MD5: 4309514a1d3a566f209b7569cb3b0c41
SHA1: cc1dbf1f5bdf8edb8f79df2834baad35adf38a18
SHA256: 52086d951ffe5738d0e24dfff75a9f221e6100b7b06e0388d0db6afa70be20fd
SSDeep: 3072:ROy ImltB/kHeKnC8hkNJlkH3Yb0JB26efmAPReyRDop:ROy ImlrOeKOzkH3YuBFefzf6
Size: 213760 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: BorlandDelphi30, BorlandDelphiv30, UPolyXv05_v6
Company: TweakBit
Created at: 2015-12-10 14:35:00
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

Process activity

The Trojan creates the following process(es):

driver-updater-setup.exe:1360
reader.exe:1284
reader.exe:1656
downloader.exe:1640
2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup.tmp:616
DefaultBrowserFinder.exe:276
DefaultBrowserFinder.exe:2012
InternetOptimizer.exe:1920
GASender.exe:1084
GASender.exe:1668
driver-updater-setup.tmp:224
DriverUpdater.exe:608
2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup.exe:552
%original file name%.exe:856

The Trojan injects its code into the following process(es):

InternetOptimizer.exe:900
DriverUpdater.exe:1820

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process driver-updater-setup.exe:1360 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-0JQMM.tmp\driver-updater-setup.tmp (7386 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-0JQMM.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-0JQMM.tmp\driver-updater-setup.tmp (0 bytes)

The process downloader.exe:1640 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\driver-updater-setup.exe (1137707 bytes)

The process 2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup.tmp:616 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\TweakBit\Internet Optimizer\is-VI161.tmp (5441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\AxComponentsVCL.bpl (30618 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\GoogleAnalyticsHelper.dll (2321 bytes)
%Program Files%\TweakBit\Internet Optimizer\Lang\is-RE40N.tmp (60 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-JBJ2J.tmp (8657 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-G3KV7.tmp (32641 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-9GMKE.tmp (41 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-SPL2K.tmp (7433 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-OA493.tmp (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\ProductHelper.dll (601 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-7BSLN.tmp (1425 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\TweakBit\Internet Optimizer\TweakBit Internet Optimizer.lnk (924 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-PLJKM.tmp (25 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-RJVNK.tmp (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\_isetup\_shfoldr.dll (23 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\rtl160.bpl (21387 bytes)
%Documents and Settings%\%current user%\Desktop\TweakBit Internet Optimizer.lnk (906 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-20VM4.tmp (1281 bytes)
%Program Files%\TweakBit\Internet Optimizer\Data\main.ini (39 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\downloader.exe (31 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-DFQND.tmp (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\DefaultBrowserFinder.exe (5441 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-JK2CQ.tmp (7726 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-63R8S.tmp (6841 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-S37RP.tmp (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Del_2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup\GA.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\installer_enu.ini (60 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-UP241.tmp (3361 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-JPLNG.tmp (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\GASender.exe (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Del_2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup\AxComponentsRTL.bpl (8657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\reader.exe (3361 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-QUT3N.tmp (4545 bytes)
%Program Files%\TweakBit\Internet Optimizer\unins000.dat (19721 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-78CCA.tmp (6841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\AxBrowsers.dll (8657 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-SM88D.tmp (23811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Del_2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup\GoogleAnalyticsHelper.dll (2321 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-DH17D.tmp (1281 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-47N9H.tmp (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\sqlite3.dll (4545 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-ID3U1.tmp (30618 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-14Q1O.tmp (5441 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-M3G5R.tmp (2105 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-9GQQO.tmp (2105 bytes)
%Program Files%\TweakBit\Internet Optimizer\Lang\is-0JD7T.tmp (3073 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\EULA.rtf (25 bytes)
%Program Files%\TweakBit\Internet Optimizer\unins000.msg (982 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-6SKUP.tmp (21387 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-PT1J6.tmp (5873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\WizardHelper.dll (6841 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-E79ST.tmp (8657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\vclimg160.bpl (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\vcl160.bpl (23811 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-NKPU4.tmp (31 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-E12IO.tmp (1425 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-I12C8.tmp (2321 bytes)
%Program Files%\TweakBit\Internet Optimizer\Temp\is-SC230.tmp (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Del_2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup\GASender.exe (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\GA.json (5 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-DA41S.tmp (1425 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Del_2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup\rtl160.bpl (21387 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-DN2DE.tmp (1281 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-H39QA.tmp (22336 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\AxComponentsRTL.bpl (8657 bytes)
%Program Files%\TweakBit\Internet Optimizer\is-B22CJ.tmp (601 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\rtl160.bpl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\AxBrowsers.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\AxComponentsVCL.bpl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\GoogleAnalyticsHelper.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\downloader.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\vclimg160.bpl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\DefaultBrowserFinder.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\vcl160.bpl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\sqlite3.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\ProductHelper.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\installer_enu.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\EULA.rtf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\WizardHelper.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\GASender.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\_isetup\_shfoldr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\_isetup (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\AxComponentsRTL.bpl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\GA.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-8J531.tmp\reader.exe (0 bytes)

The process InternetOptimizer.exe:1920 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\TweakBit\Internet Optimizer\1.x\Data\statistics.dat (481 bytes)
%Documents and Settings%\All Users\Application Data\TweakBit\Internet Optimizer\1.x\Logs\InternetOptimizer.log (14610 bytes)
%WinDir%\Tasks\TweakBit Internet Optimizer Time for deal.job (428 bytes)
%WinDir%\Tasks\TweakBit Internet Optimizer Start Internet Optimizer оn logon.job (528 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\TweakBit\Internet Optimizer\1.x\Data\statistics.dat (0 bytes)
%Program Files%\TweakBit\Internet Optimizer\Temp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\InternetOptimizer.madExcept (0 bytes)

The process InternetOptimizer.exe:900 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\TweakBit\Internet Optimizer\1.x\Data\statistics.dat (3299 bytes)
%System%\d3d9caps.tmp (1324 bytes)
%Documents and Settings%\All Users\Application Data\TweakBit\Internet Optimizer\1.x\Data\dlc.dat (142 bytes)
%Documents and Settings%\All Users\Application Data\TweakBit\Internet Optimizer\1.x\Logs\TweakManagerStatistics.log (132 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\All Users\Application Data\TweakBit\Internet Optimizer\1.x\Data\statistics.dat (0 bytes)
%System%\d3d9caps.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\InternetOptimizer.madExcept (0 bytes)

The process driver-updater-setup.tmp:224 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\rtl160.bpl (21387 bytes)
%Program Files%\TweakBit\Driver Updater\Lang\is-K9LDE.tmp (58 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\downloader.exe (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Del_driver-updater-setup\GASender.exe (41 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\installer_fra.ini (62 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\installer_esp.ini (60 bytes)
%Program Files%\TweakBit\Driver Updater\is-R0VUN.tmp (1281 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Del_driver-updater-setup\GoogleAnalyticsHelper.dll (2321 bytes)
%Program Files%\TweakBit\Driver Updater\is-4FLQS.tmp (23811 bytes)
%Program Files%\TweakBit\Driver Updater\is-H68P3.tmp (41 bytes)
%Program Files%\TweakBit\Driver Updater\Lang\is-9DGVC.tmp (62 bytes)
%Program Files%\TweakBit\Driver Updater\is-C74NB.tmp (30618 bytes)
%Program Files%\TweakBit\Driver Updater\is-D5AES.tmp (3361 bytes)
%Program Files%\TweakBit\Driver Updater\unins000.msg (982 bytes)
%Program Files%\TweakBit\Driver Updater\is-584QN.tmp (8657 bytes)
%Program Files%\TweakBit\Driver Updater\Lang\is-Q4K63.tmp (60 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\AxComponentsRTL.bpl (8657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\reader.exe (3361 bytes)
%Program Files%\TweakBit\Driver Updater\Lang\is-G1JIR.tmp (673 bytes)
%Program Files%\TweakBit\Driver Updater\is-AV0EA.tmp (2105 bytes)
%Program Files%\TweakBit\Driver Updater\Data\main.ini (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\AxBrowsers.dll (8657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\AxComponentsVCL.bpl (30618 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\GoogleAnalyticsHelper.dll (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\GA.json (5 bytes)
%Program Files%\TweakBit\Driver Updater\is-76DFU.tmp (1281 bytes)
%Program Files%\TweakBit\Driver Updater\is-AP02P.tmp (673 bytes)
%Program Files%\TweakBit\Driver Updater\is-LPDLS.tmp (32641 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\sqlite3.dll (4545 bytes)
%Program Files%\TweakBit\Driver Updater\Lang\is-M8EL5.tmp (673 bytes)
%Program Files%\TweakBit\Driver Updater\Lang\is-U8CIK.tmp (673 bytes)
%Program Files%\TweakBit\Driver Updater\is-BIPJ2.tmp (5441 bytes)
%Program Files%\TweakBit\Driver Updater\is-ESPSE.tmp (23811 bytes)
%Program Files%\TweakBit\Driver Updater\is-SAHF4.tmp (12287 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\installer_deu.ini (62 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\EULA.rtf (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\_isetup\_shfoldr.dll (23 bytes)
%Program Files%\TweakBit\Driver Updater\is-3S99K.tmp (601 bytes)
%Program Files%\TweakBit\Driver Updater\is-I5ILJ.tmp (2321 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Del_driver-updater-setup\GA.json (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\WizardHelper.dll (7345 bytes)
%Program Files%\TweakBit\Driver Updater\is-14ADI.tmp (5441 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\vclimg160.bpl (2105 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\DefaultBrowserFinder.exe (5441 bytes)
%Program Files%\TweakBit\Driver Updater\Temp\is-3UOI3.tmp (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\vcl160.bpl (23811 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\ProductHelper.dll (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Del_driver-updater-setup\AxComponentsRTL.bpl (8657 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\installer_enu.ini (58 bytes)
%Program Files%\TweakBit\Driver Updater\is-FN986.tmp (2105 bytes)
%Program Files%\TweakBit\Driver Updater\is-GGL8P.tmp (3073 bytes)
%Program Files%\TweakBit\Driver Updater\is-J8H7V.tmp (4545 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\TweakBit\Driver Updater\TweakBit Driver Updater.lnk (876 bytes)
%Documents and Settings%\%current user%\Desktop\TweakBit Driver Updater.lnk (858 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\GASender.exe (41 bytes)
%Program Files%\TweakBit\Driver Updater\is-BFFTB.tmp (25 bytes)
%Program Files%\TweakBit\Driver Updater\is-BJ54F.tmp (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\_Del_driver-updater-setup\rtl160.bpl (21387 bytes)
%Program Files%\TweakBit\Driver Updater\is-LRL23.tmp (1425 bytes)
%Program Files%\TweakBit\Driver Updater\is-BPJGC.tmp (31 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp (4 bytes)
%Program Files%\TweakBit\Driver Updater\is-JT3DU.tmp (21387 bytes)
%Program Files%\TweakBit\Driver Updater\Lang\is-B93U6.tmp (673 bytes)
%Program Files%\TweakBit\Driver Updater\unins000.dat (20085 bytes)
%Program Files%\TweakBit\Driver Updater\is-BF87P.tmp (6841 bytes)
%Program Files%\TweakBit\Driver Updater\is-VVI00.tmp (3073 bytes)
%Documents and Settings%\All Users\Start Menu\Programs\TweakBit\Driver Updater\TweakBit Driver Updater on the Web.url (115 bytes)
%Program Files%\TweakBit\Driver Updater\DriverUpdater.url (64 bytes)
%Program Files%\TweakBit\Driver Updater\is-3IB1S.tmp (1425 bytes)
%Program Files%\TweakBit\Driver Updater\is-OST9T.tmp (7345 bytes)
%Program Files%\TweakBit\Driver Updater\is-MLUP6.tmp (1281 bytes)
%Program Files%\TweakBit\Driver Updater\Lang\is-V0VCU.tmp (62 bytes)
%Program Files%\TweakBit\Driver Updater\is-FTFGI.tmp (7433 bytes)
%Program Files%\TweakBit\Driver Updater\is-JBK70.tmp (7726 bytes)
%Program Files%\TweakBit\Driver Updater\is-M7U4D.tmp (3361 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\rtl160.bpl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\downloader.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\installer_fra.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\installer_esp.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\AxComponentsRTL.bpl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\reader.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\AxBrowsers.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\AxComponentsVCL.bpl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\GoogleAnalyticsHelper.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\sqlite3.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\GA.json (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\installer_deu.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\_isetup (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\EULA.rtf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\_isetup\_shfoldr.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\WizardHelper.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\vclimg160.bpl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\DefaultBrowserFinder.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\vcl160.bpl (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\ProductHelper.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\installer_enu.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp\GASender.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-2L8QF.tmp (0 bytes)

The process DriverUpdater.exe:608 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%WinDir%\Tasks\TweakBit Driver Updater Time for deal.job (404 bytes)
%WinDir%\Tasks\TweakBit Driver Updater Start Driver Updater оn logon.job (496 bytes)
%Documents and Settings%\All Users\Application Data\TweakBit\Driver Updater\1.x\Logs\DriverUpdater.log (13320 bytes)
%WinDir%\Tasks\TweakBit Driver Updater Start Driver Updater automatic scanning.job (488 bytes)
%Documents and Settings%\All Users\Application Data\TweakBit\Driver Updater\1.x\Data\statistics.dat (235 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DriverUpdater.madExcept (0 bytes)
%Program Files%\TweakBit\Driver Updater\Temp (0 bytes)
%Documents and Settings%\All Users\Application Data\TweakBit\Driver Updater\1.x\Data\statistics.dat (0 bytes)

The process DriverUpdater.exe:1820 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\All Users\Application Data\TweakBit\Driver Updater\1.x\Data\dlc.dat (142 bytes)
%WinDir%\inf\cdrom.PNF (3242 bytes)
%Documents and Settings%\All Users\Application Data\TweakBit\Driver Updater\1.x\Data\statistics.dat (650 bytes)
%WinDir%\win.ini (126 bytes)
%WinDir%\inf\mshdc.PNF (2728 bytes)
%WinDir%\inf\msports.PNF (4761 bytes)
%WinDir%\inf\hal.PNF (9081 bytes)
%System%\d3d9caps.tmp (1324 bytes)
%WinDir%\inf\keyboard.PNF (7083 bytes)
%Documents and Settings%\All Users\Application Data\TweakBit\Driver Updater\1.x\Logs\DriverHiveEngine_0.log (2346 bytes)
%WinDir%\inf\fdc.PNF (3866 bytes)
%WinDir%\inf\flpydisk.PNF (3881 bytes)
%WinDir%\inf\battery.PNF (6618 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\DriverUpdater.madExcept (0 bytes)
%System%\d3d9caps.dat (0 bytes)
%Documents and Settings%\All Users\Application Data\TweakBit\Driver Updater\1.x\Data\statistics.dat (0 bytes)

The process 2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup.exe:552 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-1D3J9.tmp\2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup.tmp (7386 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\is-1D3J9.tmp\2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\is-1D3J9.tmp (0 bytes)

The process %original file name%.exe:856 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\SDRR9OG9\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\2BF68F4714092295550497DD56F57004 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\7DZIJZUP\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 (408 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (54 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\1F356F4D07FE8C483E769E4586569404 (113 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\1F356F4D07FE8C483E769E4586569404 (228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (2712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (49 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 (18 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\MetaData\B69D763EB21649DA26F20618312DEE70 (232 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (54 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\02B6YPKI\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\DES548H3\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (2712 bytes)
%Documents and Settings%\%current user%\Application Data\Microsoft\CryptnetUrlCache\Content\B69D763EB21649DA26F20618312DEE70 (76 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup.exe (8171806 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\Tar2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar6.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Tar4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\Cab3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup.exe (0 bytes)

Registry activity

The process driver-updater-setup.exe:1360 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "54 ED DB CF 29 E8 A0 95 1E 8F 45 C6 C1 B5 C1 FC"

The process reader.exe:1284 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3A 4D AF E0 4C B6 03 1E 8A 04 B9 AB DB 9B E6 31"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"General.PartnerId" = "tweakbit"

The process reader.exe:1656 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D0 B5 C3 88 E5 7C 5E CF 1E 81 EF 0B 37 6B DB 56"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"General.PartnerId" = "tweakbit"

The process downloader.exe:1640 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2F 24 CE 4F 65 89 00 3A A2 52 76 57 2D 05 76 F6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup.tmp:616 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"Inno Setup: User" = "%CurrentUserName%"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\TweakBit\Internet Optimizer]
"InternetOptimizer.exe" = "Internet Optimizer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"HelpLink" = "http://www.tweakbit.com/en/support.php"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"URLInfoAbout" = "http://www.tweakbit.com/support/contact/"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\is-8J531.tmp]
"DefaultBrowserFinder.exe" = "DefaultBrowserFinder"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"GoogleAnalytics.InstallDate" = "1F 96 56 FA DB C5 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"QuietUninstallString" = "%Program Files%\TweakBit\Internet Optimizer\unins000.exe /SILENT"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"App.Application.ACCheck" = "7F 15 A5 FA DB C5 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"General.DoNotAddUtmToUrls" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"Inno Setup: Language" = "en"

[HKLM\SOFTWARE\TweakBit\Google Analytics Package\1.x\Settings]
"ClientID" = "{BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"Inno Setup: Icon Group" = "TweakBit\Internet Optimizer"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"General.Language" = "ENU"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"NoModify" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"App.Application.PurchaseUrlParam" = ""

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"DisplayVersion" = "1.0.4.1"
"InstallLocation" = "%Program Files%\TweakBit\Internet Optimizer\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"InstallDate" = "20160621"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"Publisher" = "Auslogics Labs Pty Ltd"

[HKLM\SOFTWARE\TweakBit\ATUpdaters\1.x\Settings]
"Shared.Blocking.Internet Optimizer" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"Contact" = "info@tweakbit.com"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"MajorVersion" = "1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\is-8J531.tmp]
"Reader.exe" = "reader"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"DisplayName" = "TweakBit Internet Optimizer"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AB 4C AB 9A AD 68 D6 97 83 15 0A FC FD 60 47 FD"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"MinorVersion" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"General.TrafficId" = "direct"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"Inno Setup: Setup Version" = "5.5.6 (u)"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"UninstallString" = "%Program Files%\TweakBit\Internet Optimizer\unins000.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BF32D91B-C96C-4DEC-9ADE-7E37FCB40145}_is1]
"DisplayIcon" = "%Program Files%\TweakBit\Internet Optimizer\InternetOptimizer.exe"
"NoRepair" = "1"
"Inno Setup: App Path" = "%Program Files%\TweakBit\Internet Optimizer"
"URLUpdateInfo" = "http://www.tweakbit.com/internet-optimizer"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"General.Cookie" = ""

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process DefaultBrowserFinder.exe:276 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6D B7 58 2E 9C A1 0F 32 88 5E 39 0E D6 D8 E8 97"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"General.DefWebBrowser"

The process DefaultBrowserFinder.exe:2012 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "08 5C 62 F0 E6 9A D0 92 EC 4D 8F 5C C6 1C CC 56"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"General.DefWebBrowser"

The process InternetOptimizer.exe:1920 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7B ED EF 6C 42 16 CF DC 31 4F 44 3E B9 81 19 E2"

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431]
"Blob" = "19 00 00 00 01 00 00 00 10 00 00 00 91 FA D4 83"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\TweakBit\ATUpdaters\1.x\Settings]
"Shared.Scanner.Leader" = "Internet Optimizer"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"General.InstallDateTime" = "7E DD 9A FA DB C5 E4 40"
"App.AutoScan.TimeStamp" = "00 68 20 F8 D4 DF 35 40"
"App.Application.SendInfo" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"App.AutoScan.Enabled" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"App.Application.UpdateDate" = "37 E6 9D FA DB C5 E4 40"
"App.Application.AutostartEnable" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCR\CLSID\{60D4C1FF-2B31-CF40-218F-02EEBAF1F767}\Version]
"Assembly" = "3D 2D 97 A2 E9 E8 D2 7E 39 3D 34 38 D6 0E A2 E6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
"Recent" = "%Documents and Settings%\%current user%\Recent"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates]
"503006091D97D4F5AE39F7CBE7927D7D652D3431"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"TweakBit Internet Optimizer Internet Optimizer"

The process InternetOptimizer.exe:900 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"Popups.VersionCheck.NewVersion" = "16778241"
"Popups.LibraryInitDate" = "92 73 13 FB DB C5 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 20 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"Popups.VersionCheck.LastResult" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1462975546"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\TweakBit\ATPopups\1.x\Settings]
"FirstInitDate" = "5D 16 13 FB DB C5 E4 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "InternetOptimizer.exe"

[HKLM\SOFTWARE\Microsoft\Direct3D\MostRecentApplication]
"Name" = "InternetOptimizer.exe"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "InternetOptimizer.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"Popups.VersionCheck.LastRegDate" = "8F DE 21 FB DB C5 E4 40"
"App.Application.FileName" = "%Program Files%\TweakBit\Internet Optimizer\InternetOptimizer.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\TweakBit\Internet Optimizer\1.x\Settings]
"Popups.VersionCheck.LastDate" = "8F DE 21 FB DB C5 E4 40"
"General.LastRun.InternetOptimizer.exe" = "B0 31 11 FB DB C5 E4 40"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A1 19 33 7E 8E 27 00 EA D9 0C DD E2 24 51 4E D6"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Recent" = "%Documents and Settings%\%current user%\Recent"
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Control\VIDEO\{AEE1C666-383B-477D-8CF5-4B80BD084E9A}\0000]
"Attach.ToDesktop" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process GASender.exe:1084 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 65 03 07 C5 15 89 78 98 A1 B5 C4 A2 8D A2 2C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1F 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process GASender.exe:1668 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "77 34 30 1E BB E4 72 28 BB AD 77 DA 49 14 19 BC"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 22 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process driver-updater-setup.tmp:224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"General.DoNotAddUtmToUrls" = "1"
"GoogleAnalytics.InstallDate" = "12 01 39 FC DB C5 E4 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"HelpLink" = "http://www.tweakbit.com/en/support.php"
"NoModify" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"MajorVersion" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 21 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"MinorVersion" = "7"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"Contact" = "info@tweakbit.com"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"Inno Setup: Setup Version" = "5.5.6 (u)"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"DisplayVersion" = "1.7.1.1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"QuietUninstallString" = "%Program Files%\TweakBit\Driver Updater\unins000.exe /SILENT"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"URLUpdateInfo" = "http://www.tweakbit.com/driver-updater"
"Inno Setup: Language" = "en"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"App.Application.PurchaseUrlParam" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\%Program Files%\TweakBit\Driver Updater]
"DriverUpdater.exe" = "Driver Updater"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"Inno Setup: App Path" = "%Program Files%\TweakBit\Driver Updater"
"NoRepair" = "1"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\is-2L8QF.tmp]
"DefaultBrowserFinder.exe" = "DefaultBrowserFinder"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\is-2L8QF.tmp]
"Reader.exe" = "reader"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"InstallLocation" = "%Program Files%\TweakBit\Driver Updater\"

"DisplayIcon" = "%Program Files%\TweakBit\Driver Updater\DriverUpdater.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"UninstallString" = "%Program Files%\TweakBit\Driver Updater\unins000.exe"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"General.Language" = "ENU"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"URLInfoAbout" = "http://www.tweakbit.com/support/contact/"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"General.TrafficId" = "direct"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"Publisher" = "Auslogics Labs Pty Ltd"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"Inno Setup: User" = "%CurrentUserName%"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8D B7 42 99 E9 C1 A1 8A D5 59 F4 19 F4 0C 04 31"

[HKLM\SOFTWARE\TweakBit\ATUpdaters\1.x\Settings]
"Shared.Blocking.Driver Updater" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"Inno Setup: Icon Group" = "TweakBit\Driver Updater"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"InstallDate" = "20160621"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"General.Cookie" = ""
"App.Application.ACCheck" = "22 CA B5 FC DB C5 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62D64B30-6E10-4C49-95FE-EDD8F8165DED}_is1]
"DisplayName" = "TweakBit Driver Updater"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process DriverUpdater.exe:608 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"App.AutoScan.Period" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"General.InstallDateTime" = "DE 67 AA FC DB C5 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"App.Application.AutostartEnable" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKCR\CLSID\{60D4C1FF-F0C3-CF40-218F-1419C8E86448}\Version]
"Assembly" = "3D 2D 97 A2 E9 E8 D2 7E 39 3D 34 38 D6 0E A2 E6"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"App.AutoScan.TimeStamp" = "00 B8 84 6B E5 DF 35 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"App.Application.UpdateDate" = "2C 0D AD FC DB C5 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "DriverUpdater.exe"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "DriverUpdater.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1462969125"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D 91 92 A7 87 1C 10 66 3C 0B B0 39 50 D5 17 98"

[HKLM\SOFTWARE\TweakBit\ATUpdaters\1.x\Settings]
"FirstInstalledUp" = "driverupdater"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKLM\SOFTWARE\Microsoft\Direct3D\MostRecentApplication]
"Name" = "DriverUpdater.exe"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"App.AutoScan.Enabled" = "1"
"App.Application.SendInfo" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"

The Trojan deletes the following value(s) in system registry:
The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"TweakBit Driver Updater Driver Updater"

The process DriverUpdater.exe:1820 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 23 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\BSD\DriverHiveEngine]
"DriverIgnoreList" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"General.LastRun.DriverUpdater.exe" = "35 28 24 FD DB C5 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Startup" = "%Documents and Settings%\%current user%\Start Menu\Programs\Startup"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"Popups.VersionCheck.LastDate" = "A8 71 34 FD DB C5 E4 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"Popups.VersionCheck.LastRegDate" = "A8 71 34 FD DB C5 E4 40"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Templates" = "%Documents and Settings%\%current user%\Templates"
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"Popups.VersionCheck.LastResult" = "1"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "DriverUpdater.exe"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "DriverUpdater.exe"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"App.Application.FileName" = "%Program Files%\TweakBit\Driver Updater\DriverUpdater.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1462969125"

[HKLM\SOFTWARE\BSD\DriverHiveEngine]
"DriverUploadList" = ""

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"Popups.VersionCheck.NewVersion" = "17236225"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 0D CF 8E 46 1C 59 D9 37 2A D5 69 68 B0 5C 49"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Direct3D\MostRecentApplication]
"Name" = "DriverUpdater.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Favorites" = "%Documents and Settings%\%current user%\Favorites"
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\TweakBit\Driver Updater\1.x\Settings]
"Popups.LibraryInitDate" = "76 A9 25 FD DB C5 E4 40"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process 2AC02BED-480E-4564-9122-78206DF1326C_speedtest_optimizer_setup.exe:552 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED DD D7 DD E1 2B 64 04 95 44 59 79 C4 27 62 98"

The process %original file name%.exe:856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Auslogics\Google Analytics Package\1.x\Settings]
"ClientID" = "{394F7432-F868-4866-A31E-90C245B3B265}"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8E 30 0D E9 90 16 27 44 D1 50 5A 18 E6 CB E2 4B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: TweakBit
Product Name: Speedtest Optimizer
Product Version: 1.x
Legal Copyright: Copyright (c) 2008-2015 Auslogics Labs Pty Ltd
Legal Trademarks: Copyright (c) 2008-2015 Auslogics Labs Pty Ltd
Original Filename: speedtest_optimizer_stub_installer.exe
Internal Name: speedtest-optimizer
File Version: 1.0.2.3
File Description: Speedtest Optimizer Setup
Comments: Part of TweakBit Speedtest Optimizer
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://www-google-analytics.l.google.com/collect
hxxp://downloads.tweakbit.com/en/speedtest-optimizer/wcmb/assist/speedtest-optimizer-setup.exe
hxxp://downloads.tweakbit.com/en/internet-optimizer/wcmb1/internet-optimizer-setup.exe
hxxp://tweakbit.auslogicslabspty.netdna-cdn.com/en/internet-optimizer/wcmb1/internet-optimizer-setup.exe
hxxp://crl.usertrust.com/UTN-USERFirst-Object.crl	178.255.83.2
hxxp://crl.comodoca.com.cdn.cloudflare.net/COMODOCodeSigningCA2.crl	104.16.89.188
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/503006091D97D4F5AE39F7CBE7927D7D652D3431.crt
hxxp://tweakbit.com/tools/ipInfo/
hxxp://downloads.tweakbit.com/en/driver-updater/driver-updater-setup.exe
hxxp://tweakbit.com/go/ab_dan_st_optimizer_end_c-yearly/en/internet-optimizer/afterinstall/?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false
hxxp://tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false
hxxp://tweakbit.auslogicslabspty.netdna-cdn.com/en/driver-updater/driver-updater-setup.exe
hxxp://tweakbit.com/includes/vendors/projekktor/style.css
hxxp://googleadapis.l.google.com/css?family=Open Sans:300,300italic,400,400italic,700italic,700&subset=latin,cyrillic,latin-ext
hxxp://tweakbit.com/includes/vendors/jquery.dialog/jquery.dialog.css
hxxp://tweakbit.com/includes/jscss/blocks.css
hxxp://gstaticadssl.l.google.com/s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot
hxxp://tweakbit.com/includes/jscss/index.css
hxxp://tweakbit.com/includes/jscss/ie9-10.css
hxxp://tweakbit.com/en/products/afterinstall/internet-optimizer/jscss/internet-optimizer.css
hxxp://tweakbit.com/includes/vendors/jquery/jquery-1.9.1.min.js
hxxp://tweakbit.com/includes/vendors/jscookie/js.cookie.js
hxxp://tweakbit.com/includes/jscss/s2s.js
hxxp://tweakbit.com/includes/vendors/projekktor/projekktor.min.js
hxxp://tweakbit.com/includes/vendors/jquery.dialog/jquery.dialog.js
hxxp://tweakbit.com/tools/offers/
hxxp://tweakbit.com/en/tools/checkforupdate/?s=internet-optimizer
hxxp://tweakbit.com/includes/vendors/jquery.nanoplaceholder/jquery.nanoplaceholder.js
hxxp://tweakbit.com/tools/ipInfo
hxxp://tweakbit.com/includes/vendors/jquery.zoom/jquery.zoom.js
hxxp://tweakbit.com/includes/jscss/blocks.js
hxxp://tweakbit.com/includes/mixins/phone-popup/phone-popup.js
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://v2.zopim.com/?1twDIwONaqThOPXPzrRcCAzNTduVwomb	104.16.83.55
hxxp://tweakbit.com/tools/offers/content/fixmypc/icon.png
hxxp://tweakbit.com/includes/i/logo_dark_internetoptimizer.png
hxxp://tweakbit.com/includes/i/mp_dark.png
hxxp://g.msn.com.nsatc.net/bat.js
hxxp://tweakbit.com/tools/offers/content/fixmypc/detailsheader.png
hxxp://v2.zopim.com/bin/v/widget_v2.153.js	104.16.83.55
hxxp://tweakbit.com/includes/i/l_header_phone_dark.png
hxxp://www-google-analytics.l.google.com/plugins/ua/linkid.js
hxxp://tweakbit.com/tools/offers/content/fixmypc/detailsbullet.png
hxxp://tweakbit.com/includes/i/l_speedtest_top.png
hxxp://tweakbit.com/includes/i/l_speedtest_content.png
hxxp://tweakbit.com/tools/offers/content/pcspeedup/icon.png
hxxp://tweakbit.com/en/products/afterinstall/internet-optimizer/i/graph.png
hxxp://tweakbit.com/en/products/afterinstall/internet-optimizer/i/features.png
hxxp://tweakbit.com/tools/offers/content/pcspeedup/detailsheader.png
hxxp://tweakbit.com/en/products/afterinstall/internet-optimizer/i/nh-bg.png
hxxp://tweakbit.com/tools/offers/content/driverupdater/detailsheader.png
hxxp://tweakbit.com/tools/offers/content/adguard/detailsheader.png
hxxp://www-google-analytics.l.google.com/collect?v=1&_v=j44&a=1190323766&t=pageview&_s=1&dl=http://www.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false&ul=en-us&de=utf-8&dt=Thank you for installing Internet Optimizer | tweakbit.com&sd=32-bit&sr=1276x846&vp=1260x697&je=0&fl=11.6 r602&_u=CGCAiEAiB~&jid=1112487111&cid=1128533027.1466531951&tid=UA-41053490-1&z=839656180
hxxp://g.msn.com.nsatc.net/action/0?ti=5024903&Ver=2&mid=139de602-39b0-ecd1-fc97-e558527ec603&evt=pageLoad&pi=0&lg=en-us&sw=1276&sh=846&sc=32&tl=Thank you for installing Internet Optimizer | tweakbit.com&p=http://www.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false&r=&rn=751502
hxxp://tweakbit.com/tools/offers/content/adguard/detailsbullet.png
hxxp://g.msn.com.nsatc.net/action/0?ti=5037086&Ver=2&mid=28a29f43-30bd-ca0a-3a1d-72d598a0767d&evt=pageLoad&pi=0&lg=en-us&sw=1276&sh=846&sc=32&tl=Thank you for installing Internet Optimizer | tweakbit.com&p=http://www.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false&r=&rn=321884
hxxp://tweakbit.com/tools/offers/content/webcompanion/icon.png
hxxp://tweakbit.com/favicon.ico
hxxp://g.msn.com.nsatc.net/action-uic/0?ti=5037086&Ver=2&mid=28a29f43-30bd-ca0a-3a1d-72d598a0767d&evt=pageLoad&pi=0&lg=en-us&sw=1276&sh=846&sc=32&tl=Thank you for installing Internet Optimizer | tweakbit.com&p=http://www.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false&r=&rn=118222
hxxp://g.msn.com.nsatc.net/action-uic/0?ti=5024903&Ver=2&mid=139de602-39b0-ecd1-fc97-e558527ec603&evt=pageLoad&pi=0&lg=en-us&sw=1276&sh=846&sc=32&tl=Thank you for installing Internet Optimizer | tweakbit.com&p=http://www.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false&r=&rn=336120
hxxp://tweakbit.com/tools/offers/content/webcompanion/detailsheader.png
hxxp://tweakbit.com/tools/offers/content/webcompanion/detailsbullet.png
hxxp://tweakbit.com/tools/offers/content/megabackup/icon.png
hxxp://tweakbit.com/tools/offers/content/megabackup/detailsheader.png
hxxp://tweakbit.com/tools/offers/content/megabackup/detailsbullet.png
hxxp://tweakbit.com/en/tools/checkforupdate/?s=driver-updater
hxxp://tweakbit.com/tools/offers/content/pcspeedup/detailsbullet.png
hxxp://tweakbit.com/tools/offers/content/driverupdater/icon.png
hxxp://tweakbit.com/tools/offers/content/driverupdater/detailsbullet.png
hxxp://tweakbit.com/tools/offers/content/adguard/icon.png
hxxp://bat.r.msn.com/action-uic/0?ti=5024903&Ver=2&mid=139de602-39b0-ecd1-fc97-e558527ec603&evt=pageLoad&pi=0&lg=en-us&sw=1276&sh=846&sc=32&tl=Thank you for installing Internet Optimizer | tweakbit.com&p=http://www.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false&r=&rn=336120	1.103.192.18
hxxp://www.google-analytics.com/collect?v=1&_v=j44&a=1190323766&t=pageview&_s=1&dl=http://www.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false&ul=en-us&de=utf-8&dt=Thank you for installing Internet Optimizer | tweakbit.com&sd=32-bit&sr=1276x846&vp=1260x697&je=0&fl=11.6 r602&_u=CGCAiEAiB~&jid=1112487111&cid=1128533027.1466531951&tid=UA-41053490-1&z=839656180	216.58.209.174
hxxp://www.tweakbit.com/includes/vendors/jquery.dialog/jquery.dialog.css
hxxp://www.tweakbit.com/tools/offers/content/webcompanion/detailsheader.png
hxxp://www.tweakbit.com/tools/offers/content/megabackup/detailsheader.png
hxxp://www.tweakbit.com/tools/offers/content/driverupdater/detailsheader.png
hxxp://www.tweakbit.com/tools/offers/content/pcspeedup/icon.png
hxxp://bat.bing.com/bat.js	207.46.194.14
hxxp://www.tweakbit.com/favicon.ico
hxxp://fonts.gstatic.com/s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot	216.58.209.195
hxxp://www.tweakbit.com/includes/jscss/ie9-10.css
hxxp://www.tweakbit.com/includes/jscss/s2s.js
hxxp://www.google-analytics.com/collect	216.58.209.174
hxxp://www.tweakbit.com/tools/offers/content/webcompanion/detailsbullet.png
hxxp://www.tweakbit.com/tools/offers/content/driverupdater/icon.png
hxxp://www.tweakbit.com/en/products/afterinstall/internet-optimizer/i/graph.png
hxxp://bat.r.msn.com/action-uic/0?ti=5037086&Ver=2&mid=28a29f43-30bd-ca0a-3a1d-72d598a0767d&evt=pageLoad&pi=0&lg=en-us&sw=1276&sh=846&sc=32&tl=Thank you for installing Internet Optimizer | tweakbit.com&p=http://www.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false&r=&rn=118222	1.103.192.18
hxxp://www.tweakbit.com/includes/vendors/jquery.zoom/jquery.zoom.js
hxxp://www.tweakbit.com/tools/offers/content/megabackup/icon.png
hxxp://www.tweakbit.com/en/tools/checkforupdate/?s=internet-optimizer
hxxp://www.tweakbit.com/includes/vendors/projekktor/style.css
hxxp://www.tweakbit.com/tools/offers/content/webcompanion/icon.png
hxxp://www.tweakbit.com/tools/offers/content/adguard/detailsheader.png
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	212.30.134.183
hxxp://www.tweakbit.com/go/ab_dan_st_optimizer_end_c-yearly/en/internet-optimizer/afterinstall/?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false
hxxp://www.tweakbit.com/includes/jscss/blocks.css
hxxp://static.tweakbit.com/en/driver-updater/driver-updater-setup.exe	198.232.127.32
hxxp://www.tweakbit.com/tools/offers/content/fixmypc/detailsheader.png
hxxp://www.tweakbit.com/includes/vendors/jquery.dialog/jquery.dialog.js
hxxp://www.tweakbit.com/tools/offers/content/fixmypc/icon.png
hxxp://www.tweakbit.com/includes/vendors/jscookie/js.cookie.js
hxxp://www.tweakbit.com/tools/offers/
hxxp://www.tweakbit.com/en/tools/checkforupdate/?s=driver-updater
hxxp://www.tweakbit.com/tools/offers/content/adguard/icon.png
hxxp://www.tweakbit.com/includes/i/l_speedtest_content.png
hxxp://bat.bing.com/action/0?ti=5024903&Ver=2&mid=139de602-39b0-ecd1-fc97-e558527ec603&evt=pageLoad&pi=0&lg=en-us&sw=1276&sh=846&sc=32&tl=Thank you for installing Internet Optimizer | tweakbit.com&p=http://www.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false&r=&rn=751502	207.46.194.14
hxxp://www.tweakbit.com/includes/i/l_speedtest_top.png
hxxp://www.tweakbit.com/includes/i/l_header_phone_dark.png
hxxp://www.tweakbit.com/includes/jscss/index.css
hxxp://www.tweakbit.com/tools/offers/content/pcspeedup/detailsheader.png
hxxp://www.tweakbit.com/en/products/afterinstall/internet-optimizer/i/nh-bg.png
hxxp://www.tweakbit.com/includes/vendors/projekktor/projekktor.min.js
hxxp://www.tweakbit.com/includes/jscss/blocks.js
hxxp://www.tweakbit.com/tools/ipInfo/
hxxp://www.tweakbit.com/en/products/afterinstall/internet-optimizer/i/features.png
hxxp://www.tweakbit.com/tools/offers/content/adguard/detailsbullet.png
hxxp://fonts.googleapis.com/css?family=Open Sans:300,300italic,400,400italic,700italic,700&subset=latin,cyrillic,latin-ext	173.194.220.95
hxxp://www.tweakbit.com/includes/mixins/phone-popup/phone-popup.js
hxxp://www.tweakbit.com/tools/offers/content/pcspeedup/detailsbullet.png
hxxp://www.tweakbit.com/tools/offers/content/fixmypc/detailsbullet.png
hxxp://www.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/503006091D97D4F5AE39F7CBE7927D7D652D3431.crt	212.30.134.183
hxxp://www.tweakbit.com/includes/i/mp_dark.png
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt	212.30.134.183
hxxp://www.tweakbit.com/en/products/afterinstall/internet-optimizer/jscss/internet-optimizer.css
hxxp://www.google-analytics.com/plugins/ua/linkid.js	216.58.209.174
hxxp://www.google-analytics.com/analytics.js	216.58.209.174
hxxp://bat.bing.com/action/0?ti=5037086&Ver=2&mid=28a29f43-30bd-ca0a-3a1d-72d598a0767d&evt=pageLoad&pi=0&lg=en-us&sw=1276&sh=846&sc=32&tl=Thank you for installing Internet Optimizer | tweakbit.com&p=http://www.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false&r=&rn=321884	207.46.194.14
hxxp://www.tweakbit.com/includes/vendors/jquery.nanoplaceholder/jquery.nanoplaceholder.js
hxxp://www.tweakbit.com/tools/offers/content/megabackup/detailsbullet.png
hxxp://www.tweakbit.com/tools/ipInfo
hxxp://crl.comodoca.com/COMODOCodeSigningCA2.crl	104.16.89.188
hxxp://www.tweakbit.com/includes/vendors/jquery/jquery-1.9.1.min.js
hxxp://www.tweakbit.com/includes/i/logo_dark_internetoptimizer.png
hxxp://static.tweakbit.com/en/internet-optimizer/wcmb1/internet-optimizer-setup.exe	198.232.127.32
hxxp://www.tweakbit.com/tools/offers/content/driverupdater/detailsbullet.png
de04.zopim.com	52.28.192.159
stats.g.doubleclick.net	173.194.222.155

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
SURICATA STREAM ESTABLISHED packet out of window
SURICATA STREAM Packet with invalid ack
SURICATA STREAM ESTABLISHED invalid ack
SURICATA STREAM FIN out of window
SURICATA STREAM SHUTDOWN RST invalid ack

Traffic

GET /action-uic/0?ti=5024903&Ver=2&mid=139de602-39b0-ecd1-fc97-e558527ec603&evt=pageLoad&pi=0&lg=en-us&sw=1276&sh=846&sc=32&tl=Thank you for installing Internet Optimizer | tweakbit.com&p=http://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false&r=&rn=336120 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bat.r.msn.com

Connection: Keep-Alive

HTTP/1.1 204 No Content

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Content-Length: 0

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Server: Microsoft-IIS/8.5

Access-Control-Allow-Origin: *

Set-Cookie: MUID=0D1549DF458565DE37C840E441856766; domain=.msn.com; expires=Thu, 21-Jun-2018 17:59:10 GMT; path=/;

Set-Cookie: MR=0; domain=bat.r.msn.com; expires=Sun, 18-Dec-2016 17:59:10 GMT; path=/;

Date: Tue, 21 Jun 2016 17:59:09 GMT
HTTP/1.1 204 No Content..Cache-Control: no-cache, must-revalidate..Pra
gma: no-cache..Content-Length: 0..Expires: Fri, 01 Jan 1990 00:00:00 G
MT..Server: Microsoft-IIS/8.5..Access-Control-Allow-Origin: *..Set-Coo
kie: MUID=0D1549DF458565DE37C840E441856766; domain=.msn.com; expires=T
hu, 21-Jun-2018 17:59:10 GMT; path=/;..Set-Cookie: MR=0; domain=bat.r.
msn.com; expires=Sun, 18-Dec-2016 17:59:10 GMT; path=/;..Date: Tue, 21
 Jun 2016 17:59:09 GMT..

GET /en/tools/checkforupdate/?s=internet-optimizer HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:05 GMT

Content-Type: application/json

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: PHPSESSID=663a8uds2cp1627rl9flj7q9t0; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; expires=Sat, 20-Aug-2016 17:59:05 GMT; Max-Age=5184000; path=/; domain=.tweakbit.com

Access-Control-Allow-Origin: *
39..{"status":"OK","major":1,"minor":0,"release":4,"build":1}..0..nt>....


GET /tools/ipInfo HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:05 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: PHPSESSID=cgd1t1o6ddir5vps0q4q01vgi5; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; expires=Sat, 20-Aug-2016 17:59:05 GMT; Max-Age=5184000; path=/; domain=.tweakbit.com

Access-Control-Allow-Origin: *
7b..{"ip":"194.242.96.218","continent":{"code":"EU","name":"Europe"},"
country":{"code":"UA","name":"Ukraine"},"city":"Unknown"}..0..HTTP/1.1
 200 OK..Server: nginx/1.6.2..Date: Tue, 21 Jun 2016 17:59:05 GMT..Con
tent-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Conne
ction: keep-alive..Vary: Accept-Encoding..Set-Cookie: PHPSESSID=cgd1t1
o6ddir5vps0q4q01vgi5; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0..Pragma: no-cache..Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D
3F7BD=1; expires=Sat, 20-Aug-2016 17:59:05 GMT; Max-Age=5184000; path=
/; domain=.tweakbit.com..Access-Control-Allow-Origin: *..7b..{"ip":"19
4.242.96.218","continent":{"code":"EU","name":"Europe"},"country":{"co
de":"UA","name":"Ukraine"},"city":"Unknown"}..0......


GET /tools/offers/content/fixmypc/detailsheader.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:08 GMT

Content-Type: image/png

Content-Length: 3343

Last-Modified: Wed, 30 Dec 2015 10:31:26 GMT

Connection: keep-alive

ETag: "5683b27e-d0f"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.......G........w....IDATx^...n....../.D-.......}..}..
......o...:...6...$..... ...#.:<w-.......B.)..R."i...L&rn...?.l..a.
.l>.SQ(.$..).........\....D%).D.....b.UB..XTK%..G>7.*.....p.~ 7q
,..ZFI*.t".M6..2M..P.bQ...<w..X...0.S..P~.~..C....B...R..|..KS...&l
t;..(.$.|IgS...l&.....[..}/-..a..(I...\.......h$..P..!q1..s...t:.K.0..
].B..:..b....b...7;d.........w{..p.x...>w....77......0!....\.k....T
.....kC<q...l...ld.X..{.....l..e.r...C.Ul....xI|.ih.}.&r ........,.
.z...0..X..5.p......Qq.t.aQ,...` ...........V......@pg/"..u.\v...C.%..
L.9PE .........)!7q.EW...&.`B...[..F......z~.....c..b..A..-.EC.~.....8
*.C.. .`B.............F..j.C.-..0!.;...:..k......X.G......L.r.!i@H..y.
cN.".`B..k....V...z..,.0.F.....L.A.1...V..u............M(....`8`l..NX.
.(..N........:.z\..|0ql[.......1..L.....p$......i..U.,....P....gB.&...
.L.3T..$...u..jqO. ..&.I.....L.....b.}.... .X....u..c..g..........@(..
0.|...!.t...^W.n..XF..[(.B{................WN..>`B...\.S....?......
...........9ku!.x....N.....B .(..3.a.....~.v.}..o....^W.........TKe91.
.L..D$8...^....~#0.p.X....#B.Z..../...<W.aQN.....*.a."w..cE{.Dt....
..t.q..0.......#.Q)EZ.uB........ cC..w....EO.........z=1..|.SH..*.p..1
.p. ...#].P.c.p...z.....>`.,...l.7.y..C..T........>.B.......L.a~
.....h... $.Q..`Lf...&.~_..W.:'P.....}_.(B.FS%.......-.t.....`..!.B...
.!...O..DC.......<..@=....8.{k{o..*.5..X.d...^.....`..R..!...C.=.U'
6...4.z9....$9...D.B..*.bY...-..B...,V.........D..(>7..G,..B...(B..
#"W.p!..p1D.0.)H.....rw=.../..(.[.V....X.....P.g..W..&..|.......!.
<<< skipped >>>

GET /tools/offers/content/pcspeedup/icon.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:08 GMT

Content-Type: image/png

Content-Length: 3307

Last-Modified: Wed, 30 Dec 2015 10:31:34 GMT

Connection: keep-alive

ETag: "5683b286-ceb"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR...............l;....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;.
.m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
.b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>

GET /tools/offers/content/driverupdater/detailsheader.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

GET /tools/offers/content/adguard/icon.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:09 GMT

Content-Type: image/png

Content-Length: 1238

Last-Modified: Wed, 30 Dec 2015 10:31:22 GMT

Connection: keep-alive

ETag: "5683b27a-4d6"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR...............l;....IDATx^u.{lSe...sz..[....p\."...t8
...M...?.$......Q`.p...(...F.q.......5..lC.(....s............_,bJ..7..
.}..{....B..y.^@.TE..(..D_M...........8..o"..H.4A.27M.w:%OE..LH.&...S.
T.....7....L.T..T....-#iC...EWM..|...`.l./V.8 .t6..T...X.....e.....m..
..Ax..&-Oz3...G...o1.k4...*.h.<N(Jc.V;_9...C...e*_(...}.X]....A^...
3.Z[.(.......t.Y.x. ..bV. >......9..0..Y....`...|.@?>.)./...C...
n-#g..t4.L.ug*O0s.@.]......S....^...g...{g8...HMz..M....<[u..F,Xg..
..9r......;:..~......4tSFD......%.#..L.%W.p/..W....)|....Q6..:.%.....%
.\."........N<...Y...V..E.F8.]B..,.?..e-;Q.b........... ......4.\..
J....%.... .:....k.......Q.0..2.Ft*.e.....2........d....I.r.........X,
.f...#)}..e...3y.....G..(..W.Wp..i.".{.Q..l.p........SP.#...!..PP.....
....2D..z.....ua...%.4b.h.....O........2.p.X....xz.@<..$c..........
../...#.=h*<].`....Z<<e4>.Z..jC........{....!.t YD}c-f....
.......D.g}*.#q.....K....7.7.......9..5...r....v.sJI........roL...GrY.
g..M.T.....1...a....\P.x.5>9.%3N.0...}G..lA(.#d...Z1..h.....3Nc\r..
..q.{=.m6[.....E<...r......N.{..&O.5...6..f..GY8q.....N-....\.u./..
j....z..^.. *[.[r ..s.N[....(. .gy;.b..._m.p..N...T.U.&.@.H?.....j5.Z.
.W...}..3G,.G.p....C..5..P.RzI....RU.......}.F.u...FOO..G.>.....q..
..z......IEND.B`.....
<<< skipped >>>

GET /tools/offers/content/adguard/detailsbullet.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:09 GMT

Content-Type: image/png

Content-Length: 227

Last-Modified: Wed, 30 Dec 2015 10:31:20 GMT

Connection: keep-alive

ETag: "5683b278-e3"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.............k.=.....IDATx^..1..1.E.x..J..VV[Y.BJ.....
...CX..v.AX...{.=.........^1L.0C&........3.e.\.#x......7.......I....5.
..-h.......*.?...S..!.....q..P1d"I...!.TV..C.@..W2.c...;.8#.Y........ 
.........IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 21 J
un 2016 17:59:09 GMT..Content-Type: image/png..Content-Length: 227..La
st-Modified: Wed, 30 Dec 2015 10:31:20 GMT..Connection: keep-alive..ET
ag: "5683b278-e3"..Access-Control-Allow-Origin: *..Accept-Ranges: byte
s...PNG........IHDR.............k.=.....IDATx^..1..1.E.x..J..VV[Y.BJ..
......CX..v.AX...{.=.........^1L.0C&........3.e.\.#x......7.......I...
.5...-h.......*.?...S..!.....q..P1d"I...!.TV..C.@..W2.c...;.8#.Y......
.. .........IEND.B`.....


GET /tools/offers/content/webcompanion/detailsheader.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:10 GMT

Content-Type: image/png

Content-Length: 34043

Last-Modified: Wed, 30 Dec 2015 10:31:36 GMT

Connection: keep-alive

ETag: "5683b288-84fb"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.......H........h....pHYs................6iCCPPhotosho
p ICC profile..x....J.P.@....P .qpx.((..`..-E...!....Ji.^^.~..[..w...Q
pP...@q...!........r...u.a.a.k.n:..|9...S.....n....$.... ..y..;...|.*.
L..n.. *@.B....0.~.A...:i.@<..^./@)...()..A|.f..|0..3.}.0ut..jI:Rg.
S-..eI....<.e:.dr?...&........b..n:r.jY{..3........Xz,ZA8T..*......
x..oazR.. .......V...../..O..ZOb... cHRM..z%..............R....X..:...
.o.Z.....?IDATx...i.eWu.:.>......S[j..h.j@.....4..Lb^x!1._....../v.
.IH>w.?...........1.H4B..T...J*.U%.T..u.........^k....<...t..sw.
..s.9....W.R.PU...?*..PE...~..T..w_.Ul.....B5~..i...@....`.....4..}B.o
m...1s..w..\8....T..]....?.....O?#|.....v.53.PUb...^..{.......3...s-..
.....y'..~M.^1o...g{x.K..3.%..T}.z.........C%.......j.q..a.T........}'
......E.....9..7/E..{U.k.>.'.o.A..u..F....G..u....6.2.&........6.I.
\...J.z.|....x.wH...ew?^...........&.Y.i.....G......=.*...T.>..?..3
.j...~...(|o..n..~.....gU5..~t.0T...........ga..>......s.....{F...w
..NT....g.A.{..m..(.'./....A.B5].].;..s.g........O...Q...y......k.l.._
.....y'...c.^."....d @.......*....!....M.....=..U....K5O{m...[.m...z1.
...MA...{@......].....]..q.h.?#"..va.lP......n{...v...(.[|0m...4m...*.
.t...^M...ZR."...s....f8.......&.h.B.6T...kH.Ai..C.n..]..k..R......I^.
.3..m...3..M..g.W..M.B..j.IR......x...VP h. 6..L..]Sh.....I..........6
.:..e.....n....[...f.......H..\...r...q{...,.!...].L.. 6...N....75.T..
.<....[.j.....r.6.B..@...u.BF.E.u.....(..C....=l.L.....6%..,o.q....
X8L..h...........7....E.E.w..E...t....,.q...3......~.$(p......]|..
<<< skipped >>>

GET /tools/offers/content/megabackup/icon.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:10 GMT

Content-Type: image/png

Content-Length: 915

Last-Modified: Wed, 30 Dec 2015 10:31:30 GMT

Connection: keep-alive

ETag: "5683b282-393"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR...............l;....sRGB.........gAMA......a.....pHYs
..........o.d....tEXtSoftware.paint.net 4.0.6..c.....IDATHK..iHTQ.....
.F.h.-Z..V..%iN.........~da.H.ZD{.X...D.D...&...........:..(B.4.~.;..6
N.;....9.w....`BF.F.&4-.'4.cF......k.1%.... }......1..O.......D..Z.>
;.4.k..*S/.V....j..HfFt..P..)bH....~....s........9...<..0l..".....*
.`..Vt...m.f{F..^...{.A.......d.hi-B..^`./....g....A]..C..6.<.-...v
..x7.O.....?......E....:....R......q.....*.?*..x...o.2.Ke.[&...".2 .t.
..:...-U}.{.....)k?.).Mb....YF_.}.M....,.VZ.%`..D...f..G.;.6.%.;.Z..mR
...#$z?....hdC]!...}.J..m.;w........l..sA.wK..$...).8f....m..(N.......
1.....;.....%..S..V...]i...i...........Ehk.........ix.8..V...._...P..'
....".....Y....e..Y.-...i.:..........\.I._.'....y.42.pY..`..b16._.X.e.
fw..j'/....Y~.*Q.y.p.J.x>{).U.b..1SlY.gC.f.Y.o.Q....>Y*Q.U..JV..
...k.....o. &I).XH.s..@..>Q..d.......6$.....fw.....!...F..^.vw.>
...A.'2..(.4CX....IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: 
Tue, 21 Jun 2016 17:59:10 GMT..Content-Type: image/png..Content-Length
: 915..Last-Modified: Wed, 30 Dec 2015 10:31:30 GMT..Connection: keep-
alive..ETag: "5683b282-393"..Access-Control-Allow-Origin: *..Accept-Ra
nges: bytes...PNG........IHDR...............l;....sRGB.........gAMA...
...a.....pHYs..........o.d....tEXtSoftware.paint.net 4.0.6..c.....IDAT
HK..iHTQ......F.h.-Z..V..%iN.........~da.H.ZD{.X...D.D...&...........:
..(B.4.~.;..6N.;....9.w....`BF.F.&4-.'4.cF......k.1%.... }......1..O..
.....D..Z.>.4.k..*S/.V....j..HfFt..P..)bH....~....s........9...
<<< skipped >>>

GET /tools/offers/content/megabackup/detailsbullet.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:11 GMT

Content-Type: image/png

Content-Length: 739

Last-Modified: Wed, 30 Dec 2015 10:31:30 GMT

Connection: keep-alive

ETag: "5683b282-2e3"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.............k.=.....pHYs................6iCCPPhotosho
p ICC profile..x....J.P.@....P .qpx.((..`..-E...!....Ji.^^.~..[..w...Q
pP...@q...!........r...u.a.a.k.n:..|9...S.....n....$.... ..y..;...|.*.
L..n.. *@.B....0.~.A...:i.@<..^./@)...()..A|.f..|0..3.}.0ut..jI:Rg.
S-..eI....<.e:.dr?...&........b..n:r.jY{..3........Xz,ZA8T..*......
x..oazR.. .......V...../..O..ZOb... cHRM..z%..............R....X..:...
.o.Z.....'IDATx.T.1j.@.E.wr.W...U..R....#..-.>GH.6.X.......... .O1.
x=..fF.K_...>...6aQV.R............`.a.B.bz`B...@O........S.4...~..6
......eT.)"C... .=..p.........@..\V..:7..O.k.#.....!e..`.........../..
.}di......h.T..[.w.;.......]1Y......9ptB.x..[....K.,..`s..H38.\O. .-..
l...8 "..b.J.=.......S.D...f.?.iD..........IEND.B`.HTTP/1.1 200 OK..Se
rver: nginx/1.6.2..Date: Tue, 21 Jun 2016 17:59:11 GMT..Content-Type: 
image/png..Content-Length: 739..Last-Modified: Wed, 30 Dec 2015 10:31:
30 GMT..Connection: keep-alive..ETag: "5683b282-2e3"..Access-Control-A
llow-Origin: *..Accept-Ranges: bytes...PNG........IHDR.............k.=
.....pHYs................6iCCPPhotoshop ICC profile..x....J.P.@....P .
qpx.((..`..-E...!....Ji.^^.~..[..w...QpP...@q...!........r...u.a.a.k.n
:..|9...S.....n....$.... ..y..;...|.*.L..n.. *@.B....0.~.A...:i.@<.
.^./@)...()..A|.f..|0..3.}.0ut..jI:Rg.S-..eI....<.e:.dr?...&.......
.b..n:r.jY{..3........Xz,ZA8T..*......x..oazR.. .......V...../..O..ZOb
... cHRM..z%..............R....X..:....o.Z.....'IDATx.T.1j.@.E.wr.W...
U..R....#..-.>GH.6.X.......... .O1.x=..fF.K_...>...6aQV.R...
<<< skipped >>>

GET /en/internet-optimizer/wcmb1/internet-optimizer-setup.exe HTTP/1.1

Host: static.tweakbit.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 21 Jun 2016 17:58:43 GMT

Content-Type: application/x-msdos-program

Content-Length: 8547392

Last-Modified: Thu, 12 May 2016 13:41:31 GMT

Connection: keep-alive

ETag: "5734880b-826c40"

Server: NetDNA-cache/2.2

Accept-Ranges: bytes
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L......U............
.........(............... ....@.......................................
.......@......................................t...........X/...<...
......................................................................
..................text...4........................... ..`.itext..D....
....................... ..`.data........ ......................@....bs
s.....V...0...........................idata...........................
...@....tls.....................................rdata.................
.............@..@.rsrc...t............ ..............@..@.............
.......................@..@...........................................
......................................................................
.................................................@...AnsiChar.........
...@...string(.@...AnsiString......@...............................@..
....... 9@.(9@..9@..9@..9@..9@..9@..9@.,8@.H8@..8@..TObject.%..A....%.
.A....%..A....%..A....%..A....%..A....%(.A....%..A....%$.A....%..A....
%..A....%..A....%..A....%..A....%|.A....%x.A....%t.A....%p.A....%l.A..
..%h.A....% .A....%d.A....%`.A....%\.A....%..A....%..A....%..A....%X.A
....%T.A....%..A....%..A....%..A....%P.A....%L.A....%H.A....%D.A....%@
.A...S..........$D...T.J....D$,.t...\$0....D[..@..%<.A....%8.A.
<<< skipped >>>

GET /en/tools/checkforupdate/?s=driver-updater HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:27 GMT

Content-Type: application/json

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: PHPSESSID=sf81etaklabf290e7g8n40ttj7; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; expires=Sat, 20-Aug-2016 17:59:27 GMT; Max-Age=5184000; path=/; domain=.tweakbit.com

Access-Control-Allow-Origin: *
39..{"status":"OK","major":1,"minor":7,"release":1,"build":1}..0..HTTP
/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 21 Jun 2016 17:59:27 GMT.
.Content-Type: application/json..Transfer-Encoding: chunked..Connectio
n: keep-alive..Vary: Accept-Encoding..Set-Cookie: PHPSESSID=sf81etakla
bf290e7g8n40ttj7; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cach
e-Control: no-store, no-cache, must-revalidate, post-check=0, pre-chec
k=0..Pragma: no-cache..Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D3F7B
D=1; expires=Sat, 20-Aug-2016 17:59:27 GMT; Max-Age=5184000; path=/; d
omain=.tweakbit.com..Access-Control-Allow-Origin: *..39..{"status":"OK
","major":1,"minor":7,"release":1,"build":1}..0......


GET /tools/offers/content/fixmypc/icon.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:28 GMT

Content-Type: image/png

Content-Length: 529

Last-Modified: Wed, 30 Dec 2015 10:31:28 GMT

Connection: keep-alive

ETag: "5683b280-211"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR...............l;....IDATx^..Ad.a....I.T(.....Q6.wB..Z
....ß....T{..jl.VC..&.....vY(..z....^.K.)...............y.'.?..N..c.
.25.....q.......Q...%..vv.r.b-.......J....2........ ....-.XC_G.......p
.ag.4....9.J..x./....<.{..x).%<.Ql.a.c...:...9.#.........I..X..3
).w............R..U.m.E[..j.......XQ...#.@....M.F#.1 ...}.>.%.C..{.
x....H[.G...k.....x,....aBft....4m..6FH..-........}An...\...2n~.y....^
.9.R.........W:D.<R8....M. .......*...G..'....u...,..I....j....m..%
.......U..0..........c.?....3....j.........IEND.B`.HTTP/1.1 200 OK..Se
rver: nginx/1.6.2..Date: Tue, 21 Jun 2016 17:59:28 GMT..Content-Type: 
image/png..Content-Length: 529..Last-Modified: Wed, 30 Dec 2015 10:31:
28 GMT..Connection: keep-alive..ETag: "5683b280-211"..Access-Control-A
llow-Origin: *..Accept-Ranges: bytes...PNG........IHDR...............l
;....IDATx^..Ad.a....I.T(.....Q6.wB..Z....ß....T{..jl.VC..&.....vY(.
.z....^.K.)...............y.'.?..N..c..25.....q.......Q...%..vv.r.b-..
.....J....2........ ....-.XC_G.......p.ag.4....9.J..x./....<.{..x).
%<.Ql.a.c...:...9.#.........I..X..3).w............R..U.m.E[..j.....
..XQ...#.@....M.F#.1 ...}.>.%.C..{.x....H[.G...k.....x,....aBft....
4m..6FH..-........}An...\...2n~.y....^.9.R.........W:D.<R8....M. ..
.....*...G..'....u...,..I....j....m..%.......U..0..........c.?....3...
.j.........IEND.B`.....
<<< skipped >>>

GET /tools/offers/content/fixmypc/detailsbullet.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:29 GMT

Content-Type: image/png

Content-Length: 227

Last-Modified: Wed, 30 Dec 2015 10:31:26 GMT

Connection: keep-alive

ETag: "5683b27e-e3"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.............k.=.....IDATx^..1..1.E.x..J..VV[Y.BJ.....
...CX..v.AX...{.=.........^1L.0C&........3.e.\.#x......7.......I....5.
..-h.......*.?...S..!.....q..P1d"I...!.TV..C.@..W2.c...;.8#.Y........ 
.........IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 21 J
un 2016 17:59:29 GMT..Content-Type: image/png..Content-Length: 227..La
st-Modified: Wed, 30 Dec 2015 10:31:26 GMT..Connection: keep-alive..ET
ag: "5683b27e-e3"..Access-Control-Allow-Origin: *..Accept-Ranges: byte
s...PNG........IHDR.............k.=.....IDATx^..1..1.E.x..J..VV[Y.BJ..
......CX..v.AX...{.=.........^1L.0C&........3.e.\.#x......7.......I...
.5...-h.......*.?...S..!.....q..P1d"I...!.TV..C.@..W2.c...;.8#.Y......
.. .........IEND.B`.....


GET /tools/offers/content/pcspeedup/detailsheader.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:29 GMT

Content-Type: image/png

Content-Length: 2650

Last-Modified: Wed, 30 Dec 2015 10:31:34 GMT

Connection: keep-alive

ETag: "5683b286-a5a"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.......G........w...!IDATx^...N.J.F.[..4....3.A..E-..z
.......c..K........I..;V?.{........T-"........t~~......x..uz..]...o...
w...O.........F.}~...nnn...^.<....j..T%".X...6.v||<H.......___..
.>..x.95......F.&.I...I.....fp.....<....3........./...........O 
......}......o.......B.q...7.....`p...`Q.E.p-..CC...D.1F y.@X.........
.....w.>....o.............Q..XD:.$.....hMp......FH.c.........>.!
......N ...;B.`........Od.5#...q.....z.. .N.#b.Y.Y.m.D....I....Z..3E5.
 .JXdF..Q......E.)1....i..7......WZ.....9M.a...k...r..(."..Fc.Y.....?.
0..jnQ.E..V...~n#...GtdE..D....t.n2...p?.!Ye.Y.`..y.....Z5B4.. .\pQ.E.
P#.`.O...........E..1...a..:.......Y..}E..1..../...4R.=uB..XDX@...N.7.
..|.b...h...s..(."...b: u..0 ....Eb.k.....(."..i..s].UQ...<0..0g.E^
..%.\.C.(."..&.....x<N@.%r...D.W...B..oE.I..g...E.G..>==%T..i,8.
.=......>.A..I...(........3b.."....q..d.r9...%n..T.(."...J...),..3.
...3.?Q.U....)...X..`....Xq..(..Q}...Y..07..(.........XD(.".L..D1.N..I
....`.......KU.p.*Y.p.......p..^..E<.9/...=#...Pw.......[.xgg......
m..,"...aB...Z../am:3.....L.cpN..."....*.5.J..............>.".4$...
.#.........._........[F...%..@d...w..oT...v...8...0B.c........&..HQ...
.u...m.l|O.f<'..n......\.s.Np........&.......\{.,..g.}s~m.K.@...}..
........"q:....Z..k.@<.K.*.'.S.7.>.#wG.".Y....'..<.l.....>
>>F.X..Q.<.X...@.ONNZ].:..(EK...B...]......`.Q......1n...u.'H
U8..8.o...Hy......X..(S...=..X.......T....i.!.L.r..[....Bh9'.m^.2B.D..
..#@..k....A..............&C....1f;(W..0g..ot.C..4.....p.8..y..h..
<<< skipped >>>

GET /tools/offers/content/driverupdater/icon.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:29 GMT

Content-Type: image/png

Content-Length: 499

Last-Modified: Wed, 30 Dec 2015 10:31:24 GMT

Connection: keep-alive

ETag: "5683b27c-1f3"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR...............l;....IDATx^..AD.q....&Q.a...(1k.Xb... 
.P.V.......vi4dG..m..:E.....].6":.0...i).gL...<...............M..n'
....v.../.... .5.Q......v.7P......b.K..[...=....cW.2..X. .c.. l..)..-.
...H_E.yh....h...'.!a....7..)4......&B.S..........]yV..3..9..Z\F....r.
@7......./.Vq.?..-)j........`...b.W.S.a..... ...(.E..G.#.c....S....w|&
.3.lb...0/......p..k6.M(.n..n|..r.....,.%.j.......Y.2.S....Z....)Vl...
.Q..8k.9h..-.b..),....)%.:]........:........b.'h.....x..z....=.Ui>&
.......IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 21 Jun
 2016 17:59:29 GMT..Content-Type: image/png..Content-Length: 499..Last
-Modified: Wed, 30 Dec 2015 10:31:24 GMT..Connection: keep-alive..ETag
: "5683b27c-1f3"..Access-Control-Allow-Origin: *..Accept-Ranges: bytes
...PNG........IHDR...............l;....IDATx^..AD.q....&Q.a...(1k.Xb..
. .P.V.......vi4dG..m..:E.....].6":.0...i).gL...<...............M..
n'....v.../.... .5.Q......v.7P......b.K..[...=....cW.2..X. .c.. l..)..
-....H_E.yh....h...'.!a....7..)4......&B.S..........]yV..3..9..Z\F....
r.@7......./.Vq.?..-)j........`...b.W.S.a..... ...(.E..G.#.c....S....w
|&.3.lb...0/......p..k6.M(.n..n|..r.....,.%.j.......Y.2.S....Z....)Vl.
...Q..8k.9h..-.b..),....)%.:]........:........b.'h.....x..z....=.Ui>
;&.......IEND.B`.....
<<< skipped >>>

GET /tools/offers/content/driverupdater/detailsbullet.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:30 GMT

Content-Type: image/png

Content-Length: 227

Last-Modified: Wed, 30 Dec 2015 10:31:24 GMT

Connection: keep-alive

ETag: "5683b27c-e3"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.............k.=.....IDATx^..1..1.E.x..J..VV[Y.BJ.....
...CX..v.AX...{.=.........^1L.0C&........3.e.\.#x......7.......I....5.
..-h.......*.?...S..!.....q..P1d"I...!.TV..C.@..W2.c...;.8#.Y........ 
.........IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 21 J
un 2016 17:59:30 GMT..Content-Type: image/png..Content-Length: 227..La
st-Modified: Wed, 30 Dec 2015 10:31:24 GMT..Connection: keep-alive..ET
ag: "5683b27c-e3"..Access-Control-Allow-Origin: *..Accept-Ranges: byte
s...PNG........IHDR.............k.=.....IDATx^..1..1.E.x..J..VV[Y.BJ..
......CX..v.AX...{.=.........^1L.0C&........3.e.\.#x......7.......I...
.5...-h.......*.?...S..!.....q..P1d"I...!.TV..C.@..W2.c...;.8#.Y......
.. .........IEND.B`.....


GET /tools/offers/content/adguard/detailsheader.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:30 GMT

Content-Type: image/png

Content-Length: 3325

Last-Modified: Wed, 30 Dec 2015 10:31:20 GMT

Connection: keep-alive

ETag: "5683b278-cfd"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.......G........w....IDATx^...r.....#].......Le.&..,&[
.&..I2...G.nuKj.#.%.......j..U..6......s..W{...4...h..r.>.I$.|%.&..
9t|YU...DVe!......db........u%....D.M...l.....H.49.B.,[.E3......6.IR.r
...e8..r..... 9t.y3=..0.c<..8...U..S...U,.G{X...o.2.]..Jf.B.y:\....
J`....,.......e.L]Ih9.[.(M.(Ke...{v..7B.~...&.0.[.xN...E&O.B.5-...>
e].=.UE......i...-.\.0...2..F........q.2...P~.:.b.........V.|.......A{
.V&.....mj....n..Cz.qM4..!E]!....U.KZ.R..<%?..;..T.kB.`"..r.......&
".2?...*....*7.Jy.&.'.Rr.,.?d..FD....=M..T..5]....... {...b....&Z.....
.....L.......T.....~...e...$..;.."x....LD.k bp.:K....ZX........ ."B..y
&G.H...<.<.c.~.....LD8J.i..J.....X..dC................37....N.".
0.a{.E......N.5...........D...."G%..x.7f..........D\.F..Z..'N<..&.a
y......&b%|...z0..../&.."......V%.....&.a..p.j.z..`. '.7.L.`".._Z.....
.....<..Y..CX.]...t=..LD..Fi...#.....`..,.p....|lx."Y.c...z...L....
..GV....W........?.J.y..&'.H4.....i9G...%.E....P...-.G........n ^<_
s..b.F......B.....a.-"V.D..(.....:.4.....|\^#|...FE.2.b@k0.CXu..`....D
..hS).T....ux M#.j.2....8.n.........%........S.X.>..b.J..Z..7.R....
9..q$S.....@...c<.C7.`.......".i c...n.........).,2.7*M.W..0Z..%..d
..c....".:.&.&e."C..&..}.xr...@.B...k|.....XR...a.UU..m..0.q.0~`}.....
]K.[a.......3m..'..... .D..[..Z..8>.5.G..fr,?.......US.......0.q..*
..n;..........T....U.....}_.:..,.J.....*..%f............"".."_......!*
..,.w....TF..a........\S.R T....E..uY.?..m;J:.`"......-.......(\.G....
.....r.=......0.V._V.I...u}..U.0.......p.`"..?....*A..i.b.....R.N)
<<< skipped >>>

GET /tools/offers/content/webcompanion/icon.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:30 GMT

Content-Type: image/png

Content-Length: 801

Last-Modified: Wed, 30 Dec 2015 10:31:38 GMT

Connection: keep-alive

ETag: "5683b28a-321"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR...............l;....sRGB.........gAMA......a.....pHYs
..........o.d....tEXtSoftware.paint.net 4.0.6..c.....IDATHK..KL.Q....i
7...aEB$..@4qgL..r..G.;....E......ZP4FcX.0J..."*..nHD.L..... .5M{...m.
>P.1.O.L.........................h,e.p..\.K-.6.e>k.....9@y.DZ.r.
...j........DV..^&....1Xy..X_...$..).....{n..@.*f.M.......)HCZmHs..^.x
..E...l..*'....@T.RV..C...M.>.D.X...Y.V....@=.m..*0l.3V'\.G..`3....
x..aC..m..c].u...d.x...N.i.O...t..?..r..\S..v..U..4...FR{dR.e.F.Br'/..
..;..| ;b.3..S.X~l.hE......DN.='].*..q....8.........U..8......07.4..(.
.Hq....D.w.....>q.7n.I...0/........ n..69..pgt..Q/%....../..@<..
............[z...B.Z.x......O4(.J..a.*n)..I.>.o@......dlp....`.6t..
.....3>...G}#.._........0..Ei..a.x..l....k/.i....*O.C.........l.s}U
.k..>.^.K.'. ...q7_....Y.....f..H...b73.....IEND.B`.HTTP/1.1 200 OK
..Server: nginx/1.6.2..Date: Tue, 21 Jun 2016 17:59:30 GMT..Content-Ty
pe: image/png..Content-Length: 801..Last-Modified: Wed, 30 Dec 2015 10
:31:38 GMT..Connection: keep-alive..ETag: "5683b28a-321"..Access-Contr
ol-Allow-Origin: *..Accept-Ranges: bytes...PNG........IHDR............
...l;....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftwar
e.paint.net 4.0.6..c.....IDATHK..KL.Q....i7...aEB$..@4qgL..r..G.;....E
......ZP4FcX.0J..."*..nHD.L..... .5M{...m.>P.1.O.L.................
........h,e.p..\.K-.6.e>k.....9@y.DZ.r....j........DV..^&....1Xy..X
_...$..).....{n..@.*f.M.......)HCZmHs..^.x..E...l..*'....@T.RV..C...M.
>.D.X...Y.V....@=.m..*0l.3V'\.G..`3....x..aC..m..c].u...d.x...N
<<< skipped >>>

GET /tools/offers/content/webcompanion/detailsbullet.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:31 GMT

Content-Type: image/png

Content-Length: 724

Last-Modified: Wed, 30 Dec 2015 10:31:36 GMT

Connection: keep-alive

ETag: "5683b288-2d4"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.............k.=.....pHYs................6iCCPPhotosho
p ICC profile..x....J.P.@....P .qpx.((..`..-E...!....Ji.^^.~..[..w...Q
pP...@q...!........r...u.a.a.k.n:..|9...S.....n....$.... ..y..;...|.*.
L..n.. *@.B....0.~.A...:i.@<..^./@)...()..A|.f..|0..3.}.0ut..jI:Rg.
S-..eI....<.e:.dr?...&........b..n:r.jY{..3........Xz,ZA8T..*......
x..oazR.. .......V...../..O..ZOb... cHRM..z%..............R....X..:...
.o.Z......IDATx.\.1j.0.E.Wr.W..)]..*.B.U....H..H.K,..............h-{.H
....3..O...5T......'.....m$m@..J................H.:..9...N.KV...Jz.u..
Q&]$}..o...Ap(..V...9%....S...%6...@.l...5X0...<.N.....dUm."....%..
.......aWYY....Ra....{OD...>..H.T....=..8....C.:..8:W,...#;w.s%....
l......U[w......G\~....j....IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.6
.2..Date: Tue, 21 Jun 2016 17:59:31 GMT..Content-Type: image/png..Cont
ent-Length: 724..Last-Modified: Wed, 30 Dec 2015 10:31:36 GMT..Connect
ion: keep-alive..ETag: "5683b288-2d4"..Access-Control-Allow-Origin: *.
.Accept-Ranges: bytes...PNG........IHDR.............k.=.....pHYs......
..........6iCCPPhotoshop ICC profile..x....J.P.@....P .qpx.((..`..-E..
.!....Ji.^^.~..[..w...QpP...@q...!........r...u.a.a.k.n:..|9...S.....n
....$.... ..y..;...|.*.L..n.. *@.B....0.~.A...:i.@<..^./@)...()..A|
.f..|0..3.}.0ut..jI:Rg.S-..eI....<.e:.dr?...&........b..n:r.jY{..3.
.......Xz,ZA8T..*......x..oazR.. .......V...../..O..ZOb... cHRM..z%...
...........R....X..:....o.Z......IDATx.\.1j.0.E.Wr.W..)]..*.B.U....H..
H.K,..............h-{.H....3..O...5T......'.....m$m@..J...........
<<< skipped >>>

GET /tools/offers/content/megabackup/detailsheader.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:31 GMT

Content-Type: image/png

Content-Length: 32793

Last-Modified: Wed, 30 Dec 2015 10:31:30 GMT

Connection: keep-alive

ETag: "5683b282-8019"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.......H........h....pHYs................6iCCPPhotosho
p ICC profile..x....J.P.@....P .qpx.((..`..-E...!....Ji.^^.~..[..w...Q
pP...@q...!........r...u.a.a.k.n:..|9...S.....n....$.... ..y..;...|.*.
L..n.. *@.B....0.~.A...:i.@<..^./@)...()..A|.f..|0..3.}.0ut..jI:Rg.
S-..eI....<.e:.dr?...&........b..n:r.jY{..3........Xz,ZA8T..*......
x..oazR.. .......V...../..O..ZOb... cHRM..z%..............R....X..:...
.o.Z....~]IDATx...g.].q&....9.&.H. ..&0Ib.....E..K.,.c....l.........-.
....m...[..`K.%K.H1........ .I.......k~.TU...4....7....kUx...h...0@...
.C|....'...y..........C....8..*.....{.v.............@ 8O....?..wm.5..f
..P.'z....T_.s..T]w...{W?...Bu-.>*.......O.g$.I.k..)..x.W...S\..\..
.};......g...g8.......m.....r.W?..j.g.n.k-nUz?.s.o.Q@./.=j...g4...N.(.
..Q}}.g.....j.=6......E._.P.I.kNf.....k.Yne...m.z...o.\.1..*..<..^%
u..3Cz.Y.......y...bs...h.w..H.......rO....%?.........>;3k.|s......
...g......Ac..f...... W.....I.;.......9X02....&'...].....w......]}.5..
peZ..F.>Xrq..T..X$.r.Rb..Z..h............f?.|....&.kb3..$..j...h.6.
.$.A"Xa...X...x.......>..b.O..T....g...(...kU[l.hrm..k.N....XS...z?
N9NV....d@FA...>..p.....T71..d......LEN.............#v.....6..c..H.
.>...b.....l,.....z...2.7....R8Pe..`.=...&....^. .,.F...O....Lp....
u.L..rl...#.f.g..b..\ ....O.~.;w.G.\...a...z]...G..;.;..@.....Up#.n.3.
E...........x......MRP.C{...ZuTS..2.:.Y..........:A.....?R....^fz.....
.0..md S..!....|..$J0 .,..rq.056.A..X..QFc...IT.fj.U.l.=T........,.e..
.)4.c........C..Mu...lZ'6\..5...Y.;................7..U.*..X.m..H.
<<< skipped >>>

POST /tools/offers/ HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.tweakbit.com

Content-Length: 252

Cache-Control: no-cache

data={"protocol":"1.0","product":"internet-optimizer","version":"1.x","language":"en","oslanguage":"en","registered":false,"installedProducts":[],"markers":["ab_dan_st_optimizer_end_c","yearly","actioncenter"],"hash":"e0238819af2a6408cc3863dacf21f72d"}
HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:05 GMT

Content-Type: application/json

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: PHPSESSID=66f1cab3teur1o2j135gn4svt3; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; expires=Sat, 20-Aug-2016 17:59:05 GMT; Max-Age=5184000; path=/; domain=.tweakbit.com

Access-Control-Allow-Origin: *
571e..{"phones":{"assist":{"number":"1-888-424-8349"},"tlc":{"number":
"1-855-395-7237"},"ice":{"number":"1-844-779-6861"},"default":{"number
":"1-800-943-9756"}},"protocol":"1.0","phone":{"show":true,"number":"1
-800-943-9756"},"banner":{"show":false,"url":""},"offers":[{"id":"fixm
ypc","name":"FixMyPC","iconurl":"http:\/\/VVV.tweakbit.com\/tools\/off
ers\/content\/fixmypc\/icon.png","exeurl":"http:\/\/downloads.tweakbit
.com\/en\/fix-my-pc\/fix-my-pc-setup.exe","exeurlaffiliate":{"revenuew
ire":"http:\/\/downloads.tweakbit.com\/en\/fix-my-pc\/aff\/fix-my-pc-s
etup.exe"},"requirements":{"os":"Windows XP"},"exeparams":"\/silent \/
verysilent \/campaign:\"actioncenter\"","exefilename":"fixmypc-setup.e
xe","checkinstall":[{"regkey":"SOFTWARE\\Microsoft\\Windows\\CurrentVe
rsion\\Uninstall\\{CA7C4C80-24B8-4027-8849-0C302333C427}_is1"}],"detai
lshidename":false,"detailsiconurl":"http:\/\/VVV.tweakbit.com\/tools\/
offers\/content\/fixmypc\/detailsicon.png","detailsheaderurl":"http:\/
\/VVV.tweakbit.com\/tools\/offers\/content\/fixmypc\/detailsheader.png
","detailsbulleturl":"http:\/\/VVV.tweakbit.com\/tools\/offers\/conten
t\/fixmypc\/detailsbullet.png","localization":{"en":{"title":"FixMyPC"
,"text":"FixMyPC detects the causes of computer errors, freezes and ot
her stability problems, and provides an easy one-click way to clean an
d repair the Windows registry and get those issues resolved once and f
or all.","description":"Fixes and prevents Windows registry issues for
 more stable system performance.","detailslicense":"","detailsbull
<<< skipped >>>

GET /tools/offers/content/fixmypc/icon.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:08 GMT

Content-Type: image/png

Content-Length: 529

Last-Modified: Wed, 30 Dec 2015 10:31:28 GMT

Connection: keep-alive

ETag: "5683b280-211"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR...............l;....IDATx^..Ad.a....I.T(.....Q6.wB..Z
....ß....T{..jl.VC..&.....vY(..z....^.K.)...............y.'.?..N..c.
.25.....q.......Q...%..vv.r.b-.......J....2........ ....-.XC_G.......p
.ag.4....9.J..x./....<.{..x).%<.Ql.a.c...:...9.#.........I..X..3
).w............R..U.m.E[..j.......XQ...#.@....M.F#.1 ...}.>.%.C..{.
x....H[.G...k.....x,....aBft....4m..6FH..-........}An...\...2n~.y....^
.9.R.........W:D.<R8....M. .......*...G..'....u...,..I....j....m..%
.......U..0..........c.?....3....j.........IEND.B`.HTTP/1.1 200 OK..Se
rver: nginx/1.6.2..Date: Tue, 21 Jun 2016 17:59:08 GMT..Content-Type: 
image/png..Content-Length: 529..Last-Modified: Wed, 30 Dec 2015 10:31:
28 GMT..Connection: keep-alive..ETag: "5683b280-211"..Access-Control-A
llow-Origin: *..Accept-Ranges: bytes...PNG........IHDR...............l
;....IDATx^..Ad.a....I.T(.....Q6.wB..Z....ß....T{..jl.VC..&.....vY(.
.z....^.K.)...............y.'.?..N..c..25.....q.......Q...%..vv.r.b-..
.....J....2........ ....-.XC_G.......p.ag.4....9.J..x./....<.{..x).
%<.Ql.a.c...:...9.#.........I..X..3).w............R..U.m.E[..j.....
..XQ...#.@....M.F#.1 ...}.>.%.C..{.x....H[.G...k.....x,....aBft....
4m..6FH..-........}An...\...2n~.y....^.9.R.........W:D.<R8....M. ..
.....*...G..'....u...,..I....j....m..%.......U..0..........c.?....3...
.j.........IEND.B`.....
<<< skipped >>>

GET /tools/offers/content/fixmypc/detailsbullet.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:08 GMT

Content-Type: image/png

Content-Length: 227

Last-Modified: Wed, 30 Dec 2015 10:31:26 GMT

Connection: keep-alive

ETag: "5683b27e-e3"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.............k.=.....IDATx^..1..1.E.x..J..VV[Y.BJ.....
...CX..v.AX...{.=.........^1L.0C&........3.e.\.#x......7.......I....5.
..-h.......*.?...S..!.....q..P1d"I...!.TV..C.@..W2.c...;.8#.Y........ 
.........IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 21 J
un 2016 17:59:08 GMT..Content-Type: image/png..Content-Length: 227..La
st-Modified: Wed, 30 Dec 2015 10:31:26 GMT..Connection: keep-alive..ET
ag: "5683b27e-e3"..Access-Control-Allow-Origin: *..Accept-Ranges: byte
s...PNG........IHDR.............k.=.....IDATx^..1..1.E.x..J..VV[Y.BJ..
......CX..v.AX...{.=.........^1L.0C&........3.e.\.#x......7.......I...
.5...-h.......*.?...S..!.....q..P1d"I...!.TV..C.@..W2.c...;.8#.Y......
.. .........IEND.B`.....


GET /tools/offers/content/pcspeedup/detailsheader.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

GET /tools/offers/content/driverupdater/icon.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:09 GMT

Content-Type: image/png

Content-Length: 499

Last-Modified: Wed, 30 Dec 2015 10:31:24 GMT

Connection: keep-alive

ETag: "5683b27c-1f3"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR...............l;....IDATx^..AD.q....&Q.a...(1k.Xb... 
.P.V.......vi4dG..m..:E.....].6":.0...i).gL...<...............M..n'
....v.../.... .5.Q......v.7P......b.K..[...=....cW.2..X. .c.. l..)..-.
...H_E.yh....h...'.!a....7..)4......&B.S..........]yV..3..9..Z\F....r.
@7......./.Vq.?..-)j........`...b.W.S.a..... ...(.E..G.#.c....S....w|&
.3.lb...0/......p..k6.M(.n..n|..r.....,.%.j.......Y.2.S....Z....)Vl...
.Q..8k.9h..-.b..),....)%.:]........:........b.'h.....x..z....=.Ui>&
.......IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 21 Jun
 2016 17:59:09 GMT..Content-Type: image/png..Content-Length: 499..Last
-Modified: Wed, 30 Dec 2015 10:31:24 GMT..Connection: keep-alive..ETag
: "5683b27c-1f3"..Access-Control-Allow-Origin: *..Accept-Ranges: bytes
...PNG........IHDR...............l;....IDATx^..AD.q....&Q.a...(1k.Xb..
. .P.V.......vi4dG..m..:E.....].6":.0...i).gL...<...............M..
n'....v.../.... .5.Q......v.7P......b.K..[...=....cW.2..X. .c.. l..)..
-....H_E.yh....h...'.!a....7..)4......&B.S..........]yV..3..9..Z\F....
r.@7......./.Vq.?..-)j........`...b.W.S.a..... ...(.E..G.#.c....S....w
|&.3.lb...0/......p..k6.M(.n..n|..r.....,.%.j.......Y.2.S....Z....)Vl.
...Q..8k.9h..-.b..),....)%.:]........:........b.'h.....x..z....=.Ui>
;&.......IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 21 J
un 2016 17:59:09 GMT..Content-Type: image/png..Content-Length: 227..La
st-Modified: Wed, 30 Dec 2015 10:31:24 GMT..Connection: keep-alive..ET
ag: "5683b27c-e3"..Access-Control-Allow-Origin: *..Accept-Ranges: 
<<< skipped >>>

GET /tools/offers/content/adguard/detailsheader.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:09 GMT

Content-Type: image/png

Content-Length: 3325

Last-Modified: Wed, 30 Dec 2015 10:31:20 GMT

Connection: keep-alive

ETag: "5683b278-cfd"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.......G........w....IDATx^...r.....#].......Le.&..,&[
.&..I2...G.nuKj.#.%.......j..U..6......s..W{...4...h..r.>.I$.|%.&..
9t|YU...DVe!......db........u%....D.M...l.....H.49.B.,[.E3......6.IR.r
...e8..r..... 9t.y3=..0.c<..8...U..S...U,.G{X...o.2.]..Jf.B.y:\....
J`....,.......e.L]Ih9.[.(M.(Ke...{v..7B.~...&.0.[.xN...E&O.B.5-...>
e].=.UE......i...-.\.0...2..F........q.2...P~.:.b.........V.|.......A{
.V&.....mj....n..Cz.qM4..!E]!....U.KZ.R..<%?..;..T.kB.`"..r.......&
".2?...*....*7.Jy.&.'.Rr.,.?d..FD....=M..T..5]....... {...b....&Z.....
.....L.......T.....~...e...$..;.."x....LD.k bp.:K....ZX........ ."B..y
&G.H...<.<.c.~.....LD8J.i..J.....X..dC................37....N.".
0.a{.E......N.5...........D...."G%..x.7f..........D\.F..Z..'N<..&.a
y......&b%|...z0..../&.."......V%.....&.a..p.j.z..`. '.7.L.`".._Z.....
.....<..Y..CX.]...t=..LD..Fi...#.....`..,.p....|lx."Y.c...z...L....
..GV....W........?.J.y..&'.H4.....i9G...%.E....P...-.G........n ^<_
s..b.F......B.....a.-"V.D..(.....:.4.....|\^#|...FE.2.b@k0.CXu..`....D
..hS).T....ux M#.j.2....8.n.........%........S.X.>..b.J..Z..7.R....
9..q$S.....@...c<.C7.`.......".i c...n.........).,2.7*M.W..0Z..%..d
..c....".:.&.&e."C..&..}.xr...@.B...k|.....XR...a.UU..m..0.q.0~`}.....
]K.[a.......3m..'..... .D..[..Z..8>.5.G..fr,?.......US.......0.q..*
..n;..........T....U.....}_.:..,.J.....*..%f............"".."_......!*
..,.w....TF..a........\S.R T....E..uY.?..m;J:.`"......-.......(\.G....
.....r.=......0.V._V.I...u}..U.0.......p.`"..?....*A..i.b.....R.N)
<<< skipped >>>

GET /tools/offers/content/webcompanion/icon.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:10 GMT

Content-Type: image/png

Content-Length: 801

Last-Modified: Wed, 30 Dec 2015 10:31:38 GMT

Connection: keep-alive

ETag: "5683b28a-321"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR...............l;....sRGB.........gAMA......a.....pHYs
..........o.d....tEXtSoftware.paint.net 4.0.6..c.....IDATHK..KL.Q....i
7...aEB$..@4qgL..r..G.;....E......ZP4FcX.0J..."*..nHD.L..... .5M{...m.
>P.1.O.L.........................h,e.p..\.K-.6.e>k.....9@y.DZ.r.
...j........DV..^&....1Xy..X_...$..).....{n..@.*f.M.......)HCZmHs..^.x
..E...l..*'....@T.RV..C...M.>.D.X...Y.V....@=.m..*0l.3V'\.G..`3....
x..aC..m..c].u...d.x...N.i.O...t..?..r..\S..v..U..4...FR{dR.e.F.Br'/..
..;..| ;b.3..S.X~l.hE......DN.='].*..q....8.........U..8......07.4..(.
.Hq....D.w.....>q.7n.I...0/........ n..69..pgt..Q/%....../..@<..
............[z...B.Z.x......O4(.J..a.*n)..I.>.o@......dlp....`.6t..
.....3>...G}#.._........0..Ei..a.x..l....k/.i....*O.C.........l.s}U
.k..>.^.K.'. ...q7_....Y.....f..H...b73.....IEND.B`.HTTP/1.1 200 OK
..Server: nginx/1.6.2..Date: Tue, 21 Jun 2016 17:59:10 GMT..Content-Ty
pe: image/png..Content-Length: 801..Last-Modified: Wed, 30 Dec 2015 10
:31:38 GMT..Connection: keep-alive..ETag: "5683b28a-321"..Access-Contr
ol-Allow-Origin: *..Accept-Ranges: bytes...PNG........IHDR............
...l;....sRGB.........gAMA......a.....pHYs..........o.d....tEXtSoftwar
e.paint.net 4.0.6..c.....IDATHK..KL.Q....i7...aEB$..@4qgL..r..G.;....E
......ZP4FcX.0J..."*..nHD.L..... .5M{...m.>P.1.O.L.................
........h,e.p..\.K-.6.e>k.....9@y.DZ.r....j........DV..^&....1Xy..X
_...$..).....{n..@.*f.M.......)HCZmHs..^.x..E...l..*'....@T.RV..C...M.
>.D.X...Y.V....@=.m..*0l.3V'\.G..`3....x..aC..m..c].u...d.x...N
<<< skipped >>>

GET /tools/offers/content/webcompanion/detailsbullet.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:10 GMT

Content-Type: image/png

Content-Length: 724

Last-Modified: Wed, 30 Dec 2015 10:31:36 GMT

Connection: keep-alive

ETag: "5683b288-2d4"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.............k.=.....pHYs................6iCCPPhotosho
p ICC profile..x....J.P.@....P .qpx.((..`..-E...!....Ji.^^.~..[..w...Q
pP...@q...!........r...u.a.a.k.n:..|9...S.....n....$.... ..y..;...|.*.
L..n.. *@.B....0.~.A...:i.@<..^./@)...()..A|.f..|0..3.}.0ut..jI:Rg.
S-..eI....<.e:.dr?...&........b..n:r.jY{..3........Xz,ZA8T..*......
x..oazR.. .......V...../..O..ZOb... cHRM..z%..............R....X..:...
.o.Z......IDATx.\.1j.0.E.Wr.W..)]..*.B.U....H..H.K,..............h-{.H
....3..O...5T......'.....m$m@..J................H.:..9...N.KV...Jz.u..
Q&]$}..o...Ap(..V...9%....S...%6...@.l...5X0...<.N.....dUm."....%..
.......aWYY....Ra....{OD...>..H.T....=..8....C.:..8:W,...#;w.s%....
l......U[w......G\~....j....IEND.B`.HTTP/1.1 200 OK..Server: nginx/1.6
.2..Date: Tue, 21 Jun 2016 17:59:10 GMT..Content-Type: image/png..Cont
ent-Length: 724..Last-Modified: Wed, 30 Dec 2015 10:31:36 GMT..Connect
ion: keep-alive..ETag: "5683b288-2d4"..Access-Control-Allow-Origin: *.
.Accept-Ranges: bytes...PNG........IHDR.............k.=.....pHYs......
..........6iCCPPhotoshop ICC profile..x....J.P.@....P .qpx.((..`..-E..
.!....Ji.^^.~..[..w...QpP...@q...!........r...u.a.a.k.n:..|9...S.....n
....$.... ..y..;...|.*.L..n.. *@.B....0.~.A...:i.@<..^./@)...()..A|
.f..|0..3.}.0ut..jI:Rg.S-..eI....<.e:.dr?...&........b..n:r.jY{..3.
.......Xz,ZA8T..*......x..oazR.. .......V...../..O..ZOb... cHRM..z%...
...........R....X..:....o.Z......IDATx.\.1j.0.E.Wr.W..)]..*.B.U....H..
H.K,..............h-{.H....3..O...5T......'.....m$m@..J...........
<<< skipped >>>

GET /tools/offers/content/megabackup/detailsheader.png HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:10 GMT

Content-Type: image/png

Content-Length: 32793

Last-Modified: Wed, 30 Dec 2015 10:31:30 GMT

Connection: keep-alive

ETag: "5683b282-8019"

Access-Control-Allow-Origin: *

Accept-Ranges: bytes
.PNG........IHDR.......H........h....pHYs................6iCCPPhotosho
p ICC profile..x....J.P.@....P .qpx.((..`..-E...!....Ji.^^.~..[..w...Q
pP...@q...!........r...u.a.a.k.n:..|9...S.....n....$.... ..y..;...|.*.
L..n.. *@.B....0.~.A...:i.@<..^./@)...()..A|.f..|0..3.}.0ut..jI:Rg.
S-..eI....<.e:.dr?...&........b..n:r.jY{..3........Xz,ZA8T..*......
x..oazR.. .......V...../..O..ZOb... cHRM..z%..............R....X..:...
.o.Z....~]IDATx...g.].q&....9.&.H. ..&0Ib.....E..K.,.c....l.........-.
....m...[..`K.%K.H1........ .I.......k~.TU...4....7....kUx...h...0@...
.C|....'...y..........C....8..*.....{.v.............@ 8O....?..wm.5..f
..P.'z....T_.s..T]w...{W?...Bu-.>*.......O.g$.I.k..)..x.W...S\..\..
.};......g...g8.......m.....r.W?..j.g.n.k-nUz?.s.o.Q@./.=j...g4...N.(.
..Q}}.g.....j.=6......E._.P.I.kNf.....k.Yne...m.z...o.\.1..*..<..^%
u..3Cz.Y.......y...bs...h.w..H.......rO....%?.........>;3k.|s......
...g......Ac..f...... W.....I.;.......9X02....&'...].....w......]}.5..
peZ..F.>Xrq..T..X$.r.Rb..Z..h............f?.|....&.kb3..$..j...h.6.
.$.A"Xa...X...x.......>..b.O..T....g...(...kU[l.hrm..k.N....XS...z?
N9NV....d@FA...>..p.....T71..d......LEN.............#v.....6..c..H.
.>...b.....l,.....z...2.7....R8Pe..`.=...&....^. .,.F...O....Lp....
u.L..rl...#.f.g..b..\ ....O.~.;w.G.\...a...z]...G..;.;..@.....Up#.n.3.
E...........x......MRP.C{...ZuTS..2.:.Y..........:A.....?R....^fz.....
.0..md S..!....|..$J0 .,..rq.056.A..X..QFc...IT.fj.U.l.=T........,.e..
.)4.c........C..Mu...lZ'6\..5...Y.;................7..U.*..X.m..H.
<<< skipped >>>

POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 149

Cache-Control: no-cache

v=1&tid=UA-49608409-6&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.7.1.1_ab_dan_st_optimizer_end_c&ea=Installer_Install_1_Init&el=Yes&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:24 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 186

Cache-Control: no-cache

v=1&tid=UA-49608409-6&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.7.1.1_ab_dan_st_optimizer_end_c&ea=Installer_SystemInfo_ScreenInfo*&el=Windows XP x32, 1276x846, 32, 96&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:24 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 160

Cache-Control: no-cache

v=1&tid=UA-49608409-6&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.7.1.1_ab_dan_st_optimizer_end_c&ea=Installer_SystemInfo_OS*&el=Windows XP x32&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:24 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 163

Cache-Control: no-cache

v=1&tid=UA-49608409-6&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.7.1.1_ab_dan_st_optimizer_end_c&ea=Installer_SystemInfo_Browser*&el=iexplore.exe&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:24 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 157

Cache-Control: no-cache

v=1&tid=UA-49608409-6&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.7.1.1_ab_dan_st_optimizer_end_c&ea=Installer_Install_2_FileCopyInit&el=Yes&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:24 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 167

Cache-Control: no-cache

v=1&tid=UA-49608409-6&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.7.1.1_ab_dan_st_optimizer_end_c&ea=Installer_Install_3_Offer*&el=PCSpeedUp_Installed&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:24 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 155

Cache-Control: no-cache

v=1&tid=UA-49608409-6&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.7.1.1_ab_dan_st_optimizer_end_c&ea=Installer_Install_4_Completed*&el=New&ev=5
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:24 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;..

GET /tools/ipInfo/ HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:58:56 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: PHPSESSID=mvv5kg2034cqs2satmgbdclnm4; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; expires=Sat, 20-Aug-2016 17:58:56 GMT; Max-Age=5184000; path=/; domain=.tweakbit.com

Access-Control-Allow-Origin: *
7b..{"ip":"194.242.96.218","continent":{"code":"EU","name":"Europe"},"
country":{"code":"UA","name":"Ukraine"},"city":"Unknown"}..0..HTTP/1.1
 200 OK..Server: nginx/1.6.2..Date: Tue, 21 Jun 2016 17:58:56 GMT..Con
tent-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Conne
ction: keep-alive..Vary: Accept-Encoding..Set-Cookie: PHPSESSID=mvv5kg
2034cqs2satmgbdclnm4; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0..Pragma: no-cache..Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D
3F7BD=1; expires=Sat, 20-Aug-2016 17:58:56 GMT; Max-Age=5184000; path=
/; domain=.tweakbit.com..Access-Control-Allow-Origin: *..7b..{"ip":"19
4.242.96.218","continent":{"code":"EU","name":"Europe"},"country":{"co
de":"UA","name":"Ukraine"},"city":"Unknown"}..0......


GET /tools/ipInfo/ HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:58:57 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: PHPSESSID=9ugbo4npgphu3v76dhbg9eln56; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; expires=Sat, 20-Aug-2016 17:58:57 GMT; Max-Age=5184000; path=/; domain=.tweakbit.com

Access-Control-Allow-Origin: *
7b..{"ip":"194.242.96.218","continent":{"code":"EU","name":"Europe"},"
country":{"code":"UA","name":"Ukraine"},"city":"Unknown"}..0..HTTP/1.1
 200 OK..Server: nginx/1.6.2..Date: Tue, 21 Jun 2016 17:58:57 GMT..Con
tent-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Conne
ction: keep-alive..Vary: Accept-Encoding..Set-Cookie: PHPSESSID=9ugbo4
npgphu3v76dhbg9eln56; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0..Pragma: no-cache..Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D
3F7BD=1; expires=Sat, 20-Aug-2016 17:58:57 GMT; Max-Age=5184000; path=
/; domain=.tweakbit.com..Access-Control-Allow-Origin: *..7b..{"ip":"19
4.242.96.218","continent":{"code":"EU","name":"Europe"},"country":{"co
de":"UA","name":"Ukraine"},"city":"Unknown"}..0..

GET /action-uic/0?ti=5037086&Ver=2&mid=28a29f43-30bd-ca0a-3a1d-72d598a0767d&evt=pageLoad&pi=0&lg=en-us&sw=1276&sh=846&sc=32&tl=Thank you for installing Internet Optimizer | tweakbit.com&p=http://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false&r=&rn=118222 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bat.r.msn.com

Connection: Keep-Alive

HTTP/1.1 204 No Content

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Content-Length: 0

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Server: Microsoft-IIS/8.5

Access-Control-Allow-Origin: *

Set-Cookie: MUID=34BC9CEFB105670F2E9D95D4B5056523; domain=.msn.com; expires=Thu, 21-Jun-2018 17:59:10 GMT; path=/;

Set-Cookie: MR=0; domain=bat.r.msn.com; expires=Sun, 18-Dec-2016 17:59:10 GMT; path=/;

Date: Tue, 21 Jun 2016 17:59:09 GMT
HTTP/1.1 204 No Content..Cache-Control: no-cache, must-revalidate..Pra
gma: no-cache..Content-Length: 0..Expires: Fri, 01 Jan 1990 00:00:00 G
MT..Server: Microsoft-IIS/8.5..Access-Control-Allow-Origin: *..Set-Coo
kie: MUID=34BC9CEFB105670F2E9D95D4B5056523; domain=.msn.com; expires=T
hu, 21-Jun-2018 17:59:10 GMT; path=/;..Set-Cookie: MR=0; domain=bat.r.
msn.com; expires=Sun, 18-Dec-2016 17:59:10 GMT; path=/;..Date: Tue, 21
 Jun 2016 17:59:09 GMT..

GET /bat.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bat.bing.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/javascript

Content-Encoding: gzip

Last-Modified: Tue, 14 Jun 2016 16:33:43 GMT

Accept-Ranges: bytes

ETag: "80cdbc835ac6d11:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/8.5

Access-Control-Allow-Origin: *

Set-Cookie: MUID=324E392431056E470C7F301F35056DC5; domain=.bing.com; expires=Thu, 21-Jun-2018 17:59:08 GMT; path=/;

Set-Cookie: MR=0; domain=bat.bing.com; expires=Sun, 18-Dec-2016 17:59:08 GMT; path=/;

Date: Tue, 21 Jun 2016 17:59:07 GMT

Content-Length: 2964
...........Y.o.8.. .q0...........&.6.>rm.(....E...(........_z;..u$r
fH..g..%._KVp...._..]$<..@....a)..... eI.............3.S.y=...'...q
.."...w..rd.J..x............~~........_~..&?....3..R......$..X.uU.".3.
..E...D...R..&..x2...!h...........>.....<......|;.L...j.e,..}...
.$Ot...4S?;..-......!..E. .....5...t..O.....HF...<%l....^h...qO>
n.C.x...r..wP...... ......z....H.7......q..r..&iL...@xW..N ._U.....(.%
...5....[Q..(.c.@Z.....Xj....h....._.1~J.... .l)O....t.y......n.-^....
{... ..f9-*..N.........^q.(.g<...o....r..~.h)..............1.......
-..............z.T......(N./........D.O.._2.^u%.(.nf..=....%^..c'.....
.....~HYY..~../.Su...["...}...K3[:...Y..Q8...Q..|7{.oq}..%.NA.>`..;
 ..Z3..B.."..q.:.M&E..;*$ ...{.P.....x..b.....M[..."}F5l. .]...@..S...
......P.>....o..vW...k...}..h....v.V... ..T0...N2...d.Q6..{........
dw.=g;..,......[.)..W....4.^l....M.d.x.?..7..?.>.?..../..P._...9...
]i...%p.O..t.^.k..A.9l..O....f..ua.B.....uA..*...*.TDNQ.....S...).Q...
[H.....Z...e|E.TS...3E...#S4AK{L.B.....N...U!ed...I..XR. N&...o$l....G
.|.(. ..r..m.....t#....Y.....KOo.eL>.6,.X.D8`!.Va..h...:FU.@..h..&l
t;>..,..0..M...`.:..z.u.......N.......2O;K.........<U...S...B!..
.....iy......_q .D....3e..Q..&{..Ad..|}[.5.D..(.U2P9{xDpe.W...T.;.._S.
_...Ar..a.g..uZ3....a.L'%C...mR8c7.....`D......Kur."#../. #c.C..MTn..x
D-.L`F....>.....C.d.n~. .....DB.}#..K....W.XN.....}.1.UV....&.....D
..*....i.l.W.p.....$&.?q...1@........$a.......n5.k..@.a.O...|1. ...h.g
..... ...vY..2s..!|........!.q.z=.4T../..... ...xZ..z~.Lgvj..3..)U
<<< skipped >>>

GET /action/0?ti=5024903&Ver=2&mid=139de602-39b0-ecd1-fc97-e558527ec603&evt=pageLoad&pi=0&lg=en-us&sw=1276&sh=846&sc=32&tl=Thank you for installing Internet Optimizer | tweakbit.com&p=http://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false&r=&rn=751502 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bat.bing.com

Connection: Keep-Alive

Cookie: MUID=324E392431056E470C7F301F35056DC5; MR=0

HTTP/1.1 204 No Content

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Content-Length: 0

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Server: Microsoft-IIS/8.5

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:09 GMT
HTTP/1.1 204 No Content..Cache-Control: no-cache, must-revalidate..Pra
gma: no-cache..Content-Length: 0..Expires: Fri, 01 Jan 1990 00:00:00 G
MT..Server: Microsoft-IIS/8.5..Access-Control-Allow-Origin: *..Date: T
ue, 21 Jun 2016 17:59:09 GMT..

GET /?1twDIwONaqThOPXPzrRcCAzNTduVwomb HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v2.zopim.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Date: Tue, 21 Jun 2016 17:59:08 GMT

Content-Type: application/octet-stream

Content-Length: 0

Connection: keep-alive

Set-Cookie: __cfduid=d793f2a1a0812475e9b3843eb056190ae1466531947; expires=Wed, 21-Jun-17 17:59:07 GMT; path=/; domain=.zopim.com; HttpOnly

Location: hXXp://v2.zopim.com/bin/v/widget_v2.153.js

ETag: "576916fd-0"

Expires: Tue, 21 Jun 2016 21:59:08 GMT

Cache-Control: max-age=14400

Cache-Control: max-age=14400, public, must-revalidate, proxy-revalidate

CF-Cache-Status: EXPIRED

Server: cloudflare-nginx

CF-RAY: 2b695a4277a52950-OTP
....


GET /bin/v/widget_v2.153.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: v2.zopim.com

Connection: Keep-Alive

Cookie: __cfduid=d793f2a1a0812475e9b3843eb056190ae1466531947

HTTP/1.1 200 OK

Date: Tue, 21 Jun 2016 17:59:08 GMT

Content-Type: application/javascript; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Expires: Fri, 19 Jun 2026 17:59:08 GMT

Cache-Control: public, max-age=315360000

Content-Encoding: gzip

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 2b695a43c7c22950-OTP
3cf9..............y....0..?...'.j.K.v:n...K..Y.9...-'jm ..l..........s
.s....,.H. .. .nVw2h..p`y../o.n..O.V.8.;..?r[..).o....I..4..~.........
........_..Yv...q.......;..w..N....|.M..o./xo..t......Y......[.|=op5..
..r.q..A.f.0...x....^..7...i..7...i.r._.....7....`..`...`>..9...h.F
....hS.....j......4, ....,..`...E...G8.......Z.;.f..........`c.,..A.Ak
...b.7.N. .dgy...C....|.H....>D...4...}|......pc....@*~.T<\7.G.a
X2...^... ...........i......B.,...E.z.W...?......-h../..E....c.l.@...7
...-...k.[@C.i.,.a.4t....|....].........^..~`...\P...1......,`......H.
`....h.....u8..>.7..`2.G...L\..'F.`.Y8..;.[?....d...............}.0
..Oz.7........^...F00f.k.s..G...p8N..$qt.a.d...I?.....k8.B...^0...t..c
..........>.........:..C(....:i.....Ng.$..s....8........Q.k...edq.q
.n..1..W.....q:...........S.{..@n.."..O.13.Q.....p......`.....#.}..7..
...V.......1e.........x}.C.{...P.a.(..w.Zt...%A!..6......(.1.oY...j=.C
.....m,......o..".0. ...b1[.........Q..I.......l..r.F.....L....qq(.2}.
.Y..X....i.....=.....[^M.9.........5..S..l...U.,...0....Y.S.4.#.F..I.A
.u8.dm%.a... ......>.......N..; ....~.Xalg....]...w2.~y...M.D.."...
..?..a.Oo...:........yW.M..q.......z.i.._.(..CkdSV.0.....C..l.....t...
.,-.PHi...OG.p..LP....}..v..u...^,.......zEs....m.P..ao..{....3..=o.:.
...........T..^....,....$..S...u......`...>;.............C.7.Ow..H.
.....`...&...N...b.2..#...x5.....i..n8.>w.?...C.q>.G........k...
gm...3o<..P..|..'.... .SK.^...l.......8...S...n.`.......>.4(ee..
.)..l.....3......qp.Z..j'.!...M..4j.[..R./A.G`.v5.[..Sw..G.0Y.....
<<< skipped >>>

POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 142

Cache-Control: no-cache

v=1&tid=UA-49608409-6&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.7.1.1_ab_dan_st_optimizer_end_c-yearly&ea=app_launch&el=Yes&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:32 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 21 Jun 2016 17:59:32 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;..

GET /en/driver-updater/driver-updater-setup.exe HTTP/1.1

User-Agent: Auslogics Tools Updater

Host: static.tweakbit.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Tue, 21 Jun 2016 17:59:03 GMT

Content-Type: application/x-msdos-program

Content-Length: 8883504

Last-Modified: Thu, 12 May 2016 13:40:49 GMT

Connection: keep-alive

ETag: "573487e1-878d30"

Server: NetDNA-cache/2.2

Accept-Ranges: bytes
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L......U............
.........4............... ....@..................................s....
.......@......................................l...........HP...<...
......................................................................
..................text...4........................... ..`.itext..D....
....................... ..`.data........ ......................@....bs
s.....V...0...........................idata...........................
...@....tls.....................................rdata.................
.............@..@.rsrc...l............ ..............@..@.............
.......................@..@...........................................
......................................................................
.................................................@...AnsiChar.........
...@...string(.@...AnsiString......@...............................@..
....... 9@.(9@..9@..9@..9@..9@..9@..9@.,8@.H8@..8@..TObject.%..A....%.
.A....%..A....%..A....%..A....%..A....%(.A....%..A....%$.A....%..A....
%..A....%..A....%..A....%..A....%|.A....%x.A....%t.A....%p.A....%l.A..
..%h.A....% .A....%d.A....%`.A....%\.A....%..A....%..A....%..A....%X.A
....%T.A....%..A....%..A....%..A....%P.A....%L.A....%H.A....%D.A....%@
.A...S..........$D...T.J....D$,.t...\$0....D[..@..%<.A....%8.A.
<<< skipped >>>

GET /tools/ipInfo/ HTTP/1.1

Host: VVV.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:16 GMT

Content-Type: text/html; charset=UTF-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Set-Cookie: PHPSESSID=pp0i0ipl7rhim4drq73shn0pu4; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; expires=Sat, 20-Aug-2016 17:59:16 GMT; Max-Age=5184000; path=/; domain=.tweakbit.com

Access-Control-Allow-Origin: *
7b..{"ip":"194.242.96.218","continent":{"code":"EU","name":"Europe"},"
country":{"code":"UA","name":"Ukraine"},"city":"Unknown"}..0..HTTP/1.1
 200 OK..Server: nginx/1.6.2..Date: Tue, 21 Jun 2016 17:59:16 GMT..Con
tent-Type: text/html; charset=UTF-8..Transfer-Encoding: chunked..Conne
ction: keep-alive..Vary: Accept-Encoding..Set-Cookie: PHPSESSID=pp0i0i
pl7rhim4drq73shn0pu4; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-
check=0..Pragma: no-cache..Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D
3F7BD=1; expires=Sat, 20-Aug-2016 17:59:16 GMT; Max-Age=5184000; path=
/; domain=.tweakbit.com..Access-Control-Allow-Origin: *..7b..{"ip":"19
4.242.96.218","continent":{"code":"EU","name":"Europe"},"country":{"co
de":"UA","name":"Ukraine"},"city":"Unknown"}..0..

POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 143

Cache-Control: no-cache

v=1&tid=UA-49608409-10&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.0.4.1_ab_dan_st_optimizer_end_c-yearly&ea=app_launch&el=Yes&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:07 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 21 Jun 2016 17:59:07 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;..

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Strict-Transport-Security: max-age=10886400; includeSubDomains; preload

Date: Tue, 21 Jun 2016 16:08:35 GMT

Expires: Tue, 21 Jun 2016 18:08:35 GMT

Last-Modified: Wed, 01 Jun 2016 14:34:39 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11492

Cache-Control: public, max-age=7200

Age: 6632
...........}is....w....GCF0%.N&#..r.....v..J..`I....W.......H..{..zS5.
.X.6...q..#...#.{....u....=&.~...|6kw..u.O.q2N.'..U..i.w.Rm.....TA.UW.
......aaPk.;..?P.n.k...gF.;.....<..W.1...................<..C...
}..........88<:>...........x(.....?....x. .......C......../.....
.......f....T2.FO..s.....U..q.M......- .i...{...DtAi...d.q,......JB;.)
.G.59..J&.[o..d..<..Mn.s...2....~<...zL....(...$.m....l.5.k>.
5...g.....Z|9..49.y..2......4Z./t....9A.T2....ze..8..D.d7..}.:..s....i
..G]_.......9..j.'7..|R ..\.......Q.DS........Iuw|.:z\..~a..P...`....^
.F..~.&...Q..../.x.S....j.....3gIq.......O.....Q.:.!.....}...:.z...%T.
#.p....My~.......W.^..O.{..d<.7<..N.H...1.=3.rk$.............`.8
Et..}.....v...5RQk..b.RIz..K..zT]...].h..M.......{.y.....*@T.^n4.~ (..
.hf.|aV@..cD......\......Cp......?*a......J....m.O....".O.."*.<A.Cs
.......U]............-.#1.N....O~.M.T..~$..B.V.g...&.z..........3.=.C.
...u..'<..#X8 .XE.K..B...V..=.y.1...$..........P.7......@V...9N%..7
......j.8.........0...n......=.. .E*j..V...Z...e....F..-.....ju..4....
..C.gA f..........Q.".cN.p...i._..../....=....C...[.X....A..q....9..e.
#..O.r..E..Y.$.. ... u...U....l*....U..N&....5...=....N...h.....hwQr..
........A....5.~.4..F.L9.0r......V.1H.&=...T..y.q..yS..*!z ....i....-.
..kS..%l..O..Cw...3u=."Fh...../Yx..O....w...w.... .u.....#Jb.5%.G...\#
.8.......@......wWm.c.G...g8.m..V.6..c<6?..x..%...q......y8P..}.>
;K.&.x=.c....F|...rY....>.:,B...K..17.....U..e...x|.......]..U.>
......|.....| N.%.......d...5.;..^Z..@.e........1Dh.].x.L.>.%..
<<< skipped >>>

GET /plugins/ua/linkid.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Date: Tue, 21 Jun 2016 17:54:13 GMT

Expires: Tue, 21 Jun 2016 18:54:13 GMT

Last-Modified: Thu, 21 Apr 2016 03:17:22 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 856

X-XSS-Protection: 1; mode=block

Age: 295

Cache-Control: public, max-age=3600
......n...tTQo.6.~..p.M cNq......kP.......o.HJ.,..E;5,...%.Q..E.#.#...
x8.Y........4.2V.'....].m.[...K!5b.S.s...*....%.V:.....7W..B(.d.]...|U
P......'.. "Lp1G.....Y-..l...]!... ...9G.[m.n...O.w"h|.HZ...T..yAH....
........!,K.d!1t...L.*a,...&B.&..m.f'...u.y;......',..I...:...G.....@.
G..m..{...,.."*..5Y. .!7=&I^..9{..N. 7X.c..-y|..r...DR.....8.3.wF..T..
..sYiS....*h.#._tq..........c.....;........oUZj[.........*_.U.lI..5...
2...bW..^. ...<j.T.]..!]._.m.V.nSp.\.544.. .vu....r.J.. ....Jz}.s..
...r{=%m.G....z. #....C.j......6.<.j....m.-~o.....b.....g.F4...g.j.
..T.7..QiD....]...Q.D..F.7.va.8.,o...NX...lz.`.oh...Ng.._Q......9...Jz
..mOA.....y.%.&I_8FIi..(D.a5.>0..m.S..B..i....."../u.U..o......-o..
..V.Y..0...L..W.xv....b..]>.....'.&..y...4..Dj...1....E.L..N.Q.....
O..e6.......C//......~kEy.F6......Q!.. .......p\I...k......H..z.r.....
........R.............Bj!...HTTP/1.1 200 OK..Vary: Accept-Encoding..Co
ntent-Encoding: gzip..Content-Type: text/javascript..Date: Tue, 21 Jun
 2016 17:54:13 GMT..Expires: Tue, 21 Jun 2016 18:54:13 GMT..Last-Modif
ied: Thu, 21 Apr 2016 03:17:22 GMT..X-Content-Type-Options: nosniff..S
erver: sffe..Content-Length: 856..X-XSS-Protection: 1; mode=block..Age
: 295..Cache-Control: public, max-age=3600........n...tTQo.6.~..p.M cN
q......kP.......o.HJ.,..E;5,...%.Q..E.#.#...x8.Y........4.2V.'....].m.
[...K!5b.S.s...*....%.V:.....7W..B(.d.]...|UP......'.. "Lp1G.....Y-..l
...]!... ...9G.[m.n...O.w"h|.HZ...T..yAH............!,K.d!1t...L.*a,..
.&B.&..m.f'...u.y;......',..I...:...G.....@.G..m..{...,.."*..5Y. .
<<< skipped >>>

GET /collect?v=1&_v=j44&a=1190323766&t=pageview&_s=1&dl=http://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct&registered=false&ul=en-us&de=utf-8&dt=Thank you for installing Internet Optimizer | tweakbit.com&sd=32-bit&sr=1276x846&vp=1260x697&je=0&fl=11.6 r602&_u=CGCAiEAiB~&jid=1112487111&cid=1128533027.1466531951&tid=UA-41053490-1&z=839656180 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Sat, 18 Jun 2016 20:14:20 GMT

Pragma: no-cache

Expires: Mon, 01 Jan 1990 00:00:00 GMT

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Cache-Control: no-cache, no-store, must-revalidate

Age: 251089
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Sat, 18 Jun 2016 20:14:20 GMT..Pragma: no-cache..E
xpires: Mon, 01 Jan 1990 00:00:00 GMT..Last-Modified: Sun, 17 May 1998
 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gi
f..Server: Golfe2..Content-Length: 35..Cache-Control: no-cache, no-sto
re, must-revalidate..Age: 251089..GIF89a.............,...........D..;.
.

GET /en/speedtest-optimizer/wcmb/assist/speedtest-optimizer-setup.exe HTTP/1.1

Host: downloads.tweakbit.com

HTTP/1.1 301 Moved Permanently

Server: nginx/1.2.1

Date: Tue, 21 Jun 2016 17:58:43 GMT

Content-Type: text/html

Content-Length: 184

Location: hXXp://downloads.tweakbit.com/en/internet-optimizer/wcmb1/internet-optimizer-setup.exe

Connection: keep-alive
<html>..<head><title>301 Moved Permanently</title
></head>..<body bgcolor="white">..<center><h1&
gt;301 Moved Permanently</h1></center>..<hr><cent
er>nginx/1.2.1</center>..</body>..</html>..>....


GET /en/internet-optimizer/wcmb1/internet-optimizer-setup.exe HTTP/1.1

Host: downloads.tweakbit.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: nginx/1.2.1

Date: Tue, 21 Jun 2016 17:58:43 GMT

Content-Type: text/html

Content-Length: 160

Connection: keep-alive

Location: hXXp://static.tweakbit.com/en/internet-optimizer/wcmb1/internet-optimizer-setup.exe
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx/1.2.1</ce
nter>..</body>..</html>..HTTP/1.1 302 Moved Temporarily
..Server: nginx/1.2.1..Date: Tue, 21 Jun 2016 17:58:43 GMT..Content-Ty
pe: text/html..Content-Length: 160..Connection: keep-alive..Location: 
hXXp://static.tweakbit.com/en/internet-optimizer/wcmb1/internet-optimi
zer-setup.exe..<html>..<head><title>302 Found</ti
tle></head>..<body bgcolor="white">..<center><
h1>302 Found</h1></center>..<hr><center>ngi
nx/1.2.1</center>..</body>..</html>....

POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 150

Cache-Control: no-cache

v=1&tid=UA-49608409-10&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.0.4.1_ab_dan_st_optimizer_end_c&ea=Installer_Install_1_Init&el=Yes&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:03 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 187

Cache-Control: no-cache

v=1&tid=UA-49608409-10&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.0.4.1_ab_dan_st_optimizer_end_c&ea=Installer_SystemInfo_ScreenInfo*&el=Windows XP x32, 1276x846, 32, 96&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:03 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 161

Cache-Control: no-cache

v=1&tid=UA-49608409-10&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.0.4.1_ab_dan_st_optimizer_end_c&ea=Installer_SystemInfo_OS*&el=Windows XP x32&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:03 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 164

Cache-Control: no-cache

v=1&tid=UA-49608409-10&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.0.4.1_ab_dan_st_optimizer_end_c&ea=Installer_SystemInfo_Browser*&el=iexplore.exe&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:03 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 158

Cache-Control: no-cache

v=1&tid=UA-49608409-10&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.0.4.1_ab_dan_st_optimizer_end_c&ea=Installer_Install_2_FileCopyInit&el=Yes&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:03 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 173

Cache-Control: no-cache

v=1&tid=UA-49608409-10&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.0.4.1_ab_dan_st_optimizer_end_c&ea=Installer_Install_3_Offer*&el=Driver Updater_Installed&ev=0
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:03 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 156

Cache-Control: no-cache

v=1&tid=UA-49608409-10&cid={BB2C52E1-8725-4E8C-9DB7-772273A0E1D2}&t=event&ec=1.0.4.1_ab_dan_st_optimizer_end_c&ea=Installer_Install_4_Completed*&el=New&ev=3
HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 21 Jun 2016 17:59:03 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;..

GET /includes/vendors/jquery.dialog/jquery.dialog.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tweakbit.com

Connection: Keep-Alive

Cookie: PHPSESSID=hv1bb01gneauodef189riuna87; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=0621175903_yearly-ab_0621175903_dan_st_optimizer_end_c-

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:03 GMT

Content-Type: text/css

Last-Modified: Tue, 21 Apr 2015 18:02:58 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Last-Modified:: Tuesday, 21-Jun-2016 17:59:03 GMT

Cache-Control: public

Content-Encoding: gzip
17b............uR.n.0.=....&6.@A.C...(4..Dq......s.v-CkT.....gg.9..k(.
|.-.4](\.......P.....#w...WA.a...)...2....)$..D..Y.... ...#....K..6...
..........k...q.J.H.'8n..N..............~.K^pB:..P.gdc..... ...t..>
1...v.E..z....x. ..v.....L..I.A'~........Z..dJ... Zh.......H..j.......
.......D..T.L[..7..Y..I.~......4.IQ;..........5..t.z..-.A.'5...W.k...O
^..*.....K....p.^.x..... .6..z.S.......0......


GET /includes/jscss/index.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tweakbit.com

Connection: Keep-Alive

Cookie: PHPSESSID=hv1bb01gneauodef189riuna87; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=0621175903_yearly-ab_0621175903_dan_st_optimizer_end_c-

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:04 GMT

Content-Type: text/css

Last-Modified: Mon, 06 Jun 2016 13:29:25 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Last-Modified:: Tuesday, 21-Jun-2016 17:59:04 GMT

Cache-Control: public

Content-Encoding: gzip
13bc.............;k...u.g~..E.xAj..if.@....E.o...@..D.E2$........-.4..
-. .b8.k./h.Q...H.1.....;C.{.y.....K....^^...?.......u.I.y...Q....0...
H........O.e....._....__.......?O.../.y..E..........<...a..qU..d./.
.Y.Q.Gq.G...7.2...f.'Y...#..~.W....M..~U..m.......s.[.u...K..o.._.Y..~
.8k?..<....&.2.....M....s.6.Wq..u8O.....<.k..^.y...8..%......<
;/...._..:M..~....U.o.hZ.a..*..W..\%../..$[.O..D.C.TuP..i<..,~<.
..4....w.....W...d..g.4....w...z.xN..Y."O...........Q.........{....?..
.O.A...W.gB.............. .a.Y.W..k..q......&Y...~..u..].)...A:.g.....
.%Q..z7.~..7...*.v...,9....L[..Go~..7..FOoP..M.6F....S...MS$E.uf).{...
.....r....Qjh..2.$).xS...)...}X&! ;C..r...IVlk....=...w5.Q.=tc.[....#.
Zk.J.6i....O.........V.Y.&m..e....z..E:c.^..~...Gk...h...:x...n.y=B.u[
./.$..w`h..4_....g....a5...y1...m....{..............*..tA...(..$......
.. .....eZ7.BB}......@~H....~Zf...(.t..@..V..%...-.U....8m'..^[a4...Nb
.X..{l.L.m...i...{l...Bj9m..~.m..b^.-......!.pV.......V.a3.$x.a...,...
......h.d..?aR.Z.~..b....64....$..VG.AgR.u...\...A.;i'.~x....`.1......
.XC.?..$....k.F..xIU..3J.U...b .`'.r8.....H..;...7v..h@...T..6z.v3....
.J}.?.....,z8...wRk..4.,.)P0.l.C..&BS....7..U...b.......H....H.V..0.6q
........i........V..le1;..X..>..`.......^...`6..j.....!1_B.b.uUd.&l
t;...v...H....=Ik...ix%_..0.u......J.......!V.V..... .[..*...x..<M"
gO(...<...........%.(^.%T.X.b....s*l.E.z[.v.a..D.D#vD.?......yE.y..
.&...xhr......t.e...*....`.D.@Vz.m..J....}....L.#.?. z.......d..K...^.
.....~<Sw...a..e~.[%K(>1...[.@..!.../.R5>.e....J".x<GY
<<< skipped >>>

GET /en/products/afterinstall/internet-optimizer/jscss/internet-optimizer.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tweakbit.com

Connection: Keep-Alive

Cookie: PHPSESSID=hv1bb01gneauodef189riuna87; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=0621175903_yearly-ab_0621175903_dan_st_optimizer_end_c-

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:04 GMT

Content-Type: text/css

Last-Modified: Thu, 25 Feb 2016 09:55:42 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Last-Modified:: Tuesday, 21-Jun-2016 17:59:04 GMT

Cache-Control: public

Content-Encoding: gzip
2b4.............T.n.0.}..Bh.....'i.x_#[.-D..Yn....Q.'..tC..."y..O..;:e
?:..A0..(_....;.....j..s........]..1r..i].......Bq...s...m..u... ....T
....W.[...I..v.....q.M.....htp..0..I..$ThXJ].!^KM.4...H^;..\...K..6..O
c..n....eL..@ ...e...../W.j.X=(V......<......<<&.PQil...!g...
.@..?..Y.....w...R.....v.1.{M...?v...#..e*... ../A-i..](xyK......bO...
.....4'hk........:.......$'T...Xq.Z..GQi.m.......|......a..%...Wg8...*
...'4..rI.x...K..HC..l....QX8......Jm.=X.....9.z-.$..e8Z..->.......
.../W...p....,.s...L.......9..X......J8.i...W.3u.8z.&y......n..2.&....
7n..^..t.1..?..s(..o.o.fO.o..yc.... xt....SP.`.Hm...K.M.7(.......!..q)
:.....76..ei.6...Y.%..k4..q....'......_.e......|...3{...g!. .....>c
.D..v.5.q.....0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 21 J
un 2016 17:59:04 GMT..Content-Type: text/css..Last-Modified: Thu, 25 F
eb 2016 09:55:42 GMT..Transfer-Encoding: chunked..Connection: keep-ali
ve..Vary: Accept-Encoding..Expires: Thu, 31 Dec 2037 23:55:55 GMT..Cac
he-Control: max-age=315360000..Last-Modified:: Tuesday, 21-Jun-2016 17
:59:04 GMT..Cache-Control: public..Content-Encoding: gzip..2b4........
.....T.n.0.}..Bh.....'i.x_#[.-D..Yn....Q.'..tC..."y..O..;:e?:..A0..(_.
...;.....j..s........]..1r..i].......Bq...s...m..u... ....T....W.[...I
..v.....q.M.....htp..0..I..$ThXJ].!^KM.4...H^;..\...K..6..Oc..n....eL.
.@ ...e...../W.j.X=(V......<......<<&.PQil...!g....@..?..Y...
..w...R.....v.1.{M...?v...#..e*... ../A-i..](xyK......bO........4'hk..
......:.......$'T...Xq.Z..GQi.m.......|......a..%...Wg8...*...'4..
<<< skipped >>>

GET /includes/vendors/jscookie/js.cookie.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tweakbit.com

Connection: Keep-Alive

Cookie: PHPSESSID=hv1bb01gneauodef189riuna87; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=0621175903_yearly-ab_0621175903_dan_st_optimizer_end_c-

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:04 GMT

Content-Type: application/javascript; charset=utf-8

Last-Modified: Tue, 24 Nov 2015 14:23:54 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Last-Modified:: Tuesday, 21-Jun-2016 17:59:04 GMT

Cache-Control: public

Content-Encoding: gzip
5d2.............Wmo.6..,..k.Ur.H...-.W$N..CW./.0........@RN...}w$%;N..
@...{....5y.../.=[....K.#)os..A....nnL.O.d..yu..r......m..$..d.R.ln`..
.....1.V.J..L..^.[6.\..b.-.|..g.gP.......w_..S.4G...M ..\...,5R..p...)
DfUr9..Os.a8.B.........".*..la.:..x.9l..o.TF;4y}.S.:........x:Qw....%S
..."s.D$..E&.b...V....;<.F.P&.r$..Cb....#.<.F.-.d)P.TJ."..5.Yw.[
A.8-,.f.. r.....7...UA<..(.J......L....F...33...=..`.1*.......c....
.".[.........!.c...D{oO,......e..7.N'h=.En J.Xre.r..-=J.&z.dE.{[v..i..
x...*7.m.6 [.|$..8h|..F.\..{R.....).Ih...2.=f,C....g..v.l`)=s...WT.k.|
....o ....%3.&0Q.W...C^.....LG..l...{[.iM...O...1..}.b..p".@.1jE.M..a.
......5.....Ud_....M.._._.'I..e"..m.M..3"N.d....S.Rf.9D..=..|.&G|G/..5
X\.2._?...E).f}..2..... V.,X....hpX....I=......Q}..>...o....Q.>.
../..7.I.~uQ..._.....]l....7/.....yG.Ge...`S.a.~..R..N..~.!..?.>.3.
................2......N.!.]l....0l...>.i8...&...........?a..X..N..
RZ..,..}6...AH..*iZ...^..7.HPM.~.......z..2.`........N..b.V..kr.}....k
 ..F.".C......O.e6...0.M....:.....}.P*....c.FA!eI....4W..M.`Z.3l....4 
l....i4..)n.........kkl..."..B..4.,...ws.<P...$.9v....N..5PC.....'.
...D.7...0v..@..A..$.a....|....`..Kf......dxk.z.OLEK....&.......0..G..
-..Y.q....'./Mb..F?..^E.]...........9S.&.w. y..!N.....`..a....[:~...,.
..l.lz...p.b.Y..%.....n.I..F....o...FK.$...D.|..C....g.=}4C(..D\8m....
.pc.-*g...*^......G.M.m.c3...H....'.[Kiw/rLi...A(....}#......vI..a.g..
 .b.W...).Uq.5n2cLj...j4j.#..."I.......x../..r.c....)k.V.p.[.C..V..._,
|O?.l..Z.....Gg...h..E....M...H..6...X..?..`.`.....0......
<<< skipped >>>

GET /includes/vendors/projekktor/projekktor.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tweakbit.com

Connection: Keep-Alive

Cookie: PHPSESSID=hv1bb01gneauodef189riuna87; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=0621175903_yearly-ab_0621175903_dan_st_optimizer_end_c-

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:05 GMT

Content-Type: application/javascript; charset=utf-8

Last-Modified: Tue, 21 Apr 2015 18:02:58 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Last-Modified:: Tuesday, 21-Jun-2016 17:59:05 GMT

Cache-Control: public

Content-Encoding: gzip
700a..............{W[..>....w.w..d.._.",..x../.`O&........F........
....0v...9'1..]].]]U]U].t....T._......>.F...ve....... /.n.].../.I=.
.1...w.d.....w .....*...V...l6n.-...7..p.3:.....b.?>.U.,.,... ..n{.
9iW~......q.8... ....I{.*2.J.{ju.V.........a:i.*;gG.~....I...f..P...X.
....g....;.vf.i.n........u.N.......Y.5H...|.w.QRkt.CN...8.]......Z...N
.p4..7v.\........c{RI[I......V}6iw>....I'M.....n.Im.7.TY..Z^.?I..tx
<;Y./,........j...jMz. 3m....AV.g.7.B.=...g'...o...G>...I.......
..~c.:~^.J.i..i..F[....1.wI*.V.l.M{.a....[.5...%x..4.M..7.z.....]...y.
w....h.f.. ...#n....q"Q..<.u../......=......d...(R..h....].....l0..
f .QO:i%....t....W.F.|Ph0.M......g ..Z....f...u.F."..B-....F....q:..Vk
-.I..E.n:....I.zm.3............@....px.:}.........X.].........).....k.
..k_.N..bw....p..h..vv....$~.XRB.x..O=.(..Z .5_....../..(..j.2.B..o...
........#0.h.<.R.....Xi6:..Z..D.$...%tE.~'...B.X........:..w...jD.F
.........k......)&&3...Z...N........k.].X......*s{.....N......t.y5...v
4|.....~..z.c.....|..1R.B"(K.~l]....n...hl......~J....6X.D...A.......t
....l.nO_.D..2....@..}6........=..j...$...M..D.tK.)H.F.4......@k....,.
.:g...?.M}.A.:....,mt!_b....a.*..........A{<M..K.].lB...w...r../..n
:.|........I.....P..T.....#?..l.&g.l.I.k..:Z.[.|u..ym... ..X.....V....
iB..m.....=h.!K?..U..O;3........%@(...*@k.J?..."...F........q6...)....
NE..  `..J. 8-$...?.]......h.V.m.....i...EMgi%...,.`..^...-....pWW...&
./gQj..'...(>...suue..)'.D3.Y......v...r......D5i`...2G...%.6..u.z.
......N&...h<S........F0..>c.> .....R...a...kL...m8U..e..
<<< skipped >>>

GET /includes/vendors/jquery.nanoplaceholder/jquery.nanoplaceholder.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tweakbit.com

Connection: Keep-Alive

Cookie: PHPSESSID=hv1bb01gneauodef189riuna87; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=0621175903_yearly-ab_0621175903_dan_st_optimizer_end_c-

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:05 GMT

Content-Type: application/javascript; charset=utf-8

Last-Modified: Tue, 21 Apr 2015 18:02:58 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Last-Modified:: Tuesday, 21-Jun-2016 17:59:05 GMT

Cache-Control: public

Content-Encoding: gzip
14f............u..N.0....S......l...V......`.g....D.P..O.HH\......|5..
0.'-.j....#..mtl:.Z.}..Qs<.. .d..q.m...j...Uo.r.FX...p.[..F.'G..;..
"..:Xi...........p/.U._....m:.....|r).f....@%.....)....KW9......h.~...
8.Z...0d.g...;v?....8%$o.T..@h;....p..d...U.....pMRn.%..............`.
.BSV...k<.p(...n......#.!...B.."..!....q.....{F...r;...tW.6......0.
.HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 21 Jun 2016 17:59:05
 GMT..Content-Type: application/javascript; charset=utf-8..Last-Modifi
ed: Tue, 21 Apr 2015 18:02:58 GMT..Transfer-Encoding: chunked..Connect
ion: keep-alive..Vary: Accept-Encoding..Expires: Thu, 31 Dec 2037 23:5
5:55 GMT..Cache-Control: max-age=315360000..Last-Modified:: Tuesday, 2
1-Jun-2016 17:59:05 GMT..Cache-Control: public..Content-Encoding: gzip
..14f............u..N.0....S......l...V......`.g....D.P..O.HH\......|5
..0.'-.j....#..mtl:.Z.}..Qs<.. .d..q.m...j...Uo.r.FX...p.[..F.'G..;
.."..:Xi...........p/.U._....m:.....|r).f....@%.....)....KW9......h.~.
..8.Z...0d.g...;v?....8%$o.T..@h;....p..d...U.....pMRn.%..............
`..BSV...k<.p(...n......#.!...B.."..!....q.....{F...r;...tW.6......
0......
<<< skipped >>>

GET /includes/jscss/blocks.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tweakbit.com

Connection: Keep-Alive

Cookie: PHPSESSID=hv1bb01gneauodef189riuna87; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=0621175903_yearly-ab_0621175903_dan_st_optimizer_end_c-

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:06 GMT

Content-Type: application/javascript; charset=utf-8

Last-Modified: Mon, 06 Jun 2016 13:29:24 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Last-Modified:: Tuesday, 21-Jun-2016 17:59:06 GMT

Cache-Control: public

Content-Encoding: gzip
225............}S.n. .}v....d.&8[.2.a..*um......8.!...&U..]..3......{.
9..).h......)~9...[.V....K.A".G:%y. .u..?T0.L.<)_'.,;0......!'aQ.p;
s{!...Z,...m..#*.h uC.Z....K..p..T.{....n..... ...3r.q...x..A^...3k:'.
Ae8&.F.%|.C..VL.....NJ......Z....J.m1..=....&....Tj.`...Q..%E.<...F
.e.. .....Z.........ib/v..5..QVf.W.. .h.c!.39R..4d./...Jpo,FV<.....
....._.OE$..t...0...B..(..t.......?.sRT..e......'....f.{...O..e...<
.w....e.\..#.F....7.cc v. V.9...z...3)..i...!!..:&...y.c../w.g.=.M`c..
..TU.:.M/.r....>.....`.7u'U.{|...'.u.......w..m..v..S*.M..X3.`A..&g
t;.?...Wq.....0..HTTP/1.1 200 OK..Server: nginx/1.6.2..Date: Tue, 21 J
un 2016 17:59:06 GMT..Content-Type: application/javascript; charset=ut
f-8..Last-Modified: Mon, 06 Jun 2016 13:29:24 GMT..Transfer-Encoding: 
chunked..Connection: keep-alive..Vary: Accept-Encoding..Expires: Thu, 
31 Dec 2037 23:55:55 GMT..Cache-Control: max-age=315360000..Last-Modif
ied:: Tuesday, 21-Jun-2016 17:59:06 GMT..Cache-Control: public..Conten
t-Encoding: gzip..225............}S.n. .}v....d.&8[.2.a..*um......8.!.
..&U..]..3......{.9..).h......)~9...[.V....K.A".G:%y. .u..?T0.L.<)_
'.,;0......!'aQ.p;s{!...Z,...m..#*.h uC.Z....K..p..T.{....n..... ...3r
.q...x..A^...3k:'.Ae8&.F.%|.C..VL.....NJ......Z....J.m1..=....&....Tj.
`...Q..%E.<...F.e.. .....Z.........ib/v..5..QVf.W.. .h.c!.39R..4d./
...Jpo,FV<.........._.OE$..t...0...B..(..t.......?.sRT..e......'...
.f.{...O..e...<.w....e.\..#.F....7.cc v. V.9...z...3)..i...!!..:&..
.y.c../w.g.=.M`c....TU.:.M/.r....>.....`.7u'U.{|...'.u.......w.
<<< skipped >>>

GET /includes/mixins/phone-popup/phone-popup.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tweakbit.com

Connection: Keep-Alive

Cookie: PHPSESSID=hv1bb01gneauodef189riuna87; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=0621175903_yearly-ab_0621175903_dan_st_optimizer_end_c-

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:07 GMT

Content-Type: application/javascript; charset=utf-8

Last-Modified: Fri, 13 May 2016 08:53:33 GMT

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Last-Modified:: Tuesday, 21-Jun-2016 17:59:07 GMT

Cache-Control: public

Content-Encoding: gzip
2d8.............T.n.0..n..(....5...X...$....c\......e;... $......BL `.
..7.$ [...R*..;..>....\.N(....f.!F~./.LT.t..................7r..8..
........h6./.3...f.....1....sq..]......;.T.&N..t.....Z ..t..}f@.Jr..t.
..zxoc#...v7.V.I).ZP:.n[.=.}b...$..e~.t..f...D...j...X......n...n.#=..
..D.n.U......D^..j.s..H.O....8.J7..3b|..;n..L)..E..<..T...p....qQ..
....Qr..pi.h..q..m.2 9O ......JY!.5...PS.dj..fx.. ..p..Bo...0.....x...
....m.vT.....>....N.O...ih..v..Nf..>......p.)..A.......|...]....
....l...Z~,.........qy..o.=.............s^A....Yy.l.|.r.`.1..L|.....7.
<..?p4.......n.q.r...1.NT.O.t.L.....6..XemB..x.....q.'...8.....\\w.
...T...A. .P.n.!..(...-....K.;.3.*."R.^{.&..1V.I...F...W..i.;..t.j...Y
.s...jt..n...[.......kt..$.......<.f.l.....&0.....0..HTTP/1.1 200 O
K..Server: nginx/1.6.2..Date: Tue, 21 Jun 2016 17:59:07 GMT..Content-T
ype: application/javascript; charset=utf-8..Last-Modified: Fri, 13 May
 2016 08:53:33 GMT..Transfer-Encoding: chunked..Connection: keep-alive
..Vary: Accept-Encoding..Expires: Thu, 31 Dec 2037 23:55:55 GMT..Cache
-Control: max-age=315360000..Last-Modified:: Tuesday, 21-Jun-2016 17:5
9:07 GMT..Cache-Control: public..Content-Encoding: gzip..2d8..........
...T.n.0..n..(....5...X...$....c\......e;... $......BL `...7.$ [...R*.
.;..>....\.N(....f.!F~./.LT.t..................7r..8..........h6./.
3...f.....1....sq..]......;.T.&N..t.....Z ..t..}f@.Jr..t...zxoc#...v7.
V.I).ZP:.n[.=.}b...$..e~.t..f...D...j...X......n...n.#=....D.n.U......
D^..j.s..H.O....8.J7..3b|..;n..L)..E..<..T...p....qQ......Qr..p
<<< skipped >>>

GET /includes/i/mp_dark.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tweakbit.com

Connection: Keep-Alive

Cookie: PHPSESSID=hv1bb01gneauodef189riuna87; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=0621175903_yearly-ab_0621175903_dan_st_optimizer_end_c-

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:08 GMT

Content-Type: image/png

Content-Length: 4281

Last-Modified: Tue, 21 Apr 2015 18:02:50 GMT

Connection: keep-alive

ETag: "553690ca-10b9"

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Last-Modified:: Tuesday, 21-Jun-2016 17:59:08 GMT

Cache-Control: public

Accept-Ranges: bytes
.PNG........IHDR.......).....%!......tEXtSoftware.Adobe ImageReadyq.e&
lt;...[IDATx..].tV...!..".G.....E.P....6Q...V...u9F UA.IQ[\.MP[.VM....
.PE.."V.. (.V.B.. ........w2..y.{.....9....].]f....$-.H...&L3...Pm.;..
.....7...w.a..KMD.%n....$.!d.v.C.[S....3../...^"..VF....q... ]'.....#.
k`....uG....Q..G............SX...'....o.=.$..p..] .|.FR..<.g..h3.m.
D.a..qt.".L........IM..O,^....p:..B{.....-.....'l...d_B,.H(...i. |M...
....U.\5..p.[F8...p.C...5....5.o>.m."......N.%.uh.t...`.i..x.pQ.y..
.=..0..p0B..v#l"..........\h9.v].s.8X..`@K...C}...dV..........s9.)...G
;...&.Q...X.;.;.......t./.o...eD!...........a...bF...O..s..0.........w
.x.<.D .5.Z... ...n..x......#..>..Xp..v.....%L!.p...<......H.
.p..s..^...X"%..6....d.[p.uG;>.D.z...t...#......:..7_ ....%..#.,./F
.2..<`..8..o[.."....A.n......#.....A.7..$.d.....h.U....vG.sQ....Q..
.x......&......0.W...2%.h..Ex,....."m;.6G.W..5.l..!....'..#aA"<.o..
..u!.s.;..L........S.gY....45>q.."...C....c..V.s..g.x.Js..G.:..y...
8..%.f.h.~......J...t.E.O$.e"9.... .u.1w...-......G&v...b.>...t.z.M
0.....l...i...h..S12..d...g9.....GLX.. .i.B i#L...F>NQ..,O/k.!0....
......N.^r.L..-.qpT.'t&...w".pB.h.{E.../...L..L\..A.2.?.~_mY5...g ...3
3....9....(...v.i...B...;...z)aT.....(aO....*.o......|4..&j.Y.....$%..
h.5.0.e.D{>....a.._;.w....<.er.]...iJ.b.3f(.....Y.~.$./...D.ai.a
.......... !S...].MR.;D\-.\..'.w;.."..V..a9.p.e......h...*Bw..#..c....
...n..... ...]E....... .mJ.../...Ntx..0.[......}.......J.ha..S.S.Y....
..#..I".[...$a...d7.../.g... ........k... ..I....q^... .lc....t.$.
<<< skipped >>>

GET /includes/i/l_header_phone_dark.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tweakbit.com

Connection: Keep-Alive

Cookie: PHPSESSID=hv1bb01gneauodef189riuna87; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=0621175903_yearly-ab_0621175903_dan_st_optimizer_end_c-

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:08 GMT

Content-Type: image/png

Content-Length: 1176

Last-Modified: Tue, 21 Apr 2015 18:02:50 GMT

Connection: keep-alive

ETag: "553690ca-498"

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Last-Modified:: Tuesday, 21-Jun-2016 17:59:08 GMT

Cache-Control: public

Accept-Ranges: bytes
.PNG........IHDR...)...)......`......tEXtSoftware.Adobe ImageReadyq.e&
lt;...:IDATx..Yod[Q.o.B....B...)%....atJ(.QFg.....).N)..~....lBi..*lRa
t.a:.M..I.:.V ;...8=......O_...~..?....V...R.." .P.3.n...8...."~.ZI...
(.&..8k..*`0...H..vZ.#..a........E.J..U....U..t....Y.e..qlhu ...;q....
9.F?`.........[...Mx.....v.H...d..$..I..dB....,...&(...^.9...Z%?.)..*.
.O....h..ZHx.Z.z..D.Iu.HFq2*e....\.r./{..c.MWq#x.G._..\ 9*L.;..G.d..K.
B.].v.w....I.X.n.'I8...........g}..j-;:...#.5..O.4Su.....j......2BI.X.
. ...$...i...p.M......w...&.a.../..z..JEp.!.s..f..K...R....CpI..=h.TN0
.q....9.@.q.9.7.Y...!.h([.bc6.s8C..ci..S..I...X.@.........[.pT..lZ..!Q
R....=....W?.tN........1.G&.r=S^....YrE-...J~...g...rT-.....S.B....t.&
.vs.<..:$m....y.)..L.&ybh.....L..}F...'}.a...,.......b...y^'....u..
R$....e.s.mv....T..h.i.8.....w.zr.]i..!......t.3~...........-ZN.uN'.D.
..K.x..w.N..;..................o.q...S.x.T..!.5\u...,.P~...Su..O.\....
..d.X..g..m....i........N.o.[..B;q.Zv...p.t..0.....w..:N:........l..=h
.VI...;r-.....{..U.M........At,d....t..y.kB...yl...5...U5.h..D..FW..g.
...y.......g.V,.Vz...mb=.pE....^...`...p.0.;$...%....~...F.P.{.;.q...K
>.\...Z..D1..oqQ.IT.?..cf...Z}.".^..... ........].....IEND.B`.t>....
<<< skipped >>>

GET /includes/i/l_speedtest_content.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tweakbit.com

Connection: Keep-Alive

Cookie: PHPSESSID=hv1bb01gneauodef189riuna87; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=0621175903_yearly-ab_0621175903_dan_st_optimizer_end_c-

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:08 GMT

Content-Type: image/png

Content-Length: 882

Last-Modified: Tue, 21 Apr 2015 18:02:50 GMT

Connection: keep-alive

ETag: "553690ca-372"

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Last-Modified:: Tuesday, 21-Jun-2016 17:59:08 GMT

Cache-Control: public

Accept-Ranges: bytes
.PNG........IHDR.......d......7B.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx...1J.a.....b.B........ .....nE..B.B.$.c!.1#...w.<.d...
...{|.v]7ow....Y..v..zu.y.......Q./.n6.......K..vo.>.-._.N.........
........................o...O..............k....\.z....0n.............
`.......6.D....`....."....0~"...............@..@.... .................
0......D.... .. .... ................D......."....P.. ...`...........A
...........@."...............@..@.... .................0......D.... ..
 .... ................D......."....P.. ...`...........A...........@.".
..............@..@.... .................0......D.... .. .... .........
.......D......."....P.. ...`...........A...........@."...............@
..@.... .................0......D.... .. .... ................D.......
"....P.. ...`...........A...........@."...............@..@.... .......
..........0......D.... .P..K.....p...}.....IEND.B`.....


GET /en/products/afterinstall/internet-optimizer/i/features.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.tweakbit.com

Connection: Keep-Alive

Cookie: PHPSESSID=hv1bb01gneauodef189riuna87; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=0621175903_yearly-ab_0621175903_dan_st_optimizer_end_c-

HTTP/1.1 200 OK

Server: nginx/1.6.2

Date: Tue, 21 Jun 2016 17:59:08 GMT

Content-Type: image/png

Content-Length: 1997

Last-Modified: Thu, 25 Feb 2016 09:55:42 GMT

Connection: keep-alive

ETag: "56cecf9e-7cd"

Expires: Thu, 31 Dec 2037 23:55:55 GMT

Cache-Control: max-age=315360000

Last-Modified:: Tuesday, 21-Jun-2016 17:59:08 GMT

Cache-Control: public

Accept-Ranges: bytes
.PNG........IHDR...<...<.....:..r....tEXtSoftware.Adobe ImageRea
dyq.e<...oIDATx...ylUE....R....*.. ("..*.X.`0.."..h$.".hD...?.%...@
.. .@D."R..*(Z.[...f. ...Nr.y.9gf.}.U9..6sg9g....s.%WTT$%Hj..A.p3h....
..28...!......fp<.J%.l0.....:....Pg..e`)(.MC28N......K...........7^
c{.......f....,...d..&..A...0.....B....]../P'y~..L......Np.C....`I..pU
........-q...\......n...L....60.....F.....-m...a.\..hh. .."!..........
...........A...*u...}v....N..(._.c .P/O...n.Xw...U*<...FF.?..s...8=
z.....k......2m.LP...4x.q..0.\1.gzSLWpB.u....A.PA9..7....\V.>.jY..K
)[..9..r..4v1x...w.V......gQ.aK....V.Q.....=.....~.c ..bp}...........r
Y....9..aV(6...'.:..ig..05H~6|kis..P. ...[ Gid.pB."..W.......)eG(er$.?
W>........RvPcy.L....F..sJ]o.vd.6t......3.Sa*.;..y...=y..dn'.z.T...
.._.RMb.~J9..z*k...v..\.!o.....!......3.L...>%..N.........$:.NP...t
...>..<#.i..S.a.......tpQ...B....f7..L.~..)..G......=.6....lLOb.
.W..V.".#...>;.l.2...(.N.,...|..(.J..w..*^.l.. ..0....u.y..3...'...
A=..|%<._.w.....n#<.3(.&......4..<...E..?.._,..Q. ...E....]..
.x!1.E...X.6..B.p.....X!.k.e.E.0...c..e..w.....;...\.no...IG.V....p...
..7...[......o.\..........B._BZfD...s...vP~...6)...._).VCH; ..G.9A.qPj
...^%...y.i.>...y.2.....C..........Oe[.i...RxvFH...S.e{W.Q.9..=.W.T
.:.....}1k.W.;.|:.dn........n..........9..(o...BvP3....7..u..<....P
.|D.f....KY.Z.i.d...Ag......./.O1WY.Q..4O.K\.u~.W..m_%.~..7.R.s....G..
...$..e.P_/........O..}...*u......~.]7*. .)...h...9-..p....A3OYr....k.
.".....&..J...s.....B.?....V.....J.74Cx...TR...O.oR..M..x...ch...Y
<<< skipped >>>

GET /s/opensans/v13/4fu8RBPDDCYpod03lr_bYQ.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/en/internet-optimizer/afterinstall?csoffer=true&sys=912A597C&vm=NT6sfAl&dt=8&dc=Speedtest&source=internet-optimizer&campaign=ab_dan_st_optimizer_end_c-yearly&traffic=direct®istered=false

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: font/eot

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Tue, 21 Jun 2016 02:45:25 GMT

Expires: Wed, 21 Jun 2017 02:45:25 GMT

Last-Modified: Mon, 27 Apr 2015 23:46:15 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 83867

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 54818
......n...t.UP.N..w.....w. .....;...]..;......\..........=5.U...y..._.
.......[...............I@.........1............._..(.....*...%.......?
w......c..O.....?B......wj.p.?i.............Q.........y..\@cn......}.I
[s.H.?Z..bng.x...D..`.!n.@Wl..2#..x...Vcb....nrp_.,x...AY?T=.r....6c2m
...s...]..j].y8.y.8E.;Q.......#O.k..A.}...iy2&.P.=.<..t|..u.;..d...
....VnE..z....,* .hW..3Y..v...>.j..bmt..mOEL.U-c.G./.U....T%..q|X1.
7..}.......T;YLiF...5..._.....{'.,..-E......C....._..:B...[q...b'....m
4P|...o@.~..'.I..".g)VW....9.K.."..@cx. ....X..A....N....{.yWf@.T.._*w
.........`...<..1c./.w..W.8...........p......K....e........*~n[._K.
.............'........# `{qKI....f .W.K....C..[d..DB........P.{.l.]...
Dw......'...#W@........>..R......m.......T ...z#..r...>....0[.zd
.P.-k...}..............uu..d.=.Y........#.r......aM*r1.WI.H.t..#.....j
..O..\...M..]ah..L...b...^f7......[....K.}..P4t...j0.#.9.*.=.6..c.....
.8.V..?...K.......:.|....E.D.x...S.@44y..z/.A..=.;...:...#h.....U...~.
.......o[.V...l&..E.....c.K..Q..(.../v.k...mL.*/.v..?..7Y.$]........K8
 ..<...9...r..\..Ho....I..0.{.....e......}..9Q|R.......N.em........
~..Ag..Ti^...q......#..,..z[{.yN..g0_8M._..F"5F.(...A..Au...3&.H......
J._/.....L..r.Z..p...(\.S......"s.....Z.....*...dJ"...m.<....d)....
.go.....N.".......J6n.e......!.9D......{.{].......1......D.i....-.&JN.
A2[.H....b.r...3e...g.i7 .r]..Dj..z..n.X R...%..0k..,ZF...o.X.....bf..
.0..l..n.....c.6t#....=..\..E..m...\......x..st.=..a.p.R.,`.....LG....
k..'......o.*b}%.gG.Y...V5"E... !W~...QPq>......g....1..B...B..
<<< skipped >>>

GET /COMODOCodeSigningCA2.crl HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: crl.comodoca.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Date: Tue, 21 Jun 2016 17:58:51 GMT

Content-Type: application/x-pkcs7-crl

Transfer-Encoding: chunked

Connection: keep-alive

Set-Cookie: __cfduid=d65d48faade0fa9a6e9e77908239161ae1466531931; expires=Wed, 21-Jun-17 17:58:51 GMT; path=/; domain=.comodoca.com; HttpOnly

Last-Modified: Tue, 21 Jun 2016 06:37:39 GMT

ETag: W/"5768e0b3-11a29"

X-CCACDN-Mirror-ID: rmdccacrl9

Cache-Control: public, max-age=14400

CF-Cache-Status: HIT

Expires: Tue, 21 Jun 2016 21:58:51 GMT

Server: cloudflare-nginx

CF-RAY: 2b6959d97ea82920-OTP
1bcd9..0....0.......0...*.H........0{1.0...U....GB1.0...U....Greater M
anchester1.0...U....Salford1.0...U....COMODO CA Limited1!0...U....COMO
DO Code Signing CA 2..160621063739Z..160625063739Z0....0".........=...
[...<...110824203440Z0".....[..x.Ik.M..ud...110825114542Z0!..Y\7.o.
..p......F..110825134216Z0!..*..d.. .D>Z...bH..110825235944Z0!..v..
...U...........110826180316Z0"......a...sj.........110827065611Z0"....
g..?R.G.=s.......110829195328Z0!..q.?@..|f..........110829205743Z0!..&
lt;..=. :4.....|Sk..110830163519Z0"....3.>&.=.&.QB.z....11083019554
0Z0".....W...p.~.....0T..110901131432Z0!...c:6`....V ...}...1109011318
23Z0".........<.....J.....110901152743Z0!..M....A...=...z.Z..110901
185932Z0".........b........y..110901212800Z0"....,..p.....;.@.0...1109
02154630Z0".....8...b8..}.CO....110902175624Z0"....v.<u\...`....^..
.110902194811Z0!.. gR`..k}.0c....7..110902205032Z0"....#.y...}[.^.=.. 
..110905122329Z0"....8l.q.x.....<..K..110905140709Z0!....=...oHF<
;v..O....110906095658Z0!..(..j.z5..p.....n..110906140412Z0"....=A.w.p.
..........110907092516Z0!..5....r..R.a..4....110907092609Z0!.........D
..).^.'...110907092655Z0!..[....1............110907132010Z0".......3Ee
....p-.....110908132554Z0!..A.v...GR..JJ)c.b..110909093345Z0"....b..T.
.]..........110910043824Z0"....f.......T.V.N{9..110910044920Z0!..,....
..h.L.T.|.U..110912173144Z0"....-...D,.UM...O.V..110912173717Z0!.. b..
....f..j.p.^..110913094740Z0!..Jc...RX.lp!.......110913102919Z0!..R..A
.z{~.X...B....110913165335Z0!..>......b|...Rw.g..110914090437Z0
<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: text/plain

Last-Modified: Thu, 14 Apr 2016 22:20:39 GMT

Accept-Ranges: bytes

ETag: "8095d7df9b96d11:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 18

Date: Tue, 21 Jun 2016 17:58:51 GMT

Connection: keep-alive

X-CCC: RU

X-CID: 2
1401D1969BE01E11A6....


GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 15 Apr 2016 17:23:18 GMT

Accept-Ranges: bytes

ETag: "0c730803b97d11:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET