Win32.Sality.3_f4b257a2d8

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

%original file name%.exe:2764
Explorer.EXE:1948

Mutexes

The following mutexes were created/opened:

c:!documents and settings!adm!local settings!history!history.ie5!mshist012014083020140831!_!SHMSFTHISTORY!_c:!documents and settings!adm!ietldcache!!IETld!Mutex!PrivacIE!SharedMemory!MutexRasPbFileZonesLockedCacheCounterMutexZoneAttributeCacheCounterMutexZonesCacheCounterMutexZonesCounterMutexWininetConnectionMutexWininetProxyRegistryMutexWininetStartupMutexc:!documents and settings!adm!local settings!history!history.ie5!c:!documents and settings!adm!cookies!c:!documents and settings!adm!local settings!temporary internet files!content.ie5!_!MSFTHISTORY!_ShimCacheMutex%original file name%.exeM_2764_wmiprvse.exeM_3704_vmtoolsd.exeM_3132_msiexec.exeM_3460_jqs.exeM_480_mscorsvw.exeM_424_svchost.exeM_1096_lsass.exeM_772_svchost.exeM_928_services.exeM_760_spoolsv.exeM_1432_winlogon.exeM_716_csrss.exeM_692_smss.exeM_644_CTF.TimListCache.FMPDefaultS-1-5-21-796845957-1563985344-1801674531-1003MUTEX.DefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.TMD.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.Layouts.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.Asm.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.Compart.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003CTF.LBES.MutexDefaultS-1-5-21-796845957-1563985344-1801674531-1003uxJLpe1m

File activity

The process %original file name%.exe:2764 makes changes in the file system.

The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Cookies\L7XHTVXM.txt (111 bytes)
%WinDir%\system.ini (72 bytes)
%Documents and Settings%\%current user%\Cookies\R3AX0AR2.txt (381 bytes)
%Documents and Settings%\%current user%\Cookies\H9UHGJ2H.txt (1329 bytes)
%Documents and Settings%\%current user%\Cookies\7Y6M6VWJ.txt (1335 bytes)
%Documents and Settings%\%current user%\Cookies\X90Y86O1.txt (913 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\__utm[1].gif (245 bytes)
%Documents and Settings%\%current user%\Cookies\ITAKEHM8.txt (1335 bytes)
%Documents and Settings%\%current user%\Cookies\KIM8SJZ2.txt (1117 bytes)
%Documents and Settings%\%current user%\Cookies\5U98BYKM.txt (1335 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\f[1].txt (23945 bytes)
C:\autorun.inf (226 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\f[2].txt (93111 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\universaldownloader-prefetch[1].txt (11407 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\loading[1].gif (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\306e0-e381f[1].js (185532 bytes)
%Documents and Settings%\%current user%\Cookies\27KDM6JI.txt (709 bytes)
%Documents and Settings%\%current user%\Cookies\HDHM2L44.txt (147 bytes)
%Documents and Settings%\%current user%\Cookies\6Q7GUTIV.txt (1335 bytes)
%Documents and Settings%\%current user%\Cookies\LYY5Y7T1.txt (1335 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014083020140831\index.dat (16 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winqqjtl.exe (741 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\sd_101196_6142a[1].png (7322 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\upgrade_flash_player2[1].gif (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\sprite[1].png (7 bytes)
%Documents and Settings%\%current user%\Cookies\N13MPC7I.txt (1333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\gradientbg[1].png (2 bytes)
%Documents and Settings%\%current user%\Cookies\XB45OPSG.txt (1329 bytes)
%Documents and Settings%\%current user%\Cookies\P9CICZCB.txt (1333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\universaldownloader-track[1] (15 bytes)
C:\mljl.exe (103 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\sd_101294_ba965[1].png (842 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\pubads_impl_47[1].js (60324 bytes)
%Documents and Settings%\%current user%\Cookies\9K25HFON.txt (709 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Cookies\2XXGE86N.txt (122 bytes)
%Documents and Settings%\%current user%\Cookies\21B7UTWC.txt (1335 bytes)
%Documents and Settings%\%current user%\Cookies\S0G8HX3Z.txt (1335 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\the-sims-2-41[1].jpg (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\campaign-101294,101196[1].txt (6570 bytes)
%System%\wbem\Logs\wbemprox.log (160 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
%Program Files%\Common Files\Java\Java Update\jusched.exe (368 bytes)
%Documents and Settings%\%current user%\Cookies\PLFCBD6K.txt (1335 bytes)
%Documents and Settings%\%current user%\Cookies\66LWUU6U.txt (1335 bytes)
%Documents and Settings%\%current user%\Cookies\LP53XZEY.txt (1333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\fad58-b3118[1].css (13495 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Cookies\L7XHTVXM.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041520130416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\R3AX0AR2.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013040820130415 (0 bytes)
%Documents and Settings%\%current user%\Cookies\H9UHGJ2H.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\7Y6M6VWJ.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\X90Y86O1.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\__utm[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\ITAKEHM8.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\KIM8SJZ2.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\universaldownloader-prefetch[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\9K25HFON.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\HDHM2L44.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\6Q7GUTIV.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\winqqjtl.exe (0 bytes)
%Documents and Settings%\%current user%\Cookies\LYY5Y7T1.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\N13MPC7I.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\27KDM6JI.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\XB45OPSG.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\P9CICZCB.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\universaldownloader-track[1] (0 bytes)
%Documents and Settings%\%current user%\Cookies\66LWUU6U.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\5U98BYKM.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\21B7UTWC.txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013041520130416 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012013040820130415\index.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\PLFCBD6K.txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\LP53XZEY.txt (0 bytes)

Registry activity

The process %original file name%.exe:2764 makes changes in the system registry.

The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Security Center]
"UacDisableNotify" = "1"

[HKCU\Software\Aas]
"a1_0" = "2245020606"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f3-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014083020140831]
"CachePrefix" = ":2014083020140831:"

[HKCU\Software\Aas\695404737]
"35845605" = "346"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"EnableLUA" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"GlobalUserOffline" = "0"

[HKCU\Software\Aas\695404737]
"50183847" = "5B68D29F5F257E60B647DC1827F5438DD92AAD1B81B3A1C6102C99131826B86429DC47A17661558ABD0B88DDDBFC8C493E11520205E0DD6E2B190FFE1E602DF47196BE3B95B876A40411FD1F49281AEC0373FF8649D483A9275B5B5EFC9412D9E9102DCB8E7DB7C56D7F098531F57995DF6F48E78C56E274F6496D19EFFCB523"
"43014726" = "0900687474703A2F2F676C616D66726F6D656173742E636F6D2F696D6167652F6C6F676F2E67696600687474703A2F2F656469726E656C692E6E65742F74722F6C6F676F2E67696600687474703A2F2F656D7261686B7563756B6B617064616E2E636F6D2F696D672F627574746F6E2E67696600687474703A2F2F676172646170616C6163652E69742F6C6F676F2E67696600687474703A2F2F686964726F7365727662697374726974612E726F2F696D616765732F6C6F676F2E67696600687474703A2F2F6261627973746F70686F7573652E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F6D616264657369676E2E756E6C756761722E636F6D2F627574746F6E2E67696600687474703A2F2F646174616C696E6B736F6C2E636F6D2F6C6F676F2E67696600687474703A2F2F736E736F66742E686F73742D65642E6D652F696D616765732F6C6F676F732E676966"

[HKCU\Software\Aas]
"a3_0" = "17001001"
"a3_1" = "23989832"
"a1_1" = "4177335868"

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = "1"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Softonic\Universal Downloader]
"uuid" = "291514EA-E968-44B6-A174-BDA245756B30"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallOverride" = "1"

[HKCU\Software\Aas\695404737]
"14338242" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main\WindowsSearch]
"Version" = "WS not installed"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f5-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas\695404737]
"7169121" = "215"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdd9f6f2-7454-11e2-b4cd-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Aas\695404737]
"21507363" = "0"
"28676484" = "35"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"UacDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014083020140831]
"CacheOptions" = "11"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014083020140831]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014083020140831"

[HKLM\SOFTWARE\Microsoft\Security Center]
"FirewallDisableNotify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "72 20 18 15 6D A1 18 8A 58 89 7C 89 4E DB 3F BA"

[HKCU\Software\Aas]
"a2_1" = "7175682"
"a2_0" = "8341"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{773a730e-74fb-11e2-b597-000c293bdf2f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"FirewallDisableNotify" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Security Center]
"UpdatesDisableNotify" = "1"

[HKCU\Software\Aas]
"a4_1" = "7169121"
"a4_0" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014083020140831]
"CacheRepair" = "0"
"CacheLimit" = "8192"

Adds a rule to the firewall Windows which allows any network activity:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:]
"%original file name%.exe" = "c:\%original file name%.exe:*:Enabled:ipsec"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

Firewall notifications are disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

Antivirus notifications are disabled:

[HKLM\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusDisableNotify" = "1"

A firewall is disabled:

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = "0"

The Trojan deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013041520130416]
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012013040820130415]

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

MD5	File path
7f93abb9de49c64e78045d2211be3105	c:\mljl.exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Trojan's file once a user opens a drive's folder in Windows Explorer.

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:

   %Documents and Settings%\%current user%\Cookies\L7XHTVXM.txt (111 bytes)
   %WinDir%\system.ini (72 bytes)
   %Documents and Settings%\%current user%\Cookies\R3AX0AR2.txt (381 bytes)
   %Documents and Settings%\%current user%\Cookies\H9UHGJ2H.txt (1329 bytes)
   %Documents and Settings%\%current user%\Cookies\7Y6M6VWJ.txt (1335 bytes)
   %Documents and Settings%\%current user%\Cookies\X90Y86O1.txt (913 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\__utm[1].gif (245 bytes)
   %Documents and Settings%\%current user%\Cookies\ITAKEHM8.txt (1335 bytes)
   %Documents and Settings%\%current user%\Cookies\KIM8SJZ2.txt (1117 bytes)
   %Documents and Settings%\%current user%\Cookies\5U98BYKM.txt (1335 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\f[1].txt (23945 bytes)
   C:\autorun.inf (226 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\f[2].txt (93111 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\universaldownloader-prefetch[1].txt (11407 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\loading[1].gif (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\306e0-e381f[1].js (185532 bytes)
   %Documents and Settings%\%current user%\Cookies\27KDM6JI.txt (709 bytes)
   %Documents and Settings%\%current user%\Cookies\HDHM2L44.txt (147 bytes)
   %Documents and Settings%\%current user%\Cookies\6Q7GUTIV.txt (1335 bytes)
   %Documents and Settings%\%current user%\Cookies\LYY5Y7T1.txt (1335 bytes)
   %Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014083020140831\index.dat (16 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\winqqjtl.exe (741 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\sd_101196_6142a[1].png (7322 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\upgrade_flash_player2[1].gif (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\sprite[1].png (7 bytes)
   %Documents and Settings%\%current user%\Cookies\N13MPC7I.txt (1333 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\gradientbg[1].png (2 bytes)
   %Documents and Settings%\%current user%\Cookies\XB45OPSG.txt (1329 bytes)
   %Documents and Settings%\%current user%\Cookies\P9CICZCB.txt (1333 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\universaldownloader-track[1] (15 bytes)
   C:\mljl.exe (103 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\sd_101294_ba965[1].png (842 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\pubads_impl_47[1].js (60324 bytes)
   %Documents and Settings%\%current user%\Cookies\9K25HFON.txt (709 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Cookies\2XXGE86N.txt (122 bytes)
   %Documents and Settings%\%current user%\Cookies\21B7UTWC.txt (1335 bytes)
   %Documents and Settings%\%current user%\Cookies\S0G8HX3Z.txt (1335 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\3F9KLW6F\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVYHJBCC\the-sims-2-41[1].jpg (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\campaign-101294,101196[1].txt (6570 bytes)
   %System%\wbem\Logs\wbemprox.log (160 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SZIS9VJF\desktop.ini (67 bytes)
   %Program Files%\Common Files\Java\Java Update\jusched.exe (368 bytes)
   %Documents and Settings%\%current user%\Cookies\PLFCBD6K.txt (1335 bytes)
   %Documents and Settings%\%current user%\Cookies\66LWUU6U.txt (1335 bytes)
   %Documents and Settings%\%current user%\Cookies\LP53XZEY.txt (1333 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\1GGYBZUQ\fad58-b3118[1].css (13495 bytes)

4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Find and delete all copies of the worm's file together with "autorun.inf" scripts on removable drives.
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name: Softonic
Product Name: Softonic Downloader
Product Version: 1.41.3.7
Legal Copyright: Copyright (C) 2014
Legal Trademarks:
Original Filename: SoftonicDownloader.exe
Internal Name: SoftonicDownloader.exe
File Version: 1.41.3.7
File Description: Softonic Downloader
Comments:
Language: English (United States)

Company Name: Softonic Product Name: Softonic Downloader Product Version: 1.41.3.7Legal Copyright: Copyright (C) 2014Legal Trademarks: Original Filename: SoftonicDownloader.exe Internal Name: SoftonicDownloader.exe File Version: 1.41.3.7File Description: Softonic Downloader Comments: Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
3u0ba0uc	4096	688128	0	0	d41d8cd98f00b204e9800998ecf8427e
TyVOqH71	692224	323584	323072	5.54403	5e6dbab1389e2a7330703431fc92e34b
.rsrc	1015808	90112	90112	5.3849	e2cabe414f74ef6d046ed33858e106ac

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Network Activity

URLs

URL	IP
hxxp://46.28.209.70/js/generated/306e0-e381f.js
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=1&utmn=314903792&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=installation assistant&utmhid=1363439720&utmr=-&utmp=/36136/universaldownloader-prefetch&utmht=1409347129492&utmac=UA-48247475-1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://46.28.209.74/blank.gif?product=st_session&event=prefetch:session:create&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&ab_test=&download_date=1409347111&execution_date=1409347129805&client_timezone=3&api_version=1.41.3&id_machine=d8cc41db000000000000000c293bdf2f&id_user=291514EA-E968-44B6-A174-BDA245756B30&os=WindowsXP&default_browser=unknown&default_browser_version=0.0.0.0&default_browser_language=en&default_browser_used=0&default_browser_search_provider=&default_browser_homepage=&id_cob=200&id_file=36136&id_section=352&id_main_section=245
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=camp_rpm&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101366&default_rpm=1214&campaign_id=101296&default_rpm=5700&campaign_id=101294&default_rpm=6488&campaign_id=101197&default_rpm=5180&campaign_id=101196&default_rpm=6299&campaign_id=101068&default_rpm=4876&campaign_id=100733&default_rpm=9879&campaign_id=100624&default_rpm=2506&campaign_id=100516&default_rpm=1207&campaign_id=33482&default_rpm=1778&campaign_id=33121&default_rpm=1&campaign_id=101112&default_rpm=409&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&excluded=0&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&excluded=0&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1259&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-2&sc_type=ns&met=true&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1124&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1155&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1284&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1239&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1132&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1131&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1130&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=682&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=681&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=680&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=1281&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://46.28.209.74/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=1145&sc_type=ns&met=false&sd_flag=1
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=2&utmn=1782449156&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmt=event&utme=5(js_error*SDCaughtError*A not tracked http connection ID has triggered the callback - no error provided)&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=installation assistant&utmhid=1363439720&utmr=-&utmp=/36136/universaldownloader-prefetch&utmht=1409347130805&utmac=UA-48247475-1&utmni=1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=6AAgAAAAC~
hxxp://46.28.209.70/universaldownloader-track
hxxp://46.28.209.74/blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&id_campaign=101294&id_campaign=101196
hxxp://46.28.209.70/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129
hxxp://46.28.209.70/css/generated/fad58-b3118.css
hxxp://46.28.209.70/shared/img/sd_client/gradientbg.png
hxxp://screenshots.en.sftcdn.net/campaign/scrn/101000/101294/sd_101294_ba965.png	46.28.209.52
hxxp://screenshots.en.sftcdn.net/en/scrn/36000/36136/the-sims-2-41.jpg	46.28.209.52
hxxp://46.28.209.70/shared/img/sd_client/sprite.png
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://46.28.209.70/shared/img/sd_client/loading.gif
hxxp://screenshots.en.sftcdn.net/campaign/scrn/101000/101196/sd_101196_6142a.png	46.28.209.52
hxxp://pagead46.l.doubleclick.net/pagead/show_companion_ad.js
hxxp://pagead46.l.doubleclick.net/gpt/pubads_impl_47.js
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=3&utmn=1080540854&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=-&utmp=/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129&utmht=1409347133555&utmac=UA-48247475-1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=4&utmn=2116663174&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1409347133758&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=5&utmn=2044095020&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1409347133789&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=6&utmn=18490721&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1409347133852&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=7&utmn=1900154913&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1409347133883&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=8&utmn=1728605849&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/C101294--load1&utmht=1409347133930&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://www-google-analytics.l.google.com/__utm.gif?utmwv=5.4.6&utms=9&utmn=731848023&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/C101196--load2&utmht=1409347133977&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~
hxxp://a1467.g.akamai.net/viewer/upgrade_flash_player2.gif
hxxp://softonic-analytics.net/blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&id_campaign=101294&id_campaign=101196
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1284&sc_type=ns&met=false&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=3&utmn=1080540854&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=-&utmp=/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129&utmht=1409347133555&utmac=UA-48247475-1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~	173.194.43.32
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=6&utmn=18490721&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1409347133852&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.43.32
hxxp://the-sims-2-trailer.sd.en.softonic.com/universaldownloader-track
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1131&sc_type=ns&met=false&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=8&utmn=1728605849&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/C101294--load1&utmht=1409347133930&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.43.32
hxxp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=1145&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-2&sc_type=ns&met=true&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=681&sc_type=ns&met=false&sd_flag=1
hxxp://static.sd-client.en.softonic.com/css/generated/fad58-b3118.css
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_rpm&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101366&default_rpm=1214&campaign_id=101296&default_rpm=5700&campaign_id=101294&default_rpm=6488&campaign_id=101197&default_rpm=5180&campaign_id=101196&default_rpm=6299&campaign_id=101068&default_rpm=4876&campaign_id=100733&default_rpm=9879&campaign_id=100624&default_rpm=2506&campaign_id=100516&default_rpm=1207&campaign_id=33482&default_rpm=1778&campaign_id=33121&default_rpm=1&campaign_id=101112&default_rpm=409&sd_flag=1
hxxp://admin.brightcove.com/viewer/upgrade_flash_player2.gif	67.132.183.56
hxxp://static.sd-client.en.softonic.com/js/generated/306e0-e381f.js
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=680&sc_type=ns&met=false&sd_flag=1
hxxp://static.sd-client.en.softonic.com/shared/img/sd_client/gradientbg.png
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&excluded=0&sd_flag=1
hxxp://static.sd-client.en.softonic.com/shared/img/sd_client/loading.gif
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=5&utmn=2044095020&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1409347133789&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.43.32
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1239&sc_type=ns&met=false&sd_flag=1
hxxp://static.sd-client.en.softonic.com/shared/img/sd_client/sprite.png
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=1&utmn=314903792&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=installation assistant&utmhid=1363439720&utmr=-&utmp=/36136/universaldownloader-prefetch&utmht=1409347129492&utmac=UA-48247475-1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~	173.194.43.32
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1259&sc_type=ns&met=false&sd_flag=1
hxxp://pagead2.googlesyndication.com/pagead/show_companion_ad.js	173.194.43.58
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1130&sc_type=ns&met=false&sd_flag=1
hxxp://www.googletagservices.com/tag/js/gpt.js	173.194.43.58
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1132&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1155&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_session&event=prefetch:session:create&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&ab_test=&download_date=1409347111&execution_date=1409347129805&client_timezone=3&api_version=1.41.3&id_machine=d8cc41db000000000000000c293bdf2f&id_user=291514EA-E968-44B6-A174-BDA245756B30&os=WindowsXP&default_browser=unknown&default_browser_version=0.0.0.0&default_browser_language=en&default_browser_used=0&default_browser_search_provider=&default_browser_homepage=&id_cob=200&id_file=36136&id_section=352&id_main_section=245
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=1281&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=7&utmn=1900154913&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1409347133883&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.43.32
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://partner.googleadservices.com/gpt/pubads_impl_47.js	173.194.43.58
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=682&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1124&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-1&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&excluded=0&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=2&utmn=1782449156&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmt=event&utme=5(js_error*SDCaughtError*A not tracked http connection ID has triggered the callback - no error provided)&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=installation assistant&utmhid=1363439720&utmr=-&utmp=/36136/universaldownloader-prefetch&utmht=1409347130805&utmac=UA-48247475-1&utmni=1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=6AAgAAAAC~	173.194.43.32
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-3&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-2&sc_type=ns&met=false&sd_flag=1
hxxp://softonic-analytics.net/blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=9&utmn=731848023&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/C101196--load2&utmht=1409347133977&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.43.32
hxxp://www.google-analytics.com/__utm.gif?utmwv=5.4.6&utms=4&utmn=2116663174&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1409347133758&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~	173.194.43.32

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /viewer/upgrade_flash_player2.gif HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: admin.brightcove.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

ETag: "f523ab9a498518867f12ca24f39ed087:1354824905"

Last-Modified: Thu, 06 Dec 2012 20:11:57 GMT

Accept-Ranges: bytes

Content-Length: 14202

Content-Type: image/gif

Cache-Control: max-age=1200

Date: Sat, 30 Aug 2014 02:19:16 GMT

Connection: keep-alive

GIF89a:............rz}KKL..................() 568LMO...>@C......cgkMPS246......rvz\_bilo.....................xz|...............{|}...........................................................................VZ]......fjm..............................................................................|..@CE..............................Z]_......................................................kmn...........................[_`.........oww......>??......WXX.....................................3..@..L .Y0.fA.uS..a..q........................_..q..f..Y..k..{..t............................................................44.--.)).54.PP.FF.ff.UU.MM.xx.nn...................................................................................................zzzsssqqqllldddcccXXXTTTJJJ<<<333...!.......,....:...@......H......*\......#J.H.....'....... C..I....(S.\.....0cvT(....8s.......@...J....H.*]zS...P.J.j..SM..D.g.@'GP79.........st.@..m3e= 6R'MP.B...o'{...5 ....k..p.)...."Y=...X.O.........C..M.....? D......c..M...GG,...........N.....W(_.......K.N......k........ ..D......._..}.U.X.o.*U.............(...)D...&....x..*...`)....).&h.'..p.'..(.'.&.......'.....$X.! ..r`........X..@.)..D.i..H&........PF)..TVi..Xf...\v...`.)..dB...h....p...!.0q..}8bB.'......a..i...!~.1..w..g.&.P.....'...Z... .f!. R....z.#.8....0...&0......9...0A...f...'.p....i*....&.h:"h.j....L|zj........{......... ....[.B"........... ....q....;...<..........!...'..BX4....G,...Wl...g....w... .,... ...(..r...SN:.....4.,.0...s/..../...N9..`..H'...L7...H.#.&lt

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1132&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&excluded=1&reason=Not Show condition met: isDefaultBrowserNotCompatible&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1239&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=camp_rpm&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101366&default_rpm=1214&campaign_id=101296&default_rpm=5700&campaign_id=101294&default_rpm=6488&campaign_id=101197&default_rpm=5180&campaign_id=101196&default_rpm=6299&campaign_id=101068&default_rpm=4876&campaign_id=100733&default_rpm=9879&campaign_id=100624&default_rpm=2506&campaign_id=100516&default_rpm=1207&campaign_id=33482&default_rpm=1778&campaign_id=33121&default_rpm=1&campaign_id=101112&default_rpm=409&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:11 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:10 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Sat, 30 Aug 2014 02:19:11 GMT..Server: Apache..Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:10 GMT; path=/; domain=softonic-analytics.net..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-control: max-age=0, must-revalidate..Pragma: no-cache..Content-Length: 35..Connection: close..Content-Type: image/gif..GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&excluded=0&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

POST /universaldownloader-track HTTP/1.1

md5_hash: 71419f5f987b2bc03988deac36a046c9

Accept-Language: en-us

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader-prefetch

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

x-requested-with: XMLHttpRequest

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: the-sims-2-trailer.sd.en.softonic.com

Content-Length: 10491

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: __utma=102744260.36541216.1409347129.1409347129.1409347129.1; __utmb=102744260.1.10.1409347129; __utmc=102744260; __utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_36136=false; UACA_36136=false; UD1_POSITION_36136=; _FCen=100733||.101294|1|1409347129.101196|1|1409347129

id_session=787A7657-14AA-417C-81C1-FE4658283DE8&id_machine=d8cc41db000000000000000c293bdf2f&id_user=291514EA-E968-44B6-A174-BDA245756B30&id_file=36136&id_section=352&id_main_section=245&ab_test=&api_version=1.41.3&timestamp=1409347129&download_browser=unknown_browser&download_browser_version=unknown_version&client_timezone=3&test_track=false&flavour=7&av_installed=&step=prefetch_events&events=[["special_conditions_evaluation",[{"campaign_id":"100733","campaign_priority":9879,"campaign_rera

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: sd_client_en-admin=deleted; expires=Fri, 30-Aug-2013 02:19:12 GMT; path=/; domain=sd.en.softonic.com

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 35

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: application/json; charset=utf-8

...........V*.I,)-V.R..V.....l.........

GET /36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129 HTTP/1.1

Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: the-sims-2-trailer.sd.en.softonic.com

Connection: Keep-Alive

Cookie: __utma=102744260.36541216.1409347129.1409347129.1409347129.1; __utmb=102744260.2.9.1409347130805; __utmc=102744260; __utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); UACR_36136=false; UACA_36136=false; UD1_POSITION_36136=; _FCen=100733||.101294|1|1409347129.101196|1|1409347129

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:13 GMT

Server: Apache

Set-Cookie: sd_client_en-admin=deleted; expires=Fri, 30-Aug-2013 02:19:13 GMT; path=/; domain=sd.en.softonic.com

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 13382

Keep-Alive: timeout=3, max=9

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

...........}.r.H..o.)0.mK...%J...uZ.nR......"... . ......F..}.}.}..I63...IQR._..F;.E.PGVfV.UY.w..9..~>.............\.T..m.J;........V)..n....m...Ri.$...a...J...8...`P.^.....6._.a.e......;..~..|cN7...5.:.9.;..17...._.K....n...w..:l.;dZ..q.....u..qPM....n..$*b...u..Gl#.x....fzn..p#.z.k....z}.q.qN %..........=..,.<...L...7....p..@!..K....Ji..)..^..uX......;=.l.gz.....P.*.............*..yIt.......P.....C(..@.R` ...K..Z.i......0d#..t....x..(.Yp.;.E.....^..C...t..aG....E,..^.q.....=:m.......Y...j..[.l...t..W..r....T/.*S.............\.G.)..).i::...0.\/..D.y........C..1K.cL..Z....5........x^..d.....ff.... .'y..o...n....0G.ho...D^....Y...f...........P{.. ......!.-:...C1R\.U..(p.(....{..X4.K....Yt.K^....iod.s.E..y..........)B....C=T..6%.."..N..I.k....>........#.......5.DC...8.v..k..L.d;I... .. V4..3S.B}^...HT.(D.\.q. ..4'.9....A........%.._K.............ptM...h...>.Y...e.'...%.....;.E.84v.(..h.cA.$G$...Y.'.n......A..i...ei........e....=.$,.`"..bIv.[V./...F.! ......(.$..\....`.c...\\...}._y....;...@.*H!...gx.....D/0......L.....]../.Y...x...E........../.z..`M.!Bf.AwdYU6.[.^C..Ej..v........6....|..,.D....YQ3C....K......D...t...hz@.......KQ.}.Z.C..V4.\..F.......=.6{.7.m.JQ..*.~...9Q...i.p....jZ...d........8[[Vv..=.d4I.XkVjM....f.X.........!.m..,..........X*T.>...9..".......r...V7o..:..A...&..ab.cxZ.7...@.......?.......X\.#>\.~^...h.4....|..T..Zc.P_.EQ.m..........t....2p.j...6.h.g.k..@.\..w.w......[.}G.3.F.F.$a.Wk.Z...!s.....J..:..z.f0x..MQ.Bu.]Z..V..&-JSR..':....m.s.....L....~.....-W.....*..&:.........p.S..

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=682&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /js/generated/306e0-e381f.js HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:09 GMT

Server: Apache

Last-Modified: Thu, 28 Aug 2014 14:31:15 GMT

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Mon, 29 Sep 2014 02:19:09 GMT

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/javascript

1faa...............z.H.8..?O!a.U..Q.lk!..'Kr.......b..AH.D...-.9.y..`.Inl....jf...V.E .{FFFD...l-....t......{^s....l=[...I:i... ...$...>..........Co.o&..u.nv.I..b3.....}:....d..?....f.'...T..?z..K.i2........ .}<..M.~6..`:..._.qr....G......h..8....W.a.....t.9..|s2MG......T..K......<....t.O...xx1..G..8M..A....N.......t.S....B.&.....9.d....,......8..........~...M....8=O.....8...t<.B..c..Fqv.....,....No...:y(.>..x.s..I6.l.g}.F.BL.L.Y.O..i|......>.&....MR.qor.MF......-.C=....7'.s.Q..*...Q.&A.....\...<M........{.C..Y}.#..S/o...6........}.8.....fy2q2d..e.\w...v..e8....a...p6=..F.ZN...&...)..h..GU.R.>.O.a>1..c...GJN{%u..6.Q.f.]\N..-lE...u.{..x..RX..!....M.u.O/...'........O.....~>......v...4n...M.R.......Sk.**.b......i.z..W._....#2.....=S.?...i2.F..wYw.C.m.Z.Wk..r:.5...n0o.0......<..z.d.4....V.&V...]M.........v..2......o...G.1...k1.m8.........l:.S...~. .[.......?.....4...]../..G..8 mP......./..Fm....S.......w.8x.....(.....=@0Q.y... roc..R.`.... G.X.......P...C...,......[Ot..qz9.......1...'..H-.....1....%...^.....8_....".O.Gh......:t.'...r.kqbcz.MB...e..........i...(.T....k...a..xJ.w.>.M....3.B....s...6...(N...).r~A)?a.e<.x.....D.>P..#..B.......,..`..{..~.a.<.4..vO..9t"...Ex.m..>......}{v.P.T........)...L6....hk.o....o.`.".?.....~....`...Mj<..p.N....#Ch#.BD.....y.{.N......~._L/..p:<.....0...U<.}\5..E:5yR.)]..Y....W..fm....r....u..[..!P...S).{........V.A.A.......~...a.H......zi.I[.i.\..........T.... ............wa...vw....)1.....j'....B...@Y....x|A.o.....2]UAz.. ..Z

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1259&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /campaign/scrn/101000/101294/sd_101294_ba965.png HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 12 Aug 2014 13:15:06 GMT

Cache-Control: max-age=172800

Content-Type: image/png

Content-Length: 15500

Accept-Ranges: bytes

Date: Sat, 30 Aug 2014 02:19:14 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 101

Expires: Mon, 01 Sep 2014 02:19:14 GMT

.PNG........IHDR.....................gAMA......a.....sRGB........ cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs..........o.d....vpAg...............;lIDATx.....U.....x..b.;.I.v..#I..N.V........@BD.0.,.X.<...X..SMPU....L..$.@......9w......C....}...|.Ng.}.9..{.=.M.A.....0111.V.^....&&&&.*.........!@.......7.......'.?...?..:q.=....mV..sW.._.....l..;.n...^O...uv....~.E..)......>...o.M...K.2.>.......3..f}...s.......1.V. ........_.....v..Q..,j.....`.PF.U ..C.YS.#.....{.:l-....<.Ox....E.....E..&.....7%..}m..F<..d...B./5J.5i}i.........dX..[......Xo.......K..V. ....iC-~.E..m..-N........X..._.\..B...........e..{[.m.j~.).....g...7.....z...^G.sF..7.6l.......w>.{....x....j..y.g......w.Q..{.. .....E.C.K...{....."@xSrl..s.C...a.(#...0q.....F...~....O.FQ.E6.Q8..~~z~|.0....../=..r..5..j./.9..i....5.Z.x.............D..[....g..5..Vx.u.....D...a.EA....r.i..........k5.....9...-V.....@.jDp...z .....l.b..??[>5Hz~...~~}..i.>....(cg.i...6....t>...f....gT.<...... ..O.uX.MAh.@=...t....\./m.....L..}...oE...M....vd..,2...@..~5NjtTqe.FZ...W..l...{.... .....z.z..F.......6.2."..Z....mH/....Q...A.......Mif. ....vs....t....b..[E.....x..n....D.......).A..:*/.Nm....@.7(..C...H.^.^..`..N.._.*..7%M...D........ j.r1.....nr..d. .>.g...l...*k........p#..~.!.8XD}..~4. .!..8........4z....4.h.....,R6.x.>..[.0...g.^2.......e.[.6o..%.,q} 0.......CY.7..j..9.k..#ec....M.H......o.....&..a..z?. ....XP...@.....W.Pj.......M.H.&.f....3.Gae...b...k.`H.{5.z-..t.9n....g;J...&......(.t.e..I..L.......l.0.....

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-3&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-2&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1124&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=-2&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=1281&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /pagead/show_companion_ad.js HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: pagead2.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 15469078727064674692

Date: Sat, 30 Aug 2014 01:46:25 GMT

Expires: Sat, 30 Aug 2014 02:46:25 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 45375

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 1970

Alternate-Protocol: 80:quic

............g{...0......u...%....^.V.'n...d/=..b...Kb..~g..`QV.>....zV,..t`0..3...Y.<2._..tu..z......Z...l>......je.q..s]..y..~..[.'...4..U....qPs....h....rx..-........i`.F...Z4....jny........`..~43-.f.%)C...~;.v<........k.`..T....n.sn....G......)z....u.c..g....Pj.....9..I8.V.Z?2...=.g..x.......EM...N...Wc..0jY.S*D..z5..wxly2...Xgy6n...Q......E.h...~.....5.........9....e..C/.BH.I..1..a............Th.$.....&..N]o..k.....3........O....V..._j...4HN....q.*bGs..Q.6U...H..I.0;)r..lR...`8N.B...E...j....S.(.E..x.V~........lZ.. w...n...P.p,........u..GmT...;...L....g...S8..0P.|N..5........t.x.v....'F..8ph.h...u*6.......f...G..Z.j>".'...@U..8..b..5...............q(..7.k..D..L...........o.U...N.w].''z5...IN.Q?=G......a.........y. .....1..(}w..w..G........@......DW|-.M..........>...........o:.3.. 6..c............)...z. >..pu..U.5.._....0xt^..'u.N...`...\...O.......{.. ..:...6....7..>.O6..0.b.k.{......GVm..#....l_.m\....3..k.-,..nW6^]....M6....D..v.Cw...Q.x.(..5.E .....Q)W..V.........;..g..\.......{..A...:C.^Y.X....'o..V..Sy...X.7<............b.....mAe.cj.........r....p....n..pf.Vy..Q.n...]..U....Q..]BG.xh....CY|r...sV0.....4..\@...3....fX*....fz.G.....0..|..<...m...N(..QD;.r;u......!.v...nX@./i.....A'......'...?5.f.....~. [.....}......%.< 1.a..ov..........~.....c.}.. '.....)|..{}....z....^~..F0.........!.e.._h._.........co.....a....0..d....{e.......X.i..[...e.....@..v..|...2..H.t.J..../...~..6ff...=..h;@cF. .s........w....u.3.M..}(`.H.H..]H.` G.........U.u......l....p...'w0...Ya.X....Z...4q

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1155&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_session&event=prefetch:session:create&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&ab_test=&download_date=1409347111&execution_date=1409347129805&client_timezone=3&api_version=1.41.3&id_machine=d8cc41db000000000000000c293bdf2f&id_user=291514EA-E968-44B6-A174-BDA245756B30&os=WindowsXP&default_browser=unknown&default_browser_version=0.0.0.0&default_browser_language=en&default_browser_used=0&default_browser_search_provider=&default_browser_homepage=&id_cob=200&id_file=36136&id_section=352&id_main_section=245 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:11 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:10 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;HTTP/1.1 200 OK..Date: Sat, 30 Aug 2014 02:19:11 GMT..Server: Apache..Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:10 GMT; path=/; domain=softonic-analytics.net..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Cache-control: max-age=0, must-revalidate..Pragma: no-cache..Content-Length: 35..Connection: close..Content-Type: image/gif..GIF89a.............,...........D..;..

GET /blank.gif?product=st_activity&event=prefetch:campaigns:selected&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&id_campaign=101294&id_campaign=101196 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=680&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /tag/js/gpt.js HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.googletagservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 14543961835398700302

Date: Sat, 30 Aug 2014 01:46:03 GMT

Expires: Sat, 30 Aug 2014 02:46:03 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 14500

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 1991

Alternate-Protocol: 80:quic

...........}iw.8.....GooF.....3cE.I..M.4M..~r(J^.5..4m../..........=g..I..I..@.....OG.....bq-r.~:.%...9...G.2.........}.r..A`..Oo..._c..o[.."......?.....fI.f......8.......a....T.<...".......l..wi<....M&P......>.f.....pU..-.F.....5[N.(...I.I4.....k9...h...v..,....B.Q...'G.8.Y0........,..7.........bg.;......2...[.h.D5.:[..G)H........I,.....;..B......WnP........O.S.E..y...*N...........I.f9....T.....U.......>.....rC.[|2O.qt....V.n....k...1..1.......F..j.}.b7p...b..l.......lrY<........\.F..9.0._...x..4#..u9.....Os....N.9.U.wO.h. ..o.w.".r..G.T6......4l.jU...ft....{....5........^.....4.g......KGWQ..C...>k..g..."d..(...k .Tb.C.V<....o.5...3.Yt].fJ..A..K..c.A.[.;.;..g....b1.7......4...%.,N...9K3QP.%'.....mk..f..w.6_..l=...`p[...Qt......o.w{.o..O..s.]9..v.y..^....u'.:.,),m.1e)....h...f....N...V....\..3.....\.4...B.n..K.-~...`..z......&..).l.*........]..}7..D....\..q.......C.E.#]..|,....O.....;..4J....n..[.Q..O..z...<...,.../.._....Jf.....Q.g.(*....U.....~K.}g....(.qo.....~...j....j7.{,K......,.U5..t.!K.\.N../......@.....=...#.....p.....I.....m.......Kd.... .*|5...0#...z.1...b.A.....L.W.$.fQ.)'......*.[N.....!....~..:...Y7@.w.m...q..`...{.-..,.qFR......{..2`a..4....&."k..E)...`I.aE..|..?N.M.~(..W ..]...o..t....H...M...s.."..........z.....=.y..}pI...9}@.b..B.}@..>...K...._..............>...}@3...4..>..#......0.1o....SL.......~N....>.........RP. .}..s....ro.$>,...E..,=.`.Mv{ ...I.(}.%.T~.VL..a]..x.. ....-..0'..2\...4............VB...v.~..... /.....GD....u..V.F..:...{.]E.u@\...MA...b

<<< skipped >>>

GET /__utm.gif?utmwv=5.4.6&utms=1&utmn=314903792&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=installation assistant&utmhid=1363439720&utmr=-&utmp=/36136/universaldownloader-prefetch&utmht=1409347129492&utmac=UA-48247475-1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153187

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=2&utmn=1782449156&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmt=event&utme=5(js_error*SDCaughtError*A not tracked http connection ID has triggered the callback - no error provided)&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=installation assistant&utmhid=1363439720&utmr=-&utmp=/36136/universaldownloader-prefetch&utmht=1409347130805&utmac=UA-48247475-1&utmni=1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=6AAgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader-prefetch

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153188

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=3&utmn=1080540854&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=-&utmp=/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129&utmht=1409347133555&utmac=UA-48247475-1&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qAAg~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=4&utmn=2116663174&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/init_startup&utmht=1409347133758&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=5&utmn=2044095020&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/start_api&utmht=1409347133789&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=6&utmn=18490721&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/legal_start&utmht=1409347133852&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=7&utmn=1900154913&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/legal_timestamp&utmht=1409347133883&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=8&utmn=1728605849&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/C101294--load1&utmht=1409347133930&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;....

GET /__utm.gif?utmwv=5.4.6&utms=9&utmn=731848023&utmhn=the-sims-2-trailer.sd.en.softonic.com&utmcs=utf-8&utmsr=1176x885&utmvp=650x450&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=6.0 r88&utmdt=The Sims 2 installation assistant&utmhid=824191991&utmr=http://unknown_browser_unknown_version&utmp=/C101196--load2&utmht=1409347133977&utmac=UA-152357-4&utmcc=__utma=102744260.36541216.1409347129.1409347129.1409347129.1;+__utmz=102744260.1409347129.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmmt=1&utmu=qACgAAAAC~ HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 28 Aug 2014 07:46:04 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 153191

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101196&sc_id=1145&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=681&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1284&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /css/generated/fad58-b3118.css HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:14 GMT

Server: Apache

Last-Modified: Thu, 28 Aug 2014 14:31:15 GMT

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Mon, 29 Sep 2014 02:19:14 GMT

Vary: Accept-Encoding,User-Agent

Content-Encoding: gzip

Content-Length: 5307

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: text/css

...........<i...q.. .y..= 5...6....b..:....ZdK..".$5o.........%....}.]...........H..v..s...o6...].....].'......hGZ..Iw...I..*2......_...~.E..U.K...........\.U..yxL..8<N..4<...<........sZd..0/.s.v.sG.J.:..U...s...;.]&F\N.9..:..$....>.yI.#...n.,......z.U..6J.. uK...F...$.......?.....t.P. ...m.........Q.V...}.$~".e_.].v/.].ly...'..8....r..E..CKzUp......"?.......?.'....8~.C..zG..i....;.\R6.......d.kB.6U.r..X..-.K..l._.QdM...D/...6....*=...T....x........-.oFo6.6.....x.g.wUw.|..|..y..>.YF....,/9N.......{......81..n.......GUY.l..p$....q.LxL.........H.]Ge....8k.C..,X..cX{. F'.T..B.I.M[5......0.Z.y.....D.}Q=;dl..Lz...]{nH.~....*h..........!H#.e..1...*......m......../..MN..%e......!..o.L.k.......y).A2.B.3.Y..... ...8N....qA2a?.@.I.......S..Z%.J.w._....W.4.."8.@..1..SRH-pb.W....S......2]*..r.=....R........;.................],.m.....~tj.....3.........g..lA.K..L........."7.pj}.{.;....0C...<..... .N[.9.'..E..G.LR..2.......5......Mu....)~..}.L&..3.....i..C..e.....<..}.-..h1../...5%].D.~.O7.=.-$..Pr..~...@.........nN.._%C..]..-..6..`.\..d...0.H.....wt. ...A...[.........d..3.......te..n!..%.de.f3.3Og...~i.Y.,...........z../......x....K}......|....>l....O....[f.......C.&7t...MPL1.c%4.....q.I..E...5Isp]lX......6..N......-Y........0.o.H....S.(@7..D..1f<S'-e..n...,*.m[J......#ce.6.....f...>........H.oQ^f.3.^J...ZW.`y..d..%...q.A.A......q..<....0!...F..1gD0..".5..p..RR.`....5_.Fr\.B0.. iJ.N...l....#...:G....,5cb....z..k.](..m\L. .`'.......kc.xlT,#...."g.ki..3F....9.5../}.4.H.j.$0W...#.g\.*.=.....

<<< skipped >>>

GET /shared/img/sd_client/gradientbg.png HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:14 GMT

Server: Apache

Last-Modified: Thu, 27 Mar 2014 08:17:09 GMT

Accept-Ranges: bytes

Content-Length: 2958

Cache-Control: max-age=172800

Expires: Mon, 01 Sep 2014 02:19:14 GMT

Keep-Alive: timeout=3, max=9

Connection: Keep-Alive

Content-Type: image/png

.PNG........IHDR...)...........\.....tEXtSoftware.Adobe ImageReadyq.e<....PLTE............................................................................................................................................................O *E...4tRNS....................................................KW"e...HIDATx....v.9..Q{.%y......I.3.\...m..`..u.s1.s.D...Q,. ..`(..S....O.....SJ........8...=.LR.[.&......:.eJY..oI:./...$..BJ.#KS.sH2..%.{F..='..?HR./..6.X......)./R.. ..6.....F..g.[.I.<.l..2$...42.....S.....>..........h2..f..3.........<...X&r....T..gg.-...t.....em<b.V&.g.c....6E,.-..qF6. ...o.Q.$S...(./y...DD..w..:iQ .c....3.&.TcCT.t,UE.E..HP.R.s.......V.`...%...'6.`...g..UIf(..K....uF2..r......T.!..]fLWF..\lU$....=c:2#.`....<...E". .".. qU.7P.[..c.}.J.q.N.*..:g)%...!.. ..,.@x..0.m.8.........A..,9.:l....c....<...G.8...O......?.....5..'}.....TB..#.... Uxq..\..Y....1.P ..P.........Cda...g.....V'....G.:..uW..2.X......a2!.....L..2...mb...f:.i. z........S...u)d8dC.R..q.`..N.^.~.q.......].....U.....%..p1&..b5..K..q..h...D......0...b..?M`...ak..2}J.7....l..<........7\...g!.Jf.0k.......){.-[.f...M.. ..`.hY}..]....Z...z`.J.eb.........Vl..s...p.Zi.*..kd~..Q...l.@......(l.v.L%:..|.c....,..Tg.....I..7[.-#,.....j#...B.`..b.m`..[....g..<Gs......".5c.R.4QC.5.]...X......@.S..I...T.h.6.9MD....w.Xb..N....%0.m./....z{{~.y...........gz.zz.........??{..g~....D...............z._.......k.}...^?v..w.O..........t.x...~..x..}.......................................=..m...]Ew7...._....j_.j.....~.&....\7....~.....Pw..

<<< skipped >>>

GET /shared/img/sd_client/loading.gif HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:14 GMT

Server: Apache

Last-Modified: Thu, 27 Mar 2014 08:17:09 GMT

Accept-Ranges: bytes

Content-Length: 1553

Cache-Control: max-age=172800

Expires: Mon, 01 Sep 2014 02:19:14 GMT

Keep-Alive: timeout=3, max=8

Connection: Keep-Alive

Content-Type: image/gif

GIF89a........................................................................................................................................................................................................................................................................................................................................~..}..|..z..y..x..t..v..s..r..q..p..m..o..l..k..j..............!..NETSCAPE2.0.....!.....|.,............|..;\r....bvwz.....-lqK'......|.[p9.....4lE.....Nj#.....^g.....[c.....G_......[8..!..IV*..'..|#OP1......).. @JGB=93)...$3<9 ......!.....|.,..........y.|.|4RhjW:...)Vilortvd1.&]eA..&Lwt.N`..|<.-[;...|AX....NU....JQ....8M.....%I.....|8C ......<=%.........173/*&!....% '.....!.....|.,..........w.|.|-EY[L3..!GX[_cgjZ..LS6.Cmj..?M)..6r`."I0..Iu:3E...&xZ<A...zr9=.. 8....5!....*0....... *..........!$!................!.....|.,..........w.|.|$9IM@,...8GJOSWZM&..;A..:_]).1<...0dU|.7$..Aj4&3..mR,0..pi(...qk.)..&uX.$..Mw;|....{g.|.......|2....................!.....|.,..........z.|.|.(591#...'258=AE<...)-....-KI ..)...&PE|."...5W,......ZD...._X....c[....fL....Dk4|....9o\......'Jsl......zxa.....[;....!.....|.,..........x.|.|..$'#......"&*.2-......... 77.......=5|.....(C#......G6....LG....QJ...|U?....:Z,|...1_M.N'|.Be]&.fyxtrokV)..;YljS....!.....|.,..........w.|.|...........................$%........*&|......0......3)..95..=9[z...B1<wL./G#.ct8.)M>./mrF.7TL...]nkfc_ZH!.5O_[G....!.....|.,..........v.|.|........|.........1.......gz.|...|;wM.|...Xv'..!.lt..&"jr.|*'So../#5lD.#3.|

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=-2&sc_type=ns&met=true&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1131&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /en/scrn/36000/36136/the-sims-2-41.jpg HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Thu, 19 May 2011 14:38:27 GMT

Cache-Control: max-age=172800

Content-Type: image/jpeg

Content-Length: 12690

Accept-Ranges: bytes

Date: Sat, 30 Aug 2014 02:19:14 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 4

Expires: Mon, 01 Sep 2014 02:19:14 GMT

......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 75....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....K.q.*...f....v)~VRq\.....Wu....R].)98..'. r.0\.........P...K.........~5;K....x.c.Sv".\.....[0....=.;N.. f\. TL.7m#..@.h..... .O..J5j... x...1..sJ..Ug..S.m....U.PO509..9..b........=..Um.j-......VQ.w.T.....U..J....}..4.....;...5...N......*.'.Q."..Z...V.8.V..* ....2.N)..S..S.Kc...p21T.....)Z.9..S.......$o)'.#.Y.~g..9.;.f..~c....hb:t.Ie.a....3S*....$..d.5r1........,Q.<U.....P...,>.7.QG.gv...8..........N....I.pJ.L.-....pFsY(...j.Xt...3\.e ..4.....S..8.Q..Gq.......c;Qp.*r.0 .d.zV..$.Z..9$f...\..C.qW.S....FY...Fwr)(..Z[p....h0........>.4.B..b...<.......Kq-LO,.&A.Wc...4...Q......9.D......f9.j!&.BriKbob.o....z..........i.._b.2jW.<.1.......r...D..up..3V.C.....\.....g.. m..."..U?........t..a.Z.H.....W..a..........bO5.U...F@.......ap.z>W....q$j........l.55r)...z..._T.....R....m..62}.d...........>.....4g%t.8..M.3H..1$r ..U....

<<< skipped >>>

GET /campaign/scrn/101000/101196/sd_101196_6142a.png HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: screenshots.en.sftcdn.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Tue, 15 Jul 2014 12:44:56 GMT

Cache-Control: max-age=172800

Content-Type: image/png

Content-Length: 60419

Accept-Ranges: bytes

Date: Sat, 30 Aug 2014 02:19:14 GMT

Connection: keep-alive

Age: 0

X-Served-By: screenshots

X-Cache: HIT

X-Cache-Hits: 218

Expires: Mon, 01 Sep 2014 02:19:14 GMT

.PNG........IHDR.....................bKGD..............pHYs..........o.d....IDATx....xUE...{.6...{o(.7......TT.P..{.)$...{.%..@zH...@......:g...MP.y...}..p....}....*s..}W.^.......=....}.{..../h.............o.L.h..].l.....].~............jYY..j...U.[.......~13sWE.........s[..........e....W...._...............VRR.Zii.m.....}.[xNy.333...q[.r...4.g>......}......O.~..?.......v'..p....;..)@.7..W ...nMCs.......2.7.;O..........4$''#22.............:..;v`..uX.|9...agg.{{{888`..EX.d.V.\...7...c...Q.E..w3.....{....w7............B...@fH...... .6...>U...K8..<RRR..........V..~.z,[.......y.0k.,L.2..G....#1l.0.....4hPe..w............U.1b.z...c1y.d,X..k....tCBB..3~...........@.7...W.?...................."<....3...AXX.R.....'...~l....W.VJ3c....fh...,.......................5J..nc..Q.;n.8..?^...&.6i.$L.8..&N.....s&..)S....a.F...!>>...[.?..EU...S......l.U....v...O...S.........I!8...S&.....[T...w.V.j....,.T..=[u&.!..........?..3~..W.......`.s....C .f.4.3J..i..m..1..f..0...c...x....P)...I.&a....&....M.h.8v......1k:.EIw........."..E.(.. ..-..w......l...d..._A.W>OUW.?S.*.:...DDD ((....8~.8.....[.*SBph......!.......O5...O....O.".....Pu..ZCin.R.....s......y||.-..d|.........5..............m...7~.xL.$.6Y>{...X..1....L.=....mb.]\\.....cg...M.Y..E...\U.v.h....p..-P.....{h.d4EG.~.U'44..I....hh.......'..G........[...!T4aZ}..3..<T...6Q....v.....m..3.DU2.....0{..s.mMCfV3...M.8.j.$.,.E.'.`..$..<..M.........y.0F`.5VL.....&c....wr..u.qD...'O...s.'...nW.... .......2.b.?H.9..\@jj*.Du. .<y.....\.>|..v.RN2..s..a...^.z.

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&sc_id=-1&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /gpt/pubads_impl_47.js HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: partner.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Last-Modified: Wed, 13 Aug 2014 09:40:03 GMT

Date: Thu, 28 Aug 2014 07:46:01 GMT

Expires: Fri, 28 Aug 2015 07:46:01 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33599

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 153194

Alternate-Protocol: 80:quic

......n.....y..H.8.._.....B..sL"Y..8N...L....i].9D.....?U..ZB$...wgcZ}..U.u..b.....vn/.l{..... c3_.p.v......e:...;..W.s.(.b./.....~3..d.{....."......|B...=.ds>.1..l.o........y....i;........,...f}.~....^=....E.h..l..L....=.Uk.o.l....\Z..8.g...T.......k-&Q..&qd....t4..M...i<...f'Pq<.....T'....r..Fw...{...fq2J]..o..u.=RKo..Q.o.....x..}..`......X^... ...m)..*...bQ.N.4.\.&*....M..bYU...1#......U.bq.H....Y..T.....S..s..Y..%...Q.-fqw1..Vm.n.<.........1..'O.4...~..........5...ttc.z....Y.v.d.A...%a.w.3.......,..t ..u99.b..OG.8....y.U.v..s...._*.x.\.I..$s9..E....p4..z.k...Y.......y5......k.lJ.P.v..._.......2.....D.........;.'.K.uQ\..3m..i..?.%`u..t.. ..<.t..8KC.?...>I......M..mL_......;..........Fg0......._...p6...K.....U..........5x.c.....q<g'O......q..\.iE>......1}/uU}m.xg..T.A..x.S.;.....1.0..q...........!K..4.l..u.../.6X$.nG........Wt.R.......i...........3....x..&......JB.z..<.q.K|....*f.g....<$.z.}.'.Q..71.m...o./.y:.t...r..V........5ot..._.......C-.r.V......g.t...k.-u.....,(}.6.;3............`.r`"....qf.....{...p-..s..U...e^`.^U.;..r.K..m.V.}g.. ...{..r._7.k...@..........0.s.=....>..K.....~...5.b....A.....O.;.}..j!.'.e..a........{D.. ..0.[.6.T g..e......YsaR...B.[]5T.g1...Q._....-....9.....h<..6........6..@......hn7.....%....V...".xc7a...[...9....SWOf...*8.....U..!..$.......k.......`.....Q.@?.?..B.......jbo.d.G..g.k.n..uj...i.A.6.........Bj..[...v-oK...:...D\/.{..paT,....,_......<..9.aa..|.........Y...sq....{.....[0.g.6....:?o..:.(.`0.`....'..Qp..9....n<...e0D....u...).~V..

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=sc_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=100733&sc_id=1130&sc_type=ns&met=false&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

GET /shared/img/sd_client/sprite.png HTTP/1.1

Accept: */*

Referer: hXXp://the-sims-2-trailer.sd.en.softonic.com/36136/universaldownloader/campaign-101294,101196?sd_timestamp=1409347129

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: static.sd-client.en.softonic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:14 GMT

Server: Apache

Last-Modified: Thu, 29 May 2014 10:05:58 GMT

Accept-Ranges: bytes

Content-Length: 7892

Cache-Control: max-age=172800

Expires: Mon, 01 Sep 2014 02:19:14 GMT

Keep-Alive: timeout=3, max=10

Connection: Keep-Alive

Content-Type: image/png

.PNG........IHDR.......\.....ld......sBIT.....O.....PLTE...................................................................................................................................h.......................f.....n........Dw.I..............U..}..,...v..\. g...........x.a...R..............>....:n........M..].T*..:.....m....tV.....]........7....Q..P..O)....P.i...O..N..N..M....sJ..M..K..L..L..J..J..JJz...I..I..H..I..H..Istv..H..G..H..G..G..G..F..F.x.go...F..F..E..E..D..D..D..B..C/v...B:~4kid..A..A..@..A..>/g..m..p..i...<..=.z:.g.;b..z:.7@.6?[ZW.5>.u8.4<.s7.b..3;.1:.09{O$./8.p5..7.-6.[..m4&Q..,5. 3.k3(X..*2.)1.R..(0.'/.%,.T..f1.e1.&..$,.$,.%-.# .# ."*.#,."*.!)." .!(.!*.!). (..'. (..&. '.I...'..&..%..&..%..%..$..$.."..#..#..".."..!..!....9.899...................*................>.j.....tRNS.....................................................................................................................................................................................................................................................~T.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6.......gIDATx...._[.^..'.LhC...4.t.K....H.w0......^.)w.i..T...q..w..bq..*U.2j]..hU...^.}).\.......,.@......._..!0.u>y....@.......eh\..fUHC....c.X;4.c..I...m..c...d.B.2...}. ..- ...A....,.:p51.4.Ig..:.}......r......WXw..........z. 3v..^.....2......5.Bw.;...M.......ffx..Ac.......jf...F53.K...y...^.(h..M].>....................y.o.:...m.-.2C....................(.Jro.P............wqo....7....<...7*.z......

<<< skipped >>>

GET /blank.gif?product=st_sd_prefetch&event=camp_eval&id_session=787A7657-14AA-417C-81C1-FE4658283DE8&campaign_id=101294&excluded=0&sd_flag=1 HTTP/1.1

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C; .NET4.0E) SoftonicDownloader/1.41.3

Host: softonic-analytics.net

Accept: */*

HTTP/1.1 200 OK

Date: Sat, 30 Aug 2014 02:19:12 GMT

Server: Apache

Set-Cookie: softonic_analytics-admin=deleted; expires=Fri, 30-Aug-2013 02:19:11 GMT; path=/; domain=softonic-analytics.net

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Cache-control: max-age=0, must-revalidate

Pragma: no-cache

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF89a.............,...........D..;..

Map

The Trojan connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_2764:

`.rsrc

`.rsrc

PSSSSSSh

PSSSSSSh

PSSSSh

PSSSSh

u.hL?L

u.hL?L

F><.tn>

F><.tn>

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

II I!"II#$IIII%&'III(I)*I III,-.II/0123IIII4I5IIIIIII6IIIIII789:;II?@ABCDEFIIIIGIIIIH

88888888888888888

88888888888888888

%u$Vj%

%u$Vj%

t.Gj:W

t.Gj:W

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

[%s %s %s]

[%s %s %s]

Send failure: %s

Send failure: %s

Failed writing body (%d != %d)

Failed writing body (%d != %d)

%s:%d

%s:%d

WARNING: failed to save cookies in %s

WARNING: failed to save cookies in %s

About to connect() to %s%s port %d (#%d)

About to connect() to %s%s port %d (#%d)

Connected to %s (%s) port %d (#%d)

Connected to %s (%s) port %d (#%d)

malformed

malformed

:]://%[^

:]://%[^