MD5: 068d213680c2b4bfe037290c5965e3bc
SHA1: 000d10bbf839d0df27826fa835a84afb947f99d8
SHA256: d21d38a7d8663a73e117b2d0896b84c351d77ecd6fbdbf4ead9e66fb7eeb974b
SSDeep: 196608:YCJ7mK6YY/1u5mWRpJiJwgk9dlrTlEIhXX:YCmzr/1u5jjJiJwgKl/lJH
Size: 7931384 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: BorlandDelphi30, UPolyXv05_v6
Company: Auslogics Labs Pty Ltd
Created at: 2013-10-13 11:19:32
Analyzed on: Windows7Ada SP1 64-bit

Summary:

Worm. A program that is primarily replicating on networks or removable drives.

Payload

Process activity

The Worm creates the following process(es):

TPAutoConnSvc.exe:1776
pc-cleaner-setup.tmp:3016
%original file name%.exe:1740
reader.exe:3168
reader.exe:3460
068d213680c2b4bfe037290c5965e3bc.tmp:3096
downloader.exe:3680
DefaultBrowserFinder.exe:3092
DefaultBrowserFinder.exe:1764
pc-cleaner-setup.exe:3420
FixMyPC.exe:3232
GASender.exe:3040
GASender.exe:1000
sppsvc.exe:3480
PCCleaner.exe:2004

The Worm injects its code into the following process(es):

FixMyPC.exe:3756

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process pc-cleaner-setup.tmp:3016 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\GASender.exe (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_Del_pc-cleaner-setup\GASender.exe (3589 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-JOFNG.tmp (3361 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-5NKAL.tmp (23811 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-NNF7U.tmp (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\vclimg160.bpl (2461 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\Data\main.ini (31 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakBit\PCCleaner\TweakBit PC Cleaner.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\AxComponentsVCL.bpl (22482 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\PCCleaner.exe (146 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-C6I87.tmp (2105 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-TG35K.tmp (32429 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-R4A1K.tmp (22336 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-U97NM.tmp (1425 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-MESSA.tmp (3361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\installer_enu.ini (51 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\PCCleaner.url (60 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-OSII3.tmp (4545 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-8N8D3.tmp (17627 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_Del_pc-cleaner-setup\AxComponentsRTL.bpl (7547 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-DV9GG.tmp (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\ATUpdatersHelper.dll (6684 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\unins000.dat (17461 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-F9L3V.tmp (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp (4 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-S8PRH.tmp (7547 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_Del_pc-cleaner-setup\GA.xml (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\_isetup\_setup64.tmp (6 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-TNUHP.tmp (7971 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_Del_pc-cleaner-setup\GoogleAnalyticsHelper.dll (5873 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-J8V6O.tmp (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\reader.exe (2481 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-DRBLE.tmp (2321 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-T37J6.tmp (3073 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-U72SL.tmp (3361 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-A9NEE.tmp (1425 bytes)
C:\Users\"%CurrentUserName%"\Desktop\TweakBit PCCleaner.lnk (1 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\Lang\is-SD73T.tmp (1281 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-HR85K.tmp (23 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-LO89U.tmp (5873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\$$$95C9.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\EULA.rtf (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\WizardHelper.dll (2722 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-ITBAM.tmp (673 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-E728B.tmp (5873 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-BI252.tmp (1281 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-3V6NH.tmp (25 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\unins000.msg (646 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\sqlite3.dll (4545 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakBit\PCCleaner\TweakBit PC Cleaner on the Web.url (111 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-G2SVP.tmp (2105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\AxComponentsRTL.bpl (7596 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-HC5CS.tmp (3361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\DefaultBrowserFinder.exe (2457 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-OPQ30.tmp (5441 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-S05U0.tmp (2321 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-D0B7V.tmp (5441 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\Lang\is-AH989.tmp (51 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\GoogleAnalyticsHelper.dll (6663 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\_isetup\_shfoldr.dll (47 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-HH87D.tmp (2321 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-4FQ1L.tmp (7385 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-7MUCG.tmp (601 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-M5FJ2.tmp (7433 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\rtl160.bpl (21533 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-1A65T.tmp (21387 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-20J0J.tmp (5873 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\is-RAHGL.tmp (601 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\vcl160.bpl (24102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\GA.xml (5 bytes)

The process %original file name%.exe:1740 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-RNJOE.tmp\068d213680c2b4bfe037290c5965e3bc.tmp (50 bytes)

The process 068d213680c2b4bfe037290c5965e3bc.tmp:3096 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-TCHVK.lnk (1 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-G1D61.tmp (2105 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-RBCD1.tmp (2321 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-NAVG3.tmp (3361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\$$$6566.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_Del_068d213680c2b4bfe037290c5965e3bc\AxComponentsRTL.bpl (7547 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-OP9CH.tmp (601 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-JRCQH.tmp (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\rtl160.bpl (21533 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-0K9N4.tmp (3361 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-CDKVJ.tmp (21387 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\WizardHelper.dll (2321 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-9P5O8.tmp (5441 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\unins000.dat (17461 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-T407V.tmp (2321 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-ICF51.tmp (2105 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\GA.xml (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\reader.exe (2481 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-M2UDJ.tmp (1281 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakBit\FixMyPC\TweakBit FixMyPC.lnk (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\AxComponentsRTL.bpl (7595 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\GASender.exe (3073 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_Del_068d213680c2b4bfe037290c5965e3bc\GASender.exe (3589 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-4HEEA.tmp (7971 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-3LFNU.tmp (1425 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\vcl160.bpl (24102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\EULA.rtf (25 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\Data\main.ini (29 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\Lang\is-FQLNB.tmp (52 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_Del_068d213680c2b4bfe037290c5965e3bc\GA.xml (1 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-KRHV7.tmp (673 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\ATUpdatersHelper.dll (5873 bytes)
C:\Users\"%CurrentUserName%"\Desktop\TweakBit FixMyPC.lnk (1 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-62NEN.tmp (601 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-HICTD.tmp (7547 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\unins000.msg (646 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-U3J0V.tmp (3361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\sqlite3.dll (4545 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-3BDIC.tmp (25 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-ECIGF.tmp (22336 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\FixMyPC.exe (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\installer_enu.ini (52 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-3NJB8.tmp (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\_isetup\_shfoldr.dll (47 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\AxComponentsVCL.bpl (22482 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\vclimg160.bpl (2461 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TweakBit\FixMyPC\TweakBit FixMyPC on the Web.url (110 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-TQKGV.tmp (5873 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-7OKGS.tmp (5441 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-0VADV.tmp (5873 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-S59VK.tmp (1425 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-3NSLF.tmp (17627 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\FixMyPC.url (59 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-2UP35.tmp (1425 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-UF6C9.tmp (32429 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-ID8EC.tmp (5873 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-7UQ1S.tmp (7433 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-FG6S9.tmp (2321 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_Del_068d213680c2b4bfe037290c5965e3bc\GoogleAnalyticsHelper.dll (5873 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\GoogleAnalyticsHelper.dll (6663 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-4I61V.tmp (7385 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-FT5K3.tmp (1425 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-8ILOP.tmp (3073 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-EQFUK.tmp (23811 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-FRU5D.tmp (2321 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-1LC22.tmp (23 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-5CHLQ.tmp (4545 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-BCG3P.tmp (3361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\_isetup\_setup64.tmp (6 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\Lang\is-HTR0N.tmp (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\DefaultBrowserFinder.exe (2457 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\is-NSKS3.tmp (1281 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp (4 bytes)

The process downloader.exe:3680 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pc-cleaner-setup.exe (995199 bytes)

The process DefaultBrowserFinder.exe:3092 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\$$$Cookies153639321 (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-LTCLG.tmp\sqlite3.dll (667 bytes)

The process DefaultBrowserFinder.exe:1764 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-K7NI9.tmp\sqlite3.dll (667 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\$$$Cookies153592653 (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\$$$Cookies153592731 (9 bytes)

The process pc-cleaner-setup.exe:3420 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\is-UN76S.tmp\pc-cleaner-setup.tmp (50 bytes)

The process FixMyPC.exe:3232 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 (6 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\vcl160.bpl (291 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\SystemInformationHelper.dll (778 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F (471 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\RegistryCleanerHelper.dll (806 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\rtl160.bpl (97 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\vclimg160.bpl (356 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F4D9C889B7AEBCF4E1A2DAABC5C3628A_D5F09CAA6E2CA434FEDC79A84C61CABA (1488 bytes)
C:\ProgramData\TweakBit\FixMyPC\1.x\Logs\FixMyPCLogic.log (422 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B90B117906B8A74C79D1BC450C2B94B1_A54F26A8A41DE52C237D54D67F12793F (1544 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 (378 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\AxComponentsRTL.bpl (49 bytes)
C:\ProgramData\TweakBit\FixMyPC\1.x\Logs\FixMyPC.log (45202 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F4D9C889B7AEBCF4E1A2DAABC5C3628A_D5F09CAA6E2CA434FEDC79A84C61CABA (471 bytes)
%Program Files% (x86)\TweakBit\FixMyPC\AxComponentsVCL.bpl (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2858020935-2156992550-3658131804-1003\dda388e84a6ba7994c90b3aa1edb803f_c0322acd-5e5d-42f0-b163-c591ee6ff5b9 (79 bytes)

The process FixMyPC.exe:3756 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\ProgramData\TweakBit\FixMyPC\1.x\$$$History153841192 (601 bytes)
C:\ProgramData\TweakBit\FixMyPC\1.x\$$$Cookies153841176 (9 bytes)
C:\ProgramData\TweakBit\FixMyPC\1.x\$$$History153745526 (601 bytes)
C:\ProgramData\TweakBit\FixMyPC\1.x\Downloads\pcsupportbar.exe (2997010 bytes)
C:\ProgramData\TweakBit\FixMyPC\1.x\$$$Cookies153636971 (9 bytes)
C:\ProgramData\TweakBit\FixMyPC\1.x\Queue\Queue-Report.rpq (388 bytes)
C:\ProgramData\TweakBit\FixMyPC\1.x\$$$Cookies153745510 (9 bytes)
C:\ProgramData\TweakBit\FixMyPC\1.x\$$$History153636991 (601 bytes)
C:\ProgramData\TweakBit\FixMyPC\1.x\StatDB.xml (6169 bytes)

The process GASender.exe:3040 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_Del_pc-cleaner-setup\GoogleAnalyticsHelper.dll (790 bytes)

The process GASender.exe:1000 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_Del_068d213680c2b4bfe037290c5965e3bc\GoogleAnalyticsHelper.dll (790 bytes)

The process sppsvc.exe:3480 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat (95 bytes)

The process PCCleaner.exe:2004 makes changes in the file system.
The Worm creates and/or writes to the following file(s):

%Program Files% (x86)\TweakBit\PCCleaner\Localizer.dll (151 bytes)
C:\ProgramData\TweakBit\PCCleaner\1.x\Logs\PCCleaner.log (9066 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\AxBrowsers.dll (1 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\vclimg160.bpl (356 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\rtl160.bpl (146 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\TaskSchedulerHelper.dll (217 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\AxComponentsVCL.bpl (146 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\AxComponentsRTL.bpl (49 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\CommonForms.Routine.dll (569 bytes)
C:\ProgramData\TweakBit\PCCleaner\1.x\Logs\PCCleanerLogic.log (470 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\RescueCenterHelper.dll (569 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\CommonForms.Site.dll (49 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\vcl160.bpl (291 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\ATUpdatersHelper.dll (811 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\ProductHelper.dll (110 bytes)
%Program Files% (x86)\TweakBit\PCCleaner\SettingsHelper.dll (278 bytes)

Registry activity

The process TPAutoConnSvc.exe:1776 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1]
"TrayData" = "2,Tray 3, 3,Tray 2, 1,Tray 1, 4,Manual Feed, 7,Auto Select"
"FormData" = "1,2159,2794,Letter¶40,40,2086,2712, 5,2159,3556,Legal¶40,40,2086,3474, 9,2100,2970,A4¶39,39,2032,2890, 7,1842,2667,Executive¶40,40,1761,2585, 258,2159,3302,8.5 x 13 (custom)¶40,40,2086,3220, 11,1480,2100,A5¶39,39,1408,2020, 70,1050,1480,A6¶39,39,975,1399, 13,1820,2570,B5 (JIS)¶39,39,1747,2490, 264,1950,2700,16K 195x270¶39,39,1882,2620, 263,1840,2600,16K 184x260¶39,39,1761,2520, 257,1970,2730,16K 197x273¶39,39,1896,2650, 43,1000,1480,Japanese Postcard¶39,39,921,1399, 82,1480,2000,Double Japan Postcard Rotated¶39,39,1408,1919, 20,1046,2413,Envelope #10¶40,40,975,2331, 37,983,1905,Envelope Monarch¶40,40,907,1823, 34,1760,2500,Envelope B5¶39,39,1693,2420, 28,1620,2290,Envelope C5¶39,39,1544,2209, 27,1100,2200,Envelope DL¶39,39,1029,2120"
"DelAfterCreate" = "1"

[HKU\.DEFAULT\Printers\DevModes2]
"NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1" = "4E 00 50 00 49 00 34 00 35 00 36 00 41 00 42 00"

The Worm deletes the following registry key(s):

[HKLM\SOFTWARE\ThinPrint\TPPrnUI\NPI456AB0 (HP LaserJet Professional M1212nf MFP)#:1]

The process pc-cleaner-setup.tmp:3016 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFilesHash" = "AF BE E6 17 2B 71 DF DB A5 7B AC B4 7C 91 7A A6"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFiles0000" = "%Program Files% (x86)\TweakBit\PCCleaner\WizardHelper.dll, %Program Files% (x86)\TweakBit\PCCleaner\GoogleAnalyticsHelper.dll, %Program Files% (x86)\TweakBit\PCCleaner\GASender.exe, %Program Files% (x86)\TweakBit\PCCleaner\ATToolsStdHelper.dll, %Program Files% (x86)\TweakBit\PCCleaner\ATToolsExtHelper.dll, %Program Files% (x86)\TweakBit\PCCleaner\ATPopupsHelper.dll, %Program Files% (x86)\TweakBit\PCCleaner\ATUpdatersHelper.dll, %Program Files% (x86)\TweakBit\PCCleaner\Downloader.exe, %Program Files% (x86)\TweakBit\PCCleaner\sqlite3.dll, %Program Files% (x86)\TweakBit\PCCleaner\ProductHelper.dll, %Program Files% (x86)\TweakBit\PCCleaner\Localizer.dll, %Program Files% (x86)\TweakBit\PCCleaner\DebugHelper.dll, %Program Files% (x86)\TweakBit\PCCleaner\SendDebugLog.exe, %Program Files% (x86)\TweakBit\PCCleaner\SettingsHelper.dll, %Program Files% (x86)\TweakBit\PCCleaner\CommonForms.dll, %Program Files% (x86)\TweakBit\PCCleaner\CommonForms.Site.dll, %Program Files% (x86)\TweakBit\PCCleaner\CommonForms.Routine.dll"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{32207DDC-1102-4AD5-9CCD-A361F0E1BBC4}_is1]
"InstallLocation" = "%Program Files% (x86)\TweakBit\PCCleaner\"
"DisplayVersion" = "1.6.7.2"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\PCCleaner\1.x\Settings]
"General.TrafficId" = "direct"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{32207DDC-1102-4AD5-9CCD-A361F0E1BBC4}_is1]
"Inno Setup: App Path" = "%Program Files% (x86)\TweakBit\PCCleaner"
"HelpLink" = "http://www.tweakbit.com/en/support.php"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"SessionHash" = "9A 69 C0 0C D1 38 7A 0C F0 FB F5 EA 58 E4 F4 A9"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\PCCleaner\1.x\Settings]
"General.Cookie" = ""
"GoogleAnalytics.InstallDate" = "7B CA 57 E7 98 80 E4 40"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{32207DDC-1102-4AD5-9CCD-A361F0E1BBC4}_is1]
"QuietUninstallString" = "%Program Files% (x86)\TweakBit\PCCleaner\unins000.exe /SILENT"
"NoRepair" = "1"
"InstallDate" = "20141215"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\PCCleaner\1.x\Settings]
"App.Application.PurchaseUrlParam" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{32207DDC-1102-4AD5-9CCD-A361F0E1BBC4}_is1]
"Inno Setup: Setup Version" = "5.5.4 (u)"
"URLInfoAbout" = "http://www.tweakbit.com/support/contact/"
"UninstallString" = "%Program Files% (x86)\TweakBit\PCCleaner\unins000.exe"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"Shared.Blocking.PCCleaner" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{32207DDC-1102-4AD5-9CCD-A361F0E1BBC4}_is1]
"DisplayName" = "TweakBit PCCleaner"
"Inno Setup: Icon Group" = "TweakBit\PCCleaner"
"Contact" = "[email protected]"
"Inno Setup: User" = "%CurrentUserName%"
"NoModify" = "1"
"MinorVersion" = "6"
"URLUpdateInfo" = "http://www.tweakbit.com/pc-cleaner"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Sequence" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{32207DDC-1102-4AD5-9CCD-A361F0E1BBC4}_is1]
"Inno Setup: Language" = "English"
"MajorVersion" = "1"
"DisplayIcon" = "%Program Files% (x86)\TweakBit\PCCleaner\PCCleaner.exe"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Owner" = "C8 0B 00 00 FF 41 26 DA 85 18 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{32207DDC-1102-4AD5-9CCD-A361F0E1BBC4}_is1]
"EstimatedSize" = "28872"
"Publisher" = "Auslogics Labs Pty Ltd"

The Worm deletes the following registry key(s):

[HKCU\Software\Microsoft\RestartManager\Session0000]

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFilesHash"
"Sequence"
"RegFiles0000"
"SessionHash"
"Owner"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

The process reader.exe:3168 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\TweakBit\PCCleaner\1.x\Settings]
"General.PartnerId" = "tweakbit"

The process reader.exe:3460 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"General.PartnerId" = "tweakbit"

The process 068d213680c2b4bfe037290c5965e3bc.tmp:3096 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFilesHash" = "EE 08 8B 44 F6 D2 FD 18 E7 3A 6C CD 0E A3 80 B1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFiles0000" = "%Program Files% (x86)\TweakBit\FixMyPC\WizardHelper.dll, %Program Files% (x86)\TweakBit\FixMyPC\GoogleAnalyticsHelper.dll, %Program Files% (x86)\TweakBit\FixMyPC\GASender.exe, %Program Files% (x86)\TweakBit\FixMyPC\ATToolsStdHelper.dll, %Program Files% (x86)\TweakBit\FixMyPC\ATToolsExtHelper.dll, %Program Files% (x86)\TweakBit\FixMyPC\ATPopupsHelper.dll, %Program Files% (x86)\TweakBit\FixMyPC\ATUpdatersHelper.dll, %Program Files% (x86)\TweakBit\FixMyPC\Downloader.exe, %Program Files% (x86)\TweakBit\FixMyPC\sqlite3.dll, %Program Files% (x86)\TweakBit\FixMyPC\ProductHelper.dll, %Program Files% (x86)\TweakBit\FixMyPC\Localizer.dll, %Program Files% (x86)\TweakBit\FixMyPC\DebugHelper.dll, %Program Files% (x86)\TweakBit\FixMyPC\SendDebugLog.exe, %Program Files% (x86)\TweakBit\FixMyPC\SettingsHelper.dll, %Program Files% (x86)\TweakBit\FixMyPC\CommonForms.dll, %Program Files% (x86)\TweakBit\FixMyPC\CommonForms.Site.dll, %Program Files% (x86)\TweakBit\FixMyPC\CommonForms.Routine.dll, %Program Files% (x86)\TweakBit\Fi£"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA7C4C80-24B8-4027-8849-0C302333C427}_is1]
"DisplayName" = "TweakBit FixMyPC"
"MinorVersion" = "6"
"DisplayVersion" = "1.6.6.4"
"Inno Setup: Setup Version" = "5.5.4 (u)"
"NoRepair" = "1"
"DisplayIcon" = "%Program Files% (x86)\TweakBit\FixMyPC\FixMyPC.exe"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"ServerHddSystemCapacity" = "592"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA7C4C80-24B8-4027-8849-0C302333C427}_is1]
"InstallDate" = "20141215"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"ServerHddCapacity" = "231"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA7C4C80-24B8-4027-8849-0C302333C427}_is1]
"URLInfoAbout" = "http://www.tweakbit.com/support/contact/"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"GoogleAnalytics.InstallDate" = "FE 48 EA E2 98 80 E4 40"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"SessionHash" = "FC 2B 1A 61 59 ED 1A 8F A6 B0 61 A1 F6 E8 DC F2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA7C4C80-24B8-4027-8849-0C302333C427}_is1]
"Publisher" = "Auslogics Labs Pty Ltd"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"Shared.Blocking.FixMyPC" = "1"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\Google Analytics Package\1.x\Settings]
"ClientID" = "{5BFFA9C2-C09C-42E1-812D-7CCF23235B26}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA7C4C80-24B8-4027-8849-0C302333C427}_is1]
"QuietUninstallString" = "%Program Files% (x86)\TweakBit\FixMyPC\unins000.exe /SILENT"
"Inno Setup: Language" = "English"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"General.Cookie" = ""

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"ServerCpuFrequency" = "3600"
"ServerRamVolume" = "5417"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA7C4C80-24B8-4027-8849-0C302333C427}_is1]
"Inno Setup: App Path" = "%Program Files% (x86)\TweakBit\FixMyPC"
"InstallLocation" = "%Program Files% (x86)\TweakBit\FixMyPC\"
"EstimatedSize" = "29375"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"App.Application.PurchaseUrlParam" = ""

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Sequence" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA7C4C80-24B8-4027-8849-0C302333C427}_is1]
"Contact" = "[email protected]"
"NoModify" = "1"
"Inno Setup: Icon Group" = "TweakBit\FixMyPC"
"UninstallString" = "%Program Files% (x86)\TweakBit\FixMyPC\unins000.exe"
"MajorVersion" = "1"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"General.TrafficId" = "affiliate_31095"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA7C4C80-24B8-4027-8849-0C302333C427}_is1]
"URLUpdateInfo" = "http://www.tweakbit.com/fix-my-pc"

[HKCU\Software\Microsoft\RestartManager\Session0000]
"Owner" = "18 0C 00 00 D5 13 91 BE 85 18 D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA7C4C80-24B8-4027-8849-0C302333C427}_is1]
"Inno Setup: User" = "%CurrentUserName%"
"HelpLink" = "http://www.tweakbit.com/en/support.php"

The Worm deletes the following registry key(s):

[HKCU\Software\Microsoft\RestartManager\Session0000]

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\RestartManager\Session0000]
"RegFilesHash"
"Sequence"
"RegFiles0000"
"SessionHash"
"Owner"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

The process downloader.exe:3680 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "96 61 12 D8 85 18 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3F 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"
"WpadDecisionTime" = "57 22 EA D5 85 18 D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process DefaultBrowserFinder.exe:3092 makes changes in the system registry.
The Worm deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\TweakBit\PCCleaner\1.x\Settings]
"General.DefWebBrowser"

The process DefaultBrowserFinder.exe:1764 makes changes in the system registry.
The Worm deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"General.DefWebBrowser"

The process FixMyPC.exe:3232 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"FirstInstalledUp" = "fixmypc"
"MailSystemSubscribed.msaMailingTips" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"MailSystemRegistered" = "0"
"Shared.Scanner.Leader" = "FixMyPC"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"App.AutoScan.TimeStamp" = "00 30 B3 1A 60 8E 2F 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"MailSystemSubscribed.msaMailingDiscounts" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"General.InstallDateTime" = "D9 E1 FD E5 98 80 E4 40"
"General.Cookie" = "affiliate_31095-ab_7forumstest03_a"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Direct3D\MostRecentApplication]
"Name" = "FixMyPC.exe"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"General.Language" = "enu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "57 22 EA D5 85 18 D0 01"

[HKCR\Wow6432Node\CLSID\{5D7D27E3-3814-2968-061D-195059C8D458}\Version]
"Assembly" = "B3 1C F2 B1 1F B9 D3 7A 22 41 EA 77 E6 B8 E2 29"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"App.Application.SendInfo" = "1"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "FixMyPC.exe"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"MailSystemUid" = "4772805.e15e33de9a605bd7095de81a3aad7f66"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"App.Application.UpdateDate" = "C7 47 01 E6 98 80 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3E 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"App.AutoScan.Enabled" = "1"
"App.Download.PCSupportBar" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"MailSystemSubscribed.msaMailingReports" = "0"
"MailSystemSubscribed.msaMailingUnknown" = "0"
"MailSystemSubscribed.msaMailingNotSure" = "0"
"MailSystemSubscribed.msaMailingOneTimeDiscount" = "0"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"App.Application.AutostartEnable" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "57 22 EA D5 85 18 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"
"ProxyOverride"
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process FixMyPC.exe:3756 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"App.Application.NagTutorialIsShow" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"Popups.LibraryInitDate" = "2F 73 93 E6 98 80 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"MailSystemNextReport" = "00 00 00 00 00 00 F0 BF"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATPopups\1.x\Settings]
"FirstInitDate" = "2F 73 93 E6 98 80 E4 40"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"MailSystemSubscribeLastUpdate" = "83 FE A5 E6 98 80 E4 40"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"App.Application.FileName" = "%Program Files% (x86)\TweakBit\FixMyPC\FixMyPC.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"General.LastRun.FixMyPC.exe" = "82 8E 91 E6 98 80 E4 40"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"General.Cookie" = "affiliate_31095-ab_7forumstest03_a"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "57 22 EA D5 85 18 D0 01"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"MailSystemSubscribed.msaMailingTips" = "0"

[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "FixMyPC.exe"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"MailSystemLastReport" = "00 00 00 00 00 00 F0 BF"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\FixMyPC\1.x\Settings]
"App.Application.MailSystemState" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 43 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Direct3D\MostRecentApplication]
"Name" = "FixMyPC.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"MailSystemSubscribed.msaMailingReports" = "0"
"MailSystemSubscribed.msaMailingNotSure" = "0"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATPopups\1.x\Settings]
"AntivirusNextShow" = "0"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"MailSystemSubscribed.msaMailingOneTimeDiscount" = "0"
"MailSystemSubscribed.msaMailingDiscounts" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "B3 F0 09 D9 85 18 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process GASender.exe:3040 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 44 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "FF 41 26 DA 85 18 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process GASender.exe:1000 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\Google Analytics Package\1.x\Settings]
"ClientID" = "{5BFFA9C2-C09C-42E1-812D-7CCF23235B26}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "57 22 EA D5 85 18 D0 01"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Worm deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
"AutoDetect"

The process PCCleaner.exe:2004 makes changes in the system registry.
The Worm creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\29\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\PCCleaner\1.x\Settings]
"App.AutoScan.TimeStamp" = "00 30 E6 23 78 8E 2F 40"
"App.Application.AutostartEnable" = "1"
"General.Language" = "enu"

[HKCR\Wow6432Node\CLSID\{5D7D27E3-D761-2968-061D-EF0B9B576908}\Version]
"Assembly" = "B3 1C F2 B1 1F B9 D3 7A 22 41 EA 77 E6 B8 E2 29"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\PCCleaner\1.x\Settings]
"App.AutoScan.Enabled" = "1"
"General.InstallDateTime" = "A8 8C 7F E7 98 80 E4 40"
"App.Application.UpdateDate" = "F7 DA 81 E7 98 80 E4 40"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\ATUpdaters\1.x\Settings]
"Shared.Scanner.Leader" = "PCCleaner"

[HKLM\SOFTWARE\Wow6432Node\TweakBit\PCCleaner\1.x\Settings]
"App.Download.PCSupportBar" = "1"
"App.Application.SendInfo" = "1"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name: Auslogics Labs Pty Ltd
Product Name: TweakBit FixMyPC
Product Version: 1.6.6.4
Legal Copyright: Copyright (c) 2008-2014 Auslogics Labs Pty Ltd
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 1.6.6.4
File Description: TweakBit FixMyPC Installation File
Comments: This installation was built with Inno Setup.
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

URLs

URL	IP
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a860278501051db1
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs=	178.255.83.1
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECED1peiCJBlhSarL0zjkmq4A=	178.255.83.1
hxxp://pm.tweakbit.net/api/getNewUID?DAuslogics=y&timezone=120	205.234.129.83
hxxp://downloads.tweakbit.com/en/pc-cleaner/16/pc-cleaner-setup.exe	66.135.59.166
hxxp://tweakbit.auslogicslabspty.netdna-cdn.com/en/pc-cleaner/16/pc-cleaner-setup.exe
hxxp://www-google-analytics.l.google.com/collect
hxxp://www.tweakbit.com/go/affiliate_31095-ab_7forumstest03_a/fix-my-pc/afterinstall/?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095	216.246.7.240
hxxp://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095	216.246.7.240
hxxp://pm.tweakbit.net/api/getSubscriptions?DAuslogics=y&uid=4772805.e15e33de9a605bd7095de81a3aad7f66&mailing=tweakbit_tips,tweakbit_reports,tweakbit_discounts,tweakbit_onetime_discount,tweakbit_notsure	205.234.129.83
hxxp://downloads.tweakbit.com/en/pc-support-bar/pc-support-bar-setup.exe	66.135.59.166
hxxp://www.tweakbit.com/includes/vendors/projekktor/style.css?2014121516	216.246.7.240
hxxp://www.tweakbit.com/includes/jscss/index.css?2014121516	216.246.7.240
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://googleapis.l.google.com/css?family=Open Sans:300,300italic,400,400italic,700italic,700&subset=latin,cyrillic,latin-ext&2014121516
hxxp://www.tweakbit.com/includes/jscss/blocks.css?2014121516	216.246.7.240
hxxp://www.tweakbit.com/includes/jscss/ie9-10.css?2014121516	216.246.7.240
hxxp://www.tweakbit.com/products/afterinstall/15v/ijscss/index.css?20141211&2014121516	216.246.7.240
hxxp://www.tweakbit.com/includes/vendors/jquery/jquery-1.9.1.min.js?2014121516	216.246.7.240
hxxp://www.tweakbit.com/includes/vendors/projekktor/projekktor.min.js?2014121516	216.246.7.240
hxxp://www.tweakbit.com/includes/vendors/jquery.dialog/jquery.dialog.js?2014121516	216.246.7.240
hxxp://tweakbit.auslogicslabspty.netdna-cdn.com/en/pc-support-bar/pc-support-bar-setup.exe
hxxp://www.tweakbit.com/includes/vendors/jquery.nanoplaceholder/jquery.nanoplaceholder.js?2014121516	216.246.7.240
hxxp://www.tweakbit.com/includes/vendors/jquery.zoom/jquery.zoom.js?2014121516	216.246.7.240
hxxp://www.tweakbit.com/includes/jscss/blocks.js?2014121516	216.246.7.240
hxxp://www.tweakbit.com/includes/jscss/index.js?2014121516	216.246.7.240
hxxp://pm.tweakbit.net/api/setAppInfo?	205.234.129.83
hxxp://www.tweakbit.com/includes/mixins/phone-popup/phone-popup.js?2014121516	216.246.7.240
hxxp://www.tweakbit.com/products/afterinstall/15v/ijscss/index.js?2014121516	216.246.7.240
hxxp://www.tweakbit.com/includes/vendors/jquery.dialog/jquery.dialog.css?2014121516	216.246.7.240
hxxp://www.tweakbit.com/includes/mixins/phone-popup/phone-popup.css	216.246.7.240
hxxp://pagead.l.doubleclick.net/pagead/conversion/977141508/?random=1418661633300&cv=7&fst=1418661633300&num=1&fmt=2&label=nCPPCLnit1YQhP730QM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://pagead.l.doubleclick.net/pagead/conversion/970843187/?random=1418661633311&cv=7&fst=1418661633300&num=2&fmt=2&label=Yo1DCPeWuFYQs8j3zgM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1
hxxp://pagead.l.doubleclick.net/pagead/conversion/978241879/?random=1418661633315&cv=7&fst=1418661633300&num=3&fmt=2&label=zkC7CNCYuFYQ15K70gM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1
hxxp://fonts.gstatic.com/s/opensans/v10/k3k702ZOKiLJc3WVjuplzBsxEYwM7FgeyaSgU71cLG0.woff	173.194.113.216
hxxp://fonts.gstatic.com/s/opensans/v10/uYKcPVoh6c5R0NpdEY5A-Q.woff	173.194.113.216
hxxp://fonts.gstatic.com/s/opensans/v10/O4NhV7_qs9r9seTo7fnsVD8E0i7KZn-EPnyo3HZu7kw.woff	173.194.113.216
hxxp://fonts.gstatic.com/s/opensans/v10/DXI1ORHCpsQm3Vp6mXoaTRsxEYwM7FgeyaSgU71cLG0.woff	173.194.113.216
hxxp://fonts.gstatic.com/s/opensans/v10/PRmiXeptR36kaC0GEAetxv25ds880Du_gFZbUlZlsbg.woff	173.194.113.216
hxxp://fonts.gstatic.com/s/opensans/v10/PRmiXeptR36kaC0GEAetxpXMLUeV6_io0G3F6eXSVcg.woff	173.194.113.216
hxxp://www.tweakbit.com/includes/i/l_header_tiny.png	216.246.7.240
hxxp://www.tweakbit.com/includes/i/logo_fixmypc.png	216.246.7.240
hxxp://www.tweakbit.com/products/afterinstall/15v/ijscss/mp.png	216.246.7.240
hxxp://www.tweakbit.com/products/afterinstall/15v/ijscss/ico-phone.png	216.246.7.240
hxxp://www.tweakbit.com/includes/i/video/fixmypc_how-it-works-462x289.jpg	216.246.7.240
hxxp://www.tweakbit.com/products/afterinstall/15v/ijscss/play.png	216.246.7.240
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/982723457/?random=1418661633320&cv=7&fst=1418661633300&num=4&fmt=1&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/983311939/?random=1418661633330&cv=7&fst=1418661633300&num=7&fmt=1&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/985951649/?random=1418661633323&cv=7&fst=1418661633300&num=5&fmt=1&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/978657102/?random=1418661633326&cv=7&fst=1418661633300&num=6&fmt=1&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/977141508/?random=377541974&cv=7&fst=1418661633300&num=1&fmt=2&label=nCPPCLnit1YQhP730QM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://mc.yandex.ru/metrika/watch.js	213.180.193.119
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/978241879/?random=1418661633334&cv=7&fst=1418661633300&num=8&fmt=1&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1
hxxp://173.194.113.211/ads/user-lists/985951649/?fmt=1&num=5&cv=7&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=3795113058
hxxp://173.194.113.211/ads/user-lists/978241879/?fmt=1&num=8&cv=7&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=2269199102
hxxp://173.194.113.211/ads/conversion/977141508/?random=377541974&cv=7&fst=1418661633300&num=1&fmt=2&label=nCPPCLnit1YQhP730QM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=3556823296
hxxp://173.194.113.211/ads/user-lists/982723457/?fmt=1&num=4&cv=7&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=2095916401
hxxp://173.194.113.211/ads/user-lists/978657102/?fmt=1&num=6&cv=7&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=339637568
hxxp://173.194.113.211/ads/user-lists/983311939/?fmt=1&num=7&cv=7&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=210234104
hxxp://173.194.113.211/ads/conversion/978241879/?random=2059862994&cv=7&fst=1418661633300&num=3&fmt=2&label=zkC7CNCYuFYQ15K70gM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=2147887806
hxxp://fonts.gstatic.com/ads/user-lists/983311939/?fmt=1&num=7&cv=7&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=210234104&ipr=y	173.194.113.216
hxxp://fonts.gstatic.com/ads/user-lists/978241879/?fmt=1&num=8&cv=7&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=2269199102&ipr=y	173.194.113.216
hxxp://fonts.gstatic.com/ads/user-lists/985951649/?fmt=1&num=5&cv=7&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=3795113058&ipr=y	173.194.113.216
hxxp://e6845.ce.akamaiedge.net/crls/secureca.crl
hxxp://e8218.ce.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==
hxxp://www.tweakbit.com/favicon.ico	216.246.7.240
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEAdvEkaBRZwo1UjWl8QOABs=	178.255.83.1
hxxp://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQCJu4vX6KBCDTazDOA5oCs6Cf2BAQUmeRAX2sUXj4F2d3TY1T8Yrj3AKwCEBt+MtuYCPo4TvlDVIWe6W8=	178.255.83.1
hxxp://mc.yandex.ru/watch/21425662?page-url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&browser-info=j:1:s:1716x901x24:fpr:216613626101:cn:1:w:1700x804:z:120:i:20141215184048:et:1418661649:en:utf-8:v:616:c:1:jv:10:la:en-us:ar:1:nb:1:cl:111:ls:75324134428:rqn:2:rn:319917052:hid:201936641:ds:,,,,,,,,,2496,2558,5,:rqnl:1:st:1418661649	213.180.193.119
hxxp://mc.yandex.ru/webvisor/21425662?rn=29128073&page-url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&wmode=0&wv-type=0&wv-hit=201936641&wv-part=1&wv-check=46268&browser-info=z:120:i:20141215184033:rqnl:1:st:1418661664	213.180.193.119
hxxp://gs1.wac.v2cdn.net/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkY=
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSfAP5wz6TZE9AhTecbrorIUEieTwQU3Igt2WxNPQBQM/EVuXj7weahJK8CExkAAAlE5E3bN0hKjHcAAQAACUQ=
hxxp://mc.yandex.ru/webvisor/21425662?rn=931434884&page-url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&wmode=0&wv-type=0&wv-hit=201936641&wv-part=2&wv-check=49568&browser-info=z:120:i:20141215184033:rqnl:1:st:1418661758	213.180.193.119
hxxp://mc.yandex.ru/webvisor/21425662?rn=999598497&page-url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&wmode=0&wv-type=0&wv-hit=201936641&wv-part=3&wv-check=21039&browser-info=z:120:i:20141215184033:rqnl:1:st:1418661789	213.180.193.119
hxxp://a1363.g.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1363.g.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1363.g.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?00b1ab0bd3cee2ad
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=
hxxp://a1363.g.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl	87.245.202.16
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=	23.43.139.27
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECED1peiCJBlhSarL0zjkmq4A=	178.255.83.1
hxxp://www.google.com.ua/ads/user-lists/985951649/?fmt=1&num=5&cv=7&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=3795113058&ipr=y	173.194.113.215
hxxp://www.googleadservices.com/pagead/conversion.js	173.194.113.217
hxxp://ocsp.omniroot.com/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkY=	93.184.220.20
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?00b1ab0bd3cee2ad	87.245.202.24
hxxp://www.google-analytics.com/collect	173.194.112.96
hxxp://www.googleadservices.com/pagead/conversion/977141508/?random=1418661633300&cv=7&fst=1418661633300&num=1&fmt=2&label=nCPPCLnit1YQhP730QM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1	173.194.113.217
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=	23.43.139.27
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl	87.245.202.16
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl	87.245.202.16
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==	23.43.139.27
hxxp://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQCJu4vX6KBCDTazDOA5oCs6Cf2BAQUmeRAX2sUXj4F2d3TY1T8Yrj3AKwCEBt+MtuYCPo4TvlDVIWe6W8=	178.255.83.1
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=	23.43.139.27
hxxp://www.google.com/ads/user-lists/983311939/?fmt=1&num=7&cv=7&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=210234104
hxxp://www.google.com/ads/user-lists/982723457/?fmt=1&num=4&cv=7&frm=0&url=http://www.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=2095916401
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=	23.43.139.27
hxxp://v2.zopim.com/widget/images/avatar_simple_visitor.png
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSfAP5wz6TZE9AhTecbrorIUEieTwQU3Igt2WxNPQBQM/EVuXj7weahJK8CExkAAAlE5E3bN0hKjHcAAQAACUQ=	108.162.232.199
hxxp://www.google-analytics.com/analytics.js	173.194.112.96
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl	87.245.202.16
hxxp://static.tweakbit.com/en/pc-support-bar/pc-support-bar-setup.exe	108.161.188.64
hxxp://crl.geotrust.com/crls/secureca.crl	23.43.133.163
hxxp://fonts.googleapis.com/css?family=Open Sans:300,300italic,400,400italic,700italic,700&subset=latin,cyrillic,latin-ext&2014121516	64.233.165.95
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a860278501051db1	87.245.202.24
hxxp://crl.verisign.com/pca3.crl	23.43.133.163
hxxp://static.tweakbit.com/en/pc-cleaner/16/pc-cleaner-setup.exe	108.161.188.64
googleads.g.doubleclick.net	173.194.113.205
ieonline.microsoft.com	204.79.197.200
clients1.google.com

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected
ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile

Traffic

POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 113

Cache-Control: no-cache

v=1&tid=UA-49608409-3&cid={5BFFA9C2-C09C-42E1-812D-7CCF23235B26}&t=event&ec=1.6.7.2&ea=Install_1_Init&el=Yes&ev=0
HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 15 Dec 2014 16:40:43 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 149

Cache-Control: no-cache

v=1&tid=UA-49608409-3&cid={5BFFA9C2-C09C-42E1-812D-7CCF23235B26}&t=event&ec=1.6.7.2&ea=SystemInfo_ScreenInfo*&el=Windows 7 x64, 1716x901, 32, 96&ev=0
HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 15 Dec 2014 16:40:43 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 123

Cache-Control: no-cache

v=1&tid=UA-49608409-3&cid={5BFFA9C2-C09C-42E1-812D-7CCF23235B26}&t=event&ec=1.6.7.2&ea=SystemInfo_OS*&el=Windows 7 x64&ev=0
HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 15 Dec 2014 16:40:43 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 121

Cache-Control: no-cache

v=1&tid=UA-49608409-3&cid={5BFFA9C2-C09C-42E1-812D-7CCF23235B26}&t=event&ec=1.6.7.2&ea=Install_2_FileCopyInit&el=Yes&ev=0
HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 15 Dec 2014 16:40:43 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 131

Cache-Control: no-cache

v=1&tid=UA-49608409-3&cid={5BFFA9C2-C09C-42E1-812D-7CCF23235B26}&t=event&ec=1.6.7.2&ea=Install_3_Offer*&el=PCSpeedUp_Installed&ev=0
HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 15 Dec 2014 16:40:43 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 119

Cache-Control: no-cache

v=1&tid=UA-49608409-3&cid={5BFFA9C2-C09C-42E1-812D-7CCF23235B26}&t=event&ec=1.6.7.2&ea=Install_4_Completed*&el=New&ev=2
HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 15 Dec 2014 16:40:43 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=435228, public, no-transform, must-revalidate

Last-Modified: Sat, 13 Dec 2014 17:38:40 GMT

Expires: Sat, 20 Dec 2014 17:38:40 GMT

Date: Mon, 15 Dec 2014 16:44:52 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2014121
3173840Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.l$.%t...............20141213173840Z....20141220173840Z0...*.H........
.....!..d..........w [7*[email protected]....;5..D....W1.....d...
.oj....c....R...&....6[._.?..../...(h.......&.C............kL$....|.h$
.A.MJ....=%....7.....b....Z.g.W.2.6.t...".....4.4......Y.....,.'=m..#)
.E_..}.E.L`. ...O....Ruc1:..=.,.$.Sk.is...'K.....PI...#0...0...0......
....<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....VeriS
ign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at h
ttps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Sign
ing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...U..
..VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of u
se at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3
 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.........{
(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(.......
...p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.}..
.r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....(n.
.i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U....0
.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.c
om/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by
 reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........
0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H......
<<< skipped >>>

GET /ads/user-lists/985951649/?fmt=1&num=5&cv=7&frm=0&url=http://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=3795113058&ipr=y HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com.ua

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:34 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: adclick_server

Content-Length: 76

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....
h.?.....

GET /s/opensans/v10/uYKcPVoh6c5R0NpdEY5A-Q.woff HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Origin: hXXp://VVV.tweakbit.com

Accept-Encoding: gzip, deflate

Host: fonts.gstatic.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/woff

Last-Modified: Thu, 21 Aug 2014 18:08:24 GMT

Date: Tue, 09 Dec 2014 02:42:49 GMT

Expires: Wed, 09 Dec 2015 02:42:49 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

X-XSS-Protection: 1; mode=block

Age: 568664

Cache-Control: public, max-age=31536000

Content-Length: 96116

Alternate-Protocol: 80:quic,p=0.002
wOFF......wt......;.........................GDEF.............&..GPOS..
.....3...8.7.7GSUB............. =.OS/2......._...`.>..cmap...,.....
...)./hcvt .......Y.....M..fpgm...l........~a..gasp...............#gly
f........../.t8.Khead.......6...6.v..hhea....... ...$...shmtx... .....
....5<.kern...8...Z...6T .~loca..]........V)...maxp..d.... ... .C..
name..d.........s...post..gd......& .C.lprep..v.........C...x.c`d``..b
1 f...W.I. ...........x.c`d``.b0a0c`.I,.c.`.``...Q`....U`.a`.....A....
....x....._][email protected]?..m............Q..........O.6.......!d.e$sBa6AD..
...;.....w:..W.....D.M........ .0.Hb.'.T....z..."...I#=s...l47..3....j
.6.f.L...y2....y...........L.,..3.L)([email protected]..=.JK.......6....}..kN5..!
....0....~Y...t..B..P>..O...!.....MiKW.2......R...X....Xy.U..6.m..g
..#..]. t....vvOo..7..o...Q.x....q.f.KY.rnr....!.e.L..Y ...w\.h7..kt=.
H!D..Zg.....t........K..o>.B.q(..@<i.Vj%.8.|..B..M,q..@"I$.B*i8D
....6.Cl...V~w#.?]...w..............!....#.?...E.A?7..[.....x.s.={#.=^
.jB....x.c`f..8.....u..1...<.f.....................{...h..... 0t.vf
.....&.O.....)B..q>H...u..R``.....9.x......1.../{r..V....m..m..m...
m'.ml..xg..........a..Fo....Q.=...X"...a..X6..f..qb9.....g.s.yB..BP8.G
Ci8...t...I......@>.o...".&r..b.. ..WqK.P2.....ej.Nf..e~.Zv...|.H.w
..HnTW....M..../..."z1=.%..{........1... ..(fc?...,..k...* ~.D.(.i....
_...x$..et.......6.........)z..b..'.[1d$.M....2.gq{ .g..~.W.,.........
.c......|......c..f&....~G...3uM.42..w.....}.^.N...vB....W._.z..`.W.\.
.........V..>...}z...;.....C...[*_.QO.n.@y*...".p....t....M.*..
<<< skipped >>>

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSfAP5wz6TZE9AhTecbrorIUEieTwQU3Igt2WxNPQBQM/EVuXj7weahJK8CExkAAAlE5E3bN0hKjHcAAQAACUQ= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:41:37 GMT

Content-Type: application/ocsp-response

Content-Length: 1501

Connection: keep-alive

Set-Cookie: __cfduid=d9b00279a9d69e9764a8b461d4899c9bf1418661697; expires=Tue, 15-Dec-15 16:41:37 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Mon, 15 Dec 2014 04:45:26 GMT

Expires: Fri, 19 Dec 2014 16:41:36 GMT

ETag: "bffd42e69a24ed7c2d6fee3fe16635ebd149d3b3"

Cache-Control: public, max-age=345599

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 199416f79a3305c9-WAW
0..........0..... .....0......0...0.......j.....N ...#c........2014121
5044526Z0..0..0L0... ...........p.....!M.....PH.O....-.lM=.P3...x....$
.......D.M.7HJ.w.....D....20141215044526Z....20141219044526Z."0 0... .
....0......20131215044526Z0...*.H.............%.)(......).2..d.....2.O
7v...2.5....x..c....G....R...p..f.).-..u(....&..N;qC..Z...Z7..awh...;R
t.-.8...........(.tt..q...w....5...t*...).(..GI....uO..5.x......d...(.
...6......y..b..9...b.*.J.Y..T.S.. ..2.Q.*t;..G....../...![...........
.`...:.cW.K..*e...1.......0...0...0................y#....y......0...*.
H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...
U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....Microsoft 
IT SSL SHA10...141023182318Z..150106182318Z0!1.0...U....Should be igno
re by CA0.."0...*.H.............0.........1._G....#.L;!>Q.z.m?e8.-1
\...Scf....0.....E(/F.(..nN...U....3"&M./[email protected];...j.k..\.d'.
..s2D...W6.g.9...xk................Q.GZK.1.\-.E.......l.h.]%i4....v...
..J.-. O. ?.*...A3...h.#..."..c....PhV.>..;...Y...._.".t....|c.....
.3.l.YUZ."p.r..C.U-[y..........0..0...U.......j.....N ...#c......0...U
.#..0.....-.lM=.P3...x....$.0...U...........0...U.%..0... .......0... 
.....7....0.0... .......0... .....0......0...*.H...............a.F7Z.A
..,.N.^.W..;....m<........l....\..........ar....B......V....nX/Q@..
EZ/..L...1.'..SF..Qd.........e<.[....z..`..^wB?.p0,.2....R.`.>..
E?6Ppw....5.6.Q..?.?....."9..,[email protected] :`...B..
....E....1*8.~J.U.D...zs..sw.,..V.G.d.#z...n.n..
<<< skipped >>>

GET /pca3.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.verisign.com

HTTP/1.1 200 OK

Server: Apache

ETag: "8f6b3bcd9bb64555001fba64f5b01b92:1411517716"

Last-Modified: Wed, 24 Sep 2014 00:15:16 GMT

Date: Mon, 15 Dec 2014 16:44:49 GMT

Content-Length: 933

Connection: keep-alive

Content-Type: application/pkix-crl
0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U
....Class 3 Public Primary Certification Authority..140922000000Z..141
231235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y
.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.....
..fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R
.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....
u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2..
..{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N
....* [email protected]!..Y......w
`G........070411175657Z0!..Z`[email protected].*q..080403172017Z0!..l....I..
.Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1
..7<.....e..010207211822Z0...*.H............M....s#..Lo...TU...tM.3
...'.U......:Z...w.x.=....K.0;...!....D....9...,!....B.t. <........
..-.....k.$<i{O.<.E...*.......Ow _..J.HTTP/1.1 200 OK..Server: A
pache..ETag: "8f6b3bcd9bb64555001fba64f5b01b92:1411517716"..Last-Modif
ied: Wed, 24 Sep 2014 00:15:16 GMT..Date: Mon, 15 Dec 2014 16:44:49 GM
T..Content-Length: 933..Connection: keep-alive..Content-Type: applicat
ion/pkix-crl..0...0...0...*.H........0_1.0...U....US1.0...U....VeriSig
n, Inc.1705..U....Class 3 Public Primary Certification Authority..1409
22000000Z..141231235959Z0..x0!...v....a_>..2......020924164823Z0!..
...A.....{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0
!...`y..q.......fh...020923171400Z0!...?A....a.nF`.P....0209231715
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSOJaE2H4hHYQzP74hlLuO41NG+EAQUHsWxLH2H2gJofCW8DAeEP7bP3vECED1peiCJBlhSarL0zjkmq4A= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca.com

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:25 GMT

Server: Apache/2.2.22 (Debian)

Last-Modified: Mon, 15 Dec 2014 02:25:29 GMT

Expires: Fri, 19 Dec 2014 02:25:29 GMT

ETag: 34DCCA9CCD9F6949706EE7FC6B179E28E52C3D55

Cache-Control: max-age=293703,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: h6edcaocsp5

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........,}...h|%....?......2014121
5022529Z0s0q0I0... .........%.6..Ga....e............,}...h|%....?.....
.=iz ..XRj...9&......20141215022529Z....20141219022529Z0...*.H........
......h.. J....K..q..LX.[BXW=.........!...I..q..wh........%.......{.I.
. .m!.Rwp.Y...{.......m.q..2...`c.E...R.s.JiA...j..u_54a..Q"F0....,O.C
F..yU2&4....O.4..X....&R&.J[....1N..NJ.y...P..'hO.m<.......q.NK 3A.
r.........}c).Ic/.}@I9{...r.U/....?..I.uV...d.3KD.{O....

POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 148

Cache-Control: no-cache

v=1&tid=UA-49608409-4&cid={5BFFA9C2-C09C-42E1-812D-7CCF23235B26}&t=event&ec=1.6.6.4_affiliate_31095-ab_7forumstest03_a&ea=Install_1_Init&el=Yes&ev=0
HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 15 Dec 2014 16:40:31 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 184

Cache-Control: no-cache

v=1&tid=UA-49608409-4&cid={5BFFA9C2-C09C-42E1-812D-7CCF23235B26}&t=event&ec=1.6.6.4_affiliate_31095-ab_7forumstest03_a&ea=SystemInfo_ScreenInfo*&el=Windows 7 x64, 1716x901, 32, 96&ev=0
HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 15 Dec 2014 16:40:31 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 158

Cache-Control: no-cache

v=1&tid=UA-49608409-4&cid={5BFFA9C2-C09C-42E1-812D-7CCF23235B26}&t=event&ec=1.6.6.4_affiliate_31095-ab_7forumstest03_a&ea=SystemInfo_OS*&el=Windows 7 x64&ev=0
HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 15 Dec 2014 16:40:31 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 156

Cache-Control: no-cache

v=1&tid=UA-49608409-4&cid={5BFFA9C2-C09C-42E1-812D-7CCF23235B26}&t=event&ec=1.6.6.4_affiliate_31095-ab_7forumstest03_a&ea=Install_2_FileCopyInit&el=Yes&ev=0
HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 15 Dec 2014 16:40:31 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 166

Cache-Control: no-cache

v=1&tid=UA-49608409-4&cid={5BFFA9C2-C09C-42E1-812D-7CCF23235B26}&t=event&ec=1.6.6.4_affiliate_31095-ab_7forumstest03_a&ea=Install_3_Offer*&el=PCCleaner_Installed&ev=0
HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 15 Dec 2014 16:40:31 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;....


POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 155

Cache-Control: no-cache

v=1&tid=UA-49608409-4&cid={5BFFA9C2-C09C-42E1-812D-7CCF23235B26}&t=event&ec=1.6.6.4_affiliate_31095-ab_7forumstest03_a&ea=Install_4_Completed*&el=New&ev=36
HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02
GIF89a.............,...........D..;..

GET /ads/user-lists/982723457/?fmt=1&num=4&cv=7&frm=0&url=http://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=2095916401 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com

HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/user-lists/982723457/?fmt=1&num=4&cv=7&frm=0&url=http://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=2095916401&ipr=y

Cache-Control: private, max-age=43200

Date: Mon, 15 Dec 2014 16:40:33 GMT

Expires: Mon, 15 Dec 2014 16:40:33 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 518

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/982723457/?fmt=
1&num=4&cv=7&frm=0&url=http://VVV.tweakbit.com/fix-m
y-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&
source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&t
raffic=affiliate_31095&random=2095916401&ipr=y">here</
A>...</BODY></HTML>....

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?00b1ab0bd3cee2ad HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT

If-None-Match: "0b96c77303ecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 12 Sep 2014 18:47:05 GMT

Accept-Ranges: bytes

ETag: "805a83f2b9cecf1:0"

Server: Microsoft-IIS/8.5

X-Powered-By: ASP.NET

X-Powered-By: ARR/2.5

X-Powered-By: ASP.NET

Content-Length: 56928

Date: Mon, 15 Dec 2014 16:44:48 GMT

Connection: keep-alive
MSCF....`.......,...................I.................,E.Y .authroot.s
tl..Y-..8..CK...<T...g.v!M.d..f.%d..}K..5..F. ...T..%.,YJ.,!T......
_..x.<=O.....yy....;3..>.|..~..\.....|......;..8..~.za...."A...q
.......g..m......<X........j"I........!..-w.....w....P...H..(.?}..2
.N. .u..a. ...=.C..D.F>rC.. ..|).=.. ..3b.8H.M...(...u8.%...W.g...\
YB.m:.....dE.........V....$....Dn:....0...S."...o..q.....K...I..K...(x
%....>A.R...`.0 .........<`L0mp...%....y.....g.n...R0Op..<..,
....`0$z.@..&.x"....T..H...<........~..E..".....<<.\B(.......
[email protected]/"...f.......k..Jm7j....R.5q....Rz.
.!@...].......Y.[........4.. .D8..&...t.J^O..Q.._..1.J.m5<'k.,....%
T....i.\.;.;q..S./ 8.?Bu.............}D.Q....L....*..[.."e......15m...
_.0.M........#..v!..<...@..?sc.y....*.....tX[........{.W4.Q...^u@..
*..QP.......~.L9N....2r...4.....B..-\(...b.d...K...O.8..Un.......V.<
;.......A...V.....(..s..f..q.{N0.hS.,..;M.|G|[email protected].._.....7._6...C.0...
A;L....%...M=Y.....f.JV.(.5.....0..?*...KZ....jM...8.6U...#...ew.?..?.
..........WE.Or..O>..{.'[email protected]}.o:?~....]&l
t;!...%....}@.d...L.p.a.g ..K."..N1!%..S.bT.H.-.....e..`.0$...0t..DX..
{.....#./...8.5..M...T.......D......V\C.zy.....3E:..>.{..).QW......
q....9..n..1....8%,.........r.p@.>. ...Q.?.p..7.?..7...&..!........
.`. .=....Sf..q.l.A.....L...t.}g..;...f....=.e.~.z....C..*R....H-..=..
.f..(t'.."....F...g._....n.J..U.4vr`}.....1..o@.....@.#...R. L8....z..
].|......3..y..-./....K..6{...s.<R`.}[email protected]....
<<< skipped >>>

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Mon, 15 Dec 2014 16:41:36 GMT

Last-Modified: Thu, 11 Dec 2014 15:29:57 GMT

Server: ECS (ams/49BB)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2014121
1094629Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.F....20141203203011Z....20150303203511Z0...*.H....................
..L..f.Y......C\x....Z....X^....f..Z...u.q..r.(dVv....P..E~j;..PL.C...
Rf..[.......r.Y&/.P.d...0......T...{...(........W..$..^.lP3pZ6...PQ`..
......J~...=..55..D...P.\?8.N..v....(..$y.~y...z../0....V.\.\@E.lG..W=
o1V.kxF.xR.......}$...............W{..v....0...0...0...........'..0...
*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0
 ..U....Baltimore CyberTrust Root0...140122184236Z..150122184140Z0G1.0
...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-20110.
."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...04..I..
....C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8..........h8GM
..*.4.MP..../[email protected]....
$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j.\.>
;.O....G.A........0..0... .....0......0...U.......0.0...U...........0.
..U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`;.l.uZ
..k.F..^|A.Tb0...*.H.............. .p.)...09W..Z.......]....}.:..Vr...
..c..U..:V^.O.....<...b*5.c.\.fF./....5'.>./ iS..R0..)..*.!..q.h
.T..ul.}&.......`.1".~.U....rB.BR.s..x..o..Y.......).4:.[.9.=....x...'
.f..\ [email protected]:J!.hRH..!z2DtL.s2.r.....Yi~..E..AzO..i.."N.$j...
b...o..i."{(3....
<<< skipped >>>

GET /metrika/watch.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: mc.yandex.ru

DNT: 1

Connection: Keep-Alive

Cookie: yandexuid=2579112161391436322; fuid01=52efa225559a4080.FnXUl7kQ2UnsKWXsrNOZvuy1gjQHCg1JR4X5KG6JbjNm8ywHYDR3v3sXwUhoGRccAr84V3sKYyTKQYDhyBaE3anqP-L8i-wbGtlHwnaA7ADOXPPij0wwfOF6mBYd809f

GET /watch/21425662/1?wmode=5&callback=_ymjsp142774731&page-url=http://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&browser-info=j:1:s:1716x901x24:fpr:216613626101:cn:1:w:1700x804:z:120:i:20141215184033:et:1418661634:en:utf-8:v:616:c:1:jv:10:la:en-us:ls:75324134428:rqn:1:rn:317279238:hid:201936641:ds:0,0,0,22,6,6,,51,46,,,,1198:fp:1249:wn:46579:hl:1:rqnl:1:st:1418661634:t:TweakBit HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095
HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:33 GMT

Server: Phantom/0.0.0

P3P: CP="NOI DEVa TAIa OUR BUS UNI STA"

Last-Modified: Mon, 15 Dec 2014 16:40:33 GMT

Expires: Mon, 15 Dec 2014 16:40:33 GMT

Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0

Pragma: no-cache

Content-Type: application/javascript

X-Content-Type-Options: nosniff

Content-Length: 151
/**/_ymjsp142774731({webvisor:{date:"2014-11-12 00:01:29",recp:"1.0000
0",urls:"hXXp://VVV.tweakbit.com/\nhXXp://VVV.tweakbit.com/pc-suite/pu
rchase/"}})....


POST /watch/21425662?page-url=http://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&browser-info=j:1:s:1716x901x24:fpr:216613626101:cn:1:w:1700x804:z:120:i:20141215184048:et:1418661649:en:utf-8:v:616:c:1:jv:10:la:en-us:ar:1:nb:1:cl:111:ls:75324134428:rqn:2:rn:319917052:hid:201936641:ds:,,,,,,,,,2496,2558,5,:rqnl:1:st:1418661649 HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

Origin: hXXp://VVV.tweakbit.com

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: mc.yandex.ru

Content-Length: 0

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: yandexuid=2579112161391436322; fuid01=52efa225559a4080.FnXUl7kQ2UnsKWXsrNOZvuy1gjQHCg1JR4X5KG6JbjNm8ywHYDR3v3sXwUhoGRccAr84V3sKYyTKQYDhyBaE3anqP-L8i-wbGtlHwnaA7ADOXPPij0wwfOF6mBYd809f; yabs-sid=28057761418661633

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:48 GMT

Server: Phantom/0.0.0

P3P: CP="NOI DEVa TAIa OUR BUS UNI STA"

Last-Modified: Mon, 15 Dec 2014 16:40:48 GMT

Expires: Mon, 15 Dec 2014 16:40:48 GMT

Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0

Pragma: no-cache

Content-Type: image/gif

Access-Control-Allow-Origin: hXXp://VVV.tweakbit.com

Access-Control-Allow-Credentials: true

Content-Length: 43
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Mon,
 15 Dec 2014 16:40:48 GMT..Server: Phantom/0.0.0..P3P: CP="NOI DEVa TA
Ia OUR BUS UNI STA"..Last-Modified: Mon, 15 Dec 2014 16:40:48 GMT..Exp
ires: Mon, 15 Dec 2014 16:40:48 GMT..Cache-Control: private, no-cache,
 no-store, must-revalidate, max-age=0..Pragma: no-cache..Content-Type:
 image/gif..Access-Control-Allow-Origin: hXXp://VVV.tweakbit.com..Acce
ss-Control-Allow-Credentials: true..Content-Length: 43..GIF89a........
.....!.......,...........D..;....


POST /webvisor/21425662?rn=29128073&page-url=http://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&wmode=0&wv-type=0&wv-hit=201936641&wv-part=1&wv-check=46268&browser-info=z:120:i:20141215184033:rqnl:1:st:1418661664 HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

Origin: hXXp://VVV.tweakbit.com

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: mc.yandex.ru

Content-Length: 112

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: yandexuid=2579112161391436322; fuid01=52efa225559a4080.FnXUl7kQ2UnsKWXsrNOZvuy1gjQHCg1JR4X5KG6JbjNm8ywHYDR3v3sXwUhoGRccAr84V3sKYyTKQYDhyBaE3anqP-L8i-wbGtlHwnaA7ADOXPPij0wwfOF6mBYd809f; yabs-sid=28057761418661633

wv-data=HACkDaQGpA3sDgEBRAArAACkDewOAAECTQEN9zsCAwYBA2kCGgEHAHcAcgBhAHAAcABlAHJnbgABBEUDGgAApA1QBJACynUCAQTQAk8_
HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:41:04 GMT

Server: Phantom/0.0.0

P3P: CP="NOI DEVa TAIa OUR BUS UNI STA"

Last-Modified: Mon, 15 Dec 2014 16:41:04 GMT

Expires: Mon, 15 Dec 2014 16:41:04 GMT

Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0

Pragma: no-cache

Content-Type: image/gif

Access-Control-Allow-Origin: hXXp://VVV.tweakbit.com

Access-Control-Allow-Credentials: true

Content-Length: 43
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Mon,
 15 Dec 2014 16:41:04 GMT..Server: Phantom/0.0.0..P3P: CP="NOI DEVa TA
Ia OUR BUS UNI STA"..Last-Modified: Mon, 15 Dec 2014 16:41:04 GMT..Exp
ires: Mon, 15 Dec 2014 16:41:04 GMT..Cache-Control: private, no-cache,
 no-store, must-revalidate, max-age=0..Pragma: no-cache..Content-Type:
 image/gif..Access-Control-Allow-Origin: hXXp://VVV.tweakbit.com..Acce
ss-Control-Allow-Credentials: true..Content-Length: 43..GIF89a........
.....!.......,...........D..;..

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSfAP5wz6TZE9AhTecbrorIUEieTwQU3Igt2WxNPQBQM/EVuXj7weahJK8CExkAAAlE5E3bN0hKjHcAAQAACUQ= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:41:37 GMT

Content-Type: application/ocsp-response

Content-Length: 1501

Connection: keep-alive

Set-Cookie: __cfduid=d8f1d962268af9488cc221cee918f63101418661697; expires=Tue, 15-Dec-15 16:41:37 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Mon, 15 Dec 2014 04:45:26 GMT

Expires: Fri, 19 Dec 2014 16:41:36 GMT

ETag: "bffd42e69a24ed7c2d6fee3fe16635ebd149d3b3"

Cache-Control: public, max-age=345599

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 199416f75fb80b02-WAW
0..........0..... .....0......0...0.......j.....N ...#c........2014121
5044526Z0..0..0L0... ...........p.....!M.....PH.O....-.lM=.P3...x....$
.......D.M.7HJ.w.....D....20141215044526Z....20141219044526Z."0 0... .
....0......20131215044526Z0...*.H.............%.)(......).2..d.....2.O
7v...2.5....x..c....G....R...p..f.).-..u(....&..N;qC..Z...Z7..awh...;R
t.-.8...........(.tt..q...w....5...t*...).(..GI....uO..5.x......d...(.
...6......y..b..9...b.*.J.Y..T.S.. ..2.Q.*t;..G....../...![...........
.`...:.cW.K..*e...1.......0...0...0................y#....y......0...*.
H........0..1.0...U....US1.0...U....Washington1.0...U....Redmond1.0...
U....Microsoft Corporation1.0...U....Microsoft IT1.0...U....Microsoft 
IT SSL SHA10...141023182318Z..150106182318Z0!1.0...U....Should be igno
re by CA0.."0...*.H.............0.........1._G....#.L;!>Q.z.m?e8.-1
\...Scf....0.....E(/F.(..nN...U....3"&M./[email protected];...j.k..\.d'.
..s2D...W6.g.9...xk................Q.GZK.1.\-.E.......l.h.]%i4....v...
..J.-. O. ?.*...A3...h.#..."..c....PhV.>..;...Y...._.".t....|c.....
.3.l.YUZ."p.r..C.U-[y..........0..0...U.......j.....N ...#c......0...U
.#..0.....-.lM=.P3...x....$.0...U...........0...U.%..0... .......0... 
.....7....0.0... .......0... .....0......0...*.H...............a.F7Z.A
..,.N.^.W..;....m<........l....\..........ar....B......V....nX/Q@..
EZ/..L...1.'..SF..Qd.........e<.[....z..`..^wB?.p0,.2....R.`.>..
E?6Ppw....5.6.Q..?.?....."9..,[email protected] :`...B..
....E....1*8.~J.U.D...zs..sw.,..V.G.d.#z...n.n..
<<< skipped >>>

POST /webvisor/21425662?rn=931434884&page-url=http://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&wmode=0&wv-type=0&wv-hit=201936641&wv-part=2&wv-check=49568&browser-info=z:120:i:20141215184033:rqnl:1:st:1418661758 HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

Origin: hXXp://VVV.tweakbit.com

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: mc.yandex.ru

Content-Length: 228

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: yandexuid=2579112161391436322; fuid01=52efa225559a4080.FnXUl7kQ2UnsKWXsrNOZvuy1gjQHCg1JR4X5KG6JbjNm8ywHYDR3v3sXwUhoGRccAr84V3sKYyTKQYDhyBaE3anqP-L8i-wbGtlHwnaA7ADOXPPij0wwfOF6mBYd809f; yabs-sid=28057761418661633

wv-data=AuQOA6YCgwYC5A4DoAKuBQLlDgOVAqIEAucOBPcBLgLnDgTzAR0C6A4E7wEQAukOBO0BDAKvEgTBAQoCsBIExgEVArASBMwBHQK1EgTMAR8ClRMEzAEgApcTBMkBGwKYEwTaARMCmBME4wERApoTBOcBDgKfEwSKAgsCpRME7QE1AqUTBO0BJwKmEwTuAR0CphME8gEQAqcTBPYBCQKoEwT4AQU_
HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:42:38 GMT

Server: Phantom/0.0.0

P3P: CP="NOI DEVa TAIa OUR BUS UNI STA"

Last-Modified: Mon, 15 Dec 2014 16:42:38 GMT

Expires: Mon, 15 Dec 2014 16:42:38 GMT

Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0

Pragma: no-cache

Content-Type: image/gif

Access-Control-Allow-Origin: hXXp://VVV.tweakbit.com

Access-Control-Allow-Credentials: true

Content-Length: 43
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Mon,
 15 Dec 2014 16:42:38 GMT..Server: Phantom/0.0.0..P3P: CP="NOI DEVa TA
Ia OUR BUS UNI STA"..Last-Modified: Mon, 15 Dec 2014 16:42:38 GMT..Exp
ires: Mon, 15 Dec 2014 16:42:38 GMT..Cache-Control: private, no-cache,
 no-store, must-revalidate, max-age=0..Pragma: no-cache..Content-Type:
 image/gif..Access-Control-Allow-Origin: hXXp://VVV.tweakbit.com..Acce
ss-Control-Allow-Credentials: true..Content-Length: 43..GIF89a........
.....!.......,...........D..;....


POST /webvisor/21425662?rn=999598497&page-url=http://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&wmode=0&wv-type=0&wv-hit=201936641&wv-part=3&wv-check=21039&browser-info=z:120:i:20141215184033:rqnl:1:st:1418661789 HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

Origin: hXXp://VVV.tweakbit.com

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: mc.yandex.ru

Content-Length: 92

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: yandexuid=2579112161391436322; fuid01=52efa225559a4080.FnXUl7kQ2UnsKWXsrNOZvuy1gjQHCg1JR4X5KG6JbjNm8ywHYDR3v3sXwUhoGRccAr84V3sKYyTKQYDhyBaE3anqP-L8i-wbGtlHwnaA7ADOXPPij0wwfOF6mBYd809f; yabs-sid=28057761418661633

wv-data=As0TBJwCJALPEwOZAosEAs8TA6YC-wQCzxMDqgLBBQLQEwOuAuAFAtATA7EC-AUC0BMDtAKVBgLREwO2AqMG
HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:43:09 GMT

Server: Phantom/0.0.0

P3P: CP="NOI DEVa TAIa OUR BUS UNI STA"

Last-Modified: Mon, 15 Dec 2014 16:43:09 GMT

Expires: Mon, 15 Dec 2014 16:43:09 GMT

Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0

Pragma: no-cache

Content-Type: image/gif

Access-Control-Allow-Origin: hXXp://VVV.tweakbit.com

Access-Control-Allow-Credentials: true

Content-Length: 43
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Mon,
 15 Dec 2014 16:43:09 GMT..Server: Phantom/0.0.0..P3P: CP="NOI DEVa TA
Ia OUR BUS UNI STA"..Last-Modified: Mon, 15 Dec 2014 16:43:09 GMT..Exp
ires: Mon, 15 Dec 2014 16:43:09 GMT..Cache-Control: private, no-cache,
 no-store, must-revalidate, max-age=0..Pragma: no-cache..Content-Type:
 image/gif..Access-Control-Allow-Origin: hXXp://VVV.tweakbit.com..Acce
ss-Control-Allow-Credentials: true..Content-Length: 43..GIF89a........
.....!.......,...........D..;..

GET /en/pc-cleaner/16/pc-cleaner-setup.exe HTTP/1.1

User-Agent: Auslogics Tools Updater

Host: static.tweakbit.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:31 GMT

Content-Type: application/octet-stream

Content-Length: 7822144

Last-Modified: Thu, 04 Dec 2014 18:11:26 GMT

Connection: keep-alive

ETag: "5480a3ce-775b40"

Server: NetDNA-cache/2.2

Accept-Ranges: bytes
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....WZR............
.........4............... [email protected]...
.......@......................................(...........x>w......
......................................................................
..................text...,........................... ..`.itext..D....
....................... ..`.data........ [email protected]
s.....V...0...........................idata...........................
[email protected].................
.............@[email protected]...(............ ..............@..@.............
.......................@..@...........................................
......................................................................
[email protected].........
[email protected]([email protected]......@...............................@..
....... 9@.([email protected]@[email protected]@[email protected]@..9@.,[email protected]@[email protected].%..A....%.
.A....%..A....%..A....%..A....%..A....%(.A....%..A....%$.A....%..A....
%..A....%..A....%..A....%..A....%|.A....%x.A....%t.A....%p.A....%l.A..
..%h.A....% .A....%d.A....%`.A....%\.A....%..A....%..A....%..A....%X.A
....%T.A....%..A....%..A....%..A....%P.A....%L.A....%H.A....%D.A....%@
.A...S..........$D...T.J....D$,.t...\$0....D[..@..%<.A....%8.A.
<<< skipped >>>

GET /go/affiliate_31095-ab_7forumstest03_a/fix-my-pc/afterinstall/?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Date: Mon, 15 Dec 2014 16:40:31 GMT

Server: Apache/2.2.16 (Debian)

X-Powered-By: PHP/5.3.3-7 squeeze19

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; path=/

Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; expires=Fri, 13-Feb-2015 16:40:31 GMT; path=/; domain=VVV.tweakbit.com

Set-Cookie: source=ab_1215164031_7forumstest03_a; expires=Fri, 13-Feb-2015 16:40:31 GMT; path=/; domain=VVV.tweakbit.com

Set-Cookie: source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-; expires=Fri, 13-Feb-2015 16:40:31 GMT; path=/; domain=VVV.tweakbit.com

Location: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 20

Keep-Alive: timeout=15, max=100

Connection: Keep-Alive

Content-Type: text/html
........................


GET /fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

X-Powered-By: PHP/5.3.3-7 squeeze19

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Set-Cookie: E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; expires=Fri, 13-Feb-2015 16:40:32 GMT; path=/; domain=VVV.tweakbit.com

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 3486

Keep-Alive: timeout=15, max=99

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8
.............s.8...L....)..6......t.n...n...e2.a.Pb[.$CH........J..ng/
.............G.s.4"h$...u......c..P..{..T..{:!.....v..u....WF&...q...P
.P..@[email protected]$..."~........._..aw....}.^!N..!F.K7......l...xHl.1...A...x
..,..$..\......`.tm..L&.T....\...g^.J1........26.....8..G..P..y.....8.
.F.V..Tb...&.5...b....j.>.4..SN}5._MP..z.i:ug..5Rm..O.....B ..X....
.........B...\]I.mM.R.. ...1.S...g....cv)`.......M.....w.d.tj.J.sVk..$
.........MW...b.....D...W=}[email protected]~....x...F..NZ.eS0.Y..`.....V!...
...1.#|E...........fn.. [email protected]..=.....[?..q.J..2..*..
....A.#= .C.a.!.....u....t......w....9~..".:....q{{v^..X.......tQ...A.
.<...=... ...>..x..'...*U [email protected]<.... ...>...`..i.v.h)M..
. ..@_1.X.1..32`......].<...I.".-S....T-%k...&.f..b.v).r.K...- 8..R
"z..J....S.i4.k..:p,.<?.`....8j.Km$yL.....U..5.?.X6.Q..|:.^1'b.....
 ..`.J.zE...h.K.H.......7k)..p..... ..S2.#..mC.f.P....)r},D....@ ]0.\C
...G..z.c.q...;....7.....<.dxa....0...'3.X......zg@/<.e)v.. G..L
..2.?.......... .l.j.~.a....f....P...{.m.E...S........EOP......3yf...L
-..IL..{......C. ."I..G.v........ ....b...T..z .!...^....,..k.t.n..M.m
.c...h.-Lh.&H....."[email protected]*P.S2@.%S)N.........%..p......T..i*..Gt...
F=9j7w......:[email protected].....%5
.....,..G...M.17. ...nbp.....).....RW......@!.,G......l.....Bb...n:...
U"...n..).,.q./.A..D>.$g.9.z.3.ej.""`.T......4]H..lwk.N..Ja....g.N.
........J?u.....3....W.l./...g..,..} 1x...M1;..cF..........(. 9.,.....
X,....U.*..j.g..u.z..q...iSyd..pl...d@/...0Ao.........`. R......".
<<< skipped >>>

GET /includes/vendors/projekktor/style.css?2014121516 HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Fri, 21 Jun 2013 05:41:24 GMT

ETag: "3660b43-2978-4dfa3836fd0e7"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 2255

Keep-Alive: timeout=15, max=98

Connection: Keep-Alive

Content-Type: text/css
...........Z[s.6.~^..4.N.c..(..2}[email protected]&.}q...(y.]elG.
tp.w.......O;. . L.........73.._?....luyy8.....A.=.l...2...P....Q.1.qL
...;.._R.....#.R."BS4.7b...L..m.w..eq.C..AL.d....O.~.`<.l;y{9.L...{
M.(E...............F.-.E.{.%B.....S.mh...L0yZ.W....!.'.i.^].W..Z..B...
..[.!...0..{...&$._...Y.X.< ....XS..a.........dUd.b..Q..|...V..A..~
^.....d0.q.]..b.g.>...F{3..X{.!.9~0...b."E.p......D..q..Hx.......~.
R....o^...J9b..C..\K?...............>x..8.....U3.. x.....5.Z.....X.
..N.M.Q_.. ..........S.Y.f..]...fr..M').zhMY..J..9%8.U.*.C..B.FV.<&
gt;IL......Sr%._..c]..e.Q.../.........xo.l....Fr..9.s.xsh]l6"..m9lL...
RQ.l.(....Zx...n........6....4o^..........`....b..:(.s;..V.....naU.T;O
5JY..y.RO'.2K:....A..'[email protected].)......H......nO.="..xX.....?..
s.......2.YX..0"^..~.ty...q... ....z.y....'..H.RF...s*..v~...-...`....
.F..T..u.....V...Q.#J...}....|..3.O..T.o...2.B.6..U....<...o...n...
.........)Uy.<".[.....)G......D.......k.......g...........'.3..f..R
{e......;......t.......`tC...w......yX..?l.T(.........S....6}.6.>.t
...Ng...n}{.i.h.......!.# ..[`.....`.......`..}.....cb8.D.XK.....8....
.D&Rau`0.....F...b.H..&4.......T.N.........>.r.....o?.....`zg....v.
....xL`....d.55:..F...R..W.Z).#...r.A}.p.%.V.0.="w.&....D^.."..A.;@.$?
...w..........#.....}.%bR.l.pg...SI&6."....Jy..a..v..>"NG..mp..P..b
.H.o5....../.....me;.....2]Q_.|.....D?......&.........hy.....!......*.
.-..'..].g.....U...T.....T........;...............v..._-|7.F.s..r..V..
.........X....7._...A(d-......Y.^...k.#O...i./.....3......U..!....
<<< skipped >>>

GET /includes/jscss/blocks.css?2014121516 HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Wed, 16 Jul 2014 15:59:47 GMT

ETag: "3660ad3-52e-4fe519d08bde9"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 536

Keep-Alive: timeout=15, max=97

Connection: Keep-Alive

Content-Type: text/css
...........S.n.0.=._A [email protected].,[mB]..y..,...
..3.'.........'......z..gx...6..d?.2.^...2O.Z...!.L.s.C.6aa....*Y\.$.~
Ra...!FSYWT.4.......y....^K.Ei.2.{..C..3%.r.........A.R(.,.K.s..~.....
..]42.K.;0^8..y.e...jG........u.h\...j^.Soq..Y.u...m... *N...5m.fqUs..
L..j%...4..tQS.n2.`.;.S.F....Y..~`%S"O...x...I..J........4.j.....)`k..
...L(.:L/..c...v|.g...v...S....MH...d...l.....q....q9Qau...Fv.......d.
.m.A....z\.....J.gTt...$`...0.....3. ..E...e\3..imq.........s....}.>
;.....\...._<..UR....w..[...v2.(...q..u...#S.........


GET /includes/vendors/jquery.nanoplaceholder/jquery.nanoplaceholder.js?2014121516 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Fri, 21 Jun 2013 05:41:14 GMT

ETag: "3660b30-218-4dfa382daccc5"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 330

Keep-Alive: timeout=15, max=96

Connection: Keep-Alive

Content-Type: application/javascript
.............N.0.E..W........k....`.,...8.p........I.Tb.&N..{r...,..&l
t;i!Ucu...a.b.c..~.../j....z....1...%G.......QN....,.O...mtpJ.Z...A..X
.k.v.`.W.?M.m;..g.w..'..u =.vs?@...][7..dpsu};...v..2.U42.....O.t.....
.Y..i........8..[B.M.....M.....N8...e....t..........|$a.$...(2.......p
_.).A .......#s..C..2..1C........~H..~=G..,..tW.6........


GET /includes/mixins/phone-popup/phone-popup.js?2014121516 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Fri, 10 Oct 2014 05:24:54 GMT

ETag: "3720007-47f-5050ac4e216ca"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 619

Keep-Alive: timeout=15, max=95

Connection: Keep-Alive

Content-Type: application/javascript
.............n.0.....8.*%aK]..6..f..W|.;...8...#.Y.}\!q..g...b.......N
.i..!"%.}~....s|...Z..I.u....=VBT....a.\...v l..c.e. G..(D.Ba.i.B.NO}.
.G....Fh....8y{o..Z..k...N\.".Vb.....C...1...~....iPQ)HR....,.t9.....k
.D$F..-v77..K).P.V...........t..... .0QR.`..........>H....(.U...J..
......'..di&X.>..v..a......B............S.]x-9O..'}.4.GS..!QAv?....
......G.W.1PE.4...:.R. .#.x.K"..........l....G..~..f............d.f..k
.:.`.:..{/.........:QH........".....`[email protected]%..%.
..Z..R..c".uA4..#&4Z...q..>...yo9...ag\.c..i.....mK...9.P.SGV..glz.
..X.).V.KaEz......[........MB.<.*.,..m.....[.q{.7.}.G.^.DM.........
.HTTP/1.1 200 OK..Date: Mon, 15 Dec 2014 16:40:32 GMT..Server: Apache/
2.2.16 (Debian)..Last-Modified: Fri, 10 Oct 2014 05:24:54 GMT..ETag: "
3720007-47f-5050ac4e216ca"..Accept-Ranges: bytes..Vary: Accept-Encodin
g..Content-Encoding: gzip..Content-Length: 619..Keep-Alive: timeout=15
, max=95..Connection: Keep-Alive..Content-Type: application/javascript
...............n.0.....8.*%aK]..6..f..W|.;...8...#.Y.}\!q..g...b......
.N.i..!"%.}~....s|...Z..I.u....=VBT....a.\...v l..c.e. G..(D.Ba.i.B.NO
}..G....Fh....8y{o..Z..k...N\.".Vb.....C...1...~....iPQ)HR....,.t9....
.k.D$F..-v77..K).P.V...........t..... .0QR.`..........>H....(.U...J
........'..di&X.>..v..a......B............S.]x-9O..'}.4.GS..!QAv?..
........G.W.1PE.4...:.R. .#.x.K"..........l....G..~..f............d.f.
.k.:.`.:..{/.........:QH........".....`[email protected]%..
%...Z..R..c".uA4..#&4Z...q..>...yo9...ag\.c..i.....mK...9.P.SGV
<<< skipped >>>

GET /includes/i/video/fixmypc_how-it-works-462x289.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

.......#....F....zS..GY..]9..;.....v:.. K......_.~.'.....w........F^..
k.s..n1..).~...H...X[.......E..N.Bc....J........i.9.'y`...#.A..XB0...b
.../.....A@Vu..$.st5;.....?..oa...s.X.<.5.~.!kY<../.Q....c...|C.
...7...n..9...k0U..."..j.`9D.)7.G.....c..%...:.\.....N....e...j...... 
.k6..V.%.[~ra.L.....5.g....~..k..}#{.I2d..%..=g.<s......wW1.(.s....
.9.."j/..?5.V.....].Z.\V.~I.ggj|.V.1XU.h'..1.~T.W..X Mm.5....1.Q...7..
...db....z..|.b..........c....j.1"."....U0..{........v6p...y...j...&W7
.N_,(....[.........4..Ypk...zUivh...A.!N..J2..Y....u....Y.4uG[..D3.t..
.CZO..\.2.9...b$...I..v..,.G#!.U:.d..V.....o.9...e....<(........y}.
.yU=..&.t .K........:..C....o..XD.....[.y8.%o..Y...M..D.'.F..C..m..?..
......9.W.D`.V..a.._J...}...SX.....!V..."jtuS...|..xv.(kN..N.mJ..>.
 ..47.e%...(s........9./.Q-.Y>%D.;SPk......|.vc6.).*.$.).}.f..$....
...z.K.zv...........].<.... %.M....L[....,......kF8C.4"g.x.Z...a..@
..E..8?..)...#...j..i.U.&LnhXI..$.b_&...qm...G.|a../..X..X^.2....W.7H.
.(>P...A.T[^X.........W.|}{..*[email protected]*)v
..w8.B..}..C....K.^.?-K6z.W....._.........j..a.M.;.#....K.2\..O.......
X.h. PH=^R...o._\b...#.........n...a...`.c........3...y...Zl.. &.YU...
.\.9.N.....x[.........Mm{(.M....x.....c..z6-.....E|..$~.,kb....OU;...F
......n..E........X......4..Z6..N...3d...a.Ye....y..K..U%..;.g.(qg.f8.
jmf..nFQ.}...}.p.x.Q.>K.f...j..X .......#.>.7`.;.b.U1.f....[....
............~.?.!.v..S...[..8......{..................................
..?../........?../........?......t..D.....S...c.H......|.Y"`..j...
<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-; _ga=GA1.2.1319773250.1418661634; _gat=1; _ym_visorc_21425662=w

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:34 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Fri, 21 Jun 2013 05:41:58 GMT

ETag: "3660b99-47e-4dfa38579b010"

Accept-Ranges: bytes

Content-Length: 1150

Keep-Alive: timeout=15, max=92

Connection: Keep-Alive

Content-Type: image/x-icon
............ .h.......(....... ..... .....@...........................
...............................................................E......
.............................................E........................
...................................................................<
;...T...................................................?.............
......................................................................
................r.....................................................
......................................................................
....{...........................K.....................................
..................................N...f...............................
......................................................................
......N...................................................N...........
......................................................................
......................................................................
......................................................................
......................................................................
...................................

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1363

content-transfer-encoding: binary

Cache-Control: max-age=403223, public, no-transform, must-revalidate

Last-Modified: Sat, 13 Dec 2014 08:38:24 GMT

Expires: Sat, 20 Dec 2014 08:38:24 GMT

Date: Mon, 15 Dec 2014 16:40:34 GMT

Connection: keep-alive
0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....2014121
3083824Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:v....20141213083824Z....20141220083824Z0...*.H............
.Uz....F..B.n%......3..IRx..............%...j.y7.Di..<.....kr4.XV..
...xYH.(....|{..<(1h...BP.>..x...o#.b..@.>.c.....b. =X.......
........%xZ.B##...oI..T....}~;k~......E. t3S.}....3...m..".....M.....D
.......H.6.n(.]1(.,}..?q.....!......%h.b..%..>..S....*j'.&{....0...
0..}0..e........:}0...*.H........0B1.0...U....US1.0...U....GeoTrust In
c.1.0...U....GeoTrust Global CA0...141201130534Z..151216130534Z02100..
.U...'GeoTrust Global CA TGV OCSP Responder 30.."0...*.H.............0
............\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".CZ.w..T
..Y. syd.....x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...`f.X..
.B>x..............6..m.&...'..W.plK....[.m.V..h..lI.........?~.....
>.|'....o...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....._S...
..........0..0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%
..0... .......0...U...........0...U.......0.0!..U....0...0.1.0...U....
TGV-B-2830...*.H.............~....2!...V..0...Y....L..k....z}~a.3Y.x..
dS.L...Dk$a...nR9_......B......m....Y....U.5....'.....<{....v&=.2].
....j*.r(7...=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d...z.i
.H..f...v.....\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T...?. .
.....i..%....
<<< skipped >>>

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Thu, 23 Oct 2014 05:05:32 GMT

Accept-Ranges: bytes

ETag: "a2f3ff97eeecf1:0"

Server: Microsoft-IIS/8.5

VTag: 791939326400000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 813

Cache-Control: max-age=900

Date: Mon, 15 Dec 2014 16:43:59 GMT

Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..141022204822Z..
150121090822Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......'0... .....7......150120205822
Z0...*.H.............4....w.h.Y..L.p.Q... ..?.~.q.......'.a[... ]G....
....t.....^p..De..0*r.n....G|....$b-{......d/....m...r.xQ...t..XtF...O
W~.....@6...*x.h........wi.L.%.,<}.rULPR..T........P..g...._V.\z`..
../..^...e.............r.%...:.S..W.....Qy...6.W..Fo.;.~.e9.]...;7..[.
$wzD....|.%\.w..o...X.....R.2u.w."J\.&q.f.d<&.p....[31.....il.....d
I2.#...h.Y.._e........H.%2.r.w..M.(~...W.{[email protected].^o]...K....f
[.oN\.V.../<..&.)@P.A.......p....D.Gj.M}PhUY?s...YX>..e...PC...@
.^....v...:._[.l.....z.._(..>.l....O....ReP...M.%.B1..)....


GET /pki/crl/products/WinPCA.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Mon, 06 Oct 2014 05:06:02 GMT

Accept-Ranges: bytes

ETag: "3e1c83923e1cf1:0"

Server: Microsoft-IIS/8.0

VTag: 438466244800000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=900

Date: Mon, 15 Dec 2014 16:43:59 GMT

Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Window
s Verification PCA..141005213147Z..150104095147Z._0]0...U.#..0.......p
............<.J0... .....7.......0...U......20... .....7......15010
3214147Z0...*.H.................C>....... ..3yv..N...Q...&..U...u(.
.8.2.,.K.r.M..m0..BdE..(@.bu//J.......b...H.Z...B..7zS.>......G....
{..C..}p.......9d..Q.E/.N......fM.._A{7RI*.....t.B...d..>w'.. ..0xJ
...'.0.6...o. ..(.......1..TU[..<..|F.>x..j.....xA2....b.'..{.t.
H......A...@.{{ip......


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com

HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sat, 04 Oct 2014 05:06:12 GMT

Accept-Ranges: bytes

ETag: "58cddbea90dfcf1:0"

Server: Microsoft-IIS/8.5

VTag: 279619316300000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Mon, 15 Dec 2014 16:43:59 GMT

Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..141003211553Z..150102093553Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......00... .....7......150101212553Z0...*.
H.............:...h:O..9..a.M8.}*.........A....f......SG....(...g...&g
t;.!.4o7P....O...`x.h.W.F..x.9...1....C.......5..9..p ....1 ........$.
.P.......?.6...2.....(.."C1aF..B....I.V.u.4=Cs....~d5X..R...BRo.......
.....1Q-b.... ..P.M/SfvX..l..Mm.j9..A|.q.W=...Wy.Y]<....._!.../..

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a860278501051db1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 05 Dec 2013 22:47:50 GMT

If-None-Match: "0af536cf2ce1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com

HTTP/1.1 200 OK

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

Accept-Ranges: bytes

ETag: "0b2464b1797cf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 6408

Date: Mon, 15 Dec 2014 16:40:14 GMT

Connection: keep-alive
MSCF............,...................O.......'#.........D.z .disallowed
cert.stl....2..'#CK...8T...g........g.k..".....mlI."d..m...P$"....e.J.
.......z.....\..........9g.9....~.........Q.Q......Q..DL.8.C.PS.K0.!P.
0........#.DY.8.....V.....$.C....a.0...........`......;.S.....0#...m..
. ..`0...?.!vR?.....d....`......_@..}....$...i..OR'..$....K..'Z....o.g
..*.Vc.....[nY e./.EJ...B.Y.......Ag......!....9......u..!..1Yy.......
r...Ss^@...M.Dtl\....i.k....3...B.Z.:.p.N....*......x,...ah/..].[....G
B..T..$A....SY..t.E5R..R...9!....*.*68V....1... ...Q{..."[email protected];
xd{.C.u?..e.U.=f.nx.........y.G..0.......\L .'.^....$......N=..m...Ujr
Zs...J.I.C....;......q_..e......?.T..2..bw....E.L.{...S...~.<......
...-.Q..|.l. .1..6r....[}!J..,...naPk.U.... ..{@LH..W....>.Sq...8.5
.,.z..0.jL.S..........]...yW_...Y.1..h.7...9{.....I......g.Y.,1...i8n.
6..........4.]...........=........^..n.K7...c.g).Z. .0..$7.ys.p...B.5.
].f...|(3!.|..P...j..^..j....#([email protected]..*.O..i..u....9..S.Y.n..HXW..
.F ..i...:.......!.] r......D..*ld.b.>>:Pp.....5:1 o=..5.'..4...
....hO....{.V.rx..V...%.}..u...6Wv-..".iV.b..B0.Q..,...E.Dy...x..5....
?Z.$L..1.....4...=.....g!....%..:..c..j..v~....._R.6.......;.#.Y*p..J.
4.#'..Vo...g^K...J....._.^..u...)....&/.....q....o......4.....S...,q..
...p.8IIe.....d|.3{)...M.0.X...4.."..P.......Hk.... ]!.!... ..#.x..<
;..X.........'.E(<b[.......#.. ....XiLl|[email protected] 
[email protected][email protected]..;.......mm....>~............j%..>
;.X.,V...J...C ....*..Z.8- RKGW...0./Z.__..)7g_'{.......pr......;.
<<< skipped >>>

GET /includes/vendors/jquery.dialog/jquery.dialog.js?2014121516 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Fri, 21 Jun 2013 05:41:10 GMT

ETag: "3660b24-2744-4dfa382951837"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 3344

Keep-Alive: timeout=15, max=100

Connection: Keep-Alive

Content-Type: application/javascript
.............r............(..SJt..n....v..j4..\Jp@..@...._.M.q.N&.....
?P.)ft....z..]`..e9.i..$v.9{..... l).m...F.......~...I.......:../.S...
...e..^.C6.NYv..._......3X?...7....4.s......_.. ;d......Uv....fG.g.D.&
gt;;......................'.......c.b...q.e.....:[email protected][..
>a.(.S?....!o;S..[.....*..[|...2.|.x......V....r.........{.d...T*..
......J6...3?a...4......'i._H#...].s..[w...e...........bV...t..~jl....
......2...'[email protected]......_.....r......A...d../...8...
...t.9.......*<..b`@.r<|..l............0V...IoT.B..n.2....W....l
'.),.RP.Q.....;-..<.....Dv..4.....V,.dU...*.....xIB2.PF.C~1.|.R....
..y.....Q.s..p.x..5.......0!. ..Lb.1...Q.:.:G..eh/.M....<..!_...:..
..T*x.N.&..3.l.)q@.!.../.l..B.n....<..iA.m........0"k{[email protected].
".;'B5.@.) ..mA.au...V5...y.}...[.oXI..KIB&.v].8..A.8P. P....hyA...>
;...(\....F.;......./....^|.......>.Q..........$.f..3F....B.)...^..
}.}..[..EU..sJ#.!5r..8..I......|...).~.h..".P.3.X...e....>......$..
d.J._`....B.=.v=.............0.A... l".....G!D.?..:p.....:....s{S. ...
KT...,.9As#~q9}].e..o.~gq.}....W..XUn..G..N[.ek-..?,.,/..z..* ..h..94"
......c...~n...Qe....T..pPH.....Fhr.S........;......bcH9..q4.L...E.Xy.
 ......[.e.....Ty.......2}......}.L.w..X!...cc...e?Q.x......vR.)&..._:
.b?....[..C/l..}[email protected]........)...[....
*s.!..........^._.....gMf.=k^..y.......TE4...WUaAun.J>.h.J.. .a....
A .E...#..o.OZ.kP....j..!...[I..V.$O#bI.[W.2.jPZ...[S..).-........6.\.
............y ..........:QE.....S......U.p.Z.S._.v....D^.S`....'.G
<<< skipped >>>

GET /includes/jscss/index.js?2014121516 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Fri, 31 Oct 2014 06:14:00 GMT

ETag: "3660ad8-46df-506b1e7271e76"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 5887

Keep-Alive: timeout=15, max=99

Connection: Keep-Alive

Content-Type: application/javascript
...........<ks.Gr.._1.%.B...EQ.(..(.V.|.... Yq-..`...z.|.f.eYw..g.S
IU*..UR.|...iQ.......g..]...C.r.#vg.{zzz.9...j7.;...j.}9??wZU.....5...
..f...*.s.W. 0........M.....6....U.{...t....!........ev...3.8.{..7...&
..p...i[.n....}..a..NX;{v..e.?.v..l.rx8<..{.Gl.z..F..... ..........
..C".......Ra.g.|........._...vG..?......`...C..00qm>b..@'.mnC.....
8.b1[[email protected]]6.D..uZJia..BIa~.m..l.gp.i;6_.4...l.[ }n...=
..o".M..;[email protected].]s........z.C......;a..,\nJ.t
.........T...:>.........3l.O.g .{.o....`#.}.R......_..F......S....i
.[...9......"........4..BB..0..........._.......`......nZz.O.}......8.
.~h.......Da...x.B.%)/@[email protected]...!....D.1R..2X.>..g..X...<.L..\.
8.y..g..d.~...ZmssS.6.~.m..........F5tk.^.Jp.......,......cny..v...(.i
...A@y.\....."w...........M.g).v.. .9S.4.q.....6u..9.... k6.P.G..;....
5..^..^..i......?.igO.P....#....t.j..rD.....0.h.....E. ...q|H.O...Zs..
[email protected]... ~b.......e.....f.p.."..?..J.hN..QL[%.
 .......9...gY-3z(U../d.*wT......H.S.#.2....##U..,.T.....#&........3..
...-VzG.~...Vi!5.4nz_..E...}W....l......]V..DV.j..,........S..W.Xl._.Z
;D.D.k.A..S..S.nE[..F.G.......1#.K.`.p2..&.y.oOE1Eh.@="...T..s........
...q.,....k(..$.Ph..{A.H"..%.~..........f...(..*...\..%.M..i1.F...x(..
..2...K.N.Q.86.~t....X.. .B.....|....*.._.d...f........r..a.`.Q.....s.
..a Y.^........B.....#....7.j..( .:[7.yF..V#[email protected].!5.w,p.Te
...Gk...W..).......6...;w;[email protected]:......l.....)D..`.
0T......Q...r;e....&x..v\Ve.y...M.^Y..^..V.#,}....,.c..,R.M....`|.
<<< skipped >>>

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Mon, 15 Dec 2014 16:41:37 GMT

Last-Modified: Thu, 11 Dec 2014 15:29:57 GMT

Server: ECS (ams/49BB)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2014121
1094629Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.F....20141203203011Z....20150303203511Z0...*.H....................
..L..f.Y......C\x....Z....X^....f..Z...u.q..r.(dVv....P..E~j;..PL.C...
Rf..[.......r.Y&/.P.d...0......T...{...(........W..$..^.lP3pZ6...PQ`..
......J~...=..55..D...P.\?8.N..v....(..$y.~y...z../0....V.\.\@E.lG..W=
o1V.kxF.xR.......}$...............W{..v....0...0...0...........'..0...
*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0
 ..U....Baltimore CyberTrust Root0...140122184236Z..150122184140Z0G1.0
...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-20110.
."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...04..I..
....C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8..........h8GM
..*.4.MP..../[email protected]....
$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j.\.>
;.O....G.A........0..0... .....0......0...U.......0.0...U...........0.
..U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`;.l.uZ
..k.F..^|A.Tb0...*.H.............. .p.)...09W..Z.......]....}.:..Vr...
..c..U..:V^.O.....<...b*5.c.\.fF./....5'.>./ iS..R0..)..*.!..q.h
.T..ul.}&.......`.1".~.U....rB.BR.s..x..o..Y.......).4:.[.9.=....x...'
.f..\ [email protected]:J!.hRH..!z2DtL.s2.r.....Yi~..E..AzO..i.."N.$j...
b...o..i."{(3....
<<< skipped >>>

GET /en/pc-support-bar/pc-support-bar-setup.exe HTTP/1.1

User-Agent: Auslogics Tools Updater

Host: downloads.tweakbit.com

Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Mon, 15 Dec 2014 16:40:32 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Location: hXXp://static.tweakbit.com/en/pc-support-bar/pc-support-bar-setup.exe
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>..HTTP/1.1 302 Moved Temporarily..Serv
er: nginx..Date: Mon, 15 Dec 2014 16:40:32 GMT..Content-Type: text/htm
l..Content-Length: 154..Connection: keep-alive..Location: hXXp://stati
c.tweakbit.com/en/pc-support-bar/pc-support-bar-setup.exe..<html>
;..<head><title>302 Found</title></head>..<
body bgcolor="white">..<center><h1>302 Found</h1>
</center>..<hr><center>nginx</center>..</bo
dy>..</html>....

GET /api/getNewUID?DAuslogics=y&timezone=120 HTTP/1.1

Host: pm.tweakbit.net

Cache-Control: no-cache

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:29 GMT

Server: Apache/2.4.6 (Debian)

X-Powered-By: PHP/5.5.3-1

Content-Length: 66

Content-Type: text/html; charset=UTF-8
{"status":0,"response":"4772805.e15e33de9a605bd7095de81a3aad7f66"}HTTP
/1.1 200 OK..Date: Mon, 15 Dec 2014 16:40:29 GMT..Server: Apache/2.4.6
 (Debian)..X-Powered-By: PHP/5.5.3-1..Content-Length: 66..Content-Type
: text/html; charset=UTF-8..{"status":0,"response":"4772805.e15e33de9a
605bd7095de81a3aad7f66"}..

GET /analytics.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.google-analytics.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 15:50:10 GMT

Expires: Mon, 15 Dec 2014 17:50:10 GMT

Last-Modified: Thu, 13 Nov 2014 21:10:00 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11158

Cache-Control: public, max-age=7200

Age: 3023

Alternate-Protocol: 80:quic,p=0.02
...........}{w.:.........Du..p8IMV.........,.ih.....6.g..{K..4<3..w
.....[..K..L.*...~ps!.{RFz.F...~...|<..a&N...0.].XF..}[email protected].
.....".nR.M..=....$.gy...P`(.5..P..T..z<.J{.W.%2..8..s..SO\!....'~.
........S......s.....Je;Y...i......A...;.MPn....>RO"o0R......O...r.
6..u.]c..T..z.'.....v1.t...h..c...=q.1He.|..x<@[email protected]..
>M<..F..>.Y......M.Q".'r:.>......g.t...a/C...x..12....}..s
?....W&S ..O.'...0/.R.{..z..L...8.yb$...~Of....1..LQ..v.'^F..Q...C....
.N....Z..c......=.u....?..PQ..}!;q7..g&. *U<..>U.QY...R..s.m.j5.
..][...0<..PP....h..{c{[..a...L..k!F........./^..z........G.>~..
..7. `.w..y68.....I6.....]olln=x......x.:..N.Ss....e7z.y..=/.z...f..y.
..f,..H..gZ.....x..E.-........E;...V...4..]T8....n...xU;O....^0...5t.b
.O.. .\[[ol.2T.!v.Ta#T1.N.I..=4...F....HR..E&K..m.y..~.{.xr|%...m.Z...
.jz.Ld...v8.L1..9....K..Q..S.....*..Z..T.w.L..k...Ky....."L?..../.X.z.
o<.....?7}.D..d....e..^....'....}...bE.J%....2.N9.mm......h<.)".
..n0....L\....8..>.]....@}.q.A.'z...g.{q)....f.D.5...?..,*.=K..*...
... CN...G.I.J1...A....C... X..O.\...7.{E..z..t>...k...D..k...h..[k
C~<.z.y....nka.z.....`G>..[@.L\/[email protected]....,.O....q...Lh.[..m
[email protected]%Z.....,oo....?M..=..|&~/Y.F...[[.N....
u.=C3..#/...N(v.XE81I4...h.-U."..i.T...4.*:[email protected].;=.....
8.`.g3=..{.)>...6..#...|S^nf#g.z.s.K.........Y.cC...U;c^..6.:@vU...
i/..m....i..L....|s......x.....[.v1@...(.g...]...bP..Z...=.....D.D.HM.
Y.....IXk..8..j. ..ag$....n.....A'...O..._..v..,.G..`..!...rM..o.V
<<< skipped >>>

GET /includes/jscss/index.css?2014121516 HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Wed, 16 Jul 2014 15:59:48 GMT

ETag: "3660ad7-3a46-4fe519d15f738"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 3534

Keep-Alive: timeout=15, max=100

Connection: Keep-Alive

Content-Type: text/css
[email protected].......#.1E2.hm.0.,..E...o..4H...
$. .Q....rH.N..&lK..s?g.93.O.....=yz....%e.s5.b...Yt...%.s.b...e8.>
.!... k.W#...j.W.......8H....M.(....&AP`..Yz..$..Z.8..8.aN.E.G4..".t..
Y...K..%.."...qI.9..$Ip......Y...&...3._...x.c.....G...(.Y.7.Nb..i....
.X....6.K.F.. .bH..,.L...Y.0[Q.....Ytx.dED...4..$N)|.Hx.,.M..YAR.W.$..
I..Sx...q..O.....$..W.....,....d.d..........0..x...0......(....P.....,
IH^...p.^[email protected].....>.,..h............a.K
..............u....t.7.-...#.....0.........;Q.$=@*..6.......g.}e..M..r
._z.sT..&....u`(.=^...^.w..y<.r.q#..d.'..,.)z.f..[EL.....JN."3N....
...0....;"....THG.:.....t-.S..y........Jn.r....H~..`.4~.....<]..&..
kc..D.S.. d.z...1..V..^.F....t.d...9....7...=.. .Qe.|z...."v.......(..
...Dp2.....pY..R....D1.M..X...)..b..1..7...s=.IU.u....$..l._.S..9..&..
U5.A.x<I......?..".Z_........o.........'*...M..f.....d....X.......(
..}a..M...p.ue ...5.D9..j.}..s....k..k.n..(...:........"......k*..".X.
_.....#.J..T..,.d.X.=..@...).....3J)8....X...O.b.f..._itl.... ..uU....
mbu4R..T...DD.....3P.%q...jR.v].,..4.%..!2.aV.)1....) ..........$..<
;.....f6.....*...|..!....|.7~E..<....`e.n.NAc.P....er.i.a.L.T...$..
.&[.%^5r..... .I..=R...`./..F..VrU.........K....J.t.pY......S...}[%d..
.. n.... 3..~.......Nd(..(.2.!b...Q.-K3..?....M~W.9..t#zM.$.u<.p!..
e..4S.Z..Y.......f..a... \..ur.k.iH...8..J.fV.:..wE.Hn.D..~......}{...
[email protected]..<.Es..cJwK.<`.......m....g1..[..eW.-E...^mBF...N..
..9...o...gz!X.;g.}...........k..'..Ga.t6.2..gg...D.{...t..L:.6k..
<<< skipped >>>

GET /includes/jscss/ie9-10.css?2014121516 HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Wed, 16 Jul 2014 15:59:47 GMT

ETag: "3660ad6-86-4fe519d108a10"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 149

Keep-Alive: timeout=15, max=99

Connection: Keep-Alive

Content-Type: text/css
............R..x....../.P.2.].}........l.2..<]-.t......>.CnjJf.B
qrQjj.Bb^..Fnf.nyfJI..A...B5.gR~J%...../K-J../...R(.,.L.IUP..-./*I. ..
..Y.U....|.........


GET /includes/jscss/blocks.js?2014121516 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Wed, 16 Jul 2014 15:59:47 GMT

ETag: "3660ad4-471-4fe519d08c838"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 532

Keep-Alive: timeout=15, max=98

Connection: Keep-Alive

Content-Type: application/javascript
..........}.=o.0..g.W\....[r..A..K..I.z.2P..0.I......{.!.....A.=...T..
^0....=2.[C.%...J.N....f....g.V.)M.KI1y.G>/Ni.$G. 3oL..d.;.skN.....
n.K........T.L49*.Ex|A.".j.(.g..1...0T......6u.S.U..|dWE.N....<?.4.
......u-Xc.kLv .*.C|7b-.u!....9Dz..1.."y..K&..[S.X..Q9j.....RT....S.tJ
@......W.26t. q....R|..T..`{..: ..VNI..9._.Sb...G/S"w.....J.k...!...S.
....M.".P[D9x.9:v 1..<.......{.e...l....N.O.e.......Zu3...L..=y/Fp.
."..Vt/.t...v.c=...........t...|y.k\...J}...'........6..\..zX?x|....;#
...... ......1Rh......}..a...|...6&:..T.......Wq.......


GET /includes/vendors/jquery.dialog/jquery.dialog.css?2014121516 HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Fri, 21 Jun 2013 05:41:09 GMT

ETag: "3660b23-2fc-4dfa38284d65c"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 362

Keep-Alive: timeout=15, max=97

Connection: Keep-Alive

Content-Type: text/css
..........uR... .=._Ab6.&hm........(a.P.....J.......y3...r....*4_.....
..7...[.0a.7.R.x.&..p..AG.r.#.4A.7$?.h].s5A.,..^.EU..{...2.(FPc.....e.
}..V.t....:....UVS.. .{:t.;D~.!'....Q0..l(..%h.[..h..). ..W....d.../3.
....q.#.i..)cBU].>....,[email protected].#.K.....:H..*1..M..%../...6...3.
}..{...xQ.{.......`..Q(.......<.<...........~I..O^Z%u...6...08dy
._.h..?...>..z.S.....HTTP/1.1 200 OK..Date: Mon, 15 Dec 2014 16:40:
32 GMT..Server: Apache/2.2.16 (Debian)..Last-Modified: Fri, 21 Jun 201
3 05:41:09 GMT..ETag: "3660b23-2fc-4dfa38284d65c"..Accept-Ranges: byte
s..Vary: Accept-Encoding..Content-Encoding: gzip..Content-Length: 362.
.Keep-Alive: timeout=15, max=97..Connection: Keep-Alive..Content-Type:
 text/css............uR... .=._Ab6.&hm........(a.P.....J.......y3...r.
...*4_.......7...[.0a.7.R.x.&..p..AG.r.#.4A.7$?.h].s5A.,..^.EU..{...2.
(FPc.....e.}..V.t....:....UVS.. .{:t.;D~.!'....Q0..l(..%h.[..h..). ..W
....d.../3.....q.#.i..)cBU].>....,[email protected].#.K.....:H..*1..M..%.
./...6...3.}..{...xQ.{.......`..Q(.......<.<...........~I..O^Z%u
...6...08dy._.h..?...>..z.S.........


GET /products/afterinstall/15v/ijscss/mp.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

... ;..).........eb.U...d.......6hg'..C....IEND.B`.

GET /includes/vendors/projekktor/projekktor.min.js?2014121516 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Fri, 21 Jun 2013 05:41:23 GMT

ETag: "3660b41-1fbbc-4dfa38362eff5"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 33720

Keep-Alive: timeout=15, max=100

Connection: Keep-Alive

Content-Type: application/javascript
...........}iw.........N..#.AP..h.Kk..k.".%4..e....0........KuO..*.{/.
W..R.UwW..{........Y......lQ;<...~<~.....l.wko&.O.".e...Y..lQ..i
...^.A.......{.m.\.....>|h.M.f.vI.Of.O.|4^....Z.......E....4..acG.|
:....A..0.N2.L"a..LW.1-...]..l.-......$..^..lZd...;.R.X..9...l..>..
..0....:........e6]6......M2..G..A6..f.;.I;.4..k[.k../.....?.M....i...
ly....w..,..W.|...d.../.bv..g..x.C3I.w..E...i..?...l:Z.;y.._Wt/;.O..*.
....z...vt/k.K.7H.w...z9...<....%g..85..N..{..5..\q.".w..I...,.....
...<M...l.O.....z.<....Q...:B..).3...Q7..z...:6.7...Bd.Vv......N
.....h....i.O.ew..pv.9.%$.D....j..m1....fz5.......!5.F...^......i.B.\.
.G.?.r...f....P......`.r....N...Q.<.........i=...U1.....l...W.j....
...W.Y....p...v?...c............K.H...PU..<.Cw...G.................
`..........{.c....v....A.i.........h|..PFw2...$r.pn%.R...t...^...:%xE.
..U..{........t*......<.\....k4VqGM.%...Tn.....&E...t.oB..J.=......
.....=o5.b..5.d.v6}.u......1.G4 ...J.G|....G..}z}y....a.F.....V.K.D...
.G....#X.v..0...Qr9.*....{(.P&....S}u...#8..g..-.W....E..m.W]..,...u&N
S...."K.U.38..2[.......s..$/.x.[@<..0...'/. ).V.]v?>.t.E6.sI._.)
.kw.....u?aCG...#.".u`./.l.n>....*...Z><......UF[i..S.M.V7..7
7'..S......^Q..5..p..O..D...=m.p.~|=.G.?./u..x.g/[email protected]'.2......E
3....y..'[email protected]. ......G..X..bv9[f..sa-.a....aQ.eV......I....
...^......../."...G.'.}.......P>... @..|..............z....."i..X.-
.'<8....gm.-....N..I]..J.....lN....T...#,....I6l.....p|..h.....l868
...........G.>5....lp5.DH(..Vh.....X#O.i....K..8i@...>...p&l
<<< skipped >>>

GET /includes/mixins/phone-popup/phone-popup.css HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:33 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Fri, 10 Oct 2014 05:24:54 GMT

ETag: "3720006-33c-5050ac4e216ca"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 381

Keep-Alive: timeout=15, max=99

Connection: Keep-Alive

Content-Type: text/css
.............r. ....)..E..R....e.".D...All:y.....f...v.........Lc.g...
-.f. .8....Z:.^:.V.^..981.l.i}meY9.VCu.R..ehI.....;.v...d<?...]0.X.
4./2..0..?{6A...Fp....6.......hk....pU.~.2...~....i..9(...(..W..(.....
C........Ho....dK...w6.. .^.R...[..f.z<...Y..q7.-qLG....4.i.J:.....
3{......(]MD.....]X.(.1.LA~.sC.;...[.......X.7.J&..9e.;5{..0...s9h...L
!r....a2]..S9...K..W..uK...~.....<.......


GET /includes/i/l_header_tiny.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

.&.O....E...h9...........Wd..r..qh/B)......r...........{Q:.b.&jEM.....
2k...9...n.(.e...5i.. .....W...0k.1.6.3..%QCt4p...e....<'....('....
.`S..\#@}..$^\... [email protected]^.I@.!24t.P.D....].... ..7"....W.*2#......K
.f..]xv.(..Dv.i,...x.&.?'......P.....W..*q.M....*E>....V.L/.......G
......D.W..wi.3q..K0......7_...{..M.^ ...M....9.4...I8...*.4.mj.4."i..
......o../...[....r>../.3s1m.\..gb...(..........^.$.F.e",&.(6l..`..
y4!9._6...N%5..M...u>.8....9....SE.Fl..I.8f.?...m .=..w.........0t.
....X........n.........}0h97......3q.P=.uo?......n.O._$..i..qM.(...j..
...-..~O..,...}i.z:...R._G...{I.....%E..>.9!.....uu.....[^...f|..Z.
.j.yu.f.,2e&M...?.......6q.s..x........y3...c......&..B..#K...lX...1.g
.A...T....z.G.nV.I.....dff....=.......E:.zqH2#/3.^C&.C...B".rk.~......
....F_w..{....I........!......}.inEx.....a5....O..."x5...x1^..../.e,..
[email protected]$f.....A.......?....2ajY1>.....I...5.FK..
:.y4p.}..`. ..r...7.p.%\.d:~7S._=.._[k._.)@[email protected].
.%...o..}!.g........q.O...".......6tt..f..2.pw.Y.r..m..!..=aXU...h.h..
E.Z......4.....:'........U.;..`....*.0C....~L.O....#...&Dj...^.n.@.`..
..F..$.7.b...KK.0 ..sa!f..GPS......,.a..VWC.l...........9=]...c.i(.x..
c$k>.SG..'i..Cp......9.*4..& MI...,[email protected]....}..Kq......`.D.b...
..Y.E.& N4% h....%..e...L...CKs/lIZd...B.F..xj. .V...{.y.....S..o|....
[email protected]...?.Z...-.P.2.N.4...P^...9Z.U ..$".<..XKaHHFvn&\.6..zL..
S0l......O..\..5m.....sV.3g........-..e...~).7.M..k.........s....`][..
.......~o.....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1453

content-transfer-encoding: binary

Cache-Control: max-age=458536, public, no-transform, must-revalidate

Last-Modified: Sun, 14 Dec 2014 00:03:56 GMT

Expires: Sun, 21 Dec 2014 00:03:56 GMT

Date: Mon, 15 Dec 2014 16:44:49 GMT

Connection: keep-alive
0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....2014121
4000356Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20141214000356Z....20141221000356Z0...*.H........
........t.(:....I.m....0..C...1...5.....3.E._.'=.B...T0...&KN9..[.....
'......F....>..o"9T...Jn......]..K....`$_......Rb....K*...ln......F
.>/..^.V...]..]..a..2..QO .Jw>....4.Q6..;..S...%4......h.v%...VM
......}...on.=,...6..._..\p@4..<R...Pm..XkK..f7U.-...a....2B....0..
.0...0..3......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U.
...VeriSign, Inc.1705..U....Class 3 Public Primary Certification Autho
rity0...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symante
c Corporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Clas
s 3 PCA - G1 OCSP Responder Certificate 30.."0...*.H.............0....
......'......Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....
H..3-; ).....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M..
.T..pS.p..^|o....S..v.).)[email protected]#qh...u1T.].G0.]
E...=._...... ........TE...Sa.s4........r...3.............0..0...U....
0.0l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps
0(.. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U..
......0... .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H.....
........$..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e....
...a..D...........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :
,....
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=435338, public, no-transform, must-revalidate

Last-Modified: Sat, 13 Dec 2014 17:38:38 GMT

Expires: Sat, 20 Dec 2014 17:38:38 GMT

Date: Mon, 15 Dec 2014 16:44:49 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2014121
3173838Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20141213173838Z....20141220173838Z0...*.H........
........;....f...2H.:.v...h.n...1..N4.1..PppH[vj(....I..T.`..!.G..>
F.....OK..I.......U4.......qF3qe..'VB.n...X..#..."j:.?......... ..6{e.
_........l..|.....6...H.4z.Mw6....\.!..B..^A..e....;Gm.BqF.1...Y....L.
A...0.T...Tb...n.uC..3.$....^{[email protected]...........>...#0...0...0
..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U...
.VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of us
e at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Cod
e Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0
...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Term
s of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign C
lass 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0....
.....{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(.
.........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG
.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l.
...(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...
U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.veri
sign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS inco
rp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U..
......0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQCJu4vX6KBCDTazDOA5oCs6Cf2BAQUmeRAX2sUXj4F2d3TY1T8Yrj3AKwCEBt+MtuYCPo4TvlDVIWe6W8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca.com

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:35 GMT

Server: Apache/2.2.22 (Debian)

Last-Modified: Sun, 14 Dec 2014 23:06:10 GMT

Expires: Thu, 18 Dec 2014 23:06:10 GMT

ETag: 4494BC3958117BC57337DDB0515C50530638CB36

Cache-Control: max-age=281734,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: h6edcaocsp5

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0........@_k.^>....cT.b......2014
1214230610Z0s0q0I0... .........&./_...4..3.....'......@_k.^>....cT.
b.......~2....8N.CT...o....20141214230610Z....20141218230610Z0...*.H..
...........nE...$Or.1YQD>c.X.5'../..<..]..L...z ..@..>~......
..sD.........(. ....I..UD.AsXL.... .).P...4...P....R.&....[IEE....5S..
..)........T....g.h./k..V......{^..*"q.....1.\....#V.Iu........]..!*..
..Pz... 0..ju9.6..bDT.{r.c.8.........X..\.......>.........CG..g..D.
.

GET /s/opensans/v10/k3k702ZOKiLJc3WVjuplzBsxEYwM7FgeyaSgU71cLG0.woff HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Origin: hXXp://VVV.tweakbit.com

Accept-Encoding: gzip, deflate

Host: fonts.gstatic.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/woff

Last-Modified: Thu, 21 Aug 2014 18:08:07 GMT

Date: Tue, 09 Dec 2014 02:42:04 GMT

Expires: Wed, 09 Dec 2015 02:42:04 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

X-XSS-Protection: 1; mode=block

Age: 568709

Cache-Control: public, max-age=31536000

Content-Length: 98780

Alternate-Protocol: 80:quic,p=0.002
wOFF..............W.........................GDEF.............&..GPOS..
.....3...8.7.7GSUB............. =.OS/2.......`...`.u..cmap...,........
)./hcvt .......].....-..fpgm...p.........s.ugasp................glyf..
. ...?..K.....head...`...6...6....hhea....... ...$.).Rhmtx............
$...kern.......Z...6T .~loca..h........V..` maxp..o.... ... .5..name..
o<.........f{"post..q.......& .C.lprep...............kx.c`d``..b1 f
...W.I. ...........x.c`d``.b0a0c`.I,.c.`.``...Q`....U`.a`.....A.......
.x....._][email protected]?..m............Q..........O.6.......!d.e$sBa6AD.....
;.....w:..W.....D.M........ .0.Hb.'.T....z..."...I#=s...l47..3....j.6.
f.L...y2....y...........L.,..3.L)([email protected]..=.JK.......6....}..kN5..!...
.0....~Y...t..B..P>..O...!.....MiKW.2......R...X....Xy.U..6.m..g..#
..]. t....vvOo..7..o...Q.x....q.f.KY.rnr....!.e.L..Y ...w\.h7..kt=.H!D
..Zg.....t........K..o>.B.q(..@<i.Vj%.8.|..B..M,q..@"I$.B*i8D...
.6.Cl...V~w#.?]...w..............!....#.?...E.A?7..[.....x.s.={#.=^.jB
.................3.......3.....f..................@. [...(....1ASC. . 
...........X ........^..... ..x......1.../{r..V....m..m..m...m'.ml..xg
..........a..Fo....Q.=...X"...a..X6..f..qb9.....g.s.yB..BP8.GCi8...t..
.I......@>.o...".&r..b.. ..WqK.P2.....ej.Nf..e~.Zv...|.H.w..HnTW...
.M..../..."z1=.%..{........1... ..(fc?...,..k...* ~.D.(.i...._...x$..e
t.......6.........)z..b..'.[1d$.M....2.gq{ .g..~.W.,..........c......|
......c..f&....~G...3uM.42..w.....}.^.N...vB....W._.z..`.W.\..........
V..>...}z...;.....C...[*_.QO.n.@y*...".p....t....M.*......6,..m
<<< skipped >>>

GET /en/pc-support-bar/pc-support-bar-setup.exe HTTP/1.1

User-Agent: Auslogics Tools Updater

Connection: Keep-Alive

Cache-Control: no-cache

Host: static.tweakbit.com

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Content-Type: application/octet-stream

Content-Length: 6250304

Last-Modified: Thu, 11 Dec 2014 22:58:16 GMT

Connection: keep-alive

ETag: "548a2188-5f5f40"

Server: NetDNA-cache/2.2

Accept-Ranges: bytes
MZP.....................@.............................................
..!..L.!..This program must be run under Win32..$7....................
......................................................................
..............................................PE..L....WZR............
.........(............... [email protected]`...
[email protected]_.........
......................................................................
...............text...,........................... ..`.itext..D.......
.................... ..`.data........ [email protected]..
...V...0...........................idata..............................
@....tls.....................................rdata....................
..........@[email protected]............ ..............@..@................
....................@..@..............................................
......................................................................
[email protected]............
@...string([email protected]......@...............................@.....
.... 9@.([email protected]@[email protected]@[email protected]@..9@.,[email protected]@[email protected].%..A....%..A.
...%..A....%..A....%..A....%..A....%(.A....%..A....%$.A....%..A....%..
A....%..A....%..A....%..A....%|.A....%x.A....%t.A....%p.A....%l.A....%
h.A....% .A....%d.A....%`.A....%\.A....%..A....%..A....%..A....%X.A...
.%T.A....%..A....%..A....%..A....%P.A....%L.A....%H.A....%D.A....%@.A.
..S..........$D...T.J....D$,.t...\$0....D[..@..%<.A....%8.A....
<<< skipped >>>

GET /ads/user-lists/983311939/?fmt=1&num=7&cv=7&frm=0&url=http://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=210234104 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com

HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/user-lists/983311939/?fmt=1&num=7&cv=7&frm=0&url=http://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&random=210234104&ipr=y

Cache-Control: private, max-age=43200

Date: Mon, 15 Dec 2014 16:40:33 GMT

Expires: Mon, 15 Dec 2014 16:40:33 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 517

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/983311939/?fmt=
1&num=7&cv=7&frm=0&url=http://VVV.tweakbit.com/fix-m
y-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&
source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&t
raffic=affiliate_31095&random=210234104&ipr=y">here</A
>...</BODY></HTML>......

GET /products/afterinstall/15v/ijscss/index.css?20141211&2014121516 HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Thu, 11 Dec 2014 10:07:54 GMT

ETag: "38009a1-e8f-509edf32848a6"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 948

Keep-Alive: timeout=15, max=100

Connection: Keep-Alive

Content-Type: text/css
...........W...8...<......0@B.&.V.....`...13.].....p.O..M.$........
..U4....q....\...?.wR.TS.OH..5}"...fM%.&.,....U...'....m....:3..X.Z.79
.]"_..w.`B....`.QN...k.a............F5y..f.....H..6X])w.Q.2{.A`..M....
6qMpIT$k...F....h!.l,.....7...".`.....X......0.A{.PNw.M..<.P.......
...,).....B......>...;zS.1.......^.o....fl..)t..U..V..mdP.F....'...
uEZH...a.l>T.cOD..\..-......`.Po..%[email protected].?.z|@.,= pw~E....
w.~`.#..8s...K2.c.\.d.)..{..58....k<..P...0EC$G.k9h..&...Hw.F. .B.[
.....;.4../y8.=..'95........&.t.Tz.aN6.j|09..&~0..~.g{..'v?!.8...uBv..
].l...*. S.,.........,.XK._:.o;.Z..*..r..h%!e'.[...t...a1......R.`....
.n..*....... ...K.C.....Y.~..w.../g.L ..K.m6Tz...j-...[W.K..Bez,n...A.
..5#[email protected].._..v..LZSM" U.s...r...>...r....0.~rA......F.7.....
....*..z.p.....`.....x..F...<.e2...^..8;..,.o...5....p.......\..l..
\. LL\E..i;...J....]................{.H.4vq7Y..."...<..$.8...r,/.s.
.'.6V:....z..6.|HYD....-..c..</..yva..:E...4.9bo&;h.....E.....t>....


GET /includes/vendors/jquery.zoom/jquery.zoom.js?2014121516 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Fri, 21 Jun 2013 05:41:16 GMT

ETag: "3660b34-214-4dfa382f102f1"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 319

Keep-Alive: timeout=15, max=99

Connection: Keep-Alive

Content-Type: application/javascript
..........].QO.0......&..NdL...........>[email protected].\.
...5.'...R8.W..-.L&<,.I..f..X.a.t*....~1...g4......z.U..b}.....rn..
..|.a.B3.......9`e.A...%WXl......D...[...tH\......8..).X._x.S.....-.Mv
.@}'4..eC.....k....QOI.E$k...P.h&i.._.QB.....9*%.3g.?..0.QP.K%........
..iO.:.................V.wa......e...............


GET /products/afterinstall/15v/ijscss/index.js?2014121516 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Thu, 11 Dec 2014 10:07:54 GMT

ETag: "38009a2-19f-509edf3280708"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 282

Keep-Alive: timeout=15, max=98

Connection: Keep-Alive

Content-Type: application/javascript
..........}.AJ.0....)..A...^kE..[.:.i.^HB3-..........Bz#'..]....L.....
u....e......#?8.....I......... [email protected]@....
.sCy~.Y....m.aL........A..[...H..T.-.......h.....t".......Q...=?..t...
..1~...9....)..w...n2fVc.I..[.0C..H/....lP5..T\.p..:.a.3..&.D.........
..HTTP/1.1 200 OK..Date: Mon, 15 Dec 2014 16:40:32 GMT..Server: Apache
/2.2.16 (Debian)..Last-Modified: Thu, 11 Dec 2014 10:07:54 GMT..ETag: 
"38009a2-19f-509edf3280708"..Accept-Ranges: bytes..Vary: Accept-Encodi
ng..Content-Encoding: gzip..Content-Length: 282..Keep-Alive: timeout=1
5, max=98..Connection: Keep-Alive..Content-Type: application/javascrip
t............}.AJ.0....)..A...^kE..[.:.i.^HB3-..........Bz#'..]....L..
...u....e......#?8.....I......... [email protected]@.
....sCy~.Y....m.aL........A..[...H..T.-.......h.....t".......Q...=?..t
.....1~...9....)..w...n2fVc.I..[.0C..H/....lP5..T\.p..:.a.3..&.D......
.........


GET /products/afterinstall/15v/ijscss/ico-phone.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

N.l...m.4.t.8..........0o.9.....].`.h.......p....0..s..........=......
.%..O.t.Z.@......^...>.:F ....l..J4.}.....D,....H.$."9&.....kDJJ"L.
.H....e@CY>v./....0...I...<v...mG.a..9..h\}!.X.....9X.......Q&3v
....n...0.^QUJ...y.E.qx.wY..b.........8TSO...E.V(..r..Q......u.......V
..$..u...&..[......u6.....}.Q....y\r.%....C..1.......-Xt.M(Ug..SF.(...
..Q\Q...vC.7s[!K......R....%1.5r.../.."v.p.s.....=x.._x.o......:.....'
..j4G.........c........a.-..^y...jq.i"kv...z?~...:cD.........QkU..@...
 ._.......`.T....e%.X.z)...=l....^[..]...._#.G.......Nc....... .....J.
 ....&%b..m..j.l.......Pj.!9BI..R...0..F.......bd...~....X.).f..5?-...
&.&%p.._...r/esE...]c....Zl..b.iS.i..g..D.C...AO.`v...L......,...k....
gt/.....*`[email protected]..>..7.I.;.I..*..... K....mO
.......V...6..Z=.....L.J-..[.G;....V?TZ=..9..\{-.G....eII.^|.E.w.}....
v.... $.**ka.N......w.........MAP....];.........DZGu}#b.9h.~TW.B...=..
..a4..A.<....>.tz...P......}..]..k....H........Q.x.v.l>......
-&..B0A...#.b.....>..q....s......? >.@M......$..N..........}.s..
.M<.&.....N..@.#.K.&.<.Z#....%..t.."7.....:.....b.XW..WDb|..M.D.
X.P....TW...Gb\.?..#.v.....g.......g..%..g_YY..9..f-lt_L...$..;.G.k..H
....$...iLx=...Z.._..n[=|.[ ...cT"V|...<.q.M.I.s.....o-)/.]o.N}L...
.3.n......S.k....,.z.`.g....P..%..W."(...!.*J.,....z7..L.qpb;=.L>..
.,.....f!....Gbcd..,..0.....n...z7F.?..I...2........J.vr2..FR....$.=s.
al..|A..>.......F....h%<..33Y.C&.-.....lA.iZLh.I....bvy~..>..
.W.c..g."q...wi...I...o...Kj.L.......=h,[email protected].....
<<< skipped >>>

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com

HTTP/1.1 200 OK

Server: Apache

ETag: "bce5c8d9df4aeb0aabb75a86ac14984b:1418658620"

Last-Modified: Mon, 15 Dec 2014 15:50:20 GMT

Date: Mon, 15 Dec 2014 16:40:34 GMT

Content-Length: 966

Connection: keep-alive

Content-Type: application/pkix-crl
0...0.. 0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equ
ifax Secure Certificate Authority..141215154300Z..141225154300Z0...0..
..X...140427081922Z0....v...140618150003Z0........140429180917Z0......
..140709194633Z0........140416233935Z0........140521155053Z0.....)..14
0617185515Z0....Bf..120627171053Z0.....3..020515130611Z0........140811
090836Z0.....#..140606204021Z0........100729164439Z0....x...1405072040
01Z0........140606222139Z0....%...020514181157Z0....S...140423105438Z0
........120627171058Z0........140725020038Z0........100729164732Z0....
M\..140430000442Z0.....-..140617185011Z0....V...140624123102Z0....t6..
140425041720Z0........120627171025Z0........100301134531Z0........1406
18143256Z0........120627171017Z0.....>..140711125531Z0....[...10073
0213120Z0........120627171058Z0....j...140226123519Z0...*.H...........
.#k...m........2....13...b8`...w33b...;.....%..B..a.%...3.....).......
e>..y.z|%(..G..\Z<.eQ31..pQ=W.b............:.T.#.(.Jq..C.c.HTTP/
1.1 200 OK..Server: Apache..ETag: "bce5c8d9df4aeb0aabb75a86ac14984b:14
18658620"..Last-Modified: Mon, 15 Dec 2014 15:50:20 GMT..Date: Mon, 15
 Dec 2014 16:40:34 GMT..Content-Length: 966..Connection: keep-alive..C
ontent-Type: application/pkix-crl..0...0.. 0...*.H........0N1.0...U...
.US1.0...U....Equifax1-0 ..U...$Equifax Secure Certificate Authority..
141215154300Z..141225154300Z0...0....X...140427081922Z0....v...1406181
50003Z0........140429180917Z0........140709194633Z0........14041623393
5Z0........140521155053Z0.....)..140617185515Z0....Bf..12062717105
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com

HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1697

content-transfer-encoding: binary

Cache-Control: max-age=562401, public, no-transform, must-revalidate

Last-Modified: Mon, 15 Dec 2014 04:54:07 GMT

Expires: Mon, 22 Dec 2014 04:54:07 GMT

Date: Mon, 15 Dec 2014 16:44:50 GMT

Connection: keep-alive
0..........0..... .....0......0...0...A0?1=0;..U...4VeriSign Class 3 C
ode Signing 2004 CA OCSP Responder..20141215045407Z0s0q0I0... ........
[email protected].!......Q...==d6|h.[x....7..`..........cV.!.....201412
15045407Z....20141222045407Z0...*.H.............O.1.P*........i..]w.. 
..P.Z.....4....t#..LzE8>.4".....:..t9..eUg.U....1..J\=.'...I....?,.
mr. |4<I..!..........Vd...m. ......H[x.1H./........f).........}....
[email protected]....)>..Z..`$.p9.E..p...y..;4.n
^.o.........Q....p..3.,..Lz>...3.....0...0...0..{.........[..I|....
.Zm..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U..
..VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisig
n.com/rpa (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA0...140
428000000Z..150729235959Z0?1=0;..U...4VeriSign Class 3 Code Signing 20
04 CA OCSP Responder0.."0...*.H.............0.........Y....h..@..>.
....%.-.....O...' y.........x..Gw.xF.....?..Z..u,.X.&..........3C..H.l
.....f..;]s!.\"v...|....][email protected]. ..W..
..n..*..-f?EY.......UN...r...........-_.%..,P;b.....)(.P.4...,.%....&l
t;..6.....[r^X.EV..S...5#'Y.. .TD...........0...0...U.......0.0...U.%.
.0... .......0...U...........0... .....0......0f..U. ._0]0[..`.H...E..
..0L0#.. .........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.sym
cb.com/rpa0!..U....0...0.1.0...U....TGV-B-1080...U......"...?....`>
q..i1o...0...U.#..0.....Q...==d6|h.[x....70...*.H.............B8@.$..w
o......E.....P52"b*@'C\.y.(...n....h.f..7f.....v...pb<...]..|..
<<< skipped >>>

GET /pagead/conversion.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googleadservices.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 9603012329940890601

Date: Mon, 15 Dec 2014 09:02:19 GMT

Expires: Tue, 16 Dec 2014 09:02:19 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 4017

X-XSS-Protection: 1; mode=block

Age: 27493

Cache-Control: public, max-age=86400

Alternate-Protocol: 80:quic,p=0.002
...........Z.r.......PS.1b(..3..aU..8g.;'q&g..u.$D2.H.II.-..v....g.j.\
..h4.@_....W...q...5O:s..A.....U........n.s.....d.1.B.x....4...l.....D
d.$".......Br..m.<.STc..Y.s.Y.5K..3...0.T`.4.|."[email protected]...&..\.-.V
.[$.(.d.".2..#.... ...V..2...T/(..Iv.!=..".v......(a.>..R..../.m..7
..I%.U)T.<..0.......:.$.....h...*..Jq.;y.a...)....p..w.........H...
.8.....u8}dD>O/7..|..)....l.X.....|..tW.TM...40.X6.......{..Q.1H3..
d......5.....;.....Mp...Q........xX.i.'66u?p]....e".....G....f|..rc#..
 ..G.a..}.x&.[n,....z.D.l.....q(...LlF.Z.q|.y...P..UG..=uz=...1....l. 
.HG.....awM.k....l.xD7..j..............n.W...P....e..X.k.4.V.......pE.
...me..Jw;....`N....s......'..=.yV.. .....n....z.'.1W.6l...1|E..3.7...
...d.......lnD|.x<...\..~.a..U*......7......D..N...3B..o.K.....-...
..%.%'..>......>.U...g-.>}.p.#..G...mL.._...Y.1...-O.F .e....
..SR..|...m.h{I....6...^on`..EV.,'.k..0F...[8..X..[g.P.d}=...}M.Y.j.tk
.....\..d..n.5..;.Gl.K'.|...Av=......Z..5...6.O.h..f...1.......s...H,Q
F....O. .y|.O..J'*....ARM....Q#"1l6.Y..3H.E...Pw.O<9Q.'r.>q.~..j
...........Q(Gi.;.Sp'...2......C....I...0.h.....O<...C.Xh4. .5.(Z.@
....../"..|...|%..fRK...I..Ylx".".....H5.Z.y..l...x.j....5.>.....O%
e...W.....Y...aZ.q\Y....K.....c....*...v;..-X......q4.8......{......8L
....O..... [...r.KUvt.[..........H......1..i......-.8....*....^..5.a..
Y%......8L...m.[.m..0N......n..d~..<...|..[.....Qx.F.].I.O..e. ....
..,^..k.......m..,..?.........A.fs.../..`..{.a...T..R.."[email protected]
...-.1..4.....;...Rd).Y.1v.*..A.......K.F[./.....A.-...F..S.>..
<<< skipped >>>

GET /pagead/conversion/977141508/?random=1418661633300&cv=7&fst=1418661633300&num=1&fmt=2&label=nCPPCLnit1YQhP730QM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googleadservices.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 302 Found

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Date: Mon, 15 Dec 2014 16:40:33 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/977141508/?random=377541974&cv=7&fst=1418661633300&num=1&fmt=2&label=nCPPCLnit1YQhP730QM&bg=ffffff&hl=en&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=1&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095&vis=1&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 76

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.002
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....
h.?.....

GET /includes/vendors/jquery/jquery-1.9.1.min.js?2014121516 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.tweakbit.com

DNT: 1

Connection: Keep-Alive

Cookie: PHPSESSID=uot76tq31rhujijde2l7rt4ch6; E24AE960-E6CF-4F69-B37D-A4E5D4D3F7BD=1; source=1215164031_ab_7forumstest03_a-1215164031_affiliate_31095-

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:32 GMT

Server: Apache/2.2.16 (Debian)

Last-Modified: Fri, 21 Jun 2013 05:41:10 GMT

ETag: "3660b21-169d5-4dfa38292afb6"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 32775

Keep-Alive: timeout=15, max=100

Connection: Keep-Alive

Content-Type: application/javascript
............k{.F...}......f...d..(..c'..$v&vV...<[email protected]
."...>.9...4.~..{.<.....]R...;..e|z.?.......SE.O..._..l.Wi.....b
L...._.yqu.N.IV&.qr....|W,.o..6......H....x.o......e.T.'......Q...F..6
.WG...d....M.U*..u...Kz....=>R......l....c..*Z..yFE......Z].C.~. zJ
.er.j.6.z\.........:._.d...6).;......F]F.N.I. ..,.9...2.0..E..A.F'..h&
gt;.......x.\,..2K....z..'c.*u..\...\.7......b..._~yq.t2..[..(.K.F....
.n.~..........?..0.?..G'..e............9.......|..o.........1.|..P....
^..8.....k...z.]\\.\.....w..e<Z=.}9....P....7..y..l...W.....u....z.
..|.... . .j.)G'.yt2......%U_./@E......Y\&>..WN......r..;.G_.e.dI..
{.<^zQD..;....f.N.....H....*.............5.[.@p..~...M..i$...W.<
...i.|...Wjp...?;.Q..!..L.xq..|/..?%..........V.].u...4..o...1..^.e.Ut
TJZ.E.....N.....)g4U.Y...I`..:-...|~h.......4.>.Y...O .B...7..d'.Uu
=:.o..<.x:..Q.:......6Y...A........8...d.}6..L}z)....8e....3>?..
.sT.}...(.\q......l2.3Z.MR\%>...m\..Wo...K..:1..e...=....-.s...Sa..
. P..URV.....8-.].i....dQQ....,...e..~if....y0..~.7.U\UTHq..."..NL..*.
.X'...w/....y..........o.{<N..(.....N.7%...*..d....A.o..VQ...e.N0.Q
..&kR...(f*......1.I0-.Q....c...WtV[..G.h01O8...m..(.;_...7.B.S..p....
$t..;.........v=^..5w.....]0en...t8x....?.'..4s..&s...d~P...^-.6*..."w
.7N...z..\H..~..PUcy....*!......1..YA.A.R..T.T..M..M.}.....Q|S?4.v....
....4..W|.x.WiQV.U..F.....{..L....3..:.,.&C..(.4.....<...W....p....
lN..B.7=....[...\..fO.."XM...'..... ..w.#[email protected]^T..1~U..5. ?..E|.[.i
....u......."_,*U.....kG.`.'.nG.`]'..^[email protected]..
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRtl6lMY2+iPob4twryIF+FfgUdvwQUK8NGq7oOyWUqRtF5R8Ri4uHa/LgCEBBwnU/1VAjXMGAB2OqRdbs= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.usertrust.com

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:19 GMT

Server: Apache/2.2.22 (Debian)

Last-Modified: Mon, 15 Dec 2014 00:13:37 GMT

Expires: Fri, 19 Dec 2014 00:13:37 GMT

ETag: 2D34FB2857D27C3777325768E3F6A1CDA1109BBA

Cache-Control: max-age=285797,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: h6edcaocsp5

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0...... .F....e*F.yG.b.......2014121
5001337Z0s0q0I0... ........m..Lco.>..... _.~..... .F....e*F.yG.b...
.....p.O.T..0`....u.....20141215001337Z....20141219001337Z0...*.H.....
..............B{.2....(:...Y..6..m.=|q.......d....B.....G.C$...F...Ta.
.|.m.f...*..D....o.....!yf6#*.n.....L....|: ..d=... .(..T......N...J .
.........9g..G2XR.*....e.....t2..o...........g..-e<.....5T_..D0....
[email protected](.:cf|...^.F.J...1......vm...-|`...........

GET /en/pc-cleaner/16/pc-cleaner-setup.exe HTTP/1.1

User-Agent: Auslogics Tools Updater

Host: downloads.tweakbit.com

Connection: Keep-Alive

Cache-Control: no-cache

HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Mon, 15 Dec 2014 16:40:30 GMT

Content-Type: text/html

Content-Length: 154

Connection: keep-alive

Location: hXXp://static.tweakbit.com/en/pc-cleaner/16/pc-cleaner-setup.exe
<html>..<head><title>302 Found</title></hea
d>..<body bgcolor="white">..<center><h1>302 Found
</h1></center>..<hr><center>nginx</center&g
t;..</body>..</html>..HTTP/1.1 302 Moved Temporarily..Serv
er: nginx..Date: Mon, 15 Dec 2014 16:40:30 GMT..Content-Type: text/htm
l..Content-Length: 154..Connection: keep-alive..Location: hXXp://stati
c.tweakbit.com/en/pc-cleaner/16/pc-cleaner-setup.exe..<html>..&l
t;head><title>302 Found</title></head>..<body 
bgcolor="white">..<center><h1>302 Found</h1></
center>..<hr><center>nginx</center>..</body>
;..</html>....

GET /s/opensans/v10/DXI1ORHCpsQm3Vp6mXoaTRsxEYwM7FgeyaSgU71cLG0.woff HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Origin: hXXp://VVV.tweakbit.com

Accept-Encoding: gzip, deflate

Host: fonts.gstatic.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/woff

Last-Modified: Thu, 21 Aug 2014 18:09:27 GMT

Date: Tue, 09 Dec 2014 02:49:13 GMT

Expires: Wed, 09 Dec 2015 02:49:13 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

X-XSS-Protection: 1; mode=block

Age: 568280

Cache-Control: public, max-age=31536000

Content-Length: 97924

Alternate-Protocol: 80:quic,p=0.002
wOFF......~.......OH........................GDEF.............&..GPOS..
.....3...8.7.7GSUB............. =.OS/2.......]...`...Qcmap...,........
)./hcvt .......]........fpgm...p........~a..gasp...............#glyf..
........B...zUhead.......6...6.;..hhea....... ...$...$hmtx...0........
>.L kern.......Z...6T .~loca..d`.......V=Z..maxp..kx... ... .j..nam
e..k........- ...post..nL......& .C.lprep..}h.......:...]x.c`d``..b1 f
...W.I. ...........x.c`d``.b0a0c`.I,.c.`.``...Q`....U`.a`.....A.......
.x....._][email protected]?..m............Q..........O.6.......!d.e$sBa6AD.....
;.....w:..W.....D.M........ .0.Hb.'.T....z..."...I#=s...l47..3....j.6.
f.L...y2....y...........L.,..3.L)([email protected]..=.JK.......6....}..kN5..!...
.0....~Y...t..B..P>..O...!.....MiKW.2......R...X....Xy.U..6.m..g..#
..]. t....vvOo..7..o...Q.x....q.f.KY.rnr....!.e.L..Y ...w\.h7..kt=.H!D
..Zg.....t........K..o>.B.q(..@<i.Vj%.8.|..B..M,q..@"I$.B*i8D...
.6.Cl...V~w#.?]...w..............!....#.?...E.A?7..[.....x.s.={#.=^.jB
....x.c`fig.a`e.`..j...(.../2.1..`b.ffcfeabby.....A!...A............l.
.D.Z8z."......X.Y.........U...x......1.../{r..V....m..m..m...m'.ml..xg
..........a..Fo....Q.=...X"...a..X6..f..qb9.....g.s.yB..BP8.GCi8...t..
.I......@>.o...".&r..b.. ..WqK.P2.....ej.Nf..e~.Zv...|.H.w..HnTW...
.M..../..."z1=.%..{........1... ..(fc?...,..k...* ~.D.(.i...._...x$..e
t.......6.........)z..b..'.[1d$.M....2.gq{ .g..~.W.,..........c......|
......c..f&....~G...3uM.42..w.....}.^.N...vB....W._.z..`.W.\..........
V..>...}z...;.....C...[*_.QO.n.@y*...".p....t....M.*......6,..m
<<< skipped >>>

GET /css?family=Open Sans:300,300italic,400,400italic,700italic,700&subset=latin,cyrillic,latin-ext&2014121516 HTTP/1.1

Accept: text/css

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: fonts.googleapis.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Timing-Allow-Origin: *

Expires: Mon, 15 Dec 2014 16:40:32 GMT

Date: Mon, 15 Dec 2014 16:40:32 GMT

Cache-Control: private, max-age=86400

Content-Encoding: gzip

Content-Length: 418

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=0.02
............MS.0.......3.. -.. ...,RK/L.i..M%....][email protected].
..x....E..,........r....b..1.G.}e...Si...,'....c...=@'{...~*..~.....R&
[email protected]..\.'.&....<.n...G.k......C..;-X\. (.'].
,.J.)...k....'[.7`.............&.{T..7.b3.-...d.^?..P......^.v..~.>
..{..d.T"F..7... 7X......N...z$..n..9l.5".O....T`#..M.~.|&...9.....`O.
.Iw...Gq:?....A,.F...l..j..../...-.......A&...$.ugH\cL9l.M.x...~.o...%
....HTTP/1.1 200 OK..Content-Type: text/css..Timing-Allow-Origin: *..E
xpires: Mon, 15 Dec 2014 16:40:32 GMT..Date: Mon, 15 Dec 2014 16:40:32
 GMT..Cache-Control: private, max-age=86400..Content-Encoding: gzip..C
ontent-Length: 418..X-Content-Type-Options: nosniff..X-Frame-Options: 
SAMEORIGIN..X-XSS-Protection: 1; mode=block..Server: GSE..Alternate-Pr
otocol: 80:quic,p=0.02..............MS.0.......3.. -.. ...,RK/L.i..M%.
...][email protected]..,........r....b..1.G.}e...Si...,'...
.c...=@'{...~*[email protected]..\.'.&....<.n..
.G.k......C..;-X\. (.'].,.J.)...k....'[.7`.............&.{T..7.b3.-...
d.^?..P......^.v..~.>..{..d.T"F..7... 7X......N...z$..n..9l.5".O...
.T`#..M.~.|&...9.....`O..Iw...Gq:?....A,.F...l..j..../...-.......A&...
$.ugH\cL9l.M.x...~.o...%......
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEAdvEkaBRZwo1UjWl8QOABs= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.usertrust.com

HTTP/1.1 200 OK

Date: Mon, 15 Dec 2014 16:40:35 GMT

Server: Apache/2.2.22 (Debian)

Last-Modified: Mon, 15 Dec 2014 00:13:37 GMT

Expires: Fri, 19 Dec 2014 00:13:37 GMT

ETag: BCD3FE33A7F199735BFF0DACD8D9F451CC1EF932

Cache-Control: max-age=285781,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: h6edcaocsp5

Content-Length: 471

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0.........z4.&...&T....$.T...2014121
5001337Z0s0q0I0... ........|.fT...D.b&...e{.z.......z4.&...&T....$.T..
..o.F.E.(.H..........20141215001337Z....20141219001337Z0...*.H........
.....j,C. (...V....>=.....V....AO*...eT.H.Un#........%B...nf..../..
....J_...U.../...9...M..hk.9..,.\|..V.N5......B.J..e.6...U(..j.....u..
....=..8..h.9.....P\..5?.C..6i|.q.>.......{.y~.........R"fo.vw...V.
..A.h....8....}.*..3....qTx..x4DK.....7.z'...][[email protected]@=...

GET /s/opensans/v10/PRmiXeptR36kaC0GEAetxv25ds880Du_gFZbUlZlsbg.woff HTTP/1.1

Accept: */*

Referer: hXXp://VVV.tweakbit.com/fix-my-pc/afterinstall?csoffer=true&type=7forumstest03_install_a&source=fix-my-pc&campaign=affiliate_31095-ab_7forumstest03_a&traffic=affiliate_31095

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Origin: hXXp://VVV.tweakbit.com

Accept-Encoding: gzip, deflate

Host: fonts.gstatic.com

DNT: 1

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/woff

Last-Modified: Thu, 21 Aug 2014 18:08:25 GMT

Date: Tue, 09 Dec 2014 02:55:49 GMT