assistant&utmhid=1363439720&utmr=-&utmp=/36136/universaldownloader-prefetch&utmht=1409347129492&utmac=UA-48247475-1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153187

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=2&utmn=1782449156&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmt=event&utme=5(js_error*SDCaughtError*A not tracked http connection ID has triggered the callback - no error provided)&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=installation assistant&utmhid=1363439720&utmr=-&utmp=/36136/universaldownloader-prefetch&utmht=1409347130805&utmac=UA-48247475-1&utmni=1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=6AAgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153188

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=3&utmn=1080540854&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=-&utmp=/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129&utmht=1409347133555&utmac=UA-48247475-1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=4&utmn=2116663174&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1409347133758&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=5&utmn=2044095020&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1409347133789&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=6&utmn=18490721&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1409347133852&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=7&utmn=1900154913&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1409347133883&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=8&utmn=1728605849&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/C101294--load1&utmht=1409347133930&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;....


GET /__utm.gif?utmwv=5.4.6&utms=9&utmn=731848023&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/C101196--load2&utmht=1409347133977&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=1145&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=681&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1284&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /css/generated/fad58-b3118.css HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:14 GMT

Server: Apache

Last-Modified: Thu, 28 Aug 2014 14:31:15 GMT

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Mon, 29 Sep 2014 02:19:14 GMT

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 5307

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: text/css
...........<i...q.. .y..= 5...6....b..:....ZdK..".$5o.........%....
}.]...........H..v..s...o6...].....].'......hGZ..Iw...I..*2......_...~
.E..U.K...........\.U..yxL..8<N..4<...<........sZd..0/.s.v.sG
.J.:..U...s...;.]&F\N.9..:..$....>.yI.#...n.,......z.U..6J.. uK...F
...$.......?.....t.P. ...m.........Q.V...}.$~".e_.].v/.].ly...'..8....
r..E..CKzUp......"?.......?.'....8~.C..zG..i....;.\R6.......d.kB.6U.r.
.X..-.K..l._.QdM...D/...6....*=...T....x........-.oFo6.6.....x.g.wUw.|
..|..y..>.YF....,/9N.......{......81..n.......GUY.l..p$....q.LxL...
......H.]Ge....8k.C..,X..cX{. F'.T..B.I.M[5......0.Z.y.....D.}Q=;dl..L
z...]{nH.~....*h..........!H#.e..1...*......m......../..MN..%e......!.
.o.L.k.......y).A2.B.3.Y..... [email protected]%.J.w._....
W.4.."[email protected]]*..r.=....R........;...............
..],.m.....~tj.....3.........g..lA.K..L........."7.pj}.{.;....0C...<
;..... .N[.9.'..E..G.LR..2.......5......Mu....)~..}.L&..3.....i..C..e.
....<..}.-..h1../...5%][email protected].._%C..]..
-..6..`.\..d...0.H.....wt. ...A...[.........d..3.......te..n!..%.de.f3
.3Og...~i.Y.,...........z../......x....K}......|....>l....O....[f..
.....C.&7t...MPL1.c%4.....q.I..E...5Isp]lX......6..N......-Y........0.
o.H....S.(@7..D..1f<S'-e..n...,*.m[J......#ce.6.....f...>.......
.H.oQ^f.3.^J...ZW.`y..d..%...q.A.A......q..<....0!...F..1gD0..".5..
p..RR.`....5_.Fr\.B0.. iJ.N...l....#...:G....,5cb....z..k.](..m\L.  .`
'.......kc.xlT,#...."g.ki..3F....9.5../}.4.H.j.$0W...#.g\.*.=.....
<<< skipped >>>

GET /shared/img/sd_client/gradientbg.png HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:14 GMT

Server: Apache

Last-Modified: Thu, 27 Mar 2014 08:17:09 GMT

Accept-Ranges: bytes

Content-Length: 2958

Cache-Control: max-age=172800

Expires: Mon, 01 Sep 2014 02:19:14 GMT

Keep-Alive: timeout=3, max=9

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR...)...........\.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....PLTE...........................................................
......................................................................
...........................O *E...4tRNS...............................
.....................KW"e...HIDATx....v.9..Q{.%y......I.3.\...m..`..u.
s1.s.D...Q,. ..`(..S....O.....SJ........8...=.LR.[.&......:.eJY..oI:./
...$..BJ.#KS.sH2..%.{F..='..?HR./..6.X......)./R.. ..6.....F..g.[.I.&l
t;.l..2$...42.....S.....>..........h2..f..3.........<...X&r....T
..gg.-...t.....em<b.V&.g.c....6E,.-..qF6. ...o.Q.$S...(./y...DD..w.
.:iQ .c....3.&.TcCT.t,UE.E..HP.R.s.......V.`...%...'6.`...g..UIf(..K..
..uF2..r......T.!..]fLWF..\lU$....=c:2#.`....<...E". .".. qU.7P.[..
c.}.J.q.N.*..:g)%...!.. ..,[email protected]..,9.:l....c....<...
G.8...O......?.....5..'}.....TB..#.... Uxq..\..Y....1.P ..P.........Cd
a...g.....V'....G.:..uW..2.X......a2!.....L..2...mb...f:.i. z........S
...u)d8dC.R..q.`..N.^.~.q.......].....U.....%..p1&..b5..K..q..h...D...
...0...b..?M`...ak..2}J.7....l..<........7\...g!.Jf.0k.......){.-[.
f...M.. ..`.hY}..]....Z...z`.J.eb.........Vl..s...p.Zi.*..kd~..Q...l.@
......(l.v.L%:..|.c....,..Tg.....I..7[.-#,.....j#...B.`..b.m`..[....g.
.<Gs......".5c.R.4QC.5.][email protected]....
%0.m./....z{{~.y...........gz.zz.........??{..g~....D...............z.
_.......k.}...^?v..w.O..........t.x...~..x..}.........................
..............=..m...]Ew7...._....j_.j.....~.&....\7....~.....Pw..
<<< skipped >>>

GET /shared/img/sd_client/loading.gif HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:14 GMT

Server: Apache

Last-Modified: Thu, 27 Mar 2014 08:17:09 GMT

Accept-Ranges: bytes

Content-Length: 1553

Cache-Control: max-age=172800

Expires: Mon, 01 Sep 2014 02:19:14 GMT

Keep-Alive: timeout=3, max=8

Connection: Keep-Alive

Content-Type: image/gif
GIF89a................................................................
......................................................................
......................................................................
......................................................................
......................................................~..}..|..z..y..x
..t..v..s..r..q..p..m..o..l..k..j..............!..NETSCAPE2.0.....!...
..|.,............|..;\r....bvwz.....-lqK'......|.[p9.....4lE.....Nj#..
...^g.....[c.....G_......[8..!..IV*..'..|#OP1......).. @JGB=93)...$3&l
t;9 ......!.....|.,..........y.|.|4RhjW:...)Vilortvd1.&]eA..&Lwt.N`..|
<.-[;...|AX....NU....JQ....8M.....%I.....|8C ......<=%.........1
73/*&!....% '.....!.....|.,..........w.|.|-EY[L3..!GX[_cgjZ..LS6.Cmj..
?M)..6r`."I0..Iu:3E...&xZ<A...zr9=.. 8....5!....*0....... *........
..!$!................!.....|.,..........w.|.|$9IM@,...8GJOSWZM&..;A..:
_]).1<...0dU|.7$..Aj4&3..mR,0..pi(...qk.)..&uX.$..Mw;|....{g.|.....
..|2....................!.....|.,..........z.|.|.(591#...'258=AE<..
.)-....-KI ..)...&PE|."...5W,......ZD...._X....c[....fL....Dk4|....9o\
......'Jsl......zxa.....[;....!.....|.,..........x.|.|..$'#......"&*.2
-......... 77.......=5|.....(C#......G6....LG....QJ...|U?....:Z,|...1_
M.N'|.Be]&.fyxtrokV)..;YljS....!.....|.,..........w.|.|...............
............$%........*&|......0......3)..95..=9[z...B1<wL./G#.ct8.
)M>./mrF.7TL...]nkfc_ZH!.5O_[G....!.....|.,..........v.|.|........|
.........1.......gz.|...|;wM.|...Xv'..!.lt..&"jr.|*'So../#5lD.#3.|
<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-2&sc_type=ns&met=true&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1131&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /en/scrn/36000/36136/the-sims-2-41.jpg HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 19 May 2011 14:38:27 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 12690

Accept-Ranges: bytes

Date: Sat, 30 Aug 2014 02:19:14 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 4

Expires: Mon, 01 Sep 2014 02:19:14 GMT
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 75....C................................... $.' ",#..(7),01444.
'9=82<.342...C...........2!.!22222222222222222222222222222222222222
222222222222........,.."..............................................
..............}........!1A..Qa."q.2....#B...R..$3br........%&'()*45678
9:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................
......................................................................
....................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'
()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.............................
.......................................................?....K.q.*...f.
...v)~VRq\.....Wu....R].)98..'. r.0\.........P...K.........~5;K....x.c
.Sv".\.....[0....=.;N.. f\. TL.7m#[email protected]..... .O..J5j... x...1..sJ..Ug.
.S.m....U.PO509..9..b........=..Um.j-......VQ.w.T.....U..J....}..4....
.;...5...N......*.'.Q."..Z...V.8.V..* ....2.N)..S..S.Kc...p21T.....)Z.
9..S.......$o)'.#.Y.~g..9.;.f..~c....hb:t.Ie.a....3S*....$..d.5r1.....
...,Q.<U.....P...,>.7.QG.gv...8..........N....I.pJ.L.-....pFsY(.
..j.Xt...3\.e ..4.....S..8.Q..Gq.......c;Qp.*r.0 .d.zV..$.Z..9$f...\..
C.qW.S....FY...Fwr)(..Z[p....h0........>.4.B..b...<.......Kq-LO,
.&A.Wc...4...Q......9.D......f9.j!&.BriKbob.o....z..........i.._b.2jW.
<.1.......r...D..up..3V.C.....\.....g.. m..."..U?........t..a.Z.H..
[email protected]>W....q$j........l.55r)...z..
._T.....R....m..62}.d...........>.....4g%t.8..M.3H..1$r ..U....
<<< skipped >>>

GET /campaign/scrn/101000/101196/sd_101196_6142a.png HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 15 Jul 2014 12:44:56 GMT

Cache-Control: max-age=172800

Content-Type: image/png

Content-Length: 60419

Accept-Ranges: bytes

Date: Sat, 30 Aug 2014 02:19:14 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 218

Expires: Mon, 01 Sep 2014 02:19:14 GMT
.PNG........IHDR.....................bKGD..............pHYs..........o
.d....IDATx....xUE...{.6...{o(.7......TT.P..{.)$...{.%..@zH...@......:
g...MP.y...}..p....}....*s..}W.^.......=....}.{..../h.............o.L.
h..].l.....].~............jYY..j...U.[.......~13sWE.........s[........
..e....W...._...............VRR.Zii.m.....}.[xNy.333...q[.r...4.g>.
.....}......O.~..?.......v'..p....;..)@.7..W ...nMCs.......2.7.;O.....
.....4$''#22.............:..;v`..uX.|9...agg.{{{888`..EX.d.V.\...7...c
...Q.E..w3.....{....w7............B...@fH...... .6...>U...K8..<R
RR..........V..~.z,[.......y.0k.,L.2..G....#1l.0.....4hPe..w..........
..U.1b.z...c1y.d,[email protected].?.................
..."<....3...AXX.R.....'...~l....W.VJ3c....fh...,..................
.....5J..nc..Q.;n.8..?^...&.6i.$L.8..&N.....s&..)S....a.F...!>>.
..[.?..EU...S......l.U....v...O...S.........I!8...S&.....[T...w.V.j...
.,.T..=[u&.!..........?..3~..W.......`.s....C .f.4.3J..i..m..1..f..0..
.c...x....P)...I.&a....&....M.h.8v......1k:.EIw........."..E.(.. ..-..
w......l...d..._A.W>OUW.?S.*.:...DDD ((....8~.8.....[.*SBph......!.
......O5...O....O.".....Pu..ZCin.R.....s......y||.-..d|.........5.....
.........m...7~.xL.$.6Y>{...X..1....L.=....mb.]\\.....cg...M.Y..E..
.\U.v.h....p..-P.....{h.d4EG.~.U'44..I....hh.......'..G........[...!T4
aZ}..3..<T...6Q....v.....m..3.DU2.....0{..s.mMCfV3...M.8.j.$.,.E.'.
`..$..<..M.........y.0F`.5VL.....&c....wr..u.qD...'O...s.'...nW....
 .......2.b.?H.9..\@jj*.Du. .<y.....\.>|..v.RN2..s..a...^.z.
<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /gpt/pubads_impl_47.js HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: partner.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Last-Modified: Wed, 13 Aug 2014 09:40:03 GMT

Date: Thu, 28 Aug 2014 07:46:01 GMT

Expires: Fri, 28 Aug 2015 07:46:01 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33599

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 153194

Alternate-Protocol: 80:quic
......n.....y..H.8.._.....B..sL"Y..8N...L....i].9D.....?U..ZB$...wgcZ}
..U.u..b.....vn/.l{..... c3_.p.v......e:...;..W.s.(.b./.....~3..d.{...
.."......|B...=.ds>.1..l.o........y....i;........,...f}.~....^=....
E.h..l..L....=.Uk.o.l....\Z..8.g...T.......k-&Q..&qd....t4..M...i<.
..f'Pq<.....T'....r..Fw...{...fq2J]..o..u.=RKo..Q.o.....x..}..`....
..X^... ...m)..*...bQ.N.4.\.&*....M..bYU...1#......U.bq.H....Y..T.....
S..s..Y..%...Q.-fqw1..Vm.n.<.........1..'O.4...~..........5...ttc.z
....Y.v.d.A...%a.w.3.......,..t ..u99.b..OG.8....y.U.v..s...._*.x.\.I.
.$s9..E....p4..z.k...Y.......y5......k.lJ.P.v..._.......2.....D.......
..;.'.K.uQ\..3m..i..?.%`u..t.. ..<.t..8KC.?...>I......M..mL_....
..;..........Fg0......._...p6...K.....U..........5x.c.....q<g'O....
..q..\.iE>......1}/uU}m.xg..T.A..x.S.;.....1.0..q...........!K..4.l
..u.../.6X$.nG........Wt.R.......i...........3....x..&......JB.z..<
.q.K|....*f.g....<$.z.}.'.Q..71.m...o./.y:.t...r..V........5ot..._.
......C-.r.V......g.t...k.-u.....,(}.6.;3............`.r`"....qf.....{
...p-..s..U...e^`.^U.;..r.K..m.V.}g.. ...{[email protected].=.
...>..K.....~...5.b....A.....O.;.}..j!.'.e..a........{D.. ..0.[.6.T
 g..e......YsaR...B.[]5T.g1...Q._....-....9.....h<..6........6..@..
....hn7.....%....V...".xc7a...[...9....SWOf...*8.....U..!..$.......k..
.....`.....Q.@?.?..B.......jbo.d.G..g.k.n..uj...i.A.6.........Bj..[...
v-oK...:...D\/.{..paT,....,_......<..9.aa..|.........Y...sq....{...
..[0.g.6....:?o..:.(.`0.`....'..Qp..9....n<...e0D....u...).~V..
<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1130&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

GET /shared/img/sd_client/sprite.png HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:14 GMT

Server: Apache

Last-Modified: Thu, 29 May 2014 10:05:58 GMT

Accept-Ranges: bytes

Content-Length: 7892

Cache-Control: max-age=172800

Expires: Mon, 01 Sep 2014 02:19:14 GMT

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR.......\.....ld......sBIT.....O.....PLTE..............
......................................................................
...............................................h......................
.f.....n........Dw.I..............U..}..,...v..\. g...........x.a...R.
.............>....:n........M..].T*..:.....m....tV.....]........7..
..Q..P..O)....P.i...O..N..N..M....sJ..M..K..L..L..J..J..JJz...I..I..H.
.I..H..Istv..H..G..H..G..G..G..F..F.x.go...F..F..E..E..D..D..D..B..C/v
...B:[email protected]..>/g..m..p..i...<..=.z:.g.;b..z:[email protected]?[ZW
.5>.u8.4<.s7.b..3;.1:.09{O$./8.p5..7.-6.[..m4&Q..,5. 3.k3(X..*2.
)1.R..(0.'/.%,.T..f1.e1.&..$,.$,.%-.# .# ."*.#,."*.!)." .!(.!*.!). (..
'. (..&. '.I...'..&..%..&..%..%..$..$.."..#..#..".."..!..!....9.899...
................*................>.j.....tRNS......................
......................................................................
......................................................................
......................................................................
.............~T.....pHYs...........~.....tEXtSoftware.Adobe Fireworks 
CS6.......gIDATx...._[.^..'.LhC...4.t.K....H.w0......^.)w.i..T...q..w.
.bq..*U.2j]..hU...^.}).\.......,.@......._..!0.u>[email protected]\..
fUHC....c.X;4.c..I...m..c...d.B.2...}. ..- ...A....,.:p51.4.Ig..:.}...
...r......WXw..........z. 3v..^.....2......5.Bw.;...M.......ffx..Ac...
....jf...F53.K...y...^.(h..M].>....................y.o.:...m.-.2C..
..................(.Jro.P............wqo....7....<...7*.z......
<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&excluded=0&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif
GIF89a.............,...........D..;..

The Trojan connects to the servers at the folowing location(s):

`.rsrc

PSSSSSSh

PSSSSh

u.hL?L

F><.tN<[tJ<\tF<*tB<|t><^t:<$t6

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;<IIIIIIII=>II?@ABCDEFIIIIGIIIIH

88888888888888888

%u$Vj%

t.Gj:W

xSSSh

FTPjKS

FtPj;S

C.PjRV

[%s %s %s]

Send failure: %s

Failed writing body (%d != %d)

%s:%d

WARNING: failed to save cookies in %s

About to connect() to %s%s port %d (#%d)

Connected to %s (%s) port %d (#%d)

<url> malformed

:]://%[^

[^:]:%[^

Protocol %s not supported or disabled in libcurl

http_proxy

%5[^:@]:%5[^@]

%5[^:]:%5[^

:%5[^@]

Port number too large: %lu

%s://%s%s%s:%d%s%s

ftps

[%*39[0123456789abcdefABCDEF:.%]%c

Couldn't find host %s in the _netrc file; using defaults

[email protected]

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

Connection #%d seems to be dead!

Connection (#%d) was killed to make room (holds %d)

Re-using existing connection! (#%ld) with host %s

%s://%s

Connection #%ld to host %s left intact

operation aborted by callback

HTTP/

ioctl callback returned error %d

the ioctl callback returned %d

seek callback returned error %d

The requested URL returned error: %d

HTTP/1.0 connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.0 proxy connection set to keep alive!

HTTP 1.0, assume close after body

HTTP =

HTTP/%d.%d =

No URL set!

[^?&/:]://%c

Violate RFC 2616/10.3.2 and switch from POST to GET

Disables POST, goes with %s

Issue another request to this URL: '%s'

Maximum (%d) redirects followed

Received problem %d in the chunky parser

HTTP server doesn't seem to support byte ranges. Cannot resume.

Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)

Leftovers after chunking. Rewinding %d bytes

Operation timed out after %ld milliseconds with %lld bytes received

Operation timed out after %ld milliseconds with %lld out of %lld bytes received

unspecified error %d

%s cookie %s="%s" for domain %s, path %s, expire %d

#HttpOnly_

httponly

I99[^;

skipped cookie with bad tailmatch domain: %s

skipped cookie with illegal dotcount domain: %s

23[^;=]=I99[^;

%s%s%s

# Fatal libcurl error

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/rfc/cookie_spec.html

# This file was generated by libcurl! Edit at your own risk.

bind failure: %s

Local port: %d

Bind to local port %d failed, trying next

couldn't find my own IP address (%s)

Bind local address to %s

Couldn't bind to '%s'

TCP_NODELAY set

Could not set TCP_NODELAY: %s

Failed to connect to %s: %s

Trying %s...

Internal error removing splay node = %d

Internal error clearing splay node = %d

Error in the SSH layer

Caller must register CURLOPT_CONV_ callback options

TFTP: No such user

TFTP: Unknown transfer ID

TFTP: Illegal operation

TFTP: Access Violation

TFTP: File Not Found

Login denied

Issuer check against peer certificate failed

Invalid LDAP URL

Unrecognized HTTP Content-Encoding

Problem with the SSL CA cert (path? access rights?)

Peer certificate cannot be authenticated with known CA certificates

Problem with the local SSL certificate

SSL peer certificate or SSH md5 fingerprint was not OK

A libcurl function was given a bad argument

Operation was aborted by an application callback

FTP: command REST failed

FTP: command PORT failed

HTTP response code said error

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't set file type

FTP: can't figure out the host in the PASV response

FTP: unknown 227 response format

FTP: unknown PASV reply

FTP: unknown PASS reply

FTP: weird server reply

URL using bad/illegal format or missing URL

Unsupported protocol

Winsock version not supported

Protocol family not supported

Address family not supported

Operation not supported

Socket is unsupported

Protocol is unsupported

Protocol option is unsupported

Unknown error %d (%#x)

Resolving host timed out: %s

Could not resolve host: %s; %s

Could not resolve proxy: %s; %s

Could not resolve host: %s

gethostbyname(2) failed for %s:%d; %s

init_resolve_thread() failed for %s; %s

TFTP

set timeouts for state %d; Total %d, retry %d maxtry %d

tftp_rx: giving up waiting for block %d

Received unexpected DATA packet block %d

Timeout waiting for block %d ACK. Retries = %d

tftp_rx: internal error

tftp_tx: giving up waiting for block %d ack

Received ACK for block %d, expecting %d

tftp_tx: internal error

bind() failed; %s

tftp_send_first: internal error

%s%c%s%c

TFTP finished

Can't get the size of %s

Can't open %s for writing

Last-Modified: %s, d %s M d:d:d GMT

Couldn't open file %s

There are more than %d entries

LDAP remote: %s

LDAP local: ldap_simple_bind_s %s

LDAP local: Cannot connect to %s:%d

LDAP local: trying to establish %s connection

LDAP local: %s

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

CLIENT libcurl 7.19.0

MATCH %s %s %s

DEFINE %s %s

insufficient winsock version to support telnet

WSAStartup failed (%d)

%s %d %d

%s %s %d

%s %s %s

%s IAC %d

%s IAC %s

Sending data failed (%d)

%d (unknown)

%s (unsupported)

%s IAC SB

Syntax error in telnet option: %s

Unknown telnet option %s

7[^= ]%*[ =]%5s

USER,%s

%c%c%c%c%s%c%c

%c%s%c%s

7[^,],7s

%c%c%c%c

FreeLibrary(wsock2) failed (%d)

WSACloseEvent failed (%d)

WSACreateEvent failed (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to load WS2_32.DLL (%d)

WS2_32.DLL

Excessive FTP response line length received, %zd bytes. Stripping

FTP response reading failed

FTP response aborted due to select/poll error: %d

FTP response timeout

Failed FTP upload: 

RETR response: d

Connecting to %s (%s) port %d

Uploading to a URL without a file name!

FTPS not supported!

USER %s

socket(2) failed (%s)

PORT %d,%d,%d,%d,%d,%d

Telling server to connect to %d.%d.%d.%d:%d

Failed to resolve host name %s

getsockname() failed: %s

Connect data stream passively

REST %d

SIZE %s

STOR %s

APPE %s

Bad PASV/EPSV response: d

Can't resolve new host %s:%d

%d.%d.%d.%d

Skips %d.%d.%d.%d for data connection, uses %s instead

%d,%d,%d,%d,%d,%d

%c%c%c%u%c

Failed to do PORT

Got a d response code instead of the assumed 200

RETR %s

ftp server doesn't support SIZE

PBSZ %d

Access denied: d

ACCT %s

PASS %s

ACCT rejected by server: d

QUOT string not accepted: %s

TYPE %c

MDTM %s

ddd d:d:d GMT

dddddd

unsupported MDTM reply format

server did not report OK, got %d

Remembering we are in dir "%s"

CWD %s

Failed to MKD dir: d

MKD %s

QUOT command failed with d

Entry path is '%s'

PROT %c

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

AUTH %s

Got a d ftp-server response when 220 was expected

%sAuthorization: Basic %s

%s:%s

Server auth using %s with user '%s'

Proxy auth using %s with user '%s'

Failed sending HTTP POST request

Content-Type: application/x-www-form-urlencoded

Internal HTTP POST error!

Failed sending HTTP request

If-Unmodified-Since: %s

Last-Modified: %s

If-Modified-Since: %s

%s, d %s M d:d:d GMT

%s%s=%s

%s %s%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

Content-Range: bytes %s/%lld

Content-Range: bytes %s%lld/%lld

Range: bytes=%s

;type=%c

ftps://

PTF://

Host: %s%s%s:%d

Host: %s%s%s

Accept-Encoding: %s

Referer: %s

Received HTTP code %d from proxy after CONNECT

%d bytes of chunk left

HTTP/1.%d %d

Read %d bytes of chunk, continue

CONNECT %s:%d HTTP/1.0

%s%s%s%s

Host: %s

Establish HTTP proxy tunnel to %s:%d

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

Failed to resolve "%s" for SOCKS4 connect.

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

SOCKS5 GSSAPI per-message authentication is not supported.

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Failed to resolve "%s" for SOCKS5 connect.

User was rejected by the SOCKS5 server (%d %d).

SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]

--:--:--

= %s = %s = %s %s %s %s %s %s %s

password

login

Operation too slow. Less than %d bytes/sec transfered the last %d seconds

%s, algorithm="%s"

%s, opaque="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"

%s:%s:x:%s:%s:%s

%s:%s:%s

%5[^=]=23[^

%5[^=]="23[^"]"

d:d:d

%c%c==

%c%c%c=

.html

.jpeg

--%s--

Content-Type: %s

; filename="%s"

Content-Disposition: attachment; filename="%s"

Content-Type: multipart/mixed, boundary=%s

%s; boundary=%s

()$^.* ?[]|\-{},:=!

:/-_.!~*'()

xxxxx

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

GetProcessWindowStation

portuguese-brazilian

operator

()$^.* ?[]|\-{},:=!

Kernel32.DLL

invalid map<K, T> key

User-Agent: %s

http/

NOINT_MSG

urls_to_restore_on_startup

startup_urls

search_url

keyword

zcÁ

.?AVHTTPClientImplementation@@

.?AVHTTPClientInterface@@

.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@

.?AV?$TSpecificFunctor@VWindowsAPI@@@@

.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@

.?AVChromeBrowserHandler@Browser@Lib@Softonic@@

.?AVWindowsAPI@@

.?AUDWebBrowserEvents2@@

.?AUIHttpNegotiate@@

.?AVCustomIHttpNegotiate@@

.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@

.?AVCurlMultiDownloadJob@@

c:\%original file name%.exe

GetCPInfo

GetProcessHeap

PeekNamedPipe

RegCloseKey

RegEnumKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegDeleteKeyW

RegQueryInfoKeyW

ShellExecuteW

ShellExecuteExW

URLDownloadToFileW

UrlMkGetSessionOption

UrlMkSetSessionOption

GetAsyncKeyState

GetKeyState

EnumChildWindows

EnumDesktopWindows

InternetOpenUrlA

.text

`.rdata

@.data

.rsrc

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.1.1.0" processorArchitecture="X86" name="Softonic.UniversalDownloader" type="win32"></assemblyIdentity><description>Universal Downloader Download Helper.</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

GDI32.dll

gdiplus.dll

IPHLPAPI.DLL

ole32.dll

OLEAUT32.dll

PSAPI.DLL

RPCRT4.dll

SHELL32.dll

SHLWAPI.dll

urlmon.dll

USER32.dll

VERSION.dll

WININET.dll

WLDAP32.dll

WSOCK32.dll

[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]No Internet connection detected[ENDVALUE][KEY]NOINT_MSG[VALUE]Softonic Downloader needs an internet connection to function. Please connect and try again.[ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]START_HIDDEN[VALUE]true[ENDVALUE][KEY]LOADING_DIALOG_TEXT[VALUE]Please wait...[ENDVALUE][KEY]LOADING_DIALOG_TITLE[VALUE]Download and installation process for The Sims 2[ENDVALUE][KEY]MIN_BUTTON_SIZE_X[VALUE]18[ENDVALUE][KEY]MIN_BUTTON_SIZE_Y[VALUE]17[ENDVALUE][KEY]MIN_PROGRAM_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRAM_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_X[VALUE]222[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_Y[VALUE]20[EB ]

SHELL32.DLL

ShellExecuteA

%original file name%.exe

hXXp://glamfromeast.com/image/logo.gif

hXXp://edirneli.net/tr/logo.gif

hXXp://emrahkucukkapdan.com/img/button.gif

hXXp://gardapalace.it/logo.gif

hXXp://hidroservbistrita.ro/images/logo.gif

hXXp://babystophouse.com/images/logo.gif

hXXp://mabdesign.unlugar.com/button.gif

hXXp://datalinksol.com/logo.gif

hXXp://snsoft.host-ed.me/images/logos.gif

m/images/logos.gif

hXXp://173.193.19.14/logo.gif

.info/J

home.gifI888

KERNEL32.dll

h.rata

Bkrnl.exe?

= =$=(=,=

322%2`.50728)

.klkjw:9fqwi

FamXf39.sys

.pBTa8

%s:*:

Bg.laXV

&?%x=

GUrlA'

Web%w|nc

HTTP)

2GUARDCMD.

.ENHCDM

PL/KPCKwWEB

MM.PFW.

.bssf

J:CRT

MSVCRT.dll

WS2_32.dll

SHFileOperationA

$.yx3>Q

H[%s] %s

[%d][%s|%s][%s][%s]

[%d][%s|%s][%s][%s][%s]

Glog.txt

HKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

mscoree.dll

WUSER32.DLL

.temp

Ld-d-d

[%d] [%lld|%lld]

1.41.3

Got Elevation URL. [%s]

New URL was not valid.

@Received message %s

xxxxxxxxxxx

explorer.exe "

[%d %d]

Hchrome

firefox

0.0.0.0

Web View

Web Host

%d|%d|%d

errorUrl

%s(%s)

%s --> (%s)

.swf?

.jpg?

.gif?

.png?

Value: %d

%s\*.*

%s\%s

Proxy by URL are not supported.

Automatic proxy discovery are not supported.

http=

https=

CPTF://

- URL:

[%d] Starting thread...

[%d] Thread Creation OK!

[%d] Error creating thread! trying again...

[%d] Thread started...

Bhttp/

%d - [%d][%lld/%lld][%lld]

json_writer.cpp

Hjson_value.cpp

Software\Classes\http\shell\open\command\

http\shell\open\command\

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\

chrome.exe

iexplore.exe

firefox.exe

opera.exe

opera

safari.ex

browser.startup.homepage

browser.search.order.1

browser.search.order.2

browser.search.order.3

prefs.js

\"(.)*.;

browser.search.selectedEngine

browser.search.defaultenginename

browser.search.useDBForOrder

user_pref("browser.search.useDBForOrder", "false");

browser.search.useDBForOrder", "false");

browser.search.useDBForOrder.*

%s*.*

Software\Mozilla\Mozilla Firefox\

\Google\Chrome

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

PathToExe

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

\search-metadata.json

ljson_reader.cpp

log.txt

Assertion failed: %s, file %s, line %d

w~i!!^uzyw~XwrxpOrv~Wzkh~QH66%X00QH66%X00Ht}oturx_tluwtz

tl@hUzv~XzwwyzxpF5xzww32 ;f;xzoxs3~ii2;`;i~oniu;<^iiti!;<;0;~ii ;f;f'4hxirko%Xzww;Hnxx~~

V_.Szhslz\~o_tluwtz

V_.ZhbuxSzhs

QH66%X00Tyozruru|;ark;}rw~LV!!_X32!;Htv~tu~;

QH66%X00Lru()_tluwtz

1.41.3.7

SoftonicDownloader.exe

%original file name%.exe_2764_rwx_00401000_000F7000:

PSSSSSSh

PSSSSh

u.hL?L

F><.tN<[tJ<\tF<*tB<|t><^t:<$t6

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;<IIIIIIII=>II?@ABCDEFIIIIGIIIIH

88888888888888888

%u$Vj%

t.Gj:W

xSSSh

FTPjKS

FtPj;S

C.PjRV

[%s %s %s]

Send failure: %s

Failed writing body (%d != %d)

%s:%d

WARNING: failed to save cookies in %s

About to connect() to %s%s port %d (#%d)

Connected to %s (%s) port %d (#%d)

<url> malformed

:]://%[^

[^:]:%[^

Protocol %s not supported or disabled in libcurl

http_proxy

%5[^:@]:%5[^@]

%5[^:]:%5[^

:%5[^@]

Port number too large: %lu

%s://%s%s%s:%d%s%s

ftps

[%*39[0123456789abcdefABCDEF:.%]%c

Couldn't find host %s in the _netrc file; using defaults

[email protected]

Couldn't resolve host '%s'

Couldn't resolve proxy '%s'

Connection #%d seems to be dead!

Connection (#%d) was killed to make room (holds %d)

Re-using existing connection! (#%ld) with host %s

%s://%s

Connection #%ld to host %s left intact

operation aborted by callback

HTTP/

ioctl callback returned error %d

the ioctl callback returned %d

seek callback returned error %d

The requested URL returned error: %d

HTTP/1.0 connection set to keep alive!

HTTP/1.1 proxy connection set close!

HTTP/1.0 proxy connection set to keep alive!

HTTP 1.0, assume close after body

HTTP =

HTTP/%d.%d =

No URL set!

[^?&/:]://%c

Violate RFC 2616/10.3.2 and switch from POST to GET

Disables POST, goes with %s

Issue another request to this URL: '%s'

Maximum (%d) redirects followed

Received problem %d in the chunky parser

HTTP server doesn't seem to support byte ranges. Cannot resume.

Rewinding stream by : %d bytes on url %s (size = %lld, maxdownload = %lld, bytecount = %lld, nread = %d)

Leftovers after chunking. Rewinding %d bytes

Operation timed out after %ld milliseconds with %lld bytes received

Operation timed out after %ld milliseconds with %lld out of %lld bytes received

unspecified error %d

%s cookie %s="%s" for domain %s, path %s, expire %d

#HttpOnly_

httponly

I99[^;

skipped cookie with bad tailmatch domain: %s

skipped cookie with illegal dotcount domain: %s

23[^;=]=I99[^;

%s%s%s

# Fatal libcurl error

# Netscape HTTP Cookie File

# hXXp://curl.haxx.se/rfc/cookie_spec.html

# This file was generated by libcurl! Edit at your own risk.

bind failure: %s

Local port: %d

Bind to local port %d failed, trying next

couldn't find my own IP address (%s)

Bind local address to %s

Couldn't bind to '%s'

TCP_NODELAY set

Could not set TCP_NODELAY: %s

Failed to connect to %s: %s

Trying %s...

Internal error removing splay node = %d

Internal error clearing splay node = %d

Error in the SSH layer

Caller must register CURLOPT_CONV_ callback options

TFTP: No such user

TFTP: Unknown transfer ID

TFTP: Illegal operation

TFTP: Access Violation

TFTP: File Not Found

Login denied

Issuer check against peer certificate failed

Invalid LDAP URL

Unrecognized HTTP Content-Encoding

Problem with the SSL CA cert (path? access rights?)

Peer certificate cannot be authenticated with known CA certificates

Problem with the local SSL certificate

SSL peer certificate or SSH md5 fingerprint was not OK

A libcurl function was given a bad argument

Operation was aborted by an application callback

FTP: command REST failed

FTP: command PORT failed

HTTP response code said error

FTP: couldn't retrieve (RETR failed) the specified file

FTP: couldn't set file type

FTP: can't figure out the host in the PASV response

FTP: unknown 227 response format

FTP: unknown PASV reply

FTP: unknown PASS reply

FTP: weird server reply

URL using bad/illegal format or missing URL

Unsupported protocol

Winsock version not supported

Protocol family not supported

Address family not supported

Operation not supported

Socket is unsupported

Protocol is unsupported

Protocol option is unsupported

Unknown error %d (%#x)

Resolving host timed out: %s

Could not resolve host: %s; %s

Could not resolve proxy: %s; %s

Could not resolve host: %s

gethostbyname(2) failed for %s:%d; %s

init_resolve_thread() failed for %s; %s

TFTP

set timeouts for state %d; Total %d, retry %d maxtry %d

tftp_rx: giving up waiting for block %d

Received unexpected DATA packet block %d

Timeout waiting for block %d ACK. Retries = %d

tftp_rx: internal error

tftp_tx: giving up waiting for block %d ack

Received ACK for block %d, expecting %d

tftp_tx: internal error

bind() failed; %s

tftp_send_first: internal error

%s%c%s%c

TFTP finished

Can't get the size of %s

Can't open %s for writing

Last-Modified: %s, d %s M d:d:d GMT

Couldn't open file %s

There are more than %d entries

LDAP remote: %s

LDAP local: ldap_simple_bind_s %s

LDAP local: Cannot connect to %s:%d

LDAP local: trying to establish %s connection

LDAP local: %s

LDAP local: LDAP Vendor = %s ; LDAP Version = %d

CLIENT libcurl 7.19.0

MATCH %s %s %s

DEFINE %s %s

insufficient winsock version to support telnet

WSAStartup failed (%d)

%s %d %d

%s %s %d

%s %s %s

%s IAC %d

%s IAC %s

Sending data failed (%d)

%d (unknown)

%s (unsupported)

%s IAC SB

Syntax error in telnet option: %s

Unknown telnet option %s

7[^= ]%*[ =]%5s

USER,%s

%c%c%c%c%s%c%c

%c%s%c%s

7[^,],7s

%c%c%c%c

FreeLibrary(wsock2) failed (%d)

WSACloseEvent failed (%d)

WSACreateEvent failed (%d)

failed to find WSAEnumNetworkEvents function (%d)

failed to find WSAEventSelect function (%d)

failed to find WSACloseEvent function (%d)

failed to find WSACreateEvent function (%d)

failed to load WS2_32.DLL (%d)

WS2_32.DLL

Excessive FTP response line length received, %zd bytes. Stripping

FTP response reading failed

FTP response aborted due to select/poll error: %d

FTP response timeout

Failed FTP upload: 

RETR response: d

Connecting to %s (%s) port %d

Uploading to a URL without a file name!

FTPS not supported!

USER %s

socket(2) failed (%s)

PORT %d,%d,%d,%d,%d,%d

Telling server to connect to %d.%d.%d.%d:%d

Failed to resolve host name %s

getsockname() failed: %s

Connect data stream passively

REST %d

SIZE %s

STOR %s

APPE %s

Bad PASV/EPSV response: d

Can't resolve new host %s:%d

%d.%d.%d.%d

Skips %d.%d.%d.%d for data connection, uses %s instead

%d,%d,%d,%d,%d,%d

%c%c%c%u%c

Failed to do PORT

Got a d response code instead of the assumed 200

RETR %s

ftp server doesn't support SIZE

PBSZ %d

Access denied: d

ACCT %s

PASS %s

ACCT rejected by server: d

QUOT string not accepted: %s

TYPE %c

MDTM %s

ddd d:d:d GMT

dddddd

unsupported MDTM reply format

server did not report OK, got %d

Remembering we are in dir "%s"

CWD %s

Failed to MKD dir: d

MKD %s

QUOT command failed with d

Entry path is '%s'

PROT %c

unsupported parameter to CURLOPT_FTPSSLAUTH: %d

AUTH %s

Got a d ftp-server response when 220 was expected

%sAuthorization: Basic %s

%s:%s

Server auth using %s with user '%s'

Proxy auth using %s with user '%s'

Failed sending HTTP POST request

Content-Type: application/x-www-form-urlencoded

Internal HTTP POST error!

Failed sending HTTP request

If-Unmodified-Since: %s

Last-Modified: %s

If-Modified-Since: %s

%s, d %s M d:d:d GMT

%s%s=%s

%s %s%s HTTP/%s

%s%s%s%s%s%s%s%s%s%s%s

Content-Range: bytes %s/%lld

Content-Range: bytes %s%lld/%lld

Range: bytes=%s

;type=%c

ftps://

PTF://

Host: %s%s%s:%d

Host: %s%s%s

Accept-Encoding: %s

Referer: %s

Received HTTP code %d from proxy after CONNECT

%d bytes of chunk left

HTTP/1.%d %d

Read %d bytes of chunk, continue

CONNECT %s:%d HTTP/1.0

%s%s%s%s

Host: %s

Establish HTTP proxy tunnel to %s:%d

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), Unknown.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because the client program and identd report different user-ids.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client.

Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected or failed.

Failed to resolve "%s" for SOCKS4 connect.

No authentication method was acceptable. (It is quite likely that the SOCKS5 server wanted a username/password, since none was supplied to the server on this connection.)

SOCKS5 GSSAPI per-message authentication is not supported.

Can't complete SOCKS5 connection to %d.%d.%d.%d:%d. (%d)

Failed to resolve "%s" for SOCKS5 connect.

User was rejected by the SOCKS5 server (%d %d).

SOCKS5: server resolving disabled for hostnames of length > 255 [actual len=%d]

--:--:--

= %s = %s = %s %s %s %s %s %s %s

password

login

Operation too slow. Less than %d bytes/sec transfered the last %d seconds

%s, algorithm="%s"

%s, opaque="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", response="%s"

%sAuthorization: Digest username="%s", realm="%s", nonce="%s", uri="%s", cnonce="%s", nc=x, qop="%s", response="%s"

%s:%s:x:%s:%s:%s

%s:%s:%s

%5[^=]=23[^

%5[^=]="23[^"]"

d:d:d

%c%c==

%c%c%c=

.html

.jpeg

--%s--

Content-Type: %s

; filename="%s"

Content-Disposition: attachment; filename="%s"

Content-Type: multipart/mixed, boundary=%s

%s; boundary=%s

()$^.* ?[]|\-{},:=!

:/-_.!~*'()

xxxxx

Visual C   CRT: Not enough memory to complete call to strerror.

Broken pipe

Inappropriate I/O control operation

Operation not permitted

GetProcessWindowStation

portuguese-brazilian

operator

()$^.* ?[]|\-{},:=!

Kernel32.DLL

invalid map<K, T> key

User-Agent: %s

http/

NOINT_MSG

urls_to_restore_on_startup

startup_urls

search_url

keyword

zcÁ

.?AVHTTPClientImplementation@@

.?AVHTTPClientInterface@@

.?AV?$EventTSpecificFunctor@VWindowsAPI@@@@

.?AV?$TSpecificFunctor@VWindowsAPI@@@@

.?AVFirefoxBrowserHandler@Browser@Lib@Softonic@@

.?AVChromeBrowserHandler@Browser@Lib@Softonic@@

.?AVWindowsAPI@@

.?AUDWebBrowserEvents2@@

.?AUIHttpNegotiate@@

.?AVCustomIHttpNegotiate@@

.?AV?$EventTSpecificFunctor@VCurlMultiDownloadJob@@@@

.?AVCurlMultiDownloadJob@@

c:\%original file name%.exe

GetCPInfo

GetProcessHeap

PeekNamedPipe

RegCloseKey

RegEnumKeyExW

RegCreateKeyExW

RegOpenKeyExW

RegDeleteKeyW

RegQueryInfoKeyW

ShellExecuteW

ShellExecuteExW

URLDownloadToFileW

UrlMkGetSessionOption

UrlMkSetSessionOption

GetAsyncKeyState

GetKeyState

EnumChildWindows

EnumDesktopWindows

InternetOpenUrlA

.text

`.rdata

@.data

.rsrc

H[%s] %s

[%d][%s|%s][%s][%s]

[%d][%s|%s][%s][%s][%s]

Glog.txt

HKERNEL32.DLL

- Attempt to initialize the CRT more than once.

- CRT not initialized

- floating point support not loaded

mscoree.dll

WUSER32.DLL

.temp

Ld-d-d

[%d] [%lld|%lld]

1.41.3

Got Elevation URL. [%s]

New URL was not valid.

@Received message %s

xxxxxxxxxxx

explorer.exe "

[%d %d]

Hchrome

firefox

0.0.0.0

Web View

Web Host

%d|%d|%d

errorUrl

%s(%s)

%s --> (%s)

.swf?

.jpg?

.gif?

.png?

Value: %d

%s\*.*

%s\%s

Proxy by URL are not supported.

Automatic proxy discovery are not supported.

http=

https=

CPTF://

- URL:

[%d] Starting thread...

[%d] Thread Creation OK!

[%d] Error creating thread! trying again...

[%d] Thread started...

Bhttp/

%d - [%d][%lld/%lld][%lld]

json_writer.cpp

Hjson_value.cpp

Software\Classes\http\shell\open\command\

http\shell\open\command\

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice\

Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice\

chrome.exe

iexplore.exe

firefox.exe

opera.exe

opera

safari.ex

browser.startup.homepage

browser.search.order.1

browser.search.order.2

browser.search.order.3

prefs.js

\"(.)*.;

browser.search.selectedEngine

browser.search.defaultenginename

browser.search.useDBForOrder

user_pref("browser.search.useDBForOrder", "false");

browser.search.useDBForOrder", "false");

browser.search.useDBForOrder.*

%s*.*

Software\Mozilla\Mozilla Firefox\

\Google\Chrome

SOFTWARE\Mozilla\Mozilla Firefox

SOFTWARE\Mozilla\Mozilla Firefox\

PathToExe

\Mozilla\Firefox\profiles.ini

\Mozilla\Firefox\

\search-metadata.json

ljson_reader.cpp

log.txt

Assertion failed: %s, file %s, line %d

w~i!!^uzyw~XwrxpOrv~Wzkh~QH66%X00QH66%X00Ht}oturx_tluwtz

tl@hUzv~XzwwyzxpF5xzww32 ;f;xzoxs3~ii2;`;i~oniu;<^iiti!;<;0;~ii ;f;f'4hxirko%Xzww;Hnxx~~

V_.Szhslz\~o_tluwtz

V_.ZhbuxSzhs

QH66%X00Tyozruru|;ark;}rw~LV!!_X32!;Htv~tu~;

QH66%X00Lru()_tluwtz

%original file name%.exe_2764_rwx_004FB000_00001000:

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.1.1.0" processorArchitecture="X86" name="Softonic.UniversalDownloader" type="win32"></assemblyIdentity><description>Universal Downloader Download Helper.</description><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="X86" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><dependency><dependentAssembly><assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*"></assemblyIdentity></dependentAssembly></dependency><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">

<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"></supportedOS>

<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"></supportedOS>

KERNEL32.DLL

ADVAPI32.dll

COMCTL32.dll

GDI32.dll

gdiplus.dll

IPHLPAPI.DLL

ole32.dll

OLEAUT32.dll

PSAPI.DLL

RPCRT4.dll

SHELL32.dll

SHLWAPI.dll

urlmon.dll

USER32.dll

VERSION.dll

WININET.dll

WLDAP32.dll

WSOCK32.dll

URLDownloadToFileW

[BEGIN DATA SEGMENT][KEY]WIDTH[VALUE]650[ENDVALUE][KEY]HEIGHT[VALUE]450[ENDVALUE][KEY]URL[VALUE]hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader-prefetch[ENDVALUE][KEY]NOINT_TITLE[VALUE]No Internet connection detected[ENDVALUE][KEY]NOINT_MSG[VALUE]Softonic Downloader needs an internet connection to function. Please connect and try again.[ENDVALUE][KEY]PROGRESS_BAR_X[VALUE]20[ENDVALUE][KEY]PROGRESS_BAR_Y[VALUE]99[ENDVALUE][KEY]PROGRESS_BAR_HEIGHT[VALUE]30[ENDVALUE][KEY]START_HIDDEN[VALUE]true[ENDVALUE][KEY]LOADING_DIALOG_TEXT[VALUE]Please wait...[ENDVALUE][KEY]LOADING_DIALOG_TITLE[VALUE]Download and installation process for The Sims 2[ENDVALUE][KEY]MIN_BUTTON_SIZE_X[VALUE]18[ENDVALUE][KEY]MIN_BUTTON_SIZE_Y[VALUE]17[ENDVALUE][KEY]MIN_PROGRAM_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRAM_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_X[VALUE]210[ENDVALUE][KEY]MIN_PROGRESS_TEXT_SIZE_Y[VALUE]20[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_X[VALUE]222[ENDVALUE][KEY]MIN_PROGRESS_BAR_SIZE_Y[VALUE]20[E

1.41.3.7

SoftonicDownloader.exe

%original file name%.exe_2764_rwx_004FD000_00010000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

%original file name%.exe

.rsrc

c:\%original file name%.exe

hXXp://glamfromeast.com/image/logo.gif

hXXp://edirneli.net/tr/logo.gif

hXXp://emrahkucukkapdan.com/img/button.gif

hXXp://gardapalace.it/logo.gif

hXXp://hidroservbistrita.ro/images/logo.gif

hXXp://babystophouse.com/images/logo.gif

hXXp://mabdesign.unlugar.com/button.gif

hXXp://datalinksol.com/logo.gif

hXXp://snsoft.host-ed.me/images/logos.gif

m/images/logos.gif

hXXp://173.193.19.14/logo.gif

.info/J

home.gifI888

.text

KERNEL32.dll

h.rata

Bkrnl.exe?

= =$=(=,=

322%2`.50728)

.klkjw:9fqwi

FamXf39.sys

.pBTa8

%s:*:

Bg.laXV

&?%x=

GUrlA'

Web%w|nc

HTTP)

2GUARDCMD.

.ENHCDM

PL/KPCKwWEB

MM.PFW.

.bssf

J:CRT

ADVAPI32.dll

MSVCRT.dll

SHELL32.dll

USER32.dll

WS2_32.dll

RegCloseKey

SHFileOperationA

%original file name%.exe_2764_rwx_00CF0000_0108E000:

c:\windows

hXXp://glamfromeast.com/image/logo.gif

hXXp://edirneli.net/tr/logo.gif

hXXp://emrahkucukkapdan.com/img/button.gif

hXXp://gardapalace.it/logo.gif

hXXp://hidroservbistrita.ro/images/logo.gif

hXXp://babystophouse.com/images/logo.gif

hXXp://mabdesign.unlugar.com/button.gif

hXXp://datalinksol.com/logo.gif

hXXp://snsoft.host-ed.me/images/logos.gif

%System%\drivers\jqlrtn.sys

15762659888

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

hXXp://89.119.67.154/testo5/

hXXp://kukutrustnet777.info/home.gif

hXXp://kukutrustnet888.info/home.gif

hXXp://kukutrustnet987.info/home.gif

.text

KERNEL32.dll

USER32.dll

h.rdata

H.data

.reloc

ntoskrnl.exe

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50728)

Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Software\Microsoft\Windows\CurrentVersion

hXXp://VVV.klkjwre9fqwieluoi.info/

hXXp://kukutrustnet777888.info/

Software\Microsoft\Windows\CurrentVersion\policies\system

Software\Microsoft\Windows\ShellNoRoam\MUICache

%s:*:Enabled:ipsec

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced

GdiPlus.dll

hXXp://

ipfltdrv.sys

VVV.microsoft.com

?%x=%d

&%x=%d

SYSTEM.INI

USER32.DLL

.%c%s

\\.\amsint32

NTDLL.DLL

autorun.inf

ADVAPI32.DLL

win%s.exe

%s.exe

WININET.DLL

InternetOpenUrlA

avast! Web Scanner

Avira AntiVir Premium WebGuard

cmdGuard

cmdAgent

Eset HTTP Server

ProtoPort Firewall service

SpIDer FS Monitor for Windows NT

Symantec Password Validation

WebrootDesktopFirewallDataService

WebrootFirewall

%d%d.tmp

SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

%s\%s

%s\Software\Microsoft\Windows\CurrentVersion\Ext\Stats

Software\Microsoft\Windows\CurrentVersion\Ext\Stats

SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Explorer.exe

A2CMD.

ASHWEBSV.

AVGCC.AVGCHSVX.

DRWEB

DWEBLLIO

DWEBIO

FSGUIEXE.

MCVSSHLD.

NPFMSG.

SYMSPORT.

WEBSCANX.

.adata

M_%d_

%c%d_%d

?456789:;<=

!"#$%&'()* ,-./0123

GetProcessHeap

GetWindowsDirectoryA

RegEnumKeyExA

RegDeleteKeyA

RegOpenKeyExA

RegCreateKeyA

RegCloseKey

SHFileOperationA

&3&3&3&389

.rdata

.data

Bkrnl.exe?

= =$=(=,=

322%2`.50728)

.klkjw:9fqwi

FamXf39.sys

.pBTa8

%s:*:

Bg.laXV

&?%x=

GUrlA'

Web%w|nc

HTTP)

2GUARDCMD.

.ENHCDM

PL/KPCKwWEB

MM.PFW.

.bssf

J:CRT

ADVAPI32.dll

MSVCRT.dll

SHELL32.dll

WS2_32.dll

%original file name%.exe_2764_rwx_02CD0000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

%original file name%.exe_2764_rwx_02DE0000_00001000:

|%original file name%.exeM_2764_

Explorer.EXE_1948_rwx_01100000_00002000:

SHELL32.DLL

ShellExecuteA

KERNEL32.DLL

.rsrc

Explorer.EXE_1948_rwx_01110000_00001000:

|explorer.exeM_1948_

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Cookies\L7XHTVXM.txt (111 bytes)
   %WinDir%\system.ini (72 bytes)
   %Documents and Settings%\%current user%\Cookies\R3AX0AR2.txt (381 bytes)
   %Documents and Settings%\%current user%\Cookies\H9UHGJ2H.txt (1329 bytes)
   %Documents and Settings%\%current user%\Cookies\7Y6M6VWJ.txt (1335 bytes)
   %Documents and Settings%\%current user%\Cookies\X90Y86O1.txt (913 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\__utm[1].gif (245 bytes)
   %Documents and Settings%\%current user%\Cookies\ITAKEHM8.txt (1335 bytes)
   %Documents and Settings%\%current user%\Cookies\KIM8SJZ2.txt (1117 bytes)
   %Documents and Settings%\%current user%\Cookies\5U98BYKM.txt (1335 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\f[1].txt (23945 bytes)
   C:\autorun.inf (226 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\f[2].txt (93111 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\universaldownloader-prefetch[1].txt (11407 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\loading[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\306e0-e381f[1].js (185532 bytes)
   %Documents and Settings%\%current user%\Cookies\27KDM6JI.txt (709 bytes)
   %Documents and Settings%\%current user%\Cookies\HDHM2L44.txt (147 bytes)
   %Documents and Settings%\%current user%\Cookies\6Q7GUTIV.txt (1335 bytes)
   %Documents and Settings%\%current user%\Cookies\LYY5Y7T1.txt (1335 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014083020140831\index.dat (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\winqqjtl.exe (741 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\sd_101196_6142a[1].png (7322 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\upgrade_flash_player2[1].gif (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\sprite[1].png (7 bytes)
   %Documents and Settings%\%current user%\Cookies\N13MPC7I.txt (1333 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\gradientbg[1].png (2 bytes)
   %Documents and Settings%\%current user%\Cookies\XB45OPSG.txt (1329 bytes)
   %Documents and Settings%\%current user%\Cookies\P9CICZCB.txt (1333 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\universaldownloader-track[1] (15 bytes)
   C:\mljl.exe (103 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\sd_101294_ba965[1].png (842 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\pubads_impl_47[1].js (60324 bytes)
   %Documents and Settings%\%current user%\Cookies\9K25HFON.txt (709 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Cookies\2XXGE86N.txt (122 bytes)
   %Documents and Settings%\%current user%\Cookies\21B7UTWC.txt (1335 bytes)
   %Documents and Settings%\%current user%\Cookies\S0G8HX3Z.txt (1335 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\the-sims-2-41[1].jpg (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\campaign-101294,101196[1].txt (6570 bytes)
   %System%\wbem\Logs\wbemprox.log (160 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
   %Program Files%\Common Files\Java\Java Update\jusched.exe (368 bytes)
   %Documents and Settings%\%current user%\Cookies\PLFCBD6K.txt (1335 bytes)
   %Documents and Settings%\%current user%\Cookies\66LWUU6U.txt (1335 bytes)
   %Documents and Settings%\%current user%\Cookies\LP53XZEY.txt (1333 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\fad58-b3118[1].css (13495 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.