Win32.Sality.3_9460b2f629

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:1776
Explorer.EXE:1684

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1776 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\fad58-b3118[2].css (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winquylkx.exe (741 bytes)
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hitman-pro.sd.en.softonic[1].txt (10557 bytes)
C:\autorun.inf (269 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\campaign-100624,101361[1] (1714 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sd_100624_634cd[1].jpg (5769 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pubads_impl_48[1].js (2696 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hitman-pro.sd.en.softonic[2].txt (11051 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (405 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\loading[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAOTA1N8.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_101361_af128[1].jpg (9402 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\306e0-971e8[1].js (8365 bytes)
C:\pkgtsr.pif (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].txt (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAYFG3AJ.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sprite[1].png (7 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pubads_impl_48[2].js (4636 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[1].htm (353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hitman-3[1].png (1228 bytes)
%System%\wbem\Logs\wbemprox.log (152 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sd_100624_634cd[1].jpg (4289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[1].txt (3656 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAWTE3ST.gif (35 bytes)
%Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (1336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAKXIBW9.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gradientbg[1].png (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA5FB5CW.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[2].txt (3494 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.en.softonic[1].txt (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\container[1].html (1287 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CASXUF09.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\campaign-100624,101361[1].htm (965 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAFP5317.gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\container[1].htm (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\fad58-b3118[1].css (5 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (21400 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (272 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.en.softonic[2].txt (233 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\winquylkx.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAOTA1N8.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hitman-pro.sd.en.softonic[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA5FB5CW.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAYFG3AJ.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAWTE3ST.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@hitman-pro.sd.en.softonic[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pubads_impl_48[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAKXIBW9.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041020140411\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\fad58-b3118[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAFP5317.gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sd.en.softonic[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CASXUF09.gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041020140411 (0 bytes)

Registry activity

The process %original file name%.exe:1776 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a1_0" = "2166245492"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas\695404737]
"35845605" = "267"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090820140909]
"CacheRepair" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas\695404737]
"50183847" = "23E4F7F25F8A545EF07859773043475EDD1D103E2D9C27F1F3A268ED09F30DE884DB9D92FD831B72EEF599E8C233EB23FBE7145BFA46281679ED385593CEE8869548167F08C5681A4B967232DBC5E0E01EC06026FCE8B24FCB589B28C073413E3C9C326851C4731397E851C96D85B6EDDDAA4E25FA227776D385991927AE94FC"
"43014726" = "0800687474703A2F2F616C7468617772792E6F72672F696D616765732F78732E6A706700687474703A2F2F7777772E6361726565726465736B2E6F72672F696D616765732F78732E6A706700687474703A2F2F6172746875722E6E697269612E62697A2F78732E6A706700687474703A2F2F616D73616D65782E636F6D2F78732E6A706700687474703A2F2F6170706C652D7069652E696E2F696D616765732F78732E6A706700687474703A2F2F61686D65646979652E6E65742F78732E6A706700687474703A2F2F67322E6172726F776869746563682E636F6D2F78732E6A706700687474703A2F2F616D7079617A696C696D2E636F6D2E74722F696D616765732F7873322E6A7067"

[HKCU\Software\Aas]
"a3_0" = "17001001"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090820140909]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Softonic\Universal Downloader]
"uuid" = "01750077-D3A8-493E-8564-7EA506B4EE50"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090820140909]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014090820140909\"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas\695404737]
"14338242" = "0"
"7169121" = "136"

"21507363" = "0"
"28676484" = "35"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014090820140909]
"CachePrefix" = ":2014090820140909:"
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B4 A6 19 13 6C A2 58 32 ED 1C 94 64 B3 DD A2 32"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Aas]
"a2_0" = "7512"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_0" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041020140411]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
750d1eb4906ae7230da235ee9afa7b3f	c:\pkgtsr.pif

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\fad58-b3118[2].css (22 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\winquylkx.exe (741 bytes)
   %WinDir%\system.ini (72 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@hitman-pro.sd.en.softonic[1].txt (10557 bytes)
   C:\autorun.inf (269 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\campaign-100624,101361[1] (1714 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\sd_100624_634cd[1].jpg (5769 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pubads_impl_48[1].js (2696 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@hitman-pro.sd.en.softonic[2].txt (11051 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[1].txt (405 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\loading[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAOTA1N8.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\sd_101361_af128[1].jpg (9402 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\306e0-971e8[1].js (8365 bytes)
   C:\pkgtsr.pif (103 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\f[1].txt (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAYFG3AJ.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\sprite[1].png (7 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\pubads_impl_48[2].js (4636 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\universaldownloader-prefetch[1].htm (353 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\hitman-3[1].png (1228 bytes)
   %System%\wbem\Logs\wbemprox.log (152 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\sd_100624_634cd[1].jpg (4289 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\f[1].txt (3656 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAWTE3ST.gif (35 bytes)
   %Program Files%\Adobe\Reader 9.0\Reader\Reader_sl.exe (1336 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAKXIBW9.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\gradientbg[1].png (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA5FB5CW.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\f[2].txt (3494 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@sd.en.softonic[1].txt (211 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\container[1].html (1287 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CASXUF09.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\campaign-100624,101361[1].htm (965 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAFP5317.gif (35 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\container[1].htm (2 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\fad58-b3118[1].css (5 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (21400 bytes)
   %Program Files%\Common Files\Java\Java Update\jusched.exe (272 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@sd.en.softonic[2].txt (233 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Softonic
Product Name: Softonic Downloader
Product Version: 1.41.3.10
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: SoftonicDownloader.exe
Internal Name: SoftonicDownloader.exe
File Version: 1.41.3.10
File Description: Softonic Downloader
Comments:
Language: English (United States)

Company Name: Softonic Product Name: Softonic Downloader Product Version: 1.41.3.10Legal Copyright: Copyright (C) 2014Legal Trademarks: Original Filename: SoftonicDownloader.exe Internal Name: SoftonicDownloader.exe File Version: 1.41.3.10File Description: Softonic Downloader Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
aQBhCLj8	4096	688128	0	0	d41d8cd98f00b204e9800998ecf8427e
W8PdGtu2	692224	323584	323072	5.54413	08cfcf9da2b8d144b776487f0f5751e8
.rsrc	1015808	94208	94208	5.33009	03625559ec6a7f5a353ea4f41e1d95c4

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=1&utmn=133229865&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=installation assistant&utmhid=996137364&utmr=-&utmp=/98580/universaldownloader-prefetch&utmht=1410164358952&utmac=UA-48247475-1&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://46.28.209.74/blank.gif?product=st_session&event=prefetch:session:create&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&ab_test=&download_date=1410164347&execution_date=1410164359234&client_timezone=3&api_version=1.41.3&id_machine=a8a67a25000000000000000c298e22d8&id_user=01750077-D3A8-493E-8564-7EA506B4EE50&os=WindowsXP&default_browser=iexplorer&default_browser_version=6.0.2900.5512&default_browser_language=en&default_browser_used=0&default_browser_search_provider=&default_browser_homepage=&id_cob=200&id_file=98580&id_section=556&id_main_section=548
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=camp_rpm&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101363&default_rpm=303&campaign_id=101362&default_rpm=653&campaign_id=101361&default_rpm=700&campaign_id=100624&default_rpm=2463&campaign_id=100516&default_rpm=1168&campaign_id=100509&default_rpm=2345&campaign_id=33121&default_rpm=1&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&excluded=0&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&excluded=0&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&sc_id=-2&sc_type=ns&met=true&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&sc_id=1160&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1259&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1124&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1155&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1284&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1239&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1132&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1131&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1130&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=682&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=680&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=681&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=868&sc_type=s&met=true&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1162&sc_type=s&met=true&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&sc_id=134&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.70/universaldownloader-track
hxxp://46.28.209.74/blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&id_campaign=100624&id_campaign=101361
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=2&utmn=1697242173&utmhn=hitman-pro.sd.en.softonic.com&utmt=event&utme=5(js_error*SDCaughtError*A not tracked http connection ID has triggered the callback - no error provided)&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=installation assistant&utmhid=996137364&utmr=-&utmp=/98580/universaldownloader-prefetch&utmht=1410164359749&utmac=UA-48247475-1&utmni=1&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=6AAgAAAAC~
hxxp://46.28.209.70/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359
hxxp://46.28.209.70/css/generated/fad58-b3118.css
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100624/sd_100624_634cd.jpg	46.28.209.52
hxxp://screenshots.en.sftcdn.net/en/scrn/98000/98580/hitman-3.png	46.28.209.52
hxxp://46.28.209.70/shared/img/sd_client/gradientbg.png
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://46.28.209.70/shared/img/sd_client/sprite.png
hxxp://46.28.209.70/shared/img/sd_client/loading.gif
hxxp://screenshots.en.sftcdn.net/campaign/scrn/101000/101361/sd_101361_af128.jpeg	46.28.209.52
hxxp://pagead46.l.doubleclick.net/gpt/pubads_impl_48.js
hxxp://pagead46.l.doubleclick.net/pagead/show_companion_ad.js
hxxp://pagead-googlehosted.l.google.com/safeframe/1-0-0/html/container.html
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=3&utmn=956136779&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=-&utmp=/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359&utmht=1410164361202&utmac=UA-48247475-1&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=4&utmn=657387091&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1410164361343&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=5&utmn=466526901&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1410164361374&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=6&utmn=1283831330&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1410164361484&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=7&utmn=1212637154&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1410164361515&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=8&utmn=1591044772&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/C100624--load1&utmht=1410164361577&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=9&utmn=1852854664&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/C101361--load2&utmht=1410164361624&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://screenshots.en.sftcdn.net/campaign/scrn/100000/100624/sd_100624_634cd.jpg?v=0.7186634075081184	46.28.209.52
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&sc_id=-2&sc_type=ns&met=true&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&id_campaign=100624&id_campaign=101361
hxxp://static.sd-client.en.softonic.com/shared/img/sd_client/gradientbg.png
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1132&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1162&sc_type=s&met=true&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://www.googletagservices.com/tag/js/gpt.js	173.194.113.217
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1284&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1259&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://static.sd-client.en.softonic.com/css/generated/fad58-b3118.css
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_rpm&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101363&default_rpm=303&campaign_id=101362&default_rpm=653&campaign_id=101361&default_rpm=700&campaign_id=100624&default_rpm=2463&campaign_id=100516&default_rpm=1168&campaign_id=100509&default_rpm=2345&campaign_id=33121&default_rpm=1&sd_flag=1
hxxp://tpc.googlesyndication.com/safeframe/1-0-0/html/container.html	173.194.39.108
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=682&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1131&sc_type=ns&met=false&sd_flag=1
hxxp://static.sd-client.en.softonic.com/shared/img/sd_client/loading.gif
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=8&utmn=1591044772&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/C100624--load1&utmht=1410164361577&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.113.196
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&excluded=0&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=681&sc_type=ns&met=false&sd_flag=1
hxxp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359
hxxp://hitman-pro.sd.en.softonic.com/universaldownloader-track
hxxp://static.sd-client.en.softonic.com/shared/img/sd_client/sprite.png
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=9&utmn=1852854664&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/C101361--load2&utmht=1410164361624&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.113.196
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=680&sc_type=ns&met=false&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=7&utmn=1212637154&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1410164361515&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.113.196
hxxp://pagead2.googlesyndication.com/pagead/show_companion_ad.js	173.194.113.218
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1130&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=2&utmn=1697242173&utmhn=hitman-pro.sd.en.softonic.com&utmt=event&utme=5(js_error*SDCaughtError*A not tracked http connection ID has triggered the callback - no error provided)&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=installation assistant&utmhid=996137364&utmr=-&utmp=/98580/universaldownloader-prefetch&utmht=1410164359749&utmac=UA-48247475-1&utmni=1&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=6AAgAAAAC~	173.194.113.196
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=1&utmn=133229865&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=installation assistant&utmhid=996137364&utmr=-&utmp=/98580/universaldownloader-prefetch&utmht=1410164358952&utmac=UA-48247475-1&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~	173.194.113.196
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=5&utmn=466526901&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1410164361374&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.113.196
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&sc_id=1160&sc_type=ns&met=false&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=3&utmn=956136779&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=-&utmp=/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359&utmht=1410164361202&utmac=UA-48247475-1&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~	173.194.113.196
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=4&utmn=657387091&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1410164361343&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.113.196
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=868&sc_type=s&met=true&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&excluded=0&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1155&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1124&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://partner.googleadservices.com/gpt/pubads_impl_48.js	173.194.113.205
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&sc_id=134&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1239&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_session&event=prefetch:session:create&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&ab_test=&download_date=1410164347&execution_date=1410164359234&client_timezone=3&api_version=1.41.3&id_machine=a8a67a25000000000000000c298e22d8&id_user=01750077-D3A8-493E-8564-7EA506B4EE50&os=WindowsXP&default_browser=iexplorer&default_browser_version=6.0.2900.5512&default_browser_language=en&default_browser_used=0&default_browser_search_provider=&default_browser_homepage=&id_cob=200&id_file=98580&id_section=556&id_main_section=548
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=6&utmn=1283831330&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1410164361484&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.113.196

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&id_campaign=100624&id_campaign=101361 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /gpt/pubads_impl_48.js HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: partner.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Last-Modified: Wed, 27 Aug 2014 20:22:25 GMT

Date: Sat, 06 Sep 2014 01:04:41 GMT

Expires: Sun, 06 Sep 2015 01:04:41 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33733

X-XSS-Protection: 1; mode=block

Age: 198879

Cache-Control: public, max-age=31536000

Alternate-Protocol: 80:quic

......n.....w..F.8..^......."......,....Xn....h$....Ul..?3.........r........;YL.|.Nm....oO..?..36.u.w...|1.n_..h....|.8... ..R..,...Y.&...&....q.[..8..y...p..|.b.....:.-....U...Jd....vB_.6g.4O..f.........x.mQ........(..AOB...[).u.r-..t1..9|.!5.....vw..4...4..."5...a.).::....iv...s..!.N}.m..,g}ntg...W..m.'......OXW.#...*.g..... .G1.W...@..~...EQ..b!...r:.R.. ...DJ...`..].]... ..5...3..X^.o....kGb.....{..<O4.........V,.....l1./....jl...Gw^.|..s8...y..q.a}.......X...X.&....6o.p....agL..z<\/.....|0O..O..tn..<8...<..F>.=.8g...YVE..Z.........Us-..`..rh!.t.\..hV..V.....b7k.r...j4.3...........4.3.y..j...U.........C./.odwpO..h...Oy.7...r.6..4......-u]M..o.m5-.E../..z..v.\.D..&....p./...mai..../.]....jPj.~..5...sv....8........N... ~.o0._ ]U_.!.Oa1.~P.=..P....4.fL3L.&./.<...R>..z.....:.aO......v..l#.GiH.l..k..(eR..p..`AU3h?>.y8z?.a.l......PD.,!.<....y.N(...k{.U.$.2..}..9...jO8...ob...Ob.:^dy:.t..0....A........o.......,.]..G..\.U6. .'q...8....R.~..3...7k.........................9.v.d...X.}..;.........9f..e.....y...,....]...........7..Z.k*...jvVl...]...~..7......_.~...W..._...[_ .........}vT...........|...=.~.........\..*.3....yua....0..gx.....j......8./...W.q5..y....b.x..]....Q.)!..?p/.....Qn......&T..ZV...".pc.a...k...;....S.L....*8...I.*...fk.._......k.b...d8....p......|....n..v...[?Y.......kw..z....4...-......P....`.-W" ...%b...<.<../...8\...........U..Vg12g1,.".o1..>.u..9 ..q.......g..8........S.Z..-.C.....&.L08....s..1.S0..M..}./.!....[.B.9E...=..~.._...W.;......v....v[ ..v.5.-V.|..

<<< skipped >>>

GET /safeframe/1-0-0/html/container.html HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: tpc.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/html

Last-Modified: Tue, 14 Jan 2014 13:13:27 GMT

Date: Thu, 04 Sep 2014 16:30:33 GMT

Expires: Fri, 04 Sep 2015 16:30:33 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 1287

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 316127

Alternate-Protocol: 80:quic

......n....VyS.8...Oa<.G".....4.#C.Q.B.= Iw.[q\.;......>.N..;;.3MyO...]Vs...}{w}d..8..j....9.<...*R.....8.|,.v.(.¶.R....As..O.e..h.J.0..p..*J.B...4|P.(.4..Z6`...BMeb.....m..y.m..BU.!....a.].....E!W.lm..4.. ..j$.8....0...n.2..!I`Lh.l.....:@b.<S.I .WCb^M..&.So......w.u....szd........DaR.... .718.P...t;.......?.&....4..*.0.a.$.X.!.......A.O...[..5X.]..h..(0.9.y[.Q...4.B....v..I...*....a......M=MD:4.ZO.6.<.g.@/...G.z.....^.FI..=.4...7 ..N.R.h.a....arQ..L.!.N.:.-.P....B.D...=...n.a....e".`J....'\f.8N."s]j.(.%!9..@..`.<..<..v.`... g...Y....6.......C....h.......b.s_..G.......-....2..v6.#EL...je;....p.......d."...]U.e..b.s.R.[O.j.E...../.X..p.".......b.^/..R..w.....|.........V....@.=...,........l"..n._..,.......8............"...u....U. .._y.[.i..../T...C..GQ,...yYx.7...h...mL.;.#.zla.-..lw:n;.O..I9......ZC..q5..j&uN.rY...fO......7..;Y..e.......I...{.U..Y..}L..G...1..^....~..P..Sp~.....H/...f..w...).T.8...~s.X..w.X....*..Q5...l.$I.Q......8z...p....b.$.....D.4...p...og.A.$..uj.t.t.....u..ej...e.]....Sa.G.....A.;_.s.)A.5..i&....*.].9....."..(..C...n\.....M..j..V..h....3..e..z...n...]_..d.\;.kW..&"..D...h...T7I..R].u.....).t....e.........C.;.......=...]A!{o...l"..........H..*.o{..E..w..PD.......po.L#L5v....i.gUM....8.....5f..3^...U.l....-............... ......S.S.......Si.......

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=-2&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=681&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1132&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1131&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&sc_id=134&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1284&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /__utm.gif?utmwv=5.4.6&utms=1&utmn=133229865&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=installation assistant&utmhid=996137364&utmr=-&utmp=/98580/universaldownloader-prefetch&utmht=1410164358952&utmac=UA-48247475-1&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~ HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 04 Sep 2014 18:03:33 GMT

Server: Golfe2

Content-Length: 35

Age: 310545

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=2&utmn=1697242173&utmhn=hitman-pro.sd.en.softonic.com&utmt=event&utme=5(js_error*SDCaughtError*A not tracked http connection ID has triggered the callback - no error provided)&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=installation assistant&utmhid=996137364&utmr=-&utmp=/98580/universaldownloader-prefetch&utmht=1410164359749&utmac=UA-48247475-1&utmni=1&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=6AAgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 04 Sep 2014 18:03:33 GMT

Server: Golfe2

Content-Length: 35

Age: 310546

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=3&utmn=956136779&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=-&utmp=/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359&utmht=1410164361202&utmac=UA-48247475-1&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~ HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 04 Sep 2014 18:03:33 GMT

Server: Golfe2

Content-Length: 35

Age: 310548

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=4&utmn=657387091&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1410164361343&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 04 Sep 2014 18:03:33 GMT

Server: Golfe2

Content-Length: 35

Age: 310548

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=5&utmn=466526901&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1410164361374&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 04 Sep 2014 18:03:33 GMT

Server: Golfe2

Content-Length: 35

Age: 310548

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=6&utmn=1283831330&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1410164361484&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 04 Sep 2014 18:03:33 GMT

Server: Golfe2

Content-Length: 35

Age: 310548

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=7&utmn=1212637154&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1410164361515&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 04 Sep 2014 18:03:33 GMT

Server: Golfe2

Content-Length: 35

Age: 310548

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=8&utmn=1591044772&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/C100624--load1&utmht=1410164361577&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 04 Sep 2014 18:03:33 GMT

Server: Golfe2

Content-Length: 35

Age: 310548

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=9&utmn=1852854664&utmhn=hitman-pro.sd.en.softonic.com&utmcs=utf-8&utmsr=1024x768&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Hitman installation assistant&utmhid=1695049069&utmr=http://unknown_browser_unknown_version&utmp=/C101361--load2&utmht=1410164361624&utmac=UA-152357-4&utmcc=__utma=258645779.936077090.1410164359.1410164359.1410164359.1;+__utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 04 Sep 2014 18:03:33 GMT

Server: Golfe2

Content-Length: 35

Age: 310548

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=682&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1130&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&excluded=0&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&sc_id=-2&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=camp_rpm&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101363&default_rpm=303&campaign_id=101362&default_rpm=653&campaign_id=101361&default_rpm=700&campaign_id=100624&default_rpm=2463&campaign_id=100516&default_rpm=1168&campaign_id=100509&default_rpm=2345&campaign_id=33121&default_rpm=1&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

POST /universaldownloader-track HTTP/1.1

md5_hash: a4ef5c03ff41aee281c42df2d703c371

Accept-Language: en-us

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader-prefetch

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

x-requested-with: XMLHttpRequest

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: hitman-pro.sd.en.softonic.com

Content-Length: 9748

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: __utma=258645779.936077090.1410164359.1410164359.1410164359.1; __utmb=258645779.1.10.1410164359; __utmc=258645779; __utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_98580=false; UACA_98580=false; UD1_POSITION_98580=; _FCen=100516||.100624|1|1410164359.101361|1|1410164359

id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&id_machine=a8a67a25000000000000000c298e22d8&id_user=01750077-D3A8-493E-8564-7EA506B4EE50&id_file=98580&id_section=556&id_main_section=548&ab_test=&api_version=1.41.3&timestamp=1410164359&download_browser=unknown_browser&download_browser_version=unknown_version&client_timezone=3&test_track=false&flavour=10&av_installed=&step=prefetch_events&events=[["special_conditions_evaluation",[{"campaign_id":"100516","campaign_priority":1168,"campaign_reranked_priority":null,"spec

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: sd_client_en-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=sd.en.softonic.com

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 35

Keep-Alive: timeout=3, max=9

Connection: Keep-Alive

Content-Type: application/json; charset=utf-8

...........V*.I,)-V.R..V.....l.........

GET /98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: hitman-pro.sd.en.softonic.com

Connection: Keep-Alive

Cookie: __utma=258645779.936077090.1410164359.1410164359.1410164359.1; __utmb=258645779.2.9.1410164359; __utmc=258645779; __utmz=258645779.1410164359.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_98580=false; UACA_98580=false; UD1_POSITION_98580=; _FCen=100516||.100624|1|1410164359.101361|1|1410164359

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: sd_client_en-admin=deleted; expires=Sun, 08-Sep-2013 08:19:19 GMT; path=/; domain=sd.en.softonic.com

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 12753

Keep-Alive: timeout=3, max=8

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

...........}.r.8.......mK....J..^..d]VI.;*X$......R.r.'.76b......O.K63...K%[.3...=V.....Df.H$^.e.l.........._m....\.TzW.).v/w.....cV)..e`...m.5.Ri.4.r.0..K..pX...^. ]^...V. ...0U.h.Vn..Kj.n..bc........c...6r..a...i....}nX........y`...e. B.q.l..B..../K......`.1.....x..1.sC...9..].....u=...9VJ*!...%.o7r.........d.....l?d....B~....[C.%..R(@.R..x..nO....0.j.^.m.r..<............O...X.$Am>.B.4Gd.......m.H<.h .;.K..,.........|.. ..X......!.n..~...p........jQ.......E|?..z..Q.}.w|.......;9.lA../..8..8<....r.......%Ud..!......7v....F.)..9..;...f?.\/...a..EEY..3...o...tFH.......<...xQX..K.'i.a...........(....4.1....]..#..k.F.E.p.Q4Q.....Ic.IOl..2.W.........j..p...eKq.'......<.&..I.`.......'....j....s.a..._.O..'.......1j_.,...f..).....w..O...O......F....@...Y...5.LC...9..|-..:..Y .!...C...3..3-...Z.d@."@%....., .......X}....U&..qT. ....5@}.....H.R9.&...4...O..".....eB...t.Uh'..L@e..7yT..<...H$..R.....Aj..a...I.,._.....;\~.....1...I...HR....dXV....>....d.b.....&K......h.g..[*...E......@..Z..S.JV.....^...F....Y.........!.s8>A.R./.#N.(...Hfp....}U.s..k...r...# ..R\KB.A5..^..I..H........7......).)...{.TQ.c*...6`..a..........!...O._...s........q........^7.\.l[...]x..Xr........\~P.....-..E.iIU.9^.p2....Ua....MF...k.F..>.0.<.. r.`$.sW......!t.8....(.....h)rm.)....K....3o.tZ..@!.h.$.N.C.g.Zo.....Eu...D|..H...G.u..D..}Zj...2.kKy.t.U.4...j.......N.L.3._;..u..h...V.4yMi...^.M#K.F.bok.do]>..$.,..6..FYF.#%..c.Z...>w.....;b}..t..u8|...........:.~. .Z....I...`..!TE...n.....3wW...5....)(.......T...sr

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&excluded=0&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1124&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=868&sc_type=s&met=true&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1259&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1239&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /tag/js/gpt.js HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: VVV.googletagservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 3803353402700294434

Date: Mon, 08 Sep 2014 07:56:25 GMT

Expires: Mon, 08 Sep 2014 08:56:25 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 15139

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 1375

Alternate-Protocol: 80:quic

...........}iw.<.......o/..4i..bLNi.......G......t....3......y.<.@#K..6...F.._Ly:.Mm....k.{...Q..}..._q...i.b6.k.M.gK....f...z...5....5..".Z..8..0..6.&).r...cv....... ..%$...xX..Elc......Hg..x4.48...,.@W...y4.g.=..W......:.uscM.. ..C5.1...t..e-.a..M....R..x..U.P.y...G.! .b...v.:...2.)....S......bg.].6V..qe5RCo-.q..d.t.0..`]5..@..~...AQ..t'.T({...A........B...)#J...A^....."1.|......l..i..G.`.....N.|GQ#..7}.M3.{.....x.,..t1.O...:|x.5K..............1.........z..Aj..||m.F...e..Hc.&0..rN..M...xvY;..Yl...y.....-.}.{.|Np......;jDk....(......d8...i..u.L.ak..r.%0.C....#....Q.....;..U....N.>...0..,.]D5>..Gt..=P.Q...!Y.FiTEX..."k....Y.~..=.x_.....e..1.>.../x:.}.)'fwpw...@..=Eb..R.t5..i...I.Y.DO.3.f..6J..76wnnZ..m6..N..K....q4..n.YB"..3..?v....^.{..-..v..c.ow.w...N...;..!fIaic..K..>.*.;.........S.j6.;...w.>...f*.y. ...E.?t......l.u..(...&..)}.D..B&.............wM.,.k..?....`..."....>.....<...R.nm7.(A.Ng...l...v>.7.Y.......y."^.s..]B.W2..G.u.V}.......a. .......W.........H9..<.:wZm.8...MA.......%..rU.9%.i.....c...i..pk ...e.....wD..~...7...`..lpsc._..%4..T-../`e@...|p.f..vY.$..{\l4..0<....j...4.;.(....ZP.f.iCz.2>$....'..S. .u.U.....?&j..l..pG.%...#..K...r.v'.].,L..F8[....e.7.QJ`..,.8..k.....).I..9...8a......a.....k.*S......K>K,.~...f..o...o.............(.M.)....@....z....{...v.....................F.Q.0?..`...`>d.....S.....(...S.P.Q`./.n...I...W....S....r..$.Y ?T.. Yz.`(Mv{K..1..Q.:J.(.(.."...,{. Y....}W. `N.u.p.>`i$*8.......g......v.~.....K/.....G.|?...j7XJ.A......Ut..W.q..a4..

<<< skipped >>>

GET /pagead/show_companion_ad.js HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 5831861170746907082

Date: Mon, 08 Sep 2014 08:04:56 GMT

Expires: Mon, 08 Sep 2014 09:04:56 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 45947

X-XSS-Protection: 1; mode=block

Age: 864

Cache-Control: public, max-age=3600

Alternate-Protocol: 80:quic

............i{...0.......t......;..&..O...0..G .@h.....oUih.@V.>...n..LK*.R.&..h>.g....~.....3..bv..x..5.g..h.v<.V k.....j..c...u.r<..f.Q6..........t..U.^...}....`2{|.C..u.%..j.xjb8...a8.....f...............U..A..l..>(dS....yZS._.......^8;..3w..:...[>.....?.(.[u.. ]...sf..p....Ad.c.{.....,....].....1......p1`..0.T..Z.jX.....d:.....l..M..^.w.C.....-X.<..............9....e..7^8.....pc>..h0..c-I....e...I8.=..M(8....`...L..fX..Q.} .....-..G...$,*i..zc...pU....S..l...%.j..navR.d/..`...p........"..2.<..dQB.......(.9.5../....W..E........X.9.4Y.........8.ew2.>.n..U..i..p4.a....0Kk.5.O.w.........=.O..oq.....]..Tl:..m.._. W...[.,.|D.Ot.g....q..."_k.L....s..; rci..P..oT..%....V....),..;.....8..\..v_N.j,......Az...ac.e..9>.....'.._0....c..Q..:..,,..w....-.....6.....Z......u.....>...........o8.o... 6..c............)...z. >..p...U.5..w..d=.<:.n..t.N...p...T.:.O.......{.. ..:...6,^.T...J`.J....&..Cm....>.,...[P_....G. o=.j.......f..n.S.*[....-... .].x.)Y.'.l...#.....o...7GI.}.Y*...@~...iT..-.U,6.A.....Y.9O>o.....>.|H>.&....q.{e.Bo..}..RB..c..;p.t.1..Tw*......e.h.l.j....w............5.....a..q.W..s8.}X...Q83`.}p..X.nL....*....(....5.|c....CY|.>...*.y.B.x.N....#......fX*....3=...z..S..1..".0._.....(..QD...;w.b....!&w.D.nX@`/i.....A'......'...?5.f.....~. [.....}......%.O.U.`..o..1.........S.5...~...._.....9|..{}......>.......`..F5.K../.p././4.......cC.b.m..1.6...7.....Z.xu..OC8....k4.`pkX..,.P....r.>.,....^n....\i=.....[.......X.......x.(y.x...dVa.8....`....D...>.

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&sc_id=1160&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_session&event=prefetch:session:create&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&ab_test=&download_date=1410164347&execution_date=1410164359234&client_timezone=3&api_version=1.41.3&id_machine=a8a67a25000000000000000c298e22d8&id_user=01750077-D3A8-493E-8564-7EA506B4EE50&os=WindowsXP&default_browser=iexplorer&default_browser_version=6.0.2900.5512&default_browser_language=en&default_browser_used=0&default_browser_search_provider=&default_browser_homepage=&id_cob=200&id_file=98580&id_section=556&id_main_section=548 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /campaign/scrn/100000/100624/sd_100624_634cd.jpg HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 11 Feb 2014 10:50:08 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 55463

Accept-Ranges: bytes

Date: Mon, 08 Sep 2014 08:19:20 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 20854

Expires: Wed, 10 Sep 2014 08:19:20 GMT

......JFIF.....%.%.....C....................................................................C.........................................................................|..............................................p...........................!..1A...Qaq.."T.....2RSV..........$&'38Urw...#46BXfv....%(CDFHWb.....)5gsu..7G........................................c........................!..1.AQ..."aq2R......#ST......3BU.....$%&4Cbdst..56Dceru.....EVv....FW...............?........T.I$.e.QC.....&9.s...)K..a....uy.#G.GH...I$..#...wwb..T.....$.U*... ;.*"".wv8UEPY...*....k...7..2....~z..b..-...2].R..%.N....(.n'HT..L.....w.......q.....p..qF..Xh.\>...{.....0..i,!...qum..n.#0W..k?#<x.i...7...>..H.......h......4g.....8..P..........x..........)Z...fr......V.*H*S.....C..._;."..t....[.......Oxv.F.....u[..)5.v.kM.[.....V.5).....%..v..nVT..o'1.v.5..x.m.A.Egx#.....Yf{<H.f...\F.r.p%..d..X.W..txG..Y..]#.R\.0.bW.>.....>.....;....;...I.DY...Lx..6.....,/...u8..CZjCO....}..`..Htt.Q....]Ar[..\.P..x......uk. ".R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R......0...[Fh.Xh...B.&F......;..."..v..u...T ...............?.V.......]s[..z.W..v............X.m..0.pJ.E=.i........'.Q<.ym......h.W.X..mB.^......8.C..7.O.*Ij...{ k...Z7.....t8......n....`.E....)i8....d..HD...4u..c..8<..x....)......M...3.........e.....=...M*..-D.........q.v1...8E.t..c.$P...._p....^J...P..2.5Mf...%./.,..F..hu[[H...[U.....-.... ....vx....T(..s.H....*........I.....=..&..4..,h..$T.p...q...s.)..._>.. )...=..i...w

<<< skipped >>>

GET /campaign/scrn/100000/100624/sd_100624_634cd.jpg?v=0.7186634075081184 HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 11 Feb 2014 10:50:08 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 55463

Accept-Ranges: bytes

Date: Mon, 08 Sep 2014 08:19:21 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: MISS

X-Cache-Hits: 0

Expires: Wed, 10 Sep 2014 08:19:21 GMT

......JFIF.....%.%.....C....................................................................C.........................................................................|..............................................p...........................!..1A...Qaq.."T.....2RSV..........$&'38Urw...#46BXfv....%(CDFHWb.....)5gsu..7G........................................c........................!..1.AQ..."aq2R......#ST......3BU.....$%&4Cbdst..56Dceru.....EVv....FW...............?........T.I$.e.QC.....&9.s...)K..a....uy.#G.GH...I$..#...wwb..T.....$.U*... ;.*"".wv8UEPY...*....k...7..2....~z..b..-...2].R..%.N....(.n'HT..L.....w.......q.....p..qF..Xh.\>...{.....0..i,!...qum..n.#0W..k?#<x.i...7...>..H.......h......4g.....8..P..........x..........)Z...fr......V.*H*S.....C..._;."..t....[.......Oxv.F.....u[..)5.v.kM.[.....V.5).....%..v..nVT..o'1.v.5..x.m.A.Egx#.....Yf{<H.f...\F.r.p%..d..X.W..txG..Y..]#.R\.0.bW.>.....>.....;....;...I.DY...Lx..6.....,/...u8..CZjCO....}..`..Htt.Q....]Ar[..\.P..x......uk. ".R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R......0...[Fh.Xh...B.&F......;..."..v..u...T ...............?.V.......]s[..z.W..v............X.m..0.pJ.E=.i........'.Q<.ym......h.W.X..mB.^......8.C..7.O.*Ij...{ k...Z7.....t8......n....`.E....)i8....d..HD...4u..c..8<..x....)......M...3.........e.....=...M*..-D.........q.v1...8E.t..c.$P...._p....^J...P..2.5Mf...%./.,..F..hu[[H...[U.....-.... ....vx....T(..s.H....*........I.....=..&..4..,h..$T.p...q...s.)..._>.. )...=..i...w

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1162&sc_type=s&met=true&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /css/generated/fad58-b3118.css HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:20 GMT

Server: Apache

Last-Modified: Thu, 04 Sep 2014 14:00:33 GMT

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Wed, 08 Oct 2014 08:19:20 GMT

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 5307

Keep-Alive: timeout=3, max=9

Connection: Keep-Alive

Content-Type: text/css

...........<i...q.. .y..= 5...6....b..:....ZdK..".$5o.........%....}.]...........H..v..s...o6...].....].'......hGZ..Iw...I..*2......_...~.E..U.K...........\.U..yxL..8<N..4<...<........sZd..0/.s.v.sG.J.:..U...s...;.]&F\N.9..:..$....>.yI.#...n.,......z.U..6J.. uK...F...$.......?.....t.P. ...m.........Q.V...}.$~".e_.].v/.].ly...'..8....r..E..CKzUp......"?.......?.'....8~.C..zG..i....;.\R6.......d.kB.6U.r..X..-.K..l._.QdM...D/...6....*=...T....x........-.oFo6.6.....x.g.wUw.|..|..y..>.YF....,/9N.......{......81..n.......GUY.l..p$....q.LxL.........H.]Ge....8k.C..,X..cX{. F'.T..B.I.M[5......0.Z.y.....D.}Q=;dl..Lz...]{nH.~....*h..........!H#.e..1...*......m......../..MN..%e......!..o.L.k.......y).A2.B.3.Y..... ...8N....qA2a?.@.I.......S..Z%.J.w._....W.4.."8.@..1..SRH-pb.W....S......2]*..r.=....R........;.................],.m.....~tj.....3.........g..lA.K..L........."7.pj}.{.;....0C...<..... .N[.9.'..E..G.LR..2.......5......Mu....)~..}.L&..3.....i..C..e.....<..}.-..h1../...5%].D.~.O7.=.-$..Pr..~...@.........nN.._%C..]..-..6..`.\..d...0.H.....wt. ...A...[.........d..3.......te..n!..%.de.f3.3Og...~i.Y.,...........z../......x....K}......|....>l....O....[f.......C.&7t...MPL1.c%4.....q.I..E...5Isp]lX......6..N......-Y........0.o.H....S.(@7..D..1f<S'-e..n...,*.m[J......#ce.6.....f...>........H.oQ^f.3.^J...ZW.`y..d..%...q.A.A......q..<....0!...F..1gD0..".5..p..RR.`....5_.Fr\.B0.. iJ.N...l....#...:G....,5cb....z..k.](..m\L. .`'.......kc.xlT,#...."g.ki..3F....9.5../}.4.H.j.$0W...#.g\.*.=.....

<<< skipped >>>

GET /shared/img/sd_client/gradientbg.png HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:20 GMT

Server: Apache

Last-Modified: Thu, 27 Mar 2014 08:17:09 GMT

Accept-Ranges: bytes

Content-Length: 2958

Cache-Control: max-age=172800

Expires: Wed, 10 Sep 2014 08:19:20 GMT

Keep-Alive: timeout=3, max=8

Connection: Keep-Alive

Content-Type: image/png

.PNG........IHDR...)...........\.....tEXtSoftware.Adobe ImageReadyq.e<....PLTE............................................................................................................................................................O *E...4tRNS....................................................KW"e...HIDATx....v.9..Q{.%y......I.3.\...m..`..u.s1.s.D...Q,. ..`(..S....O.....SJ........8...=.LR.[.&......:.eJY..oI:./...$..BJ.#KS.sH2..%.{F..='..?HR./..6.X......)./R.. ..6.....F..g.[.I.<.l..2$...42.....S.....>..........h2..f..3.........<...X&r....T..gg.-...t.....em<b.V&.g.c....6E,.-..qF6. ...o.Q.$S...(./y...DD..w..:iQ .c....3.&.TcCT.t,UE.E..HP.R.s.......V.`...%...'6.`...g..UIf(..K....uF2..r......T.!..]fLWF..\lU$....=c:2#.`....<...E". .".. qU.7P.[..c.}.J.q.N.*..:g)%...!.. ..,.@x..0.m.8.........A..,9.:l....c....<...G.8...O......?.....5..'}.....TB..#.... Uxq..\..Y....1.P ..P.........Cda...g.....V'....G.:..uW..2.X......a2!.....L..2...mb...f:.i. z........S...u)d8dC.R..q.`..N.^.~.q.......].....U.....%..p1&..b5..K..q..h...D......0...b..?M`...ak..2}J.7....l..<........7\...g!.Jf.0k.......){.-[.f...M.. ..`.hY}..]....Z...z`.J.eb.........Vl..s...p.Zi.*..kd~..Q...l.@......(l.v.L%:..|.c....,..Tg.....I..7[.-#,.....j#...B.`..b.m`..[....g..<Gs......".5c.R.4QC.5.]...X......@.S..I...T.h.6.9MD....w.Xb..N....%0.m./....z{{~.y...........gz.zz.........??{..g~....D...............z._.......k.}...^?v..w.O..........t.x...~..x..}.......................................=..m...]Ew7...._....j_.j.....~.&....\7....~.....Pw..

<<< skipped >>>

GET /shared/img/sd_client/loading.gif HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:20 GMT

Server: Apache

Last-Modified: Thu, 27 Mar 2014 08:17:09 GMT

Accept-Ranges: bytes

Content-Length: 1553

Cache-Control: max-age=172800

Expires: Wed, 10 Sep 2014 08:19:20 GMT

Keep-Alive: timeout=3, max=7

Connection: Keep-Alive

Content-Type: image/gif

GIF89a........................................................................................................................................................................................................................................................................................................................................~..}..|..z..y..x..t..v..s..r..q..p..m..o..l..k..j..............!..NETSCAPE2.0.....!.....|.,............|..;\r....bvwz.....-lqK'......|.[p9.....4lE.....Nj#.....^g.....[c.....G_......[8..!..IV*..'..|#OP1......).. @JGB=93)...$3<9 ......!.....|.,..........y.|.|4RhjW:...)Vilortvd1.&]eA..&Lwt.N`..|<.-[;...|AX....NU....JQ....8M.....%I.....|8C ......<=%.........173/*&!....% '.....!.....|.,..........w.|.|-EY[L3..!GX[_cgjZ..LS6.Cmj..?M)..6r`."I0..Iu:3E...&xZ<A...zr9=.. 8....5!....*0....... *..........!$!................!.....|.,..........w.|.|$9IM@,...8GJOSWZM&..;A..:_]).1<...0dU|.7$..Aj4&3..mR,0..pi(...qk.)..&uX.$..Mw;|....{g.|.......|2....................!.....|.,..........z.|.|.(591#...'258=AE<...)-....-KI ..)...&PE|."...5W,......ZD...._X....c[....fL....Dk4|....9o\......'Jsl......zxa.....[;....!.....|.,..........x.|.|..$'#......"&*.2-......... 77.......=5|.....(C#......G6....LG....QJ...|U?....:Z,|...1_M.N'|.Be]&.fyxtrokV)..;YljS....!.....|.,..........w.|.|...........................$%........*&|......0......3)..95..=9[z...B1<wL./G#.ct8.)M>./mrF.7TL...]nkfc_ZH!.5O_[G....!.....|.,..........v.|.|........|.........1.......gz.|...|;wM.|...Xv'..!.lt..&"jr.|*'So../#5lD.#3.|

<<< skipped >>>

GET /en/scrn/98000/98580/hitman-3.png HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 29 Jun 2010 11:37:15 GMT

Cache-Control: max-age=172800

Content-Type: image/png

Content-Length: 20364

Accept-Ranges: bytes

Date: Mon, 08 Sep 2014 08:19:20 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 5

Expires: Wed, 10 Sep 2014 08:19:20 GMT

.PNG........IHDR...d...d.....p..T....bKGD..............pHYs..........o.d..M_IDATx.m.i.mYv......9w....^..]].t7.(4.l.. !..)J..&%.V0.`......DAR...VP....4C.....z...A..(.....FwUw.\....r..9g...a.s3.....y...............o...T........I..].....fJ.>)...b.....Z.T....}L BR...*{..*',.-.#b......9T.b.{.!a......1...8 .UP)........k.c..?.F.1.........(@......@.1!"........'C.......*.PD.....A..........).8.CW..*..Q...X>...../....|...g......&..mT.lc.$vh..FT......, ..1..@J.(I..BJY8.P9....;C.........Q.......*..b..s.c.#....AS..*Z."?..<...........o.K..%@.{.......M.Yw..K$...D.6.F.Q\Y.,.. "...W...p).%.1(.......1...^...s. ..?{...$..........b....z4F.r.".\.".wW.|q).m.b...`@.....b:..x. $M[.R.....b...h.....`...h^.c.......{..X.,...# ....>....JLJR.1.F....".gT{....UPV...C........P.|m....K^..`PD.JI..F....;g....7E..Zd.$$%.,.1..DJ`.E..SDD..f...I...."E.3-!$.J...78Q..U..@.-._.RRRT.S....5.....s..#E..1.......Q.l...Iu.....RI.@..&.....}....u....x.j#..E..T^]0..h>h.Y.R..K$..4l..#...k.Zk.s.b|A..g.IJ..5.R..w....T.L....18W.R.h...).vLG....t..[.M....KL...&..`.)r..b.....GbTR..%k....[[.......X....km.....P..Y I.1.zI@.)B.DJ....&...t...X.......du.~.E4e.h..1.I.p.0...;........~)...R6C.)$.YA...b .>FB.0A.1....De.....]....xo. ....O.....$J.1.*..Y(..l.'.v....;......P.M.....b..&0Q....T4#./...H1[.T......MQ..I.hlyo.&E..3.g.g.K......D...).Q....V.........ZI.x..M[.%[E..N..3..d.i...k,....>.Xg.M<J.QLH...K..}E...#hD....`.!../B..#Q.k.b......I:.%.1%.. .klq.....s.....8.....1.<...|g.P...J^h.xQ*.....o.}.D....j...q.A.$.R......e;....Z1..N.HV..J.........5!...%....}O

<<< skipped >>>

GET /campaign/scrn/101000/101361/sd_101361_af128.jpeg HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 21 Aug 2014 13:49:15 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 50331

Accept-Ranges: bytes

Date: Mon, 08 Sep 2014 08:19:20 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 604452

Expires: Wed, 10 Sep 2014 08:19:20 GMT

......JFIF.....H.H......Exif..II*................*hXXp://ns.adobe.com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:E51D1E8EAAD211E382BC8783FA93A9BA" xmpMM:DocumentID="xmp.did:E51D1E8FAAD211E382BC8783FA93A9BA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E51D1E8CAAD211E382BC8783FA93A9BA" stRef:documentID="xmp.did:E51D1E8DAAD211E382BC8783FA93A9BA"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...C....................................................................C......................................................................................................................`............................!"1..2A.BQRa.#3bqr...$....C...%4Scs.....Dt.....&'58Tduv.....9UWe...................................F........................"..2..BR.#13br!A..$4Qq........a...S..................?....4y..z..@I=@x.`$..$..J@S.1.IJ.y-.J..V....;..h. bv...z...!?5K..W%...$...b2...9.?v..I...OC.b..i.}3*.K......B....!..5m.\.D.*.\.P.Y)R..y~...U.!n.......;.'4.)<qs..`.V....O[.K.>..Q........vT..w..:....nK.I.....Z;h.m..e3.!

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&sc_id=-2&sc_type=ns&met=true&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=1155&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100516&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=101361&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=6836FA36-775D-40DB-A6BF-E7611FD22079&campaign_id=100624&sc_id=680&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:19 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Sun, 08-Sep-2013 08:19:18 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /shared/img/sd_client/sprite.png HTTP/1.1

Accept: */*

Referer: hXXp://hitman-pro.sd.en.softonic.com/98580/universaldownloader/campaign-100624,101361?sd_timestamp=1410164359

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 08 Sep 2014 08:19:20 GMT

Server: Apache

Last-Modified: Thu, 29 May 2014 10:05:23 GMT

Accept-Ranges: bytes

Content-Length: 7892

Cache-Control: max-age=172800

Expires: Wed, 10 Sep 2014 08:19:20 GMT

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: image/png

.PNG........IHDR.......\.....ld......sBIT.....O.....PLTE...................................................................................................................................h.......................f.....n........Dw.I..............U..}..,...v..\. g...........x.a...R..............>....:n........M..].T*..:.....m....tV.....]........7....Q..P..O)....P.i...O..N..N..M....sJ..M..K..L..L..J..J..JJz...I..I..H..I..H..Istv..H..G..H..G..G..G..F..F.x.go...F..F..E..E..D..D..D..B..C/v...B:~4kid..A..A..@..A..>/g..m..p..i...<..=.z:.g.;b..z:.7@.6?[ZW.5>.u8.4<.s7.b..3;.1:.09{O$./8.p5..7.-6.[..m4&Q..,5. 3.k3(X..*2.)1.R..(0.'/.%,.T..f1.e1.&..$,.$,.%-.# .# ."*.#,."*.!)." .!(.!*.!). (..'. (..&. '.I...'..&..%..&..%..%..$..$.."..#..#..".."..!..!....9.899...................*................>.j.....tRNS.....................................................................................................................................................................................................................................................~T.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6.......gIDATx...._[.^..'.LhC...4.t.K....H.w0......^.)w.i..T...q..w..bq..*U.2j]..hU...^.}).\.......,.@......._..!0.u>y....@.......eh\..fUHC....c.X;4.c..I...m..c...d.B.2...}. ..- ...A....,.:p51.4.Ig..:.}......r......WXw..........z. 3v..^.....2......5.Bw.;...M.......ffx..Ac.......jf...F53.K...y...^.(h..M].>....................y.o.:...m.-.2C....................(.Jro.P............wqo....7....<...7*.z......

<<< skipped >>>

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_1776:

`.rsrc

`.rsrc

PSSSSSSh

PSSSSSSh

PSSSSh

PSSSSh

u.hL?L

u.hL?L

F><.tn>

F><.tn>

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

88888888888888888

88888888888888888

%u$Vj%

%u$Vj%

t.Gj:W

t.Gj:W

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

[%s %s %s]

[%s %s %s]

Send failure: %s

Send failure: %s

Failed writing body (%d != %d)

Failed writing body (%d != %d)

%s:%d

%s:%d

WARNING: failed to save cookies in %s

WARNING: failed to save cookies in %s

About to connect() to %s%s port %d (#%d)

About to connect() to %s%s port %d (#%d)

Connected to %s (%s) port %d (#%d)

Connected to %s (%s) port %d (#%d)

malformed

malformed

:]://%[^

:]://%[^