MD5: c56f92a5564909f359112aea862481ee
SHA1: 187ca566216ed26a0ee28c74ccc95fb1cfe83e1e
SHA256: 3738d1806654246a787fd81a76ed471b2b7ffa0923d3e7160d1c90e5a50a3492
SSDeep: 6144:3M/in98C/WvBJIzvGO8QC2Vk8nVG2CPRgLXM 1mq7kycl8dk3LNr6XoRDae8N5Y7:OC98CQnmGl23 gL8 13gyc6EZou ALR
Size: 735336 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: For Or
Created at: 2010-11-01 23:14:48
Analyzed on: WindowsXP SP3 32-bit

Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The Adware creates the following process(es):

regsvr32.exe:1496
ShopAtHome_Toolbar_Installer.exe:784
SelectRebates.exe:444
SelectRebatesDownload.exe:164
SelectRebatesDownload.exe:1852
%original file name%.exe:468

The Adware injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process ShopAtHome_Toolbar_Installer.exe:784 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\SelectRebates\FFToolbar\chrome\sahtoolbar.jar (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar (4 bytes)
%Program Files%\SelectRebates\FFToolbar\defaults\preferences\sahtoolbar.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar (4 bytes)
%Program Files%\SelectRebates\Toolbar\CashBack.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\GroceryCoupon.bmp (1 bytes)
%Program Files%\SelectRebates\SelectRebates.exe (6841 bytes)
%Program Files%\SelectRebates\Toolbar\ReviewSite.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\Scissors.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\logo_24.bmp (6 bytes)
%Program Files%\SelectRebates\FFToolbar\install.rdf (1 bytes)
%Program Files%\SelectRebates\Toolbar\logo_HotSpots.bmp (6 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-icons.bmp (8 bytes)
%System%\config\SOFTWARE.LOG (6075 bytes)
%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (5441 bytes)
%Program Files%\SelectRebates\Toolbar\logo.bmp (6 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-alert.bmp (1 bytes)
%Program Files%\SelectRebates\SelectRebatesApi.exe (673 bytes)
%Program Files%\SelectRebates\Toolbar\AddtoList.bmp (1 bytes)
%Program Files%\SelectRebates\FFToolbar\chrome.manifest (271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\C81R815U.tmp (146 bytes)
%Program Files%\SelectRebates\Toolbar\i_magnifying.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\icons.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-wishlist.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.ini (2836 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-restaurant.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-grocerycoupons.bmp (1 bytes)
%Program Files%\SelectRebates\SRFF3.dll (673 bytes)
%Program Files%\SelectRebates\Toolbar\basis.xml (20 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-go.bmp (1 bytes)
%Program Files%\SelectRebates\SelectAlerts.dat (1 bytes)
%System%\config\software (3822 bytes)
%Program Files%\SelectRebates\SelectRebates.ini (12195 bytes)
%Program Files%\SelectRebates\SelectRebatesUninstall.exe (1425 bytes)
%Program Files%\SelectRebates\SelectRebatesDownload.exe (673 bytes)
%Program Files%\SelectRebates\Toolbar\Blank.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\Coupons.bmp (1 bytes)
%Program Files%\SelectRebates\SRebates.dll (673 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebates_.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-wishlist.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_HotSpots.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\basis.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.cab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome\sahtoolbar.jar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-alert.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\icons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-go.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_24.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults\preferences\sahtoolbar.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome.manifest (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRebates_.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\ReviewSite.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\install.rdf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUninstall_.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Blank.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-icons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\ShopAtHomeToolbar_.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-grocerycoupons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\CashBack.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\SelectAlerts.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\i_magnifying.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesApi_.exe (0 bytes)
%Program Files%\SelectRebates\FFToolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults\preferences (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\GroceryCoupon.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\toolbar.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-restaurant.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRFF3_.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Coupons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Scissors.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\AddtoList.bmp (0 bytes)

The process SelectRebates.exe:444 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\SelectRebates\srtmpsquqe4ti044.tmp (4 bytes)
%Program Files%\SelectRebates\SelectRebatesBT.dat (16 bytes)
%Program Files%\SelectRebates\srtmpprfp29oh9d9.tmp (2 bytes)
%Program Files%\SelectRebates\SelectAlerts.dat (7 bytes)
%Program Files%\SelectRebates\srtmpprf9cv0vhs2.tmp (2 bytes)
%Program Files%\SelectRebates\SelectRebates.ini (167132 bytes)
%Program Files%\SelectRebates\SelectRebatesB.dat (7345 bytes)
%Program Files%\SelectRebates\srtmpgfid1mlfets.tmp (7277 bytes)
%Program Files%\SelectRebates\srtmpsquvkbh9m3i.tmp (6 bytes)
%Program Files%\SelectRebates\SelectRebatesA.dat (6 bytes)
%Program Files%\SelectRebates\srtmpprfhha4mm4u.tmp (2 bytes)

The Adware deletes the following file(s):

%Program Files%\SelectRebates\srtmpsquqe4ti044.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpprfp29oh9d9.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpprf9cv0vhs2.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpprfhha4mm4u.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpgfid1mlfets.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpsquvkbh9m3i.tmp (0 bytes)

The process SelectRebatesDownload.exe:164 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\toolbar5200_ff.cab (172089 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.cab (235057 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2DMGHG1K.tmp (460 bytes)

The process SelectRebatesDownload.exe:1852 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\SelectRebates\srtmpsquqe4ti044.tmp (460 bytes)
%Program Files%\SelectRebates\srtmpprfp29oh9d9.tmp (1 bytes)
%Program Files%\SelectRebates\srtmpprf9cv0vhs2.tmp (1 bytes)
%Program Files%\SelectRebates\srtmpprfhha4mm4u.tmp (25 bytes)
%Program Files%\SelectRebates\srtmpgfid1mlfets.tmp (120137 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installstatus.tmp (72 bytes)

The process %original file name%.exe:468 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebates_.exe (17138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-wishlist.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_HotSpots.bmp (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\basis.xml (1347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome\sahtoolbar.jar (3689 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\toolbar.ini (115 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\icons.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-go.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ShopAtHome_Toolbar_Installer.exe (189 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_24.bmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults\preferences\sahtoolbar.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUpdater.exe (2128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\GroceryCoupon.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome.manifest (271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRebates_.dll (3624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\ReviewSite.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUninstall_.exe (7104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Blank.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-icons.bmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\desktop.ini (159 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\ShopAtHomeToolbar_.dll (13304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\C81R815U.tmp (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-grocerycoupons.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\CashBack.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\SelectAlerts.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.ini (4683 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\i_magnifying.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesApi_.exe (2804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-alert.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\KOI6MES5.exe (173 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-restaurant.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo.bmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRFF3_.dll (3553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Coupons.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Scissors.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\AddtoList.bmp (1 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\KOI6MES5.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\C81R815U.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUpdater.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ShopAtHome_Toolbar_Installer.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installstatus.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar5200_ff.cab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2DMGHG1K.tmp (0 bytes)

Registry activity

The process regsvr32.exe:1496 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\ShopAtHome\Toolbar]
"EditWidthcombo1" = "1"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\TypeLib]
"(Default)" = "{462E4AEC-DB3B-4e69-AF61-4F300D76255C}"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\VersionIndependentProgID]
"(Default)" = "ShopAtHome.IEToolbar"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\InprocServer32]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll"

[HKCU\Software\ShopAtHome\Toolbar]
"KeepHistory" = "1"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0\HELPDIR]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\"

[HKCU\Software\ShopAtHome\Toolbar]
"RunSearchDragAutomatically" = "1"
"corruptedMsg" = "One of the XML files is corrupted or invalid. Press OK to uninstall."
"lastVersionMsg" = "You have the latest version of the ShopAtHome Toolbar."
"ShowExternalSearches" = "1"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\VersionIndependentProgID]
"(Default)" = "ToolBand.ShopAtHomeIEHelper"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}" = "00"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\ToolBand.ShopAtHomeIEHelper\CLSID]
"(Default)" = "{E8DAAA30-6CAA-4b58-9603-8E54238219E2}"

[HKCR\ToolBand.ShopAtHomeIEHelper.1\CLSID]
"(Default)" = "{E8DAAA30-6CAA-4b58-9603-8E54238219E2}"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\ProgID]
"(Default)" = "ShopAtHome.IEToolbar.1"

[HKCU\Software\ShopAtHome\Toolbar]
"PopStop" = "Untitled Toolbar has blocked a Pop-up window"

[HKCR\ToolBand.ShopAtHomeIEHelper]
"(Default)" = "ShopAtHomeIEHelper Class"

[HKCU\Software\ShopAtHome\Toolbar]
"autoUpdateMsg" = "New version of ShopAtHome Toolbar is available. Would you like to download and install new version?"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0\0\win32]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll"

[HKCR\ShopAtHome.IEToolbar\CLSID]
"(Default)" = "{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}"

[HKCU\Software\ShopAtHome\Toolbar]
"firstTime" = "1"
"ErrorMsg" = "Error"
"#EditWidthcombo1#" = "Widthcombo11"
"versionError" = "Can not find current version information."
"UpdateAutomatically" = "0"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\ProgID]
"(Default)" = "ToolBand.ShopAtHomeIEHelper.1"

[HKCU\Software\ShopAtHome\Toolbar]
"DescriptiveText" = "1"
"OpenNew" = "0"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}]
"(Default)" = "ShopAtHomeIEHelper Class"

[HKCU\Software\ShopAtHome\Toolbar]
"AutoComplete" = "1"
"closeAllWindowsForUpdate" = "All running IE Windows will be closed before updating the ShopAtHome Toolbar. Continue?"
"RunSearchAutomatically" = "1"
"toolbar_version" = "undefined"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}]
"(Default)" = "ShopAtHome.com Toolbar"

[HKCU\Software\ShopAtHome\Toolbar]
"updateMsg" = "This will try to update the ShopAtHome Toolbar from the server. Continue?"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 7E 43 1B 8F CB D2 51 18 1E 0E EB 6A 9D 8F B5"

[HKCU\Software\ShopAtHome\Toolbar]
"toolbar_id" = "{E3D4FC6E-C7C8-47ad-8C33-2C0CB3540EDB}"

[HKCR\ShopAtHome.IEToolbar.1]
"(Default)" = "ShopAtHome.com Toolbar"

[HKCU\Software\ShopAtHome\Toolbar]
"contextMenuItemName" = "ShopAtHome Toolbar search"

[HKCR\ShopAtHome.IEToolbar.1\CLSID]
"(Default)" = "{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}"

[HKCU\Software\ShopAtHome\Toolbar]
"ShowFindButtons" = "0"

[HKCR\ToolBand.ShopAtHomeIEHelper\CurVer]
"(Default)" = "ToolBand.ShopAtHomeIEHelper.1"

[HKCR\ShopAtHome.IEToolbar]
"(Default)" = "ShopAtHome.com Toolbar"

[HKCR\ToolBand.ShopAtHomeIEHelper.1]
"(Default)" = "ShopAtHomeIEHelper Class"

[HKCR\ShopAtHome.IEToolbar\CurVer]
"(Default)" = "ShopAtHome.IEToolbar.1"

[HKCU\Software\ShopAtHome\Toolbar]
"AlertMsg" = "Alert"
"uninstallMsg" = "This will remove the ShopAtHome Toolbar from your computer! Are you sure?"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0]
"(Default)" = "ShopAtHome Toolbar 1.0 Type Library"

[HKCU\Software\ShopAtHome\Toolbar\tb_items]
"Widthcombo11" = "1"

[HKCU\Software\ShopAtHome\Toolbar]
"connectionError" = "Can't establish a connection."

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\TypeLib]
"(Default)" = "{462E4AEC-DB3B-4e69-AF61-4F300D76255C}"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\InprocServer32]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\InprocServer32]
"ThreadingModel" = "Apartment"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}]
"(Default)" = "ShopAtHomeIEHelper"

The Adware deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations"

The process ShopAtHome_Toolbar_Installer.exe:784 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 1B 4B 91 28 7C CA C0 5C 71 C3 07 4A F4 FC 62"

[HKCU\Software\ShopAtHome\Toolbar]
"TBHideFirst" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ShopAtHome_Toolbar_Installer.exe,"

[HKLM\SOFTWARE\ShopAtHome\SelectRebates]
"SelectRebatesLocation" = "%Program Files%\SelectRebates\SelectRebates.exe"

[HKCU\Software\ShopAtHome\Toolbar]
"TBShowOnce" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"UninstallString" = "%Program Files%\SelectRebates\SelectRebatesUninstall.exe"
"DisplayName" = "ShopAtHome.com Toolbar"

To automatically run itself each time Windows is booted, the Adware adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SelectRebates" = "%Program Files%\SelectRebates\SelectRebates.exe"

The Adware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"DisplayIcon"
"Publisher"
"HelpLink"
"URLUpdateInfo"

"URLInfoAbout"

The Adware disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SAHAgent"

The process SelectRebates.exe:444 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 45 1D 4B 43 C0 2A B4 25 CC DB 08 AD E7 80 19"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"UninstallString" = "%Program Files%\SelectRebates\SelectRebatesUninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"DisplayName" = "ShopAtHome.com Toolbar"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"DisplayIcon"
"Publisher"
"HelpLink"

[HKLM\SOFTWARE]
"test"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"URLUpdateInfo"
"URLInfoAbout"

The process SelectRebatesDownload.exe:164 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 6F BE E4 7A 9B 26 1C 04 66 1E 8A 90 21 8C 7B"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SelectRebatesDownload.exe:1852 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 4A 37 4A D9 74 ED 62 75 C4 A5 5D 54 A6 FD 07"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process %original file name%.exe:468 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 B9 84 0A 56 A6 6C B6 07 DC A5 13 A6 10 BC C4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version: 5, 2, 0, 0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 5, 2, 0, 0
File Description:
Comments:
Language: English (United Kingdom)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 4
7c40047b2eaa3134e4f422ff3bc99685
aacfe8b716110218ca2e2823f57b9a0d
acf3d9de64451615f5af37bd76bcb844
ea1fbc75a22d0a4f85a13c5d3258c0af

URLs

URL	IP
hxxp://tbws.shopathome.com/RequestHandler.ashx?MfcISAPICommand=set&param= I-7cOM4DjEMHro-mFEESbqRzRRe6jzF6TSyknmmJRZ3MnOnMxU-cDDjXvKLw7jRpwn9NDNma30SQn6LxQzCoGuJgX-ahxDwW62-2Ce-cg8g8YE_OCsHQQ8736qtlvmM6TCLrYSSElIz6S2OqQqUa-knmlJhNeRQf2QF3Q0LZwEA7R-76JzV15FXe3oHwQD6Qbjq5j40GG2mNXCZUq7tdEjcKw3GDqr-vYLdMN41bx5PRVEKP1jEYAVjdx4jFhOS4NR-9R33VIMJWbW-kribLlP13Wd5qILkRoiUU3uqsMcPvng7FUDgwG1NIU7QPBFOKTqWe2MwLpXUjIi7A_MItAm	74.63.145.160
hxxp://toolbar.shopathome.com/install/setup5200.cab	74.63.145.172
hxxp://toolbar.shopathome.com/install/toolbar5200_ff.cab	74.63.145.172
hxxp://www.shopathome.com/agent/agentprefs_.sah	74.63.145.186
hxxp://gs1.wpc.v2cdn.net/agent/toolbarprefs.sah
hxxp://tbws.shopathome.com/RequestHandler.ashx	74.63.145.160
hxxp://gs1.wpc.v2cdn.net/agent/bce_.sah
hxxp://tbws.shopathome.com/RequestHandler.ashx?MfcISAPICommand=installstatus&param=Ø frtXFiqIX4GbgcJxPRH7be0DduJjehBXcU_ijoe_Yk7184KcM5uMOzy6qgQ684qQN_n1tdMvaDFMnOnMxU-cDDjXvKLw7jRpwn9NDNma30SQn6LxQzCoGuJgX-ahxDwW62-2Ce-cg8g8YE_OCsHQQ8736qtlvmM6TCLrYSSElIz6S2OqQqUa-knmlJhNeRQf2QF3Q0LZwEA7R-76JzV15FXe3oHwQD6Qbjq5j40GG2mNXCZUq7tdEjcKw3GDqr-vzD5TotpEF7iYYlqFkcm-aD7dpavkYcG9YpKNqIlcgyB6Risamc1F0eaIAWSnsPcHJ0xjWSJbFUy_KyFcciHxaWioGx1EfKzFuZ4-jsCQ8XUKnLtXXXGsw-ii0iXC2dehnUrgz5sxvXgMvuiftqIYSXVi__8vO87lB9Ngznf4KWUzLgnUScExyCLHDYkBNQNk07Re3RlqcnNK1MxRpsSXTswdoM9PV6j0CtRMiX8AemJwAnlQ1Vx59ZQJc7rj4O63gLg8YzxiLLc18B42VkQgOfsJ3WF8JlrciICqgt9c1gdbKighhbvM_ciEHWZZQU_9fAYNGr0tur-n8pIhScO6gPHsO77JAkN5WMzg9Z-P1ZLg4ZqpfHegmW	74.63.145.160
hxxp://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=	74.63.145.186
hxxp://googleadapis.l.google.com/css?family=Roboto:300,700,400|Fjalla One|Noticia Text:400italic
hxxp://e250.b.akamaiedge.net/js/rac/sli-rac.1.3.css
hxxp://cs227.wac.edgecastcdn.net/Content/SiteCssWebformsBundle?v=47
hxxp://svip-usa7.sli-systems.net/rac/sli-rac.css?rev=148249
hxxp://gstaticadssl.l.google.com/s/fjallaone/v4/rxxXUYj4oZ6Q5oDJFtEd6lQlYEbsez9cZjKsNMjLOwM.eot
hxxp://gstaticadssl.l.google.com/s/noticiatext/v6/dAuxVpkYE_Q_IwIm6elsKDoGYR7Z3iWH66EXnaJoKgg.eot
hxxp://cs227.wac.edgecastcdn.net/js/html5shiv.js
hxxp://gstaticadssl.l.google.com/s/roboto/v15/5YB-ifwqHP20Yn46l_BDhA.eot
hxxp://cs227.wac.edgecastcdn.net/js/tipped/excanvas/excanvas.js
hxxp://cs227.wac.edgecastcdn.net/js/CombinedJS_16C48997C531D7EDA08CDC195581896D.js
hxxp://www.shopathome.com/WebResource.axd?d=utXq0EopSmH_wSGx3BdZvDyYLpS5Ff55sDuYcl5aUvI_mXIJL5BpykW6xvZro8cCJWqYDkZtKLBu4ajxaGC76D-cQPk1&t=635418424260000000	74.63.145.186
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://e6640.g.akamaiedge.net/js/91114986.js
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j37&a=1859351553&t=pageview&_s=1&dl=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&dp=/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&sahusertype=nonauth&ul=en-us&de=utf-8&dt=Toolbar&sd=32-bit&sr=1276x846&vp=1256x669&je=0&fl=11.6 r602&cn=960117215&cm=91125&_u=QEAAAEAAK~&jid=2074980047&cid=1409388095.1434955669&tid=UA-2915199-1&_r=1&z=588593829
hxxp://www.shopathome.com/datalayer.min.js	74.63.145.186
hxxp://cs145.wpc.edgecastcdn.net/images/background_sah_2014.jpg
hxxp://www.shopathome.com/dlhelpers.js	74.63.145.186
hxxp://www.shopathome.com/datalayerconfig.js?u=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=	74.63.145.186
hxxp://www-googletagmanager.l.google.com/gtm.js?id=GTM-TWR3HX&l=gtm
hxxp://cs227.wac.edgecastcdn.net//js/browserdetection.js
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j37&a=1859351553&t=pageview&_s=1&dl=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&ul=en-us&de=utf-8&dt=Toolbar&sd=32-bit&sr=1276x846&vp=1256x669&je=0&fl=11.6 r602&_u=SECAAEAAK~&jid=1920325723&cid=1409388095.1434955669&tid=UA-2915199-69&_r=1&gtm=GTM-TWR3HX&z=1571068651
hxxp://cs227.wac.edgecastcdn.net/js/jquery.browser.js
hxxp://cs227.wac.edgecastcdn.net//js/toolbar/toolbarutilities.js
hxxp://cs227.wac.edgecastcdn.net/js/jquery-ui-1.10.3/themes/smoothness/jquery-ui.min.css
hxxp://cs227.wac.edgecastcdn.net/js/jquery-ui-1.10.3/ui/minified/jquery-ui.min.js
hxxp://cs227.wac.edgecastcdn.net/styles/tbpi.css
hxxp://cs145.wpc.edgecastcdn.net/images/merchants-computer-screen.png
hxxp://cs145.wpc.edgecastcdn.net/images/circle-step-1.png
hxxp://cs145.wpc.edgecastcdn.net/images/chrome-example-window.png
hxxp://cs145.wpc.edgecastcdn.net/images/ie-example-window.png
hxxp://cs145.wpc.edgecastcdn.net/images/circle-step-2.png
hxxp://cs145.wpc.edgecastcdn.net/images/btn-continue-to-coupons-orange.png
hxxp://cs145.wpc.edgecastcdn.net/images/bttn_continueshopping.png
hxxp://cs145.wpc.edgecastcdn.net/images/button-continue-for-great-coupons.jpg
hxxp://www.shopathome.com/images/bttn-claim-shopgold.png	74.63.145.186
hxxp://cs145.wpc.edgecastcdn.net/Images/landing/machine-and-animation1.gif
hxxp://e54.g.akamaiedge.net/meter/www.shopathome.com/32.gif
hxxp://data.solvemedia.com/dapi/collect	8.20.87.8
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://data.solvemedia.com/dapi/data?type=html;sid=2wtw;ea=sm1;hema=H1:c60ef57601cd523f0739ed10bb37b82989c67264,H2:5da30ffb179f33b498a1065abad15d0c77b4fdf3,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:0e13aa58ada0f7cb73f006e69d2ab632,H5:2bc3adfd94e5e4177b007f850ef66489;_t=1434955671223	8.20.87.8
hxxp://pagead.l.doubleclick.net/pagead/conversion/1071192949/?random=1434955671364&cv=7&fst=1434955671364&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=1396043444&utmhn=www.shopathome.com&utmcs=utf-8&utmsr=1276x846&utmvp=1256x669&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Toolbar&utmhid=1859351553&utmr=-&utmp=/1394716560/goal&utmht=1434955671457&utmac=UA-2915199-5&utmcc=__utma=57828200.1409388095.1434955669.1434955671.1434955671.1;+__utmz=57828200.1434955671.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=10251946&utmredir=1&utmu=DACAAAAAAAAAAAAAAAABAAAE~
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/1071192949/?random=624130316&cv=7&fst=1434955671364&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&ocp_id=lq-HVbPIMMOJ8wPCx4GABg
hxxp://cs145.wpc.edgecastcdn.net/images/global-sprite2.png
hxxp://spdc-global.pbp.gysm.yahoodns.net/spp.pl?a=1000742424085&.yp=7164&js=no
hxxp://www.google.com/ads/user-lists/1071192949/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&random=1295422861	216.58.209.196
hxxp://data.solvemedia.com/dapi/data?type=html;sid=2wtw;ea=sm1;hema=H1:c60ef57601cd523f0739ed10bb37b82989c67264,H2:5da30ffb179f33b498a1065abad15d0c77b4fdf3,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:0e13aa58ada0f7cb73f006e69d2ab632,H5:2bc3adfd94e5e4177b007f850ef66489;_t=1434955671223;cm=1	8.20.87.8
hxxp://fd-world.ngd.gysm.yahoodns.net/pixel?id=2285230&t=2
hxxp://gstaticadssl.l.google.com/ads/user-lists/1071192949/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&random=1295422861&ipr=y
hxxp://c.global-ssl.fastly.net/nr-632.min.js
hxxp://a1945.g.akamai.net/j/roundtrip.js
hxxp://adservers-users-4-181763155.eu-west-1.elb.amazonaws.com/pixel/77I5CH5ZEZFNVPMSE3MTAA/ONW3GFE3ZNGOPDPAXKOR5I?pv=61806223177.91205&cookie=&keyw=&adroll_external_data=customer_type=nonauth&registration_user=&refer_code=91125&source_code=REBATE&brand=ToolbarPostInstall
hxxp://a1945.g.akamai.net/pixel/77I5CH5ZEZFNVPMSE3MTAA/ONW3GFE3ZNGOPDPAXKOR5I/HR3E4M74MREKJACLTHVERQ.js
hxxp://bam.nr-data.net/1/eabd37c669?a=442317&pl=1434955667676&v=632.2b17625&to=YlVRZxFXX0VWVkMPDVsfcmAzGUVZWFlVBxBFX0BHClhCQlZZW0gDRkBL&ap=7&fe=4250&dc=4235&tt=48D7134DDF395B1D&f=[]&jsonp=NREUM.setToken	50.31.164.165
hxxp://adservers-users-4-181763155.eu-west-1.elb.amazonaws.com/cm/r/out
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/0/?label=null&guid=ON&script=0&ord=6450794183058108
hxxp://adservers-users-4-181763155.eu-west-1.elb.amazonaws.com/cm/b/out
hxxp://adservers-users-4-181763155.eu-west-1.elb.amazonaws.com/cm/f/out
hxxp://www.google.com/ads/user-lists/0/?label=null&script=0&random=799290124	216.58.209.196
hxxp://www.google.com/ads/user-lists/0/?label=null&script=0&random=910929902	216.58.209.196
hxxp://gstaticadssl.l.google.com/ads/user-lists/0/?label=null&script=0&random=799290124&ipr=y
hxxp://adservers-users-4-181763155.eu-west-1.elb.amazonaws.com/cm/w/out
hxxp://ib.anycast.adnxs.com/seg?add=2518433&t=2
hxxp://ib.anycast.adnxs.com/seg?add=3033413&t=2
hxxp://star.c10r.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZGUxOWU5MWFjMjRhNWU1MjBlYTYxMzdhZWRkZDcxMjU
hxxp://gstaticadssl.l.google.com/ads/user-lists/0/?label=null&script=0&random=910929902&ipr=y
hxxp://fd-world.ngd.gysm.yahoodns.net/pixel?id=2498203&t=2&piggyback=http://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1
hxxp://adservers-users-4-181763155.eu-west-1.elb.amazonaws.com/cm/x/out
hxxp://adservers-users-4-181763155.eu-west-1.elb.amazonaws.com/cm/l/out
hxxp://ib.anycast.adnxs.com/bounce?/seg?add=3033413&t=2
hxxp://ib.anycast.adnxs.com/bounce?/seg?add=2518433&t=2
hxxp://x.bidswitch.net/sync?dsp_id=44&user_id=ZGUxOWU5MWFjMjRhNWU1MjBlYTYxMzdhZWRkZDcxMjU	23.251.130.39
hxxp://adservers-users-4-181763155.eu-west-1.elb.amazonaws.com/cm/o/out
hxxp://fd-world.ngd.gysm.yahoodns.net/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1
hxxp://adservers-users-4-181763155.eu-west-1.elb.amazonaws.com/cm/g/out?google_nid=adroll5
hxxp://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=ZGUxOWU5MWFjMjRhNWU1MjBlYTYxMzdhZWRkZDcxMjU	23.251.130.39
hxxp://adservers-users-4-181763155.eu-west-1.elb.amazonaws.com/cm/r/in?xid=PuhqTm9ZIctcgIjqlix2sts3
hxxp://idsync-ext.rlcdn.com/377928.gif?partner_uid=de19e91ac24a5e520ea6137aeddd7125
hxxp://pug22000.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=4b48b2a8-27b1-4415-a100-95ca708c87e0
hxxp://prod-mkt-d.d.xx.openx.com.akadns.net/w/1.0/sd?id=537103138&val=de19e91ac24a5e520ea6137aeddd7125
hxxp://idsync-ext.rlcdn.com/377928.gif?partner_uid=de19e91ac24a5e520ea6137aeddd7125&redirect=1
hxxp://prod-mkt-d.d.xx.openx.com.akadns.net/w/1.0/sd?cc=1&id=537103138&val=de19e91ac24a5e520ea6137aeddd7125
hxxp://www.google.com.ua/ads/user-lists/0/?label=null&script=0&random=910929902&ipr=y	216.58.209.195
hxxp://j2.sahcdn.com/js/tipped/excanvas/excanvas.js	68.232.35.51
hxxp://images.sahcdn.com/images/background_sah_2014.jpg	93.184.221.172
hxxp://fonts.googleapis.com/css?family=Roboto:300,700,400|Fjalla One|Noticia Text:400italic	173.194.71.95
hxxp://ads.yahoo.com/pixel?id=2285230&t=2	217.163.21.35
hxxp://d.adroll.com/cm/l/out	54.195.255.141
hxxp://d.adroll.com/cm/r/in?xid=PuhqTm9ZIctcgIjqlix2sts3	54.195.255.141
hxxp://ib.adnxs.com/seg?add=3033413&t=2	37.252.162.89
hxxp://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=4b48b2a8-27b1-4415-a100-95ca708c87e0	198.47.127.15
hxxp://images.sahcdn.com/images/global-sprite2.png	93.184.221.172
hxxp://d.adroll.com/cm/r/out	54.195.255.141
hxxp://images.sahcdn.com/images/chrome-example-window.png	93.184.221.172
hxxp://j2.sahcdn.com/js/jquery.browser.js	68.232.35.51
hxxp://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=de19e91ac24a5e520ea6137aeddd7125	1.117.192.17
hxxp://www.googleadservices.com/pagead/conversion.js	216.58.209.162
hxxp://idsync.rlcdn.com/377928.gif?partner_uid=de19e91ac24a5e520ea6137aeddd7125&redirect=1	54.210.200.97
hxxp://fonts.gstatic.com/s/roboto/v15/5YB-ifwqHP20Yn46l_BDhA.eot	216.58.209.195
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/0/?label=null&guid=ON&script=0&ord=6450794183058108	216.58.209.162
hxxp://d.adroll.com/cm/o/out	54.195.255.141
hxxp://images.sahcdn.com/images/merchants-computer-screen.png	93.184.221.172
hxxp://cdn.optimizely.com/js/91114986.js
hxxp://idsync.rlcdn.com/377928.gif?partner_uid=de19e91ac24a5e520ea6137aeddd7125	54.210.200.97
hxxp://images.sahcdn.com/images/circle-step-1.png	93.184.221.172
hxxp://images.scanalert.com/meter/www.shopathome.com/32.gif
hxxp://d.adroll.com/cm/g/out?google_nid=adroll5	54.195.255.141
hxxp://d.adroll.com/pixel/77I5CH5ZEZFNVPMSE3MTAA/ONW3GFE3ZNGOPDPAXKOR5I?pv=61806223177.91205&cookie=&keyw=&adroll_external_data=customer_type=nonauth&registration_user=&refer_code=91125&source_code=REBATE&brand=ToolbarPostInstall	54.195.255.141
hxxp://j2.sahcdn.com/js/html5shiv.js	68.232.35.51
hxxp://images.sahcdn.com/images/button-continue-for-great-coupons.jpg	93.184.221.172
hxxp://c2.sahcdn.com/styles/tbpi.css	68.232.35.51
hxxp://j2.sahcdn.com/js/jquery-ui-1.10.3/ui/minified/jquery-ui.min.js	68.232.35.51
hxxp://c2.sahcdn.com/js/jquery-ui-1.10.3/themes/smoothness/jquery-ui.min.css	68.232.35.51
hxxp://www.google.com.ua/ads/user-lists/0/?label=null&script=0&random=799290124&ipr=y	216.58.209.195
hxxp://sp.analytics.yahoo.com/spp.pl?a=1000742424085&.yp=7164&js=no	188.125.66.33
hxxp://d.adroll.com/cm/f/out	54.195.255.141
hxxp://d.adroll.com/cm/w/out	54.195.255.141
hxxp://assets.resultspage.com/js/rac/sli-rac.1.3.css	23.64.209.38
hxxp://images.sahcdn.com/Images/landing/machine-and-animation1.gif	93.184.221.172
hxxp://d.adroll.com/cm/x/out	54.195.255.141
hxxp://www.googleadservices.com/pagead/conversion/1071192949/?random=1434955671364&cv=7&fst=1434955671364&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0	216.58.209.162
hxxp://fonts.gstatic.com/s/noticiatext/v6/dAuxVpkYE_Q_IwIm6elsKDoGYR7Z3iWH66EXnaJoKgg.eot	216.58.209.195
hxxp://fonts.gstatic.com/s/fjallaone/v4/rxxXUYj4oZ6Q5oDJFtEd6lQlYEbsez9cZjKsNMjLOwM.eot	216.58.209.195
hxxp://www.google-analytics.com/r/collect?v=1&_v=j37&a=1859351553&t=pageview&_s=1&dl=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&ul=en-us&de=utf-8&dt=Toolbar&sd=32-bit&sr=1276x846&vp=1256x669&je=0&fl=11.6 r602&_u=SECAAEAAK~&jid=1920325723&cid=1409388095.1434955669&tid=UA-2915199-69&_r=1&gtm=GTM-TWR3HX&z=1571068651	216.58.209.174
hxxp://a.adroll.com/pixel/77I5CH5ZEZFNVPMSE3MTAA/ONW3GFE3ZNGOPDPAXKOR5I/HR3E4M74MREKJACLTHVERQ.js	194.146.191.106
hxxp://j2.sahcdn.com//js/browserdetection.js	68.232.35.51
hxxp://xml.sahcdn.com/agent/bce_.sah	93.184.221.133
hxxp://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1	217.163.21.35
hxxp://us-u.openx.net/w/1.0/sd?id=537103138&val=de19e91ac24a5e520ea6137aeddd7125	1.117.192.17
hxxp://www.google-analytics.com/analytics.js	216.58.209.174
hxxp://a.adroll.com/j/roundtrip.js	194.146.191.106
hxxp://js-agent.newrelic.com/nr-632.min.js	185.31.17.175
hxxp://www.googletagmanager.com/gtm.js?id=GTM-TWR3HX&l=gtm	216.58.209.168
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071192949/?random=624130316&cv=7&fst=1434955671364&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&ocp_id=lq-HVbPIMMOJ8wPCx4GABg	216.58.209.162
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=1396043444&utmhn=www.shopathome.com&utmcs=utf-8&utmsr=1276x846&utmvp=1256x669&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Toolbar&utmhid=1859351553&utmr=-&utmp=/1394716560/goal&utmht=1434955671457&utmac=UA-2915199-5&utmcc=__utma=57828200.1409388095.1434955669.1434955671.1434955671.1;+__utmz=57828200.1434955671.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=10251946&utmredir=1&utmu=DACAAAAAAAAAAAAAAAABAAAE~	216.58.209.174
hxxp://shopathome.resultspage.com/rac/sli-rac.css?rev=148249
hxxp://images.sahcdn.com/images/btn-continue-to-coupons-orange.png	93.184.221.172
hxxp://xml.sahcdn.com/agent/toolbarprefs.sah	93.184.221.133
hxxp://images.sahcdn.com/images/ie-example-window.png	93.184.221.172
hxxp://ib.adnxs.com/bounce?/seg?add=2518433&t=2	37.252.162.89
hxxp://j2.sahcdn.com/js/CombinedJS_16C48997C531D7EDA08CDC195581896D.js	68.232.35.51
hxxp://images.sahcdn.com/images/bttn_continueshopping.png	93.184.221.172
hxxp://c2.sahcdn.com/Content/SiteCssWebformsBundle?v=47	68.232.35.51
hxxp://images.sahcdn.com/images/circle-step-2.png	93.184.221.172
hxxp://www.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZGUxOWU5MWFjMjRhNWU1MjBlYTYxMzdhZWRkZDcxMjU	31.13.93.3
hxxp://ib.adnxs.com/bounce?/seg?add=3033413&t=2	37.252.162.89
hxxp://j2.sahcdn.com//js/toolbar/toolbarutilities.js	68.232.35.51
hxxp://www.google-analytics.com/ga.js	216.58.209.174
hxxp://ib.adnxs.com/seg?add=2518433&t=2	37.252.162.89
hxxp://d.adroll.com/cm/b/out	54.195.255.141
hxxp://www.google.com.ua/ads/user-lists/1071192949/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&random=1295422861&ipr=y	216.58.209.195
hxxp://ads.yahoo.com/pixel?id=2498203&t=2&piggyback=http://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1	217.163.21.35
cm.g.doubleclick.net	216.58.209.194
stats.g.doubleclick.net	64.233.163.155
analytics.twitter.com	1.115.192.22

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /images/circle-step-1.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Mon, 22 Jun 2015 06:47:50 GMT

Expires: Mon, 29 Jun 2015 06:47:50 GMT

Last-Modified: Wed, 17 Jun 2015 04:40:30 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/8732)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

Content-Length: 2302
.PNG........IHDR...2...2......?......tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:7B6DFDEEEFF211E4BF4D
CBB8829BA22F" xmpMM:DocumentID="xmp.did:7B6DFDEFEFF211E4BF4DCBB8829BA2
2F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7B6DFDECEFF211
E4BF4DCBB8829BA22F" stRef:documentID="xmp.did:7B6DFDEDEFF211E4BF4DCBB8
829BA22F"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>.)jb...nIDATx..Z]lTE.>..vw.nK..1-..M
I.Z..........P....6.}2..k.1.......6D..> 1.....!."D.V..Z.-..ve......
;w.....{{w..I....;s.9sf.......d.T2....ZF5c...aax.......>F/c.....|..
..he..([&......9.!...%..X.Z.....q..$..._1.f.M..T..`t1~a..HB..E..%.J...
9....O.Xd...M...3>bt3J)sR*..#uX.."..F;eO..:..%.b...a.%.R.W.D.e/l..#
...D.,.:.>.......\k.!.c)........_..f....?. ^.WAs.cf.... .P.g..Z>
....*Z.. 1....Y....^ZKV.......%M...3.Z.Y......5...F.!........a..w....s
......&{.j......>Q.roPV...dsU....'.,...;..D ...'.....P..=..A.(.F...
..B.(.\.-.|..V..I.......rx...n*.....a...vQ...dj|.x2..B...c........
<<< skipped >>>

GET /images/ie-example-window.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Mon, 22 Jun 2015 06:47:50 GMT

Expires: Mon, 29 Jun 2015 06:47:50 GMT

Last-Modified: Wed, 17 Jun 2015 00:59:52 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/876D)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web03

Content-Length: 72728
.PNG........IHDR...x.........~..G....tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:902764010EA811E58AFB
BB99DE315D26" xmpMM:DocumentID="xmp.did:902764020EA811E58AFBBB99DE315D
26"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:902763FF0EA811
E58AFBBB99DE315D26" stRef:documentID="xmp.did:902764000EA811E58AFBBB99
DE315D26"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>.*E.....IDATx....|..u=|.l.E....(.ITa/.z
., rQ.^.w;.k\e..l'_...r.[.mE.,.Z..."%Q.b.........}..,..`A..|.....N}3s.
y..w.bY.$$$$....2.>......T..TfK5.R*.*..f.*.].J$.,L%E.#[email protected]...
LY.'..$x..I.....r*K......%......T^..mT^..W..$x.........*k..Ce...$>.
....<K.)*O......./!!.=..WQ.8[.QQGM............B..Es.2b.....t......,
.=.T^.r.....$..$x..S..K...*[email protected].'.7.W..V..~..F|^.. ...
....l..o...#z.f....~X..Hw.F..*.b.'...'@.....F..,....%T..l.yg@ ].=0....
(..v.....A:..F..n.{^.F.H....T.....>!.^BBb*..J.x?.....y.....Qq6...p.
-..|..L.!..2..[..xV(.b...o.....UI....S.........,..%w..Qy..U..s.p.L
<<< skipped >>>

GET /images/bttn_continueshopping.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Mon, 22 Jun 2015 06:47:50 GMT

Expires: Mon, 29 Jun 2015 06:47:50 GMT

Last-Modified: Fri, 19 Jun 2015 03:15:17 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/8759)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web01

Content-Length: 4797
.PNG........IHDR.......J......t.<....tEXtSoftware.Adobe ImageReadyq
.e<....PLTE(\..!c.=.#H..C........c.......v...K.......0R.h...,......
.....;..6.(M..C................i}..6..........$P.....9....q..<]....
.........Dd.EX...........0.Ki.Zv...."T..6.yyyc}.. .h|..0.G`.Sq..4....0
e.,\.....7..0.Qn.}...=.Rk.*Y.$S.y...6..3.....2../.\p....4V..8....5P..2
....7Y..........eu..4.(V._y.Uf.Hf.A_..7..>.0Dy/`.......u..=Y.n...N.
Yu.......v..$@....'X..3.......7X.9Q.......9Y..........\ 6.....IDATx...
._.H..... ..... ...j-6F..hi.....)b...S..<..b..gfv......<w.....f7
;_ff7.D.."........`..0..'.....-j... .........!.6.'....ZJ......P2..E.&n
....;&..`.N..o............xG0..i...m.)w"b0...C...$m..M...:....b.~r.I#.
.D...U.2....1.&!Ot.p#.. ..A...{.>...........&..p..l.k.....g.L.v=<
;.S .(....5..8.7....c]s....m.<...T&!O=...H.3...~(.J..,..W-.5."%jL.&
lt;Q-.]s =...A..<..(t.n..DY..^Z../?.~>.........e.>`WI:....N.2
*...I...Jss.8.(..[,.?....{..5..uw..5.......................V....H4.S%R
.b..!...)e2s.l......g........p9y..:.B...0..?.......h...V.ei."..K...&l!
.1 ....X.................V.!.8d4,.8.gf....w.]....Y.d..,..U$..C=.C.-.e.
... .r/.I,%.....a@2?s.T>..,[email protected]...(..A;.9.....q...G.<
;d*.....H%..........md.P..ry..e..H....33.c{.x\\tvv..@*....`.|ZaH..j..x
.xB^.b.F.aJ.D... .a...2sL`Z_3.*[email protected])....p..o....:5fL|..
.I...p.r.~^...b.......v.......<..p.B.p ." ..Hd..8.$....>.x......
.... ..|..bpp.2.0radZ\.O.A8.?8.A. [email protected]'.!.J.."[email protected].!q..........F
.u..9.cO.......r*..ai...l.6Ar.....R.<.s.4.z(..*..r...4D..E]..
<<< skipped >>>

GET /Images/landing/machine-and-animation1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/gif

Date: Mon, 22 Jun 2015 06:47:50 GMT

Expires: Mon, 29 Jun 2015 06:47:50 GMT

Last-Modified: Fri, 19 Jun 2015 03:15:18 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/8752)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

Content-Length: 126390
GIF89a........p........y'..gW..........D555l-.ccc.K...3FFF..$..[VVV%%%
........nnL..s..e...p....{...5.Rs..6,.............v.S$./*Q....B..#....
.......E..O........(.....6..H..t....uOW&...F...c.u..7.Jh..s.i-........
...h.......{......B..h....{......u.....Z..(...........5../..N.."..U..U
.....e.....k.. g...\[..j........F....x............$.."..xuoF..Y.B]..).
.U......=...ly.....T..4...K}t.....F....h.H...Rk........k.].)OO..D0 .Si
M........4.....g..%.k.....h...v.........q8......*..F.cx...#Yc.SeN9..&g
t;...2....Ys......}OE.r.62#......JRt........[.>@.x~.....1......@SD^
W:.......................E...6c].....V..>..70)...8|..L4O....Ja..)..
...8...8?b.....s..{..Q........R........{..*..)..Z.....N.Z|..!.....^..{
..[...........R..............r........!..O.....,........b..W..Z<ZNT
J-..........{..........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket b
egin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="a
dobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-
19:44:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02
/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="
hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/
1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM
:OriginalDocumentID="xmp.did:a7ba2afb-8184-944a-9d3c-a10ac86d2a77" xmp
MM:DocumentID="xmp.did:0F5430A018D611E4B3BEE4ECA4D565FE" xmpMM:Instanc
eID="xmp.iid:0F54309F18D611E4B3BEE4ECA4D565FE" xmp:CreatorTool="Adobe 
Photoshop CC 2014 (Windows)"> <xmpMM:DerivedFrom stRef:insta
<<< skipped >>>

POST /RequestHandler.ashx HTTP/1.1

Accept: */*

Content-Type: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: tbws.shopathome.com

Content-Length: 704

Cache-Control: no-cache

MfcISAPICommand=update¶m=ð

s9mQ3qq04PIFw7WcIXILQUCakjdCz1xK5NaTj3W4eAb4EhUsG3eHoXtToe-CkfGyR4L1gzFzrnrsl43tEcZA0JZqOYi44BetlYWGfx4nJKwMDwEDSvxJkPAm_dSkuDAoT0SJwZ_L13W7_h5FUQPshqxFw1PCtRwnXA6T4f8akZClh2c6g-FZqkPdTfTvYnmWc5tvcY5WnFudiH71JAVSWot0kvQkdOiifvMlMvMnWKKsNwmukolsEPhezGZy4etTidBvgaS_YSDh79hNfK1edVyan4RKHU5K5Bfx70XETuFr8FYw-Qe_GchXQTMcIFzy5eD8h4uxw2Av3IvYaXSTVZoPzk0IL63izFwany0vpucPYVl5v5lS41a6uJAKQ8AqsnhQm19R4oFmDt7yDg5roz4vXlnekCdFOHJbQR85LGm5S7dUEQMCQHOPCpGPAWSjfXiw19Kc3ij-wF_0rzPLnTSkOZnDFe-akR8KcnY86mTjQY49sNXsoBN3X_eJ_MjuhcPzLNrS1yOUS4535cgFSq30no8JuQHkiE1P79MLfF3THUleSdi0QZxQiXtT-obnUt71f96U9HHNxop45BIBAD7zg-vpns_SRdRTlM0Pb4NwFZjxpdY2uNMmcEwf2sr5adTVkU08EaoP5M_6tNgsIG.
HTTP/1.1 200 OK

Connection: close

Date: Mon, 22 Jun 2015 06:47:41 GMT

Server: Microsoft-IIS/6.0

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Farm01

Etag:

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: -1

Content-Type: text/html

Content-Length: 460
........M.....x&J..i.$.......y..8...D:..@:..X.n.."[email protected]..
^8.....s..^.5....).0V.N^.....Z'...L...|..O3.....0..."J...h5.J.Xh...)e.
Gk..GJ. .......n...~.j...V@&O..... ....y.L&..g.y..;.EY}AD.e..p.....&..
.....x....UR$.U..{.x....8....O...Tn........^.{.. .(.Z.h.Y#.7..D.F_.-..
z..V...Cb..l....$.r.G......hh%hOoJx.8G%*.jS...a*...r.....L.p.=...o...]
....48..).tz.h..qP........dg...fbN.=6Ef..{.B{.....n.e....b.c.....g....
.d7q F.O?9....SQ...,.....q....g.r...*Z.Q..

GET /agent/agentprefs_.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: VVV.shopathome.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Last-Modified: Tue, 12 May 2015 17:09:39 GMT

Accept-Ranges: bytes

ETag: "80bfe6dd68cd01:0"

Server: Microsoft-IIS/7.5

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web08

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Mon, 22 Jun 2015 06:47:40 GMT

Content-Length: 1080
..1....?"[email protected]&d../....=d;....]z.`.*.... .....d..(..$%..R]......
...8w-..n. ...Up.Z.TKOX.p..P....=9..M..?.."...$j.H..;..gw..f.U........
pf..[\.....r......hE.....a=.o.]P,..f.5..6...D.;5BP.wTH.....Z..P,:....&
gt;..4.8...3...jg.$...n.....3]...l.T<....3.S."...2.[...k.~.NB...=..
....j.YFcJ[..%...Y...ES<........'..dh.S...A}R.oa<.M9.m.. ...(..t
...O.k..T22j........-3j,...b...(m=.14.."..mO.n.>[email protected]...
.U..-.Nu. .^..0.S........Q...$!4.....:..p.!......s...wo..f.....n?Ft..?
..O.cP......{.I.,..m.Pd,.V........."..c.....v..s..%.....l...2j........
._....._1-...U........i ......>.k&([email protected].?....{.}......ei-..
&].`.-U. s.....V..^............I..E}.A_.b1.X!.Zy..Ig.G....^.TJ7.?.l..V
..<.KZ....|.....dDZ.f....U;.s.2...='Cw......I......G.....s@>....
K....1.t..rH.8k....q.... .{.q>.....88.....S..TH.O..<!....u].....
...<.w......(l.(.......%D...].....o....Y.:...E..g9.....x.....].K{.Q
....u.d..u..R "n}kVCC .;.b2d..W (........k.1.&.......f.9..^.V`.l...IN.
.>.C.{.0.D.J%.?......'! 7z..........4Q@;.. ..8|..............I....{
.:.H.Z#.b.<.~.k....S.....6.=3.B........5.y.'.VD..-~UJ.....s.hZA...H
TTP/1.1 200 OK..Cache-Control: max-age=86400..Content-Type: applicatio
n/octet-stream..Last-Modified: Tue, 12 May 2015 17:09:39 GMT..Accept-R
anges: bytes..ETag: "80bfe6dd68cd01:0"..Server: Microsoft-IIS/7.5..P3P
: CP="NON DSP COR CURa ADMa OUR NOR PUR"..X-Server: Web08..X-Powered-B
y: ASP.NET..X-UA-Compatible: IE=edge..Date: Mon, 22 Jun 2015 06:47:40 
GMT..Content-Length: 1080....1....?"[email protected]&d../....=d;....]z.
<<< skipped >>>

GET /ads/user-lists/0/?label=null&script=0&random=910929902&ipr=y HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com.ua

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Date: Mon, 22 Jun 2015 06:47:52 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Typ
e: image/gif..Date: Mon, 22 Jun 2015 06:47:52 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_
server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate
-Protocol: 80:quic,p=0..GIF89a.............!.......,...........D.;..

GET /js/91114986.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.optimizely.com

Connection: Keep-Alive

HTTP/1.1 200 OK

x-amz-id-2: nLv3bpNUZCYqDVcfskoNHKq1qSogZwuG4twenY0nXgeWY4Wz U73zuK1JJ1zXxdYVVC cBQ4Cu0=

x-amz-request-id: 3D13FF5AE160D537

Content-Encoding: gzip

ETag: "15d3545a333cef4d6e80c918d626baca"

Accept-Ranges: bytes

Content-Type: text/javascript

Content-Length: 105852

Server: AmazonS3

Cache-Control: max-age=120

Date: Mon, 22 Jun 2015 06:47:48 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
......uU...}k{...... [email protected].}z.......'.EB6.ITI*.WW....)^$R...
d.^{......`.....?.....g.'........?........)...../[email protected]....
[email protected].$&.....G...............G?;=......
~...........h.D.B..}zp.......<....#.d..lG........o...g...........q~
r~..........zp........o.........wx...l,&Q...w......<.E\..0=...<.
...O.G..O....<..k......_.y...O..<.px....{GP`.....0.......it=....
_~I..k.j.._~yx.......................N...?.O9.QP.....s......lf.x.28../
......... .>t.....Og....,...=..h.G%........S..........M...<8z"..
......._/D.b$.c....}..=...X...w..\......AN...[J....N.M#x-4.4..A$>D'
......\....s......9u..0..Z.......c..zA.=..F...<.a;....{............
.|.......F...K?.....~v.........Go..i .......}@..[.j.........(...<&g
t;99..........Mx.O.......O:??..BD.?....f...'..........9...............
.]/t.......=q._..*......Qt~....Z...P*.8n...uf......uvF.....w.....?....
........~.y.w.........f.w...0y.........D..n..|G......&#.v.D..5S1....O"
xN,.e.w..B._.......t.....Vj..%.].8.<T.....{N.........aQ*.~.g..Q,...
c..C......7Rfj.....o.....y...3,n....mO....{/...[..y.^....\.4]>.vK%M
.[..j..xPCp.^..#..^.V..4......4..CeP/........3.e.{Ba...\w:e<yXl.0..
.......E.D..m......... ......r..P.)UL.\[email protected] ..Yj,.f...oA.
St=.x.Y.eO..5..oe.O..iR..E...R.P.3nPJ.1...N.......Q.P...S..:-..7L...N.
.H..3..............C-.n.[y.%u.R..p..F.....[.".0j(.......p..|:.n<q..
.T.i....U..\...o....cY..X...d...,j.ZJ.....s."p;...[eF.?DU-E.y,._..Tq..
.......'.J-..K....I...){../.i...f.x...-s...2....... .#OR1...J...fa
<<< skipped >>>

GET /j/roundtrip.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: a.adroll.com

Connection: Keep-Alive

HTTP/1.1 200 OK

x-amz-id-2: aHSN2//ScOedrcwzjbS1O0I4ApHY/2ak/RMhfEryUF391LwlCsE/twItV8qJg/SS2qeI9W2/0vk=

x-amz-request-id: 740A98EFC70D4A79

x-amz-replication-status: REPLICA

x-amz-version-id: pU_8g55jeJdK9jEgv17oTDDM35uKrMhL

Cache-Control: max-age=300, must-revalidate

Last-Modified: Thu, 30 Apr 2015 20:10:50 GMT

ETag: "ec8062a85123bd253d9a7dcfda673ccd"

Accept-Ranges: bytes

Content-Type: text/javascript

Server: AmazonS3

Vary: Accept-Encoding

Content-Encoding: gzip

Date: Mon, 22 Jun 2015 06:47:51 GMT

Content-Length: 6422

Connection: keep-alive
...........;ks.F... H...sD.$.. ..sv]I.{.SW[...cD.....%kE.._.....l.^.%.
..GwO..1.o...xa [...[.-7.}.,.O.'..0.......@%....V.^.f%.^d.n....;...?..
^..:...J..C...........m..C...{<F.|.vH....L....>Tq_.....Y..9Ft...
<E49F..M.C<.L.L.^.[..0...........G.zn...4Hz....)>.........T.p
...NK.y.,.....]v.>Vw}sS.D.!.pu.`E0.>t)....N.K.......l..y.x.%^%..
./.m..Uv.b.s...]9.Lg ....zFfZ...-..".............o.J.=|.....bk.\..p.e`
......"..\......)......,`7s..B..6*...%.....F.bN.....~?....l......x)..{
....s....?..Y...?v^........<...^...b~......O.&].*./W..Aeq.S..X..%4N
dd........[.l.Gy....k.vg<..GJWv...i.}}..q<.u....6>.|.9.. Lb.J
n.FyrLWve...qe.#.P@.\].....ppyK,[email protected].?..%..O..v_.FOV...m...
.O.{..*...`....5m.s..~.......l.g."[..[..m.p..\...t2...............r8..
..h...0.[q..`....cM.M...(..aoa...`....h0..U.\.....6...t:.T...~m...T..5
.c..R.'[email protected]:T*.."zm2Q..H.j....k..T.t].T.k*'@...a.......T].
..*zm......p<...?...*.MS..z==.H....3.F......c0..`.$.D.Vd.....l<.
T.`'P.............`'R.....>...5.......A.r8......S..........k.U.#.gd
8..*...}.._...>...ET......S.L.i..3.>.Ou.N0.!...k.)...[.?....d8..
.Z......q.!.H.1.........'U.........W.O.zm.....T..z.....84..u$..?......
..(.)...;.......4r9...M.H&.G.|.E..P......:TG...a.`.$..b0.4..:...u24F..
.3.%.N..H....t..n.d... #}6a.Z#[email protected].:5.....9!
09.h...N...1....6....1v.}...O'u"P.H.>...h.._.....,[email protected]...#
.~98 ?g..P..A*|A9......t...#..x....7Z.>S.}....w.S.n..F...)A..=.....
J..Q..7..H.C5.PXH.:.F.a.....T n...U..2.`..\..Y.?c1.7... z..8.>.
<<< skipped >>>

GET /pixel/77I5CH5ZEZFNVPMSE3MTAA/ONW3GFE3ZNGOPDPAXKOR5I/HR3E4M74MREKJACLTHVERQ.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: a.adroll.com

HTTP/1.1 200 OK

x-amz-id-2: JxN31ZHK lAGjvz9zYNTRYOnL0MXrA65iJW1A5NBHtnGzBi9AKzoE868Fm7GrnbBLXNO5h093d4=

x-amz-request-id: 986252D8520786CF

x-amz-replication-status: COMPLETED

x-amz-version-id: VWW0uOo7JCl5pQ3LpGWvK5YfUikLgqel

Cache-Control: max-age=300, must-revalidate

Last-Modified: Sun, 21 Jun 2015 18:57:04 GMT

ETag: "dfe6f50df99e918808aa2c4f39d54c2e"

Accept-Ranges: bytes

Content-Type: text/javascript

Server: AmazonS3

Vary: Accept-Encoding

Content-Encoding: gzip

Date: Mon, 22 Jun 2015 06:47:51 GMT

Content-Length: 946

Connection: keep-alive
...........Wmo.6..._..0,w.d[V..0.5..l.....!...<KDiR.(.A........:...
.3lY....(..]..Y..q{...! jH.RX....uRk...!.....KP....R.....i.#?.Z.!....{
.X.\m...%..mvs`..."{L/.;A-?..@yL..._..".*y.e.YB.q.8}....!.....L.%..F..
....8....m..$.K.3@-L%. ..bU.....;.7.Zp.:..........HR....<...f.%...M
[email protected] ..k1*.C..a.2.....9j.>
;...-e.0.-}........3...oq......>nx...'...>nxI./X$Z'."%P.."...>
;.s.D..n.?D[.....z.-(.X...Pk.b.-.a<......0<..uF..c.9$.........y0
._....._..........[...rg..3".5.*....u.)......%0)..T`..&..W..65.HR<.
.L....K..Ic.h[.Rb.t.!...2.z...u....H....V7!.B...5..{.$.X..Dyiv........
NG.e.0...M7{{.......f/^^..........M..n.`.....n.n.s.......(j....(..u..W
.....N.';.../..w..F..-I.Z.t)8.3....C.wV.x].*...yd..B........}bM.......
.5w....-.....`c.=i{ylb...g.....'.....^l...3........5y..'.OL...mm..:._W
.._..O...v.F..#.(...hG..`.Eq.......P......{.%gg$J..p{..2P."... {..d.2.
.{...0..........F.......3...nMG.*...O.D.j.|....i{.u{...Z.........
<<< skipped >>>

GET /pagead/viewthroughconversion/1071192949/?random=624130316&cv=7&fst=1434955671364&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&ocp_id=lq-HVbPIMMOJ8wPCx4GABg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: googleads.g.doubleclick.net

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Mon, 22 Jun 2015 06:47:50 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/user-lists/1071192949/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&random=1295422861

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Set-Cookie: test_cookie=CheckForPermission; expires=Mon, 22-Jun-2015 07:02:50 GMT; path=/; domain=.doubleclick.net

Alternate-Protocol: 80:quic,p=1
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Mon, 22 Jun 2015 06:47:50 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/user-lists/107119294
9/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=f
alse&cv=7&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.asp
x?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessP
I&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F
0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsour
ce=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&s
etupcid=40336643&cid=40336643&refer=960117215&disabler=-
1&tbstatus=1&tbcode=1&tbtext=&random=1295422861..Content-T
ype: image/gif..X-Content-Type-Options: nosniff..Server: cafe..Content
-Length: 42..X-XSS-Protection: 1; mode=block..Set-Cookie: test_cookie=
CheckForPermission; expires=Mon, 22-Jun-2015 07:02:50 GMT; path=/; dom
ain=.doubleclick.net..Alternate-Protocol: 80:quic,p=1..GIF89a.........
....!.......,...........D.;....
<<< skipped >>>

GET /pagead/viewthroughconversion/0/?label=null&guid=ON&script=0&ord=6450794183058108 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

Cookie: test_cookie=CheckForPermission

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Mon, 22 Jun 2015 06:47:51 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/user-lists/0/?label=null&script=0&random=910929902

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Set-Cookie: id=222ca3ce0f0200ec||t=1434955671|et=730|cs=002213fd489ba85069dc0d45f6; expires=Wed, 21-Jun-2017 06:47:51 GMT; path=/; domain=.doubleclick.net

Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT

Alternate-Protocol: 80:quic,p=1
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Mon, 22 Jun 2015 06:47:51 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/user-lists/0/?label=
null&script=0&random=910929902..Content-Type: image/gif..X-Content-Typ
e-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protection
: 1; mode=block..Set-Cookie: id=222ca3ce0f0200ec||t=1434955671|et=730|
cs=002213fd489ba85069dc0d45f6; expires=Wed, 21-Jun-2017 06:47:51 GMT; 
path=/; domain=.doubleclick.net..Set-Cookie: test_cookie=; domain=.dou
bleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT
..Alternate-Protocol: 80:quic,p=1..GIF89a.............!.......,.......
....D.;..
<<< skipped >>>

GET /ads/user-lists/0/?label=null&script=0&random=910929902 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/user-lists/0/?label=null&script=0&random=910929902&ipr=y

Cache-Control: private, max-age=43200

Date: Mon, 22 Jun 2015 06:47:52 GMT

Expires: Mon, 22 Jun 2015 06:47:52 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 294

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/0/?label=null&a
mp;script=0&random=910929902&ipr=y">here</A>...</B
ODY></HTML>..HTTP/1.1 302 Found..Location: hXXp://VVV.google.
com.ua/ads/user-lists/0/?label=null&script=0&random=910929902&ipr=y..C
ache-Control: private, max-age=43200..Date: Mon, 22 Jun 2015 06:47:52 
GMT..Expires: Mon, 22 Jun 2015 06:47:52 GMT..Content-Type: text/html; 
charset=UTF-8..X-Content-Type-Options: nosniff..Server: adclick_server
..Content-Length: 294..X-XSS-Protection: 1; mode=block..Alternate-Prot
ocol: 80:quic,p=0..<HTML><HEAD><meta http-equiv="conten
t-type" content="text/html;charset=utf-8">.<TITLE>302 Moved&l
t;/TITLE></HEAD><BODY>.<H1>302 Moved</H1>.T
he document has moved.<A HREF="hXXp://VVV.google.com.ua/ads/user-li
sts/0/?label=null&script=0&random=910929902&ipr=y">here
</A>...</BODY></HTML>....
<<< skipped >>>

GET /rac/sli-rac.css?rev=148249 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: shopathome.resultspage.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 22 Jun 2015 06:47:47 GMT

Server: Apache

Last-Modified: Wed, 27 May 2015 22:19:02 GMT

ETag: "262-51717a155e180"

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Wed, 22 Jul 2015 06:47:47 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 265

Keep-Alive: timeout=2, max=100

Connection: Keep-Alive

Content-Type: text/css
.............J.1...}...(........l2..l&$.Y\..nK..v....g........mE!..G..
......l3vB~..%(&.c............j.......qh..b.D..S.K..... 3nc.IA:y.Atju.
...D.......#_M........{[email protected]%..z..<..6.c ...
'.i*$./...|...."........g..n.........<`......x.b..w'6Ab...HTTP/1.1 
200 OK..Date: Mon, 22 Jun 2015 06:47:47 GMT..Server: Apache..Last-Modi
fied: Wed, 27 May 2015 22:19:02 GMT..ETag: "262-51717a155e180"..Accept
-Ranges: bytes..Cache-Control: max-age=2592000..Expires: Wed, 22 Jul 2
015 06:47:47 GMT..Vary: Accept-Encoding..Content-Encoding: gzip..Conte
nt-Length: 265..Keep-Alive: timeout=2, max=100..Connection: Keep-Alive
..Content-Type: text/css...............J.1...}...(........l2..l&$.Y\..
nK..v....g........mE!..G........l3vB~..%(&.c............j.......qh..b.
D..S.K..... 3nc.IA:y.Atju....D.......#_M........{[email protected].
.zh.S.x%..z..<..6.c ...'.i*$./...|...."........g..n.........<`..
....x.b..w'6Ab.....

GET /ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Expires: -1

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

Set-Cookie: SAHSessionID=164f0fcc-0235-491d-8d43-dd85367af9bf; domain=shopathome.com; path=/; HttpOnly

X-AspNet-Version: 4.0.30319

Set-Cookie: SAHSessionID=164f0fcc-0235-491d-8d43-dd85367af9bf; domain=shopathome.com; path=/; HttpOnly

Set-Cookie: SAH=REFER=91125&SRC=REBATE; domain=.shopathome.com; expires=Tue, 23-Jun-2015 06:47:46 GMT; path=/

Set-Cookie: sahdsp=tbinstalldate=6/22/2015 12:47:46 AM; domain=.shopathome.com; expires=Thu, 31-Dec-2020 07:00:00 GMT; path=/

Set-Cookie: SolveMedia=H1:c60ef57601cd523f0739ed10bb37b82989c67264,H2:5da30ffb179f33b498a1065abad15d0c77b4fdf3,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:0e13aa58ada0f7cb73f006e69d2ab632,H5:2bc3adfd94e5e4177b007f850ef66489; domain=.shopathome.com; expires=Mon, 29-Jun-2015 05:00:00 GMT; path=/

Set-Cookie: SaagId=8d659088-6a0d-4280-8ba5-381a0a3bcfe9; domain=.shopathome.com; expires=Fri, 10-Dec-4049 08:35:32 GMT; path=/

Set-Cookie: CookieCheck=Y; domain=.shopathome.com; path=/

Set-Cookie: pixelparamid=; domain=shopathome.com; expires=Sat, 14-Mar-2015 06:47:46 GMT; path=/

Set-Cookie: SAHtbpi=showconversion=false; domain=.shopathome.com; expires=Wed, 22-Jul-2015 06:47:46 GMT; path=/

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web06

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Mon, 22 Jun 2015 06:47:46 GMT

Content-Length: 12274
...........}kw.H...3k..P...' $......I......,/!. [HjI...k..q...%w.*I...
{z...... ...k.~......>.k.6{7gmn...}H._.i..N....U.f...0...=.J.J%..yx
.........B... (.8........Yfs.d6..0&Y...~.........o.#...*..5^quQ.c..B..
..t5W'..?z...e..gY..1qeN...C..?q..]..z..<&5...q...9.4\b@.....<..
s`..9...VF.#..E.3....X..3..L..[...u.......! .(.f..;..M.<..{.Qf.....
4...y.....$...xI..'A3.&W.~.}"C.|...c..3....A\>...6.F.w]S......>.
....J.T./.e.G..4.-.X(..R.>..l8...N.W..F.z~......^}}8>k}u....|p..
....m<5:.b....._... q.:.h.Ae.O...4.F\h....9.`....n.,...V'_)6...8...
.{'C..SS.@......|N.k.p../....o.z.....l._...... I.F.M...9;.o. ....~O.x.
m...s..y.L.u.?^^...|......IS.>..j..(.(}.f|...;.....Y5R/i3..L.x_.)?.
....*.Z.{l..pGR^.p......uq....:1..h...!...f~O...$.|.<..O.oa....&I..
z.v.r....!.sZ.<.....'5.P...&^.i..%e...J[..`......7...t3K:0.>\.K.
.....|.JI.h......y0..W.3.......$.|.......5..4.r..5.j......N........*.;
.......%D'[email protected]./*&..5..I.C..S{.?.57....R.|.\.:#..{[email protected],....
......R ..$0......!q.7...>"a\..d.=L.R.36.<...D_*.T..R.K...?.I:..
..I.c:..wv..c-...=.\.}.At.......J!....)uF.i...8.9.....'.f.f5g.-..=.g.R
......C.e.a. ..(9..{&P."....[.....2.. .Tz..p>@.T.r.\U...^.|........
..np.........>.......D. .i..(...}[email protected]...'.j......
....41`.m.&A.....e..R?^B..@>y..5`..k...#.9..~Sa.gt.4...=.yT.at]...^
.........vF..D.'[@...V.&......{*.hj*.o.5qF 8Rs. .....I...&!..].......k
&.....1...k;z}T>lt.....L.P.>'.O..#?..&.6.].f...5....HUR.yT.I.jP.
..K..w.>..=..L..B..p.....,6.5=`. 5.ZD..q.6j..Wm.P.....!J.$.)...
<<< skipped >>>

GET /WebResource.axd?d=utXq0EopSmH_wSGx3BdZvDyYLpS5Ff55sDuYcl5aUvI_mXIJL5BpykW6xvZro8cCJWqYDkZtKLBu4ajxaGC76D-cQPk1&t=635418424260000000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

Cookie: SAHSessionID=164f0fcc-0235-491d-8d43-dd85367af9bf; SAH=REFER=91125&SRC=REBATE; sahdsp=tbinstalldate=6/22/2015 12:47:46 AM; SolveMedia=H1:c60ef57601cd523f0739ed10bb37b82989c67264,H2:5da30ffb179f33b498a1065abad15d0c77b4fdf3,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:0e13aa58ada0f7cb73f006e69d2ab632,H5:2bc3adfd94e5e4177b007f850ef66489; SaagId=8d659088-6a0d-4280-8ba5-381a0a3bcfe9; CookieCheck=Y; SAHtbpi=showconversion=false

HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/x-javascript

Content-Encoding: gzip

Expires: Sat, 11 Jun 2016 16:50:08 GMT

Last-Modified: Fri, 25 Jul 2014 05:47:06 GMT

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web06

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Mon, 22 Jun 2015 06:47:47 GMT

Content-Length: 4391
............io...{.......,.....*.B..]..mXJ6...hrdqC.*9.-...;'97.8i?4=,
..5..7o.....&y....N.b9..Kx.F_.Wx......4,...z...._/......I.b8...E.^u...
.P.]....i..............x...O....I..8yCO.6P........ky.T...BD.....\M..U.
E.z...."[email protected]....?i.8..=~M...$.. .=.. .5(.)$B..c..=.%L.".A.f..yp....
.H.....7.z{\[email protected]..&6..S....^.=...`.d .;........u.Z.
.R.......w......b.h...>7."....ZxiX....;......?...&.......;..E.TT.J.
.peh.(^.#h,....8...G.......C..k hN.}...>.....`.R......3..<.o....
T..f/.]d.c.;.a.W6 ..3.c>........e.......S.]..F.yve..........* .....
...'...I..n9..@.'..8L.;D..x...QQ...#P.r.E."..u.A1.3..'.~.f`\68I..M.rH.
4...Ox.(..._.`.E......q.C$.l.......M...xt~~4....x.{...'Y...$p.H.uM.jt=
z.HL..q[*1N.'.O...G.g....... Y......V.].]<...>....L......]......
...]>.?........Q..E..I)..TG$.?]...".......|.{..tz.w......6..@......
x.."[email protected]....).J..8&.................FM.>LM....8
0......<O..KO.4=M.....$..R0Is....[..#......G.z.3....,o.4n=......$%M
....r..9.zyV .M.QU.-..........U....U....."...z.w...(....yAC.M...n..'.#
R3.V!\........?.z.X......{...c..F.x54..... .w%,....c/._.fY...._.?*...E
...F.*66..............d.CM.c.E0..Y.....%[email protected].
..."<..)........L}......Rrd........)*2..?\.............y...H....C.X
 B.5.....r....."[email protected].(.>..Z9...)!..?..w,s<P.(.o
...`[R.F9B....P..Q)..#...$&.....P.../`#...Q^ .c....m........i{..nR.C..
.....2O....X0..$..M..z...S0....Y.a.FlM#DHk....."b..Q[..V..............
x..q...^.&(..T."..Q...q.....oa..^....5..T.R.q..B..Q......BM.6...".
<<< skipped >>>

GET /datalayer.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

Cookie: SAHSessionID=164f0fcc-0235-491d-8d43-dd85367af9bf; SAH=REFER=91125&SRC=REBATE; sahdsp=tbinstalldate=6/22/2015 12:47:46 AM; SolveMedia=H1:c60ef57601cd523f0739ed10bb37b82989c67264,H2:5da30ffb179f33b498a1065abad15d0c77b4fdf3,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:0e13aa58ada0f7cb73f006e69d2ab632,H5:2bc3adfd94e5e4177b007f850ef66489; SaagId=8d659088-6a0d-4280-8ba5-381a0a3bcfe9; CookieCheck=Y; SAHtbpi=showconversion=false; _ga=GA1.2.1409388095.1434955669; _gat=1

HTTP/1.1 200 OK

Cache-Control: public,max-age=604800

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Fri, 29 May 2015 19:35:15 GMT

Accept-Ranges: bytes

ETag: "809b1396469ad01:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Server: Web06

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Mon, 22 Jun 2015 06:47:47 GMT

Content-Length: 3565
...........:........w.e..S...q..\V...C....8..YX...%.H....O...G....sf..
...:(. ....9s../.....).....U;w.q...?..y4...XQ....OW.a.'V.....7..w<.
l......sy.p.......nx..*.3.#9...*r..>...QRV..[[email protected].
J8s..}{A=.P.......a..'1'.'q.c..&.J. X&........."....7....... g3.[...H.
.8...j8.....I..9.C.Ns...].(WK..V........]:.... Z|z..i...t...l...m$..r,
t.1.b..@..!.B...E.L...wU.d...[..C......2.U...?.^I........1...O......NI
...1=r:e.4.o../.-b........;8..R.EU.d...J.Jeo...Fc.A.~.........l.gE._.,
}.\.I.5#.......*..-{...........!.}V...%...%..l6...6..3T"...>......9
..2..q.\...T..1.;..0..h..U..qT../.ZY.O.`....,M`.D....]...u...e.;\.].eV
.O. ~f...)[email protected].......(:%ZG&\g....Y.......b..Pn.
.W.{..W.:0...L.u..*...#L... UPm.... ..:Zi.r.&X%g..[...T.KB&7.N..)U.AU.
.......V..P%.}dA T.;..)/4......<..=.Q.2^...L.J.........._M#..9".o..
....Q(...}.B..$..../A......v.,D.Kf8.....e...y.....?...ij...aV-..8.$.[|
...7l....Z...D,%.P....._.....m' l.O.J.Bf....4.6...;6..F./\ 8..6qMwy.:.
.=q.#...r.g.p.C............E.....-...~.8....p/u.."....y.eV..!......a,h
...............}qq...e.......].oj..M....z......<7...'...,.I......&.
.b..3..(.= K .v)..@..:.5...._^L.......:...\c..G..x...y.QGa.F.a%..r....
.C...a<.^....~.h^$...H..7..k.....|..S8..7uP.G.....^.........rh.*..2
.........W....?(..>],.K...d.....X1.!,D.`.w.....6..o......|."f.....=
.b Ls..\.^.I.&.?..i......`.L1..4.\g.2......P.KHJ......~g.I)w._..6Fg.b.
[email protected]..}..0-(.!..b....d.....M{@.%#...=.....ow7Qs...,n..
.z.'P..#.Y.I.HyM<.u..H...p.`..X ..C...9 .......l..g.Y..R.w....x
<<< skipped >>>

GET /dlhelpers.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

Cookie: SAHSessionID=164f0fcc-0235-491d-8d43-dd85367af9bf; SAH=REFER=91125&SRC=REBATE; sahdsp=tbinstalldate=6/22/2015 12:47:46 AM; SolveMedia=H1:c60ef57601cd523f0739ed10bb37b82989c67264,H2:5da30ffb179f33b498a1065abad15d0c77b4fdf3,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:0e13aa58ada0f7cb73f006e69d2ab632,H5:2bc3adfd94e5e4177b007f850ef66489; SaagId=8d659088-6a0d-4280-8ba5-381a0a3bcfe9; CookieCheck=Y; SAHtbpi=showconversion=false; _ga=GA1.2.1409388095.1434955669; _gat=1; optimizelySegments={"172491114":"direct","172437468":"false","172419741":"ie","172406886":"none"}; optimizelyEndUserId=oeu1434955669145r0.9696937679864475

HTTP/1.1 200 OK

Cache-Control: public,max-age=604800

Content-Type: application/x-javascript

Content-Encoding: gzip

Last-Modified: Fri, 29 May 2015 19:35:15 GMT

Accept-Ranges: bytes

ETag: "3ef3096469ad01:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-Server: Web06

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Mon, 22 Jun 2015 06:47:48 GMT

Content-Length: 1969
...........Y_........0.C,#>..K..9Ao..n.i.$.....J..]Z4H*.#.O..~.~..P
.,J..M/@.  ............=.N.G.W\.,..cf...f.`{..[.....G..M...g.C&......V
..p....3.L....V~..fF./...:.%.e.....qd.....2..b..2!Y....A.c.5S...>3.
.\/...N..k.tM..F.|<'..2[..\q...=X...4.X...b... .j..nx-..i;TRV[. .!.
.......p....w.......(nr.5(..[...... .O.D.Gk..LW$}...d....j^...b.."....
[email protected]*.sa....U.53.?._..&e.'&
gt;...s.."....7<n.lM..Q.u..b..e,.;....~.s..)..S.[.fK.%~......Y..S..
)-.se.;<.|..~.....C....lY.. ..]%...!.....9..|...v.fk..,.8u...I.b..%
.J..' Q...1.)...K.w......m".b....O../B.0.....[......w\G../...f.....w.7
|%..Z.....9q..\.gj{T........z.r...I.*d...}..../sm......,`.U......$.V..
....F.}........:....)..D..M.k^e...W.:...]b.7\.`.}f.H.m.'...(...Lr.k..6
..k0G50.R.....D.........FCd.9.A.......s.Wi...yR.........{?...7X3 "|Y..
su.hsb0.......s Y..wo....9Y..|..6p..H.#=..]Z.G..K."._.H.a...........Y=
._..v.... .T.........h....Q......%Qa...r.X.......d...|.R.*V.O.n...#!.i
.... .9.b.1..y-....~..D.0.c2....=16..~.]....J.X..M...6........ .9..8..
.....Ks....W..8..ZA.......0.{.d`..QT?U...`#1...6..X/6..=.inZ...r..T.D.
..jidSH...0.w..$...../q...>i.#[email protected]..?......9.={..k
K.L....(p...b.;*e[.........l.`..@c.).%."..'.....U.Mj.?.9;....U.....zx.
P.6.'[email protected].."........E..y.?X...v........KY^....H...HA...vMg.....-
ji..B..E......aK.'n4.woUJ.T.. (.T..^...GW.]n...H..($..|.#|.....r-?..g.
..Y.....EP......v-.M.Y...Q....|...X.i......l....vMw..I-......X...;la..
.7.......B.......1...`.g..4N...OG"[email protected].."..
<<< skipped >>>

GET /datalayerconfig.js?u=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

Cookie: SAHSessionID=164f0fcc-0235-491d-8d43-dd85367af9bf; SAH=REFER=91125&SRC=REBATE; sahdsp=tbinstalldate=6/22/2015 12:47:46 AM; SolveMedia=H1:c60ef57601cd523f0739ed10bb37b82989c67264,H2:5da30ffb179f33b498a1065abad15d0c77b4fdf3,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:0e13aa58ada0f7cb73f006e69d2ab632,H5:2bc3adfd94e5e4177b007f850ef66489; SaagId=8d659088-6a0d-4280-8ba5-381a0a3bcfe9; CookieCheck=Y; SAHtbpi=s
HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/javascript; charset=utf-8

Content-Encoding: gzip

Expires: -1

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Server: Web06

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Mon, 22 Jun 2015 06:47:48 GMT

Content-Length: 490
..........t.ak.0.....O6h.../ a.:.@.`..`..Hr|X..tJ.i.{.vl\..@....;.....
.#......F X.....#.....S\|.)..-.^]g...7R..3._.s..v......r.....w..7.6>
;.R.p.."...*...}...$........\R............5K..........o.n{..".|...5wEc
=.`<.O.}W..S.t..N..%,i8.. .DUt.S..V........,.L..)M..6....=.<:X..
2"...E...{.dd.......V.FE.Q...^..8\[email protected]........
.....i"..W.<.........7...z...5..h.Lh.3.".9...-....}...Zd..re.o..?K8
"..#5.2....d.B..P-DM....W.$.k..F...$;[email protected]
.......u....HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Pragma
: no-cache..Content-Type: text/javascript; charset=utf-8..Content-Enco
ding: gzip..Expires: -1..Vary: Accept-Encoding..Server: Microsoft-IIS/
7.5..X-AspNet-Version: 4.0.30319..X-Server: Web06..X-Powered-By: ASP.N
ET..X-UA-Compatible: IE=edge..Date: Mon, 22 Jun 2015 06:47:48 GMT..Con
tent-Length: 490............t.ak.0.....O6h.../ a.:.@.`..`..Hr|X..tJ.i.
{.vl\..@....;......#......F X.....#.....S\|.)..-.^]g...7R..3._.s..v...
...r.....w..7.6>.R.p.."...*...}...$........\R............5K........
..o.n{..".|...5wEc=.`<.O.}W..S.t..N..%,i8.. .DUt.S..V........,.L..)
M..6....=.<:X..2"...E...{.dd.......V.FE.Q...^..8\....n........o.B.@
.i...7...u.............i"..W.<.........7...z...5..h.Lh.3.".9...-...
.}...Zd..re.o..?K8"..#5.2....d.B..P-DM....W.$.k..F...$;..SR.....V...Z.
[email protected]........
<<< skipped >>>

GET /images/bttn-claim-shopgold.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

Cookie: SAHSessionID=164f0fcc-0235-491d-8d43-dd85367af9bf; SAH=REFER=91125&SRC=REBATE; sahdsp=tbinstalldate=6/22/2015 12:47:46 AM; SolveMedia=H1:c60ef57601cd523f0739ed10bb37b82989c67264,H2:5da30ffb179f33b498a1065abad15d0c77b4fdf3,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:0e13aa58ada0f7cb73f006e69d2ab632,H5:2bc3adfd94e5e4177b007f850ef66489; SaagId=8d659088-6a0d-4280-8ba5-381a0a3bcfe9; CookieCheck=Y; SAHtbpi=showconversion=false; _ga=GA1.2.1409388095.1434955669; _gat=1; optimizelySegments={"172491114":"direct","172437468":"false","172419741":"ie","172406886":"none"}; optimizelyEndUserId=oeu1434955669145r0.9696937679864475; _gat_UA-2915199-69=1; is_toolbar_post_install=true; refer=960117215

HTTP/1.1 200 OK

Cache-Control: public,max-age=604800

Content-Type: image/png

Last-Modified: Tue, 03 Jun 2014 18:00:57 GMT

Accept-Ranges: bytes

ETag: "8052efc4557fcf1:0"

Server: Microsoft-IIS/7.5

X-Server: Web06

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Mon, 22 Jun 2015 06:47:49 GMT

Content-Length: 17635
.PNG........IHDR...<...R.......h.....tEXtSoftware.Adobe ImageReadyq
.e<...fiTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0M
pCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmp
tk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        ">
; <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"&
gt; <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/
xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRe
f#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID=
"xmp.did:18E19DCFBAEAE311B305BCB5DBB562AB" xmpMM:DocumentID="xmp.did:0
35EED58EB4911E39356D5375984A511" xmpMM:InstanceID="xmp.iid:035EED57EB4
911E39356D5375984A511" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:18E19DCFBAEAE311B
305BCB5DBB562AB" stRef:documentID="xmp.did:18E19DCFBAEAE311B305BCB5DBB
562AB"/> </rdf:Description> </rdf:RDF> </x:xmpmeta&g
t; <?xpacket end="r"?>... ..A.IDATx..}........03.w.P..HV.c.B.0`.
.p.....o.8p:#.......0'..6........$I`."[email protected] .)}..
[email protected]'Z.R....N.L.:.J..J...0..........;......%...
....~.o..S..Y...<{....z...;[email protected][email protected]
p...8`Y...........?..hB?..o...?W.u.?.S..M..l_....uKgD ...j....0.$.sy.w
.7.. .Z..J...p......p..LA.....{K... kf..}....^.^........W..0.v...a...T
J.T..8...%.....).......w@<...9.....]{G..o.Cs.kZ....#..Fc...L...TJ.T
...c.l.{[email protected]..'...5.....^.|...t.............^>...4.&.K.TJ.T
<<< skipped >>>

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 22 Jun 2015 06:21:10 GMT

Expires: Mon, 22 Jun 2015 08:21:10 GMT

Last-Modified: Wed, 27 May 2015 21:02:55 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11093

Age: 1598

Cache-Control: public, max-age=7200

Alternate-Protocol: 80:quic,p=0
...........}iW....w~E\'.U..e...6.^.L$.I.l.,.$......!....~...28.......j
k...,ux2..i.4.......21C5........x44..8I..C=...d_NO[...7*."..33.e.{2>
;..I..W..[......2....ZNe ...\N.i ~.$...i fI.2#.....S....$....t.......T
.g......M..A..>I..HI.&...9......l46.....l4..%*.$.....F.g..H...bJ.h.
.8........x<.f.Tx6.Z...%....Lh..ht..43..ht...4..i..!........`.Q.f.{
..vDW4.3.M...<..~b.B.....Wc*8.\5..z>.5....NeFH.......c..zi..S.zN
....!r...H...~ONGY ^&..Q.....F{.K.....ZX..*........I|....Nw...:..1...2
..M*u_.n....NFY..-.tE..[...x.m..j.....j(;..d0.*i.a.Mn}.klm..~....mK.f$
....Ov.>{......{...o..;z....._..T...N.?......g6.....]..7.76.<|..
...A.Ne.=....M=j...y... ...'.3..t24.......Z.40E.9J....p|.T.f.TS....F..
$'^h...h............-&.d.P...S..#..5jKZ. BN.Q...nn.U]7..5.F.[...}z.[..
xXQ.L...&.j....1r....<(H.......gK.vF.......L^u..!.c_MGG..;;..B.....
..{....W.$ruu...........sP.E.Li-m...{k.\ .....L..di?.-;oU7.}..O...z.z.
...z..j..\L.......h..s.C ./q....N.0sr..Dz4.s1...5.......R...T.P...]f..
..k......N.-L_(..lgW.2.Z?. ....L..d...0. JT*:jR.t*.)....|....*5...8Bh.
k...h>.....1..P,.&*....N.6....i......2..j....41.R"(*&.B....d.......
[email protected]<.....a....Y..:e&.bh..ty...=.N..&m....n.Yw.~-,...AP..s
..`......8.hC=.......Z.ibb\&.L."4..q...q..V.w....a.o...A.V..b6E......$
Q77..o..I......F"......m.K? ...}O.>...K...P.WD.....B.:..{...O......
.$N%......}j.Z.6D..3D...n."u...6M.`E=:#..?......Y:=PI.....$....`b..f3\
BR.-..!.....c.vf.&D([.q.a`Bs.........Yq.K.t..L.m.u..U..i..j..-.n.j7T..
f.5..F.4..<.......st.........KK..`%*ji...H1..........t.}.\.8..d
<<< skipped >>>

GET /r/collect?v=1&_v=j37&a=1859351553&t=pageview&_s=1&dl=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&dp=/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&sahusertype=nonauth&ul=en-us&de=utf-8&dt=Toolbar&sd=32-bit&sr=1276x846&vp=1256x669&je=0&fl=11.6 r602&cn=960117215&cm=91125&_u=QEAAAEAAK~&jid=2074980047&cid=1409388095.1434955669&tid=UA-2915199-1&_r=1&z=588593829 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Age
HTTP/1.1 302 Found

Location: hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2915199-1&cid=1409388095.1434955669&jid=2074980047&_v=j37&z=588593829

Access-Control-Allow-Origin: *

Date: Mon, 22 Jun 2015 06:47:48 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

Content-Type: text/html; charset=UTF-8

Server: Golfe2

Content-Length: 367

Alternate-Protocol: 80:quic,p=0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1
&t=dc&_r=3&tid=UA-2915199-1&cid=1409388095.1434955669&
amp;jid=2074980047&_v=j37&z=588593829">here</A>...<
;/BODY></HTML>..HTTP/1.1 302 Found..Location: hXXps://stats.g
.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2915199-1&cid=14
09388095.1434955669&jid=2074980047&_v=j37&z=588593829..Access-Control-
Allow-Origin: *..Date: Mon, 22 Jun 2015 06:47:48 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-
store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..
Content-Type: text/html; charset=UTF-8..Server: Golfe2..Content-Length
: 367..Alternate-Protocol: 80:quic,p=0..<HTML><HEAD><me
ta http-equiv="content-type" content="text/html;charset=utf-8">.<
;TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>3
02 Moved</H1>.The document has moved.<A HREF="hXXps://stats.g
.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-
2915199-1&cid=1409388095.1434955669&jid=2074980047&_v=j37&
amp;z=588593829">here</A>...</BODY></HTML>..t>....
<<< skipped >>>

GET /r/collect?v=1&_v=j37&a=1859351553&t=pageview&_s=1&dl=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&ul=en-us&de=utf-8&dt=Toolbar&sd=32-bit&sr=1276x846&vp=1256x669&je=0&fl=11.6 r602&_u=SECAAEAAK~&jid=1920325723&cid=1409388095.1434955669&tid=UA-2915199-69&_r=1&gtm=GTM-TWR3HX&z=1571068651 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Location: hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2915199-69&cid=1409388095.1434955669&jid=1920325723&_v=j37&z=1571068651

Access-Control-Allow-Origin: *

Date: Mon, 22 Jun 2015 06:47:49 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

Content-Type: text/html; charset=UTF-8

Server: Golfe2

Content-Length: 369

Alternate-Protocol: 80:quic,p=0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1
&t=dc&_r=3&tid=UA-2915199-69&cid=1409388095.1434955669
&jid=1920325723&_v=j37&z=1571068651">here</A>...&
lt;/BODY></HTML>..HTTP/1.1 302 Found..Location: hXXps://stats
.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2915199-69&cid
=1409388095.1434955669&jid=1920325723&_v=j37&z=1571068651..Access-Cont
rol-Allow-Origin: *..Date: Mon, 22 Jun 2015 06:47:49 GMT..Pragma: no-c
ache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache,
 no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 G
MT..Content-Type: text/html; charset=UTF-8..Server: Golfe2..Content-Le
ngth: 369..Alternate-Protocol: 80:quic,p=0..<HTML><HEAD>&l
t;meta http-equiv="content-type" content="text/html;charset=utf-8">
.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1&
gt;302 Moved</H1>.The document has moved.<A HREF="hXXps://sta
ts.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid
=UA-2915199-69&cid=1409388095.1434955669&jid=1920325723&_v
=j37&z=1571068651">here</A>...</BODY></HTML>.
.....
<<< skipped >>>

GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 22 Jun 2015 06:21:14 GMT

Expires: Mon, 22 Jun 2015 08:21:14 GMT

Last-Modified: Wed, 27 May 2015 21:02:55 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16075

Cache-Control: public, max-age=7200

Age: 1596

Alternate-Protocol: 80:quic,p=0
...........}.W........_/.>.!aj..f....--....Y.!MHB.0....o..-'.......
{K..y.....d.Wig.....r.H.P.. ............"..a?..;..P2...C.R.&..e....o.e
x"...e.....[..C.K...G:....de...d.F.,..|.=..Fn..9..//5$X...Co..=..'z2..
.`0..%[email protected]...#.^a.......Kh.'.C.....I.]......tp..:.sO...x..
.8...t0<....\b;=. .z.e>.1..#.v.j......<q...#[email protected]...}H1.C..
.R.5...z..XWb.2.t.......B.....[(i.....P...x.....9.nM...."...^.....c.. 
R......t...Z..q.hl......;.c.....9.@g_.(..n.hO....|......t`.|.)H..Z....
.l..f .j......J...%._.KN......Tf..g.^.b....r.I..z...UK.\^^.m....}..DA/
.......g.A........0.........".c0.....$~I....D#......{...}.=..j...m....
@.....k.?$....J..Q......}.g......~...6.l<]..x...d?.\...w.3].._.X@..
|....}.C..$0.|.53...Q.8.....i.0=Vr.h.........<.a>.....4.:...ttg.
.....f....'.T.`=..........a...oB...Q.q......3N5 ..<....R....4......
....K..I.i#..C..$#i....`Ja..:..z.*...O...?..41.!.w}......T............
.........y..pE^r..n....A..............q..`.i>;........ .).......m..
P61I.jK.nG..Vj......9.....2....Tv. ^. ........OZ....U.9399].).,.p..\..
\YW..j3..H%...........e.c.....[[email protected].=...R...
.]....xz.`.<..7........r1..87.....7.iL}u..Yu;T. X..d.GT L Uy.....q}
......./...=. ..<#u%..4h...mZJ......p.m...,,<..4.,o$..E.a&.-qy9Z
^6i-,@...".6.7.......-f;.`..f.2...?./.S<[email protected].%.|.
.:.J5.Vy...........%5....... ..g.*..v..".......K..e0....H.....n..6a...
q..I..8..:.q1`......Z*'[email protected]... X.1.....
.B.km._.Uzr..2.D..2..n..}8.wu.O....38..}5.c.`.. ....`...MC.....#A[
<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.4&utms=1&utmn=1396043444&utmhn=VVV.shopathome.com&utmcs=utf-8&utmsr=1276x846&utmvp=1256x669&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Toolbar&utmhid=1859351553&utmr=-&utmp=/1394716560/goal&utmht=1434955671457&utmac=UA-2915199-5&utmcc=__utma=57828200.1409388095.1434955669.1434955671.1434955671.1;+__utmz=57828200.1434955671.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=10251946&utmredir=1&utmu=DACAAAAAAAAAAAAAAAABAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Mon, 22 Jun 2015 06:47:50 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Mon, 22 Jun 2015 06:47:50 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0..GIF89a..........
...,...........D..;..

GET /pagead/viewthroughconversion/0/?label=null&guid=ON&script=0&ord=6450794183058108 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

Cookie: test_cookie=CheckForPermission

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Mon, 22 Jun 2015 06:47:51 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/user-lists/0/?label=null&script=0&random=799290124

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Set-Cookie: id=22f9aef20f02003c||t=1434955671|et=730|cs=002213fd48b2c832236ee604f1; expires=Wed, 21-Jun-2017 06:47:51 GMT; path=/; domain=.doubleclick.net

Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT

Alternate-Protocol: 80:quic,p=1
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Mon, 22 Jun 2015 06:47:51 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/user-lists/0/?label=
null&script=0&random=799290124..Content-Type: image/gif..X-Content-Typ
e-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protection
: 1; mode=block..Set-Cookie: id=22f9aef20f02003c||t=1434955671|et=730|
cs=002213fd48b2c832236ee604f1; expires=Wed, 21-Jun-2017 06:47:51 GMT; 
path=/; domain=.doubleclick.net..Set-Cookie: test_cookie=; domain=.dou
bleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT
..Alternate-Protocol: 80:quic,p=1..GIF89a.............!.......,.......
....D.;..
<<< skipped >>>

GET /dapi/data?type=html;sid=2wtw;ea=sm1;hema=H1:c60ef57601cd523f0739ed10bb37b82989c67264,H2:5da30ffb179f33b498a1065abad15d0c77b4fdf3,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:0e13aa58ada0f7cb73f006e69d2ab632,H5:2bc3adfd94e5e4177b007f850ef66489;_t=1434955671223 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: data.solvemedia.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Date: Mon, 22 Jun 2015 06:47:50 GMT

Server: Apache

X-AC-Origin: ccsphl-prod-152

P3P: CP="NOI ADM DEV PSA PSD UNI COM NAV OUR STP"

Set-Cookie: _sscn_a=SAJZ-OVOrdedy8N4vM5ncf79lqvgtHJM; domain=.solvemedia.com; path=/; expires=Thu, 19-Jun-2025 06:47:50 GMT

Location: hXXp://data.solvemedia.com/dapi/data?type=html;sid=2wtw;ea=sm1;hema=H1:c60ef57601cd523f0739ed10bb37b82989c67264,H2:5da30ffb179f33b498a1065abad15d0c77b4fdf3,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:0e13aa58ada0f7cb73f006e69d2ab632,H5:2bc3adfd94e5e4177b007f850ef66489;_t=1434955671223;cm=1

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=iso-8859-1
1eb..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<HTML
><HEAD>.<TITLE>302 Found</TITLE>.</HEAD><
;BODY>.<H1>Found</H1>.The document has moved <A HREF
="hXXp://data.solvemedia.com/dapi/data?type=html;sid=2wtw;ea=sm1;hema=
H1:c60ef57601cd523f0739ed10bb37b82989c67264,H2:5da30ffb179f33b49
8a1065abad15d0c77b4fdf3,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c
0,H4:0e13aa58ada0f7cb73f006e69d2ab632,H5:2bc3adfd94e5e4177b007
f850ef66489;_t=1434955671223;cm=1">here</A>.<P>.</BO
DY></HTML>...0..

GET /s/noticiatext/v6/dAuxVpkYE_Q_IwIm6elsKDoGYR7Z3iWH66EXnaJoKgg.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/eot

Last-Modified: Wed, 27 Aug 2014 14:51:34 GMT

Date: Sat, 20 Jun 2015 16:05:12 GMT

Expires: Sun, 19 Jun 2016 16:05:12 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Content-Length: 18076

Age: 139355

Alternate-Protocol: 80:quic,p=0
..........t{eP...........S(.................{qw......o...\2.7.{....C..
..A(.......... ........._........R.T...R`......w ..c..%.#..`.0./L..j.,
.^.U..T...h....Y........p./w.8..e.....s..X..o'......W.V..'.....x..<
...X......,.|Id..g.7.,....<i.).x.p...r...amYtF.B)$.(jK..9..M.<-S
&.......i.^.4.\.....\.Xs[C.a{..h.....V....O...57d...:.l.7....x......?.
6.. .C.V.@..$X...J......b!..N..o.F...[]... ?G.E.e......N.|.....u./ao..
.Ms... :v.p..x.EPw1.0.k..h....V......Q.b.73.g2..I.'....Gr$..)$`.......
S.6..}21IU..x.]..v....G.NG.'%;e].h.o.......}pr-.......QS ..J.wN.a.e..N
....U4...m....#....&<.ZQ...B1...."&.....%[..u..&.l=L !,a.... j).,..
*.0..x.n..,fx..4.y.........Wd~;..vW..2......B6WK....2.-......,..\.....
.u...9vN~/v.V#zrXOT-.......^7....v......?OG.|...P|....u.....&LC.V....d
.JZ.?i.......8..k.s.{.O..\.m...h..9.s.;1.E..*.R.....H|..R.Vy..'R...kF.
..M..$5N.I.~.-.^.:.....G..0;....*d.v..h.0Y.r.p$.e0:r...F...OX...SX'W..
Gj..w...$..5J.._*(.Y.P%.."..,......A..6.'"].f ..2=VV.....Qk.x.lA.7o!K.
T...u1..p?7H&...%2..E/./9.#.pZ..T...@&c.....w.Y..>...6W.Q.!X...."|.
.y.....aH.9P7.a.L..L-..Biw. SY._Z...s.2.6`w-.....V...z..sXKzHI..V...&.
... . ....qd.............1...p.L.i..D.T....*.]..E}E$.8...{(......F..`.
l.1..6....._P.....i.GG.Pu....6.O.Yj....L.1S...v...h.z.._.....f.....h  
.v.....N..[.B.......!......].......g..V.@.".qt.N.T.5.b1. 8./.......T..
.....ox-.b6j.e.......17/........./......tD....~.......:..\.q.....ye.I,
...N.B...........,..>.I..1...A..@E1nF..............]u_'q..b."....|G
_..Pd.............x3.nhZ.LZ.......E....)......J..fn.Hy... ..`.L.%.
<<< skipped >>>

GET /js/html5shiv.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Mon, 22 Jun 2015 06:47:47 GMT

Etag: "6d7b1263d67d01:0 gzip"

Expires: Mon, 29 Jun 2015 06:47:47 GMT

Last-Modified: Wed, 25 Mar 2015 20:49:13 GMT

Server: ECS (fcn/9F8E)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web01

X-UA-Compatible: IE=edge

Content-Length: 2808
....I..U....ks.6.{~.......N...~.y5Mf..sN?..."!.1E..$.g......IQ.}mo.3.L
p.............}L.r.&.G.'...&O...s...O.-.(..Q.V2Z...-.......?.....) ...
~r.8...TsQ.......d"]-Y.G..^..I.....yq....&B..}..d.i"*......f..X..\/...
.............s^.J.Y.<2...-\..!.)I~=....;..4..^..V...Z.KM%...}.g>
.t.j..~-.XU..%.!.....E......I.Q.[.$o.'.......|..#...gu*2Vg|].9 2.D.?..
...Q..]....I....XQ...E].....e........Vk:.....j..:...WE...L...E.t.$..2.
.B..jUUB..26..B. m..%H.......A. /"..-...31F.\.y.:.9Y.b^....E.D...Th. .
.] .......[..5t..=....'......"{....6.^.4..eTS....n>^".i..o#.Uy^..r.
8=./..{.`...B7".......p?2....`..9.qD..q.L'.,.D.GY.\^.....?...$..0.Y.Jt
..I}E."|YY. ..f..*..A.9....Q.S.l..4......#K:B..##..|OR..N......LjR.r..
vzJ.b....?)[email protected].........../t(.[..Z..aY.z.... ..V.K.....=u.I.W.$qk..
~U1.-.71....G.V%.,....aw..$|g....}.M..l..{....4.YP...13.. ....6h...q./
....N..H.".9..K1..l.A.2A..~.FS..gg....(Ah...h4.vD.X|O ....?QH6...gC..L
.G.....-gZ.r..V.=.FP........x?C.7....E$..A....!l.;<.=E.R.v....~8...
...8.1.....^...........f....G..../.........O.a...A#.....[...\.r.. ....
R...IA.~.Qf...\.%c......I.........._.......FQ)...i4.{.0...A#6.L...6RbH
(A\[email protected]].:.q. ..H.1..|.,OTUpP3.F....m......I...E....].*..?.q...
d.=#Q[..H.........mif.6hU..:.......x!..{.....P`.%W.....a..............
..-U...5{.......*.M.....{.[..........X..l.....U...........y.t..a..1..C
.....A..R\.8h......o..9...q=.....Fw......#v.n.....k.....6.......BM.75.
......i.9.u....L4D...p.$......b.........l.(.d!pBh...K....|.]cJW.y.....
....j...32E..b.4.X<.......M...4....X.).^.e..1..Ig.1..hcw.g(P...
<<< skipped >>>

GET /js/tipped/excanvas/excanvas.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Mon, 22 Jun 2015 06:47:47 GMT

Etag: "e11cc263d67d01:0 gzip"

Expires: Mon, 29 Jun 2015 06:47:47 GMT

Last-Modified: Wed, 25 Mar 2015 20:49:13 GMT

Server: ECS (fcn/41BB)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web03

X-UA-Compatible: IE=edge

Content-Length: 4290
....I..U...:.s.....S..\LJ.%...wd........M.......$D..H..,1..... .Jr....
.L....b.X./p<......h^iG..[.C.E......a<....8`i.Bm.....9.Nr......7
V.q.jG.D3p..Q..".:[j.ZkiVi......f1..... -N. [.IL..i....u$..D..42..0...
.z3u.F .....*w...jeQ.....8.............,..3MXYj.{\..l..5..K.........hT
0.U...*.*N#....Z..!.0.."..UOb...ou.....~r.]\.......A"._\....k...._O../
.../_../.././.\B.W...F.....Dc /X....w.l.(K.r.]1.ca.......,.`ki........
).H.Y..K<.....L./..V.../..0....VVP0Z...a....>.R7..UgYZ.u..2[..R2
.....Ag..N.j>..XU..;...).;.7...n...A5.54&b^.%YQ.y..n.........7.7_^.
j-.<[email protected]{f0...L.......w....O.&..(.C..h.....q.......C...h...
........5N........S`(./.e.7.V-.......[..[!..L.`Y. ...j~g..rn<....g.
bV.-.'v..$....[kl....q.v..9..Q...B.....IZ...y.o.7..;~V...D.......h... 
.t..2...J$WU.0q.pu..&.....D....~..j....?.8.tP[V(..h..p.*...O..^4...$.i
r..s.....QW.,..U.....}.?...._..Zq.@\p)...9...N..s......w.C.n..l...8.Y.
a...Q..N.2K...p4`.X....$...{`.=..V.R.......l.....t..tK0...[..;......g.
.t....lE..=.)..`1u'd3.L.f..o....m".g......F.u..P.\...L...yz......Dc.U.
/[email protected].$3O%. .L....'I..A.t~.Qsw#....]..e......cv.M..;...Fp.....
i....F....%.f..Ss.....K...37S.O(*..(B......r.h..Uh4.6-..w..M..]*d...r.
..A5..0[.&....vZ.....x..}..JV..be.........]u.....O....(-U:..F...I.....
.N....0.h..F.BP..1...2...:.7..8..Go.)..8.hz..n.}6.f.i......}...[.L.dJn
'.....*.-.<.....]rQ....V..P..L...T...V...Z.3\..Jc@... ...K.`..p&t..
..V2p*..J...F.%kX.......-........A...uG...B^....rS.TM....$.-".%Jrd...)
1..p.....9.X..V..|.3...n..r8kw....^.V......3.}.x..H.M.......-f...L
<<< skipped >>>

GET /js/CombinedJS_16C48997C531D7EDA08CDC195581896D.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Mon, 22 Jun 2015 06:47:47 GMT

Etag: "55747dfdfba5d01:0"

Expires: Mon, 29 Jun 2015 06:47:47 GMT

Last-Modified: Sat, 13 Jun 2015 17:11:30 GMT

Server: ECS (fcn/418A)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

X-UA-Compatible: IE=edge

Content-Length: 108487
.............v.H.0....B.JD1EQ.rw5(..-.....k.]..V..d.D...X$.%.3.1..=...
3.2/0.0.....E...{...........X.......~.....<..\........o.........'..
0..(......?..Y.G.l.1.A.d]...K:.ky.l.L.&.'...n~..2...5|...~.M.h......e3
h.......L..:T...e...-..,.B~sC.#..~Fy..L.....L/.X$R....l......u....n...
...L.<..lk.U.....` F.3.r...%.,....nv.........GY.....iv......9....u.
<.q?....u.t-,e1k.....8M...*.X....X.2.e.....T1.Z..O.0..&...G..z.s...
r.............?.!.f.............K..t....j'..;.j;..{"..`.\..8....\H-e].
...*..)|WT..>...C.m...9..k'.....;.... o....u.Q..7....nP....={..s...
...._`DQ1M8wb.k&........;i2uw...w.e.....7.=k..W./.....m..Y....z.w..eo.
...(...$......m'c.....m9.p..8.]F.g...gr.|..r..g....'G^..6..l..r..\...n
n.O..CS.'4.~B...g.f.6..G...,...)...4....R.....\.S...e..p...<.d.3.=.
.[....8.1.....$..\XVo.?...V/.Y.......P....;....f.~..y...6..........f.q
.wJ..m..Vr.l.-MoP.>AQ..u....=.....5..v...us.[.C....../..A.."u""H.9.
.&.r(.=.:4...v..Rg{....<8.X...S........a..X........f...,.s.......@E
..C....~.....G......j[..0.X.BC....v.p/[email protected]..!.u
.7....r<..%.> ......{..u}.%...*CZ..M.....'........._....Mz..(.&.
.. ......%{..;..Kw.(.S.q.YfGcTD.4_...KL.?......G....W.t...v......i..^.
y.....3 .g.;4 n...6.i..........Y...,....w...s:..O~U.8j.4\.l.k.=b2....U
..)I..]u.W)F....k.k;.z..va.H.E..1.q...#.(..s.'.. ..-.........!...@..!#
F.CN......._A.Q.-....i<.n$.......z..N...R..T)...Gz.......4.....{...
7...Ff..~.._..5u..l{[email protected]......>..%.h.5.c.?...8..E..!0R
1.S...S.......F......CZ.q.:KRN...O..$J.~.......(NbV...2..q....OG1\
<<< skipped >>>

GET //js/browserdetection.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Mon, 22 Jun 2015 06:47:49 GMT

Etag: "4912ad263d67d01:0"

Expires: Mon, 29 Jun 2015 06:47:49 GMT

Last-Modified: Wed, 25 Mar 2015 20:49:13 GMT

Server: ECS (fcn/41B9)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

X-UA-Compatible: IE=edge

Content-Length: 4789
...........<ks.F..S..0a.Eb....AR...8.E.-.,.... .H.EX [email protected].
r.Wu.T4.~LOOOw.Lc......|..pH~..p...,....I..).%x.n.Y.....q.ZY....0..c..
..._...-.E.R.:.l.q...@..=..N...m....6a.... .......6.$..d..E.........1.
....w.....=X.I......M....).8.)%s.%...`<"?....4..t..0..:..........2&
gt;...Q....|..IV.U.......uJ....#?'.j.!..oo?.R...:'#..\$YF..S{....-....
.....8g..H.d..G..R2.........][email protected].?..5 .k2..]N...).'Ib}......Ye.\DS
@I0..k@..(.....:..c2."..........Qr....t8......Z$.~...p.....#.`...}..`.
..h]]...eR....^.w..a....r....i|............w...I..>...IN..7....w...
T6..(.\.(.<....r|1)).....}[email protected]"...F...k.....m.E..TkZ6ge
so...46a(l...D....i..9O..]...v...I.y.........Y......nro~<.L.>...
...m..i....{....].9....=..z......7aFW.8.T.M........<...z...\..W.!..
...)......|BX..KQ.....<...Z........C....(........P...O.y_'.....;..h
f..M..7.?....O@..>%[....)';....dG.y.-...O.C.l...Rd..%XeA.....X.Ez.y
../..P!...vQ.K]m....B@[email protected]..$..x...`HK.H..S.h..._.J0..T).o......
`.uR.4X{G..G .. [email protected]>.X../Y....9.&..S9.Au..YJK8.BJ.........'...
*J..{J>.m..:.k.....hI..c.O6.#$.4.5....u...Mp...........q.......b...
..)......k...8.a$.. .A.5P..l.yeK...........&,...P.....l:e.-.....[.<
.cG.. ..l........{...?..V...NO.Tm..g....'..x....6.P..1"....k....U....'
[q......~.E....e.....cs./d<.............;.r... ..l.S...,.s#...Z..:.
r.l.T..../.._[6.......Da,...d g..2..M..<G.h.."...%....X...(..K...:.
....... "..v; ,f.kI....?....w..h8...............\..9.....<0$A<..
..`.yhN..f.Yp..~p...sK..'..`.]&.Q..'...............{.6....b..zy..d
<<< skipped >>>

GET /js/jquery.browser.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Mon, 22 Jun 2015 06:47:49 GMT

Etag: "6d7b1263d67d01:0"

Expires: Mon, 29 Jun 2015 06:47:49 GMT

Last-Modified: Wed, 25 Mar 2015 20:49:13 GMT

Server: ECS (fcn/9F97)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web01

X-UA-Compatible: IE=edge

Content-Length: 1200
...........Umo.6......W ..D..t[.{Y..k.6..%[email protected]"U......;R.$w.0$A.{
y..9.)>|.....?**...)..J..W...>.;...TLp8....i..x...........A.....
...2..A....h....-.UQ*.xZc;..T.......hl..M.LA..3.ij. %%...iD..g([email protected]
 ..........Hs..L\.W.....5.....pR-.......T...E...^p.3...$w...|.l..Aw.?.
./..P..M.........K.YJ..u..o..G...)..4jR`[email protected]>.W9j.ho
...):.- .:IMCOB?...`.$..;......R..'...{.u.t..Ni....i........ ^........
GM..Ti8........[...*../.Xs/.......q.!d..-.|...$.... .r..:.:!.#8...I..H
.2')...........$.:....kLu%9H'..B........x.n....X..HX..$....,.c`T.PM...
.A.o..8.... .%..G.f0.....m....1.O..l.<9.. :..X.9.,....:....$.....N.
.......s.(%.Sx...m.{........o.3I....x..)..L.`}....RKjI..orA..*C8I...p.
..f.E~..nl....</.T5UZ.Ih...6[..A.]...|..v7|..4Rb..-...T.sMVlApG.\;t
.h>3.~...4...a.mv.........&.\l...._k.p.[`I..-M..|...^!.8.b&a....p..
....:..f.-B.k...&.N..a..T \..l....."-........4..o.....e...>..;....!
.$.~J...I].f.p...f.....|c........[[email protected].?".....q4>.
[email protected]_f....XG ...(....YM3.u.llR
.9.....&.,c`.-p[.8... K.v......5.. ....6FU\(.D..)..Lp.........:.......
.K\l.....C..5.^..>...m.){....."2.]...G6k7.a...so......6..5.D..q../.
? v.5..|.z.W(z...Y..._.B......{.B........
<<< skipped >>>

GET //js/toolbar/toolbarutilities.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Mon, 22 Jun 2015 06:47:49 GMT

Etag: "99713296469ad01:0 gzip"

Expires: Mon, 29 Jun 2015 06:47:49 GMT

Last-Modified: Fri, 29 May 2015 19:35:15 GMT

Server: ECS (fcn/41A4)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

X-UA-Compatible: IE=edge

Content-Length: 3274
....s.hU...[.r.6........kR.....m...q.4U&........@$$1....-{.?...G.W....
.".j.d=.H....9........ ..KJ.....8.yL...Np.b|>yOB...~...o:#..F).8IHt
..y......!....`...g).$....'...W<..T.E...9....wR<.j..... ..{_.{F8
..u{'j......$........J..../...Ig|.~D.=-E...g...s ..E!....$.....fI..)..
...L...`..y..i...[LR.....,....j>x.P].~..GB.K.NHSF..$t...n.^..,3...}
.r.^bN...d.ty>...*.<[email protected]...
.^..dC.It.......y.......H.<$e...X..b..g...../...%..c#..F.U.......0.
.#.....8.C...,........^Z.)..bl..{./.<I.O..........[7m..Z........i}5
........U.....,.Q..Oq..Q.".J.L.6.W...[..z..D.].j..^........ .3.v..=k}f
....5.jm...P.........!...B...u.Y$... $.e..h..6<...k...A..Nr....J.@.
.0_.-AH.%....Y8/.d..1...|Z...(.......-..y..p..rp"..v...r.gp..../lTNP& 
b..`{1..I...'L~.mi...~!..J..;q.5.]... .....|......q.>..<vR.P?.E.
.C..............<c.2J....uWd...........O`1s..f..W3..o......KQ*.k/..
...u.a./. ....5.....C.v...~..M..............]T...h.J.=._......2....v..
M.=q.Lq.X.,....].f...).4....<g..YaQ$.Ya.WE...b.bb..aZ...?{..k...n.V
.M..6.......[...iFW......a....FN....cx....Y.M..x..RsOn.|!.._H*7bY.....
[email protected].... ..m[../.*e.H.D.^.W_. ...>.'Y@=
.g..p#....E\.[~D...i..r.....b..V..(f........N.....y...~.,.....;.l.P3].
ne..*..`...S...Zz...E...xN...g`...),.......agl.d....h ....RX........&l
t;....QB...9.9.{..'(..C.5..25.T..X.C%Y....H.).6........4.>n#kJ..-..
9...B.Pv...C..,.Y..$|...,...w...H..v .N.0..-..J....z.]..W.kOY..UyA..4.
. .[C.F.].w8.]cO.....~.....].....Bu.`.q.\...U.....v.g)..L....TX..n
<<< skipped >>>

GET /js/jquery-ui-1.10.3/ui/minified/jquery-ui.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Mon, 22 Jun 2015 06:47:49 GMT

Etag: "5da77818e388d01:0"

Expires: Mon, 29 Jun 2015 06:47:49 GMT

Last-Modified: Thu, 07 May 2015 16:30:14 GMT

Server: ECS (fcn/41D4)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

X-UA-Compatible: IE=edge

Content-Length: 60616
............{{...0..~..m...R..t[0...v6y6.....}...LB"..`... r?.o....Jr.
..mv-../s..............?.|......t<................=:Y..69;..?..../.
kH..\nv..IN8cL9u>.{..I7..*o...j...Wuvu...t.....^.M.OOz.o.e...j_r~y.
...l.SY.U.............].v...6.......(.Mu......(W=Y..\.g0Zn..?.......n.
UO..YoN......Zo..[..v.i.....f.m....O}Y..o.m...eg...r.$m..h..... ...]..
A.v..EYvR...7..6-....g..c.KF.N../`..z`L'Y.:..u^.,.......nf'_...l...7_.
9yt.o.%.....8.n..I..q......2..,..|\....].0.....~.5y......e..y..iZ....o
..l..*q.......x]......ip.m.t...<..6.....8.P8.M0..."..&.x0.NO.0..d0.
...(..v..y...Z......z.wH>..y..u4..p..<..$......ERD.t...j..-O....
........f..h.h.....Z.#&...8[...-.._\Z/.l-X..U^.....i.v][email protected]...
.v}..H'..g....b5.q5......H..........\......AB.I.x:...?>..On......~.
.........|.4......._.x."...../..6..$~.....g...........gO_.H..G...o^$O.
.....7........WO..}..y2..../.}......t...........L..O.(.....7_.........
..?.....7.......|..................z....$.............q.....?.X...C.ku
Y.......&Q[.w\%.q.6..]..k....6..O.9n.8..ks.q....fM..)..j....d..0....1`
..B...C...l..|d.....5.Wt8.4x....u...".K.....q ").....i.Q,.u.....H.....
b .[.E.....j.k.c.x.4....Y({..f....|..a...}.6^.{...t..~..n.h.K.}......I
...N.....W.&>..9.?...I..p. [email protected]..?h...^\.. M.H"4.$....fP......
.C..&.. .a...f.(.8...Y...:j...m..r...5.} .A~..........&..l...g.Oay.E.m
.mXB..._Fr^....y... R'.xW.p.~.J:;z.=..X...P.J.F...d8,a..q._..}... cS..
...Gcn.i..p....`t.P;.A.A.,.[...D.JK....U..V.....Eo2i0h..........c...by
.\<Y.*[email protected]|..T'.K}U.2...I...~....XJ...u..
<<< skipped >>>

POST /RequestHandler.ashx HTTP/1.1

Accept: */*

Content-Type: application/octet-stream

User-Agent: SelectRebates

Host: tbws.shopathome.com

Content-Length: 565

Cache-Control: no-cache

Cookie: SAHSessionID=164f0fcc-0235-491d-8d43-dd85367af9bf; SAH=REFER=91125&SRC=REBATE; sahdsp=tbinstalldate=6/22/2015 12:47:46 AM; SolveMedia=H1:c60ef57601cd523f0739ed10bb37b82989c67264,H2:5da30ffb179f33b498a1065abad15d0c77b4fdf3,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:0e13aa58ada0f7cb73f006e69d2ab632,H5:2bc3adfd94e5e4177b007f850ef66489; SaagId=8d659088-6a0d-4280-8ba5-381a0a3bcfe9; CookieCheck=Y; SAHtbpi=showconversion=false; _ga=GA1.2.1409388095.1434955669; _gat=1; optimizelySegments={"172491114":"direct","172437468":"false","172419741":"ie","172406886":"none"}; optimizelyEndUserId=oeu1434955669145r0.9696937679864475; _gat_UA-2915199-69=1

cmd=ar0&xml=<?xml version="1.0" encoding="utf-8" ?><AlertRequest><Cust><GUID></GUID><Id>40336643</Id></Cust><Dog><GUID>{01049F0F-5795-4B5D-935C-3623810093BF}</GUID><Ver>5.2.0.0</Ver><TbVer>5.2.0.0</TbVer><Prefs>1</Prefs></Dog><Requests><Request><Type>Favorites</Type><Id>5</Id><Src></Src><String></String><LastFavorites>-1</LastFavorites><LRFav>-1</LRFav><OpenTime>1</OpenTime></Request><Request><Type>Checkin</Typ
HTTP/1.1 200 OK

Connection: close

Date: Mon, 22 Jun 2015 06:47:50 GMT

Server: Microsoft-IIS/6.0

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Farm01

Etag:

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: -1

Content-Type: text/xml

Content-Length: 138
<?xml version="1.0" ?><AlertResponse xmlns:xsi="hXXp://VVV.w3
.org/2001/XMLSchema-instance" xmlns:xsd="hXXp://VVV.w3.org/2001/XMLSch
ema" />..

GET /Content/SiteCssWebformsBundle?v=47 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Cache-Control: public

Content-Type: text/css; charset=utf-8

Date: Mon, 22 Jun 2015 06:47:47 GMT

Expires: Tue, 21 Jun 2016 05:18:36 GMT

Last-Modified: Tue, 09 Jun 2015 16:40:08 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECS (fcn/405E)

Vary: Accept-Encoding

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web05

X-UA-Compatible: IE=edge

Content-Length: 46223
......wU...........W.XFkq...@..*...lu....Gr...=k.#[email protected]............
.[.4S.b...q{x..y...6...p..]G7.....[..f..'..nC&..=...;.........l.59X...
..p\W.2..uM.59..M7n..U.?.....t ..m..0^..f.....~.%..xW|.w...).....z..7.
[email protected]....[....xw.Z.5..X.o.vG.........dw.~6zv#h..qu."....v..F
..v3...............NG.Zo...)..oI..F.ns7...!.Q..G....'5.......>....|
.......^|.G....#94.........I..g=.cQn.....O.b..d...z.o..bw|..S;..N..@9F
bOgP..dC..5k..yp...yT..-X.>.M.]o...z..im...<....;..H..(..&......
.u.....X.xF.Y...p}5.......\.x...MYT..>...Y.i...........~.-nI7..UU..
U........~.s........^...~..?:.=)....c.D.i.=.u.W 5.,..a.....a..u....}..
EY.7G..HwE.........N.....k.?.......j.d....I....$......'.#.i.........oO
G6:..T...t..[[.a.i._....j...*.7k.....,e.@.#...V...$f.,..g.$t.W)(......
8..kB.....eY...=.n....n.........m.y.v..1D.,y.c.L.3~...J28w|-..z..J\l3.
Y.*j.k..H....8...p.5..l...Y.h$f.a*8...)>.....x..9..v.{-X.==........
..)|....%%...A.......0.K....H.!..^.....jt..)..}..LA......#66.w......r\
.?._.F...]...............u.......(..kUUzB.k.=v;......W.&...^S.......Q.
|.*..z...}"....T.$.......z.......J"..w. %..~...f^.M|A../........`E...Q
~..........F||o}.%.}2.......b.W..[.......J....C......g.. .1.[...9...2F
(.2c'L]..v.[z....@6..!o.1Y.j........,6...uE..E..79...._ w.n...L...^..t
.c"..4...n6.I.....^7#.....6y..H...C1../".p..........b.9..p.GZ0a.......
.Tn....*B8..U..J....7rZ.T......K.l....;..5..a.lR.\.K.8..}...\"T..;...-
g.[.(.GEuitU..j...l.3..eG.l...s..f.[.....T.v..GWE^.r...<....&....Ho
oG.........V.zsh....jz.WO~...(-R.,.Q...4.3.3.-................,%..
<<< skipped >>>

GET /js/jquery-ui-1.10.3/themes/smoothness/jquery-ui.min.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: text/css

Date: Mon, 22 Jun 2015 06:47:49 GMT

Etag: "9da85918e388d01:0"

Expires: Mon, 29 Jun 2015 06:47:49 GMT

Last-Modified: Thu, 07 May 2015 16:30:14 GMT

Server: ECS (fcn/41CE)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

X-UA-Compatible: IE=edge

Content-Length: 5272
...........]{o.F...>.w..2.hS........]..!....;.....".$5.G..~.O..(...
13b.~..........D...D....?Fq.yy.L.V.)M..8Y..._.....m....'.<UWy{...M^
..2l"......U>...,......yq.[`[email protected]..".IW.O.w.TY....#iNvY.......s.
@q.%...4..I>z..U.J3tU....ap........N.k...y.....mQ...x.............k
F..uM...-...2;....!}.5.....=h....f...W...Y.5m...w. .............N.....
.n.c[..O$.F......F^.SOD....j.3~..r....._.,..WAq.~... ..-c?..\<...].
..N&..$?..H..C.~&QTy........T. .l!.r!.........|_g.`.!..b..bE.A.Y.f?...
....ni?.....j..J].x.........`....j..Jo..WV....g.t.(v ./n..E....l./.M.~
.F......h.Wo<:P....&n9.zIu..V..W..z....k> .{......K.9./uE......,
/.,..0.U.F......:{..T..r.-...]k.......Y.>;,E..Q. [email protected][.
...k;Q.O.?.r.K..4q...c.....X..y...S.i.....-..>...}.9.....*'.@..?>
;..}..A9>..#}|...4...:...i...y.C~..T.....6.6..n.C.........P.6..e{..
}.lb..:SY....m.eEQ5{.....A..d..>.d.\...r....E..`.hx%L{...!....KA.V.
..0....i..p[.rbH.d.L.o.3...Z.G.yM...^6;RB._.^e.H.s.......Jm.t*..s.\Y7.
.....E.7;.I...X5...N........j.......K..].0. ..D.<..!.NX...=....../q
.....e...c...M.[..S?....../..k.1kFFK}ZY..n.'.C.#(/fq.c3.,.......:...S.
......1n.O.U.A#.0..W....q........[..k ..~.iO P@..>...Sh.4..59F._w..
uz4$...p..b...*%G......w..?.z.=o!.........uk.*M.4F...W.rn`..11./r{P6FG
...6\.He..i...G..L...#n-.yLaL.Y|.*......Tms...*..8...l..&.k./.....N5..
..?5A.......?.a8)...e..dl.r.EX....q..."4q......F..F0.. F.ed...."...o..
.._-.c.pQ..REKWv/j.......4d:B.:...SB.U..l.".!..Z7U7...X........9.A..%.
K.qg..WMw.5......bV.a*[email protected].|....n.S.Uzx...o
<<< skipped >>>

GET /styles/tbpi.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: text/css

Date: Mon, 22 Jun 2015 06:47:49 GMT

Etag: "ec578918e388d01:0"

Expires: Mon, 29 Jun 2015 06:47:49 GMT

Last-Modified: Thu, 07 May 2015 16:30:14 GMT

Server: ECS (fcn/419C)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web09

X-UA-Compatible: IE=edge

Content-Length: 870
...........W.n.0....w.ZUm.8..Y3z.U...]..../.F..4..d..#..f...P...vS..p.
}......?.M/... L*D.....~N.^#.Kh..z....)p."..AL...l.>...G@_..\......
......g.&('t......e..2|..%y.......t.I...0.rDk.%....\.4;r$R...%..^-U.A[
.P.....Zi..w...R.1.hO...Z..leN3.b,l.1..E..6N....H.2.7D.2.|.bh..EQ.X...
.4..&.v.^..W......J!.S.b...P...........|.;..YY.pITk..8..'...._!W......
...m..4...W...h......._n"./........j1g.>...[xp............#........
S..t<..,.._6).H7...m ...... -{.Q.......~...A..J0..J......a......O.7
i.vg.V.^.LI.R,.).!.P..(<..,=.........:D./[email protected].#.<Z.B
.n..;.fL-.].{.\.B....9...........n......7.*.h..BO............B...dQ"5.
..j<.@.^..vR....a}...".4.V..J.....F .;9..mB.b.B*.......PBI.[.....g.
...S....S.N.].%.o..X..0..`..-...F...o#.m..0b......F.N....C....6s...].Y
5d.W[K..ds.#w.....>&.G..@gf..._.H..w.W}=.`[email protected].
.d...W}...3.l..4].6..X..v..Fk.6......y........%1...HTTP/1.1 200 OK..Co
ntent-Encoding: gzip..Accept-Ranges: bytes..Cache-Control: max-age=604
800..Content-Type: text/css..Date: Mon, 22 Jun 2015 06:47:49 GMT..Etag
: "ec578918e388d01:0"..Expires: Mon, 29 Jun 2015 06:47:49 GMT..Last-Mo
dified: Thu, 07 May 2015 16:30:14 GMT..Server: ECS (fcn/419C)..Vary: A
ccept-Encoding..X-Cache: HIT..X-Powered-By: ASP.NET..X-Server: Web09..
X-UA-Compatible: IE=edge..Content-Length: 870.............W.n.0....w.Z
Um.8..Y3z.U...]..../.F..4..d..#..f...P...vS..p.}......?.M/... L*D.....
~N.^#.Kh..z....)p."..AL...l.>...G@_..\............g.&('t......e..2|
..%y.......t.I...0.rDk.%....\.4;r$R...%..^-U.A[.P.....Zi..w...R.1.
<<< skipped >>>

GET /RequestHandler.ashx?MfcISAPICommand=set¶m=

I-7cOM4DjEMHro-mFEESbqRzRRe6jzF6TSyknmmJRZ3MnOnMxU-cDDjXvKLw7jRpwn9NDNma30SQn6LxQzCoGuJgX-ahxDwW62-2Ce-cg8g8YE_OCsHQQ8736qtlvmM6TCLrYSSElIz6S2OqQqUa-knmlJhNeRQf2QF3Q0LZwEA7R-76JzV15FXe3oHwQD6Qbjq5j40GG2mNXCZUq7tdEjcKw3GDqr-vYLdMN41bx5PRVEKP1jEYAVjdx4jFhOS4NR-9R33VIMJWbW-kribLlP13Wd5qILkRoiUU3uqsMcPvng7FUDgwG1NIU7QPBFOKTqWe2MwLpXUjIi7A_MItAm HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: tbws.shopathome.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Connection: close

Date: Mon, 22 Jun 2015 06:47:27 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: -1

Content-Type: text/html

Content-Length: 460
.....'...P.I:..C.JUd[."%i..>rP..w...M..H..D...p...!....../..u......
.~6)Ko.u.\JX....C..,e...xa...k.($j%....u$....3:u .]....48e..w.. <j.
...v.U..Y..6wS]M..(.X;...b.c.....g.....:I....G./......[KL....^..hA..GT
..W-...H}..c3x.HY....W!....g.n..m....C..&..)....m.X|......J..W..Y....`
....y..~..~UX.V.f....Z.....-R.......*..m.~.S*.*.....<.]....D..@.|-.
.}.Y%...V@&O..... ....yb..B.%...W.d...U.c,-..c..#.. .Fq...O.R.......|1
...:.i...2.|[email protected]... I."..

GET /w/1.0/sd?id=537103138&val=de19e91ac24a5e520ea6137aeddd7125 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: us-u.openx.net

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Set-Cookie: i=2536a716-3cb3-49c3-fe47-3cc3165532ce|1434955672; Version=1; Expires=Tue, 21-Jun-2016 06:47:52 GMT; Max-Age=31536000; Domain=.openx.net; Path=/

Server: OXGW/10.94.4

P3P: CP="CUR ADM OUR NOR STA NID"

Location: hXXp://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=de19e91ac24a5e520ea6137aeddd7125

Date: Mon, 22 Jun 2015 06:47:52 GMT

Content-Length: 0

Connection: close

GET /seg?add=3033413&t=2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Location: hXXp://ib.adnxs.com/bounce?/seg?add=3033413&t=2

Content-Type: text/html; charset=utf-8

Set-Cookie: sess=1; Path=/; Max-Age=86400; Expires=Tue, 23-Jun-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=2530524156394811283; Path=/; Max-Age=7776000; Expires=Sun, 20-Sep-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Date: Mon, 22 Jun 2015 06:47:52 GMT

Content-Length: 0
....


GET /bounce?/seg?add=3033413&t=2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: sess=1; uuid2=614436593884179937

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Access-Control-Allow-Credentials: true

Access-Control-Allow-Origin: *

Location: hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=614436593884179937

Content-Type: text/html; charset=utf-8

Set-Cookie: anj=dTM7k!M40eCxrEQDgEREg0BG7mEbb%%phwSNS v_o5U_uNXbdAQg4UGt6AyCd56pz9'Ey=JJ7Xm; Path=/; Max-Age=7776000; Expires=Sun, 20-Sep-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; Path=/; Max-Age=86400; Expires=Tue, 23-Jun-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=614436593884179937; Path=/; Max-Age=7776000; Expires=Sun, 20-Sep-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Date: Mon, 22 Jun 2015 06:47:52 GMT

Content-Length: 0
....


GET /pxj?bidder=172&seg=802787&action=setuid('ZGUxOWU5MWFjMjRhNWU1MjBlYTYxMzdhZWRkZDcxMjU') HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: sess=1; uuid2=614436593884179937

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Content-Length: 43

Content-Type: image/gif

Set-Cookie: anj=dTM7k!M4.NDunaTDgEREg0BG7mEbb%%phwSNai4xO3g#l!1÷[?qsz; Path=/; Max-Age=7776000; Expires=Sun, 20-Sep-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; Path=/; Max-Age=86400; Expires=Tue, 23-Jun-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=614436593884179937; Path=/; Max-Age=7776000; Expires=Sun, 20-Sep-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Date: Mon, 22 Jun 2015 06:47:52 GMT
GIF89a.............!.......,[email protected]..;HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Content-Length: 43..Content-Type:
 image/gif..Set-Cookie: anj=dTM7k!M4.NDunaTDgEREg0BG7mEbb%%phwSNai4xO3
g#l!1÷[?qsz; Path=/; Max-Age=7776000; Expires=Sun, 20-Sep-2015 06:47
:52 GMT; Domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; Path=/; Max-
Age=86400; Expires=Tue, 23-Jun-2015 06:47:52 GMT; Domain=.adnxs.com; H
ttpOnly..Set-Cookie: uuid2=614436593884179937; Path=/; Max-Age=7776000
; Expires=Sun, 20-Sep-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly..
Date: Mon, 22 Jun 2015 06:47:52 GMT..GIF89a.............!.......,.....
[email protected]..;..
<<< skipped >>>

GET /1/eabd37c669?a=442317&pl=1434955667676&v=632.2b17625&to=YlVRZxFXX0VWVkMPDVsfcmAzGUVZWFlVBxBFX0BHClhCQlZZW0gDRkBL&ap=7&fe=4250&dc=4235&tt=48D7134DDF395B1D&f=[]&jsonp=NREUM.setToken HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bam.nr-data.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Set-Cookie: JSESSIONID=551a4abaee9b9b26;Path=/

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Content-Type: text/javascript;charset=ISO-8859-1

Content-Length: 41
NREUM.setToken({'stn':1,'err':1,'ins':0})HTTP/1.1 200 OK..Set-Cookie: 
JSESSIONID=551a4abaee9b9b26;Path=/..Expires: Thu, 01 Jan 1970 00:00:00
 GMT..Content-Type: text/javascript;charset=ISO-8859-1..Content-Length
: 41..NREUM.setToken({'stn':1,'err':1,'ins':0})..

GET /spp.pl?a=1000742424085&.yp=7164&js=no HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sp.analytics.yahoo.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Date: Mon, 22 Jun 2015 06:47:51 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Set-Cookie: B=8hiaiqdaofbsn&b=3&s=5o; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.yahoo.com

TS: 0 508 spdc0018.pbp.ir2

Location: hXXp://ads.yahoo.com/pixel?id=2285230&t=2

Pragma: no-cache

Expires: Mon, 22 Jun 2015 06:47:52 GMT

Cache-Control: no-cache, private, must-revalidate

Accept-Ranges: bytes

Tracking-Status: site tracked

Content-Length: 43

Content-Type: image/gif

Age: 0

Connection: keep-alive

Server: ATS
GIF89a.............!.......,...........D..;HTTP/1.1 302 Moved Temporar
ily..Date: Mon, 22 Jun 2015 06:47:51 GMT..P3P: policyref="hXXp://info.
yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi I
VDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FI
N COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"..Set-Cookie: B=8hiaiqda
ofbsn&b=3&s=5o; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=
.yahoo.com..TS: 0 508 spdc0018.pbp.ir2..Location: hXXp://ads.yahoo.com
/pixel?id=2285230&t=2..Pragma: no-cache..Expires: Mon, 22 Jun 2015 06:
47:52 GMT..Cache-Control: no-cache, private, must-revalidate..Accept-R
anges: bytes..Tracking-Status: site tracked..Content-Length: 43..Conte
nt-Type: image/gif..Age: 0..Connection: keep-alive..Server: ATS..GIF89
a.............!.......,...........D..;..

GET /gtm.js?id=GTM-TWR3HX&l=gtm HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googletagmanager.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/javascript; charset=UTF-8

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Mon, 22 Jun 2015 06:47:49 GMT

Expires: Mon, 22 Jun 2015 06:47:49 GMT

Cache-Control: private, max-age=903

Server: HTTP server (unknown)

Content-Length: 13886

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0
...........}y[.8...|..;.. B.n.w...f..n.3...m9..j'!.$.}.J....y...O..:K.
R..T.77K'..S.mw&.z.V/....=Q:....Q.W..q).c.=.....E.......UD..p`...V.p:.
'.f.X.z.5.-.......@E.q......4........p..9...........o.....E.f9I......J
......)O...3.x..i$.a.;..4....'..z..B.|......|.v.E......_.'...*Q.J.....
.....d.mV&..I... >...-..)!(}.....@..`.d#p(.|n..}OD...T..A{.Y][email protected]
..QNR..^../...#.M...gP..............2nb`_ .kx..Ed.?...J..#o,Do,J*v0.&l
t;..E!.q. ...n......^..4.1O.Y..H.F...RC.....d.j..(E..L.Y....2..;.>.
..L.....\...{.b.f...:.....>ME.Tz.U.*...[0..;LNj..z....>......W.Q
{....E...&..G.n..!6.......G........9aa~.'b.Y...G.Mk.=e.%..B..\.!Y.....
G^...7.aN.d(f....^...|..3...1`....`.....-5......R.].9D:.[.T...........
.W..@\C....W$gS=/..I.D\.....DS.2....Cqf...K..3&.3.;../.a</....'~..;
.1.02.l...x...a7(U].]..K.....b...sSq.Wv..l...........kT.o....M...K...k
"....:K.n.e1..CF.Y.}'......e....R.X...."...~..N%.0.}.b.r..3...Cm..M...
.....{..$ld.>..\.......-/.1^.h..H....#...<?t0.yF..(./B=.\G..8..T
..F`o$T..U.?.........x..Va.W.AA.WQGJ.. ...8...........f....a....J.qD.f
J........ DW.a-...<'.,....R.... .&.-\.>a..$...I....d..n...R.....
(.=....M ..A .....=.*.<..U..................iz..ZG....i\G. `!|t..._
1...yl*.0.....^..$.a*{3U.:o.^.p;S8...5...R...U".W.%i.[.I..*.1.T`l..x5.
5..........=|Z.q.0.c.......J.,.... ..BtA..1..L.%...R3./.W..&..jXL.U.C_
S....o..$...p<Y........P.f.`..pe<.....,......k....E..SRB`W5}U...
oz...M.O.r.K...%.....P....p./.B\\w.0.......Y].........`..2.W.d.X.H....
.tk.{-7........^.2&\.......2a.....w.'...f..z-..'zBA]N/......,6..x.
<<< skipped >>>

GET /nr-632.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js-agent.newrelic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

x-amz-id-2: uoZDf01UJMdKUwMnfqOem9neoZODagroS2lNtk0s7eq2GRu523cjtu/9Z2Lrc2uVh7bofQurLcQ=

x-amz-request-id: F9BF7D9D660E45A4

Last-Modified: Mon, 23 Mar 2015 23:49:49 GMT

ETag: "f9cdcb1e4b2be3825b6dfcbd33deff25"

Content-Type: application/javascript

Server: AmazonS3

Content-Length: 22469

Accept-Ranges: bytes

Date: Mon, 22 Jun 2015 06:47:51 GMT

Via: 1.1 varnish

Connection: keep-alive

X-Served-By: cache-fra1224-FRA

X-Cache: HIT

X-Cache-Hits: 2967

X-Timer: S1434955671.438501,VS0,VE0

Vary: Accept-Encoding

Cache-Control: public, max-age=3600
!function(e,n,t){function r(t,i){if(!n[t]){if(!e[t]){var a="function"=
=typeof __nr_require&&__nr_require;if(!i&&a)return a(t,!0);if(o)return
 o(t,!0);throw new Error("Cannot find module '" t "'")}var u=n[t]={exp
orts:{}};e[t][0].call(u.exports,function(n){var o=e[t][1][n];return r(
o?o:n)},u,u.exports)}return n[t].exports}for(var o="function"==typeof 
__nr_require&&__nr_require,i=0;i<t.length;i  )r(t[i]);return r}({1:
[function(e,n){n.exports=function(e,n){return"addEventListener"in wind
ow?addEventListener(e,n,!1):"attachEvent"in window?attachEvent("on" e,
n):void 0}},{}],2:[function(e,n){function t(e,n,t,o){d("bstAgg",[e,n,t
,o]),m[e]||(m[e]={});var i=m[e][n];return i||(m[e][n]=i={params:t||{}}
),i.metrics=r(o,i.metrics),i}function r(e,n){return n||(n={count:0}),n
.count =1,c(e,function(e,t){n[e]=o(t,n[e])}),n}function o(e,n){return 
n?(n&&!n.c&&(n={t:n.t,min:n.t,max:n.t,sos:n.t*n.t,c:1}),n.c =1,n.t =e,
n.sos =e*e,e>n.max&&(n.max=e),e<n.min&&(n.min=e),n):{t:e}}functi
on i(e,n){return n?m[e]&&m[e][n]:m[e]}function a(e){for(var n,t={},r="
",o=0;o<e.length;o  )r=e[o],t[r]=u(m[r]),t[r].length&&(n=!0),delete
 m[r];return n?t:null}function u(e){return"object"!=typeof e?[]:c(e,fu
nction(e,n){return n})}function s(e,n){"undefined"==typeof n&&(n=(new 
Date).getTime()),p[e]=n}function f(e,n,r){var o=p[n],i=p[r];"undefined
"!=typeof o&&"undefined"!=typeof i&&t("measures",e,{value:i-o})}var c=
e(1),d=e("handle"),l=e(2),m={},p={};n.exports={store:t,take:a,get:i,ma
rk:s,measure:f},setTimeout(function(){l("bstAgg",function(){})},1e
<<< skipped >>>

GET /seg?add=2518433&t=2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Location: hXXp://ib.adnxs.com/bounce?/seg?add=2518433&t=2

Content-Type: text/html; charset=utf-8

Set-Cookie: sess=1; Path=/; Max-Age=86400; Expires=Tue, 23-Jun-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=614436593884179937; Path=/; Max-Age=7776000; Expires=Sun, 20-Sep-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Date: Mon, 22 Jun 2015 06:47:52 GMT

Content-Length: 0
....


GET /bounce?/seg?add=2518433&t=2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: sess=1; uuid2=614436593884179937

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Access-Control-Allow-Credentials: true

Access-Control-Allow-Origin: *

Location: hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=614436593884179937

Content-Type: text/html; charset=utf-8

Set-Cookie: anj=dTM7k!M40eCxrEQDgEREg0BG7mEbb%%phwSNS v_o5U_uNXbdAQg4UGt6AyCd56pz9'Ey=JJ7Xm; Path=/; Max-Age=7776000; Expires=Sun, 20-Sep-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; Path=/; Max-Age=86400; Expires=Tue, 23-Jun-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=614436593884179937; Path=/; Max-Age=7776000; Expires=Sun, 20-Sep-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly

Date: Mon, 22 Jun 2015 06:47:52 GMT

Content-Length: 0
HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, private..Pragma
: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="ht
tp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo 
OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Acc
ess-Control-Allow-Credentials: true..Access-Control-Allow-Origin: *..L
ocation: hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=6144365
93884179937..Content-Type: text/html; charset=utf-8..Set-Cookie: anj=d
TM7k!M40eCxrEQDgEREg0BG7mEbb%%phwSNS v_o5U_uNXbdAQg4UGt6AyCd56pz9'Ey=J
J7Xm; Path=/; Max-Age=7776000; Expires=Sun, 20-Sep-2015 06:47:52 GMT; 
Domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; Path=/; Max-Age=86400
; Expires=Tue, 23-Jun-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly..
Set-Cookie: uuid2=614436593884179937; Path=/; Max-Age=7776000; Expires
=Sun, 20-Sep-2015 06:47:52 GMT; Domain=.adnxs.com; HttpOnly..Date: Mon
, 22 Jun 2015 06:47:52 GMT..Content-Length: 0..
<<< skipped >>>

GET /agent/toolbarprefs.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: xml.sahcdn.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Date: Mon, 22 Jun 2015 06:47:41 GMT

Etag: "804d15d84ca8d01:0"

Expires: Tue, 23 Jun 2015 06:47:41 GMT

Last-Modified: Tue, 16 Jun 2015 15:55:19 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/8760)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web09

Content-Length: 1008
.|..A...k}......@1......$L..X:u.F5..m..h..j.\.. .#....D.....}8..j.Y.^.
.......(.'....4M...6.h6b........0)._..al...eZ.e...S.....W....7.1.....i
.......Y.t..|._..o4......E......Z........Z#..R._.?..].~..m1V.....F=...
Q....!..r..\j........h..\..7...L.P...!8f."......S'.}V..b...&...p.5OW.h
.q. @J.T'......t....iN.:......].R{.d..Puw..D...o....._.P....0..z..!...
...I....3....kb.N....rC....V.GiM.$.....G....Sx.:......."..."...>A..
.?4..w.fq=.`...%..k......p`3:./n.....C..0Wx.K.ZX........K..%...... ...
.......9k..OI..*A....m....G:..[Z..m........Z.?.. }.'....[....I........
a..r...... ..|. ..a5..1..?..-#...D...........G. rt.&....}gA...o..!....
.Kl..:.qe....%y\?.9]&.by....t-.i...d..W.:e2!8.....u....&O...m..[.WCRB.
.Z..K.......cZF....... ....P....D..|5F6.....].G7.8^s.qi..z...s.Q...E?]
.......QA........Wf<...P.|.`f_...>S..u...]U...{`[.>..a...t...
......41..S....eDJ.~.`...H.C.....!H..G.......hRc$..}....].....[Y..T..s
q.*..K{.~...&..N.].Y......._...']..V.5.>. & ...>T.......vJ...U..
z.{.Y,D..?X.....N...3..l..W>.<.3.N.-.....xqDh.HTTP/1.1 200 OK..A
ccept-Ranges: bytes..Cache-Control: max-age=86400..Content-Type: appli
cation/octet-stream..Date: Mon, 22 Jun 2015 06:47:41 GMT..Etag: "804d1
5d84ca8d01:0"..Expires: Tue, 23 Jun 2015 06:47:41 GMT..Last-Modified: 
Tue, 16 Jun 2015 15:55:19 GMT..P3P: CP="NON DSP COR CURa ADMa OUR NOR 
PUR"..Server: ECAcc (frf/8760)..X-Cache: HIT..X-Powered-By: ASP.NET..X
-Server: Web09..Content-Length: 1008...|..A...k}......@1......$L..X:u.
F5..m..h..j.\.. .#....D.....}8..j.Y.^........(.'....4M...6.h6b....
<<< skipped >>>

GET /agent/toolbarprefs.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: xml.sahcdn.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Date: Mon, 22 Jun 2015 06:47:41 GMT

Etag: "804d15d84ca8d01:0"

Expires: Tue, 23 Jun 2015 06:47:41 GMT

Last-Modified: Tue, 16 Jun 2015 15:55:19 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/8760)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web09

Content-Length: 1008
.|..A...k}......@1......$L..X:u.F5..m..h..j.\.. .#....D.....}8..j.Y.^.
.......(.'....4M...6.h6b........0)._..al...eZ.e...S.....W....7.1.....i
.......Y.t..|._..o4......E......Z........Z#..R._.?..].~..m1V.....F=...
Q....!..r..\j........h..\..7...L.P...!8f."......S'.}V..b...&...p.5OW.h
.q. @J.T'......t....iN.:......].R{.d..Puw..D...o....._.P....0..z..!...
...I....3....kb.N....rC....V.GiM.$.....G....Sx.:......."..."...>A..
.?4..w.fq=.`...%..k......p`3:./n.....C..0Wx.K.ZX........K..%...... ...
.......9k..OI..*A....m....G:..[Z..m........Z.?.. }.'....[....I........
a..r...... ..|. ..a5..1..?..-#...D...........G. rt.&....}gA...o..!....
.Kl..:.qe....%y\?.9]&.by....t-.i...d..W.:e2!8.....u....&O...m..[.WCRB.
.Z..K.......cZF....... ....P....D..|5F6.....].G7.8^s.qi..z...s.Q...E?]
.......QA........Wf<...P.|.`f_...>S..u...]U...{`[.>..a...t...
......41..S....eDJ.~.`...H.C.....!H..G.......hRc$..}....].....[Y..T..s
q.*..K{.~...&..N.].Y......._...']..V.5.>. & ...>T.......vJ...U..
z.{.Y,D..?X.....N...3..l..W>.<.3.N.-.....xqDh.HTTP/1.1 200 OK..A
ccept-Ranges: bytes..Cache-Control: max-age=86400..Content-Type: appli
cation/octet-stream..Date: Mon, 22 Jun 2015 06:47:41 GMT..Etag: "804d1
5d84ca8d01:0"..Expires: Tue, 23 Jun 2015 06:47:41 GMT..Last-Modified: 
Tue, 16 Jun 2015 15:55:19 GMT..P3P: CP="NON DSP COR CURa ADMa OUR NOR 
PUR"..Server: ECAcc (frf/8760)..X-Cache: HIT..X-Powered-By: ASP.NET..X
-Server: Web09..Content-Length: 1008...|..A...k}......@1......$L..X:u.
F5..m..h..j.\.. .#....D.....}8..j.Y.^........(.'....4M...6.h6b....
<<< skipped >>>

GET /agent/bce_.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: xml.sahcdn.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Date: Mon, 22 Jun 2015 06:47:41 GMT

Etag: "09872dd4ca8d01:0"

Expires: Tue, 23 Jun 2015 06:47:42 GMT

Last-Modified: Tue, 16 Jun 2015 15:55:28 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: Microsoft-IIS/7.5

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web05

Content-Length: 248800
...v.a.5uq,:..=w2..b....M..T>.!...>.l..jW.&...W?C'..w. .C.......
.!....G.'........P....p(bPA.;.x..l. .}3#..5.............s.....J.h;.at.
|.....h...M.5.....J.?. dP....f....f.(Hj...#.,U.:..l3..k.X...}...K...|I
...s>(.o^<...*K.........t.l2$.q.....ZX..u,.qO-....f...gE{...x}"R
.%(..<)}[email protected].}.**........"....s.o....5q.&.....*
/64..}.T..4D...q..|.#0..(.._..u.b4(...Lo..E..o20xh.^c.xby}...|!.Nd.n..
.\.`..K7.;..w............'@.`. ....<..{.....8...n..2...H..lX...y..q
u....t.6..|..^.I3m`.....S{..._=v.....a.....A.A.ga?....AAFM.=....H..._.
.U..e .`.....j1...Q...I....O...4(:..c)Q*....RA....|=A`}mW.xf. .....r..
PhH..S..7o._...0Ey...>..;.l..L)7PS.,...S.Y'.W.........c<s\#. ...
..E........RX.<U...A....,.e..............u.iS......7.].5......#.'..
>...........=U.Kc5..d..?.EbO....i...x..z.....vRu..[.4Y..F..".X.....
...3T.5a.N/.N.C&....9.%Y..&..N........ ..xc`..=n...QB.....A$.S87......
.8~*E!..yU.."k...9.OX..K....YH....<..;.{..4hg.J..*..eS...l. .....W.
Z..2..3L.1..X...H....p.G.Kq..g|.......z)85...LrFlh.$=g.I.[.eQ.v.\Dz.7.
A..5$.UVS!=..2...9...&..6..h....b..Y.%....ZM....:...G..~..%...F..3=H..
. .[|?.e.{.......n|...:..0..z.b....=....~.WpS.I...r..F...b......<.Q
ND..Z.W.....09.f.g!.%m..'y....)..[.I.%..IH.w}..'...k...a...xP.......PT
._..g\.'......]Oe...3NH.@[...\.4..k.........i. ....)....p9'.w...-PT.(.
)..}......t.9uP.._L.....^.\...(A'..J@...}...'.....&....".c..0...Yo.y..
.c.....v...3Rh.p....3..G.R ....'..(....|.Q.[XVF......&.........'.>.
BFA...B).0..P.y...V.5..-...8G..v1..|.....|..To| .. ..S.....`..6...
<<< skipped >>>

GET /images/background_sah_2014.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/jpeg

Date: Mon, 22 Jun 2015 06:47:48 GMT

Expires: Mon, 29 Jun 2015 06:47:48 GMT

Last-Modified: Sat, 20 Jun 2015 09:46:55 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/876A)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

Content-Length: 1198
......Exif..II*.................Ducky.......<..... hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c061 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" 
xmpMM:InstanceID="xmp.iid:3295104FD23211E3AE07B2FBA6D740AA" xmpMM:Docu
mentID="xmp.did:32951050D23211E3AE07B2FBA6D740AA"> <xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:3295104DD23211E3AE07B2FBA6D740AA" stRe
f:documentID="xmp.did:3295104ED23211E3AE07B2FBA6D740AA"/> </rdf:
Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
r"?>....Adobe.d....................................................
......................................................................
.......................................d..............................
..................................Q.....U.......................R.....
[email protected]...'r..W.U...H.w..t>....
<<< skipped >>>

GET /images/merchants-computer-screen.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Mon, 22 Jun 2015 06:47:49 GMT

Expires: Mon, 29 Jun 2015 06:47:49 GMT

Last-Modified: Wed, 17 Jun 2015 00:34:33 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/871A)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

Content-Length: 46289
.PNG........IHDR...l...5.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:F1C3EB54EE9111E4B362
9A61F0848031" xmpMM:DocumentID="xmp.did:F1C3EB55EE9111E4B3629A61F08480
31"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F1C3EB52EE9111
E4B3629A61F0848031" stRef:documentID="xmp.did:F1C3EB53EE9111E4B3629A61
F0848031"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>v..u...AIDATx........=~F]...........lS.
.-.... y@H..{.._^..).!!!@B ...c.b...7.{o.........4.V i.-n....FS...9..s
.{...;..h4......q#...p.E.a..%.......g..n..............UU.(...-...k.5h.
.....B.>..#.....m....w~....m..u...w.....7............ki.v..!2.D>
.....n......yV..%..".. .&z.;r........#.4&..;r.h..U.N...u...<...<
.y.9533.......;.........;..........l.$$$$$..L....8z.h..&....%$$$N.X}..
.....C.-.[BBB.4 m..*  %aKHHH....p8p..II.....g;..a.f...=".[BBB....f.p..
$l....s...i...-!!!q...6G.TUUI.....8WH;^..$l...........=".[BBB.,.{.N.S.
v..-.[BBB.,..K.!..i.G...m..n0........]c6...;.uf.m .m....O..h#!q&2.
<<< skipped >>>

GET /images/chrome-example-window.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Mon, 22 Jun 2015 06:47:49 GMT

Expires: Mon, 29 Jun 2015 06:47:49 GMT

Last-Modified: Wed, 17 Jun 2015 00:34:33 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/873F)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

Content-Length: 22552
.PNG........IHDR...x.........~..G....tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:AD09A042EFF211E4AA0D
A4E090660B49" xmpMM:DocumentID="xmp.did:AD09A043EFF211E4AA0DA4E090660B
49"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AD09A040EFF211
E4AA0DA4E090660B49" stRef:documentID="xmp.did:AD09A041EFF211E4AA0DA4E0
90660B49"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>......T.IDATx...........}{.........w.`.
.!p...I...p.....$$.r)..IHh..^C.qo......w.... iW..V..}a>..%.......7o
.(B...f.r.Go.JH.oo.../..L......R.)..........E...W.Gd.]..(...E.......}.
..A......G.|_.U..g.......}....,Q..2O.........H!.#.S...W4*'.....K......
O'.....x....N..2Q..r.(..b..S..az.\...&.....I.wEyG....I.x............T.
K"e.(.....U..V..T...>..^Qt. ....L. T..,...>..'....B...o../...(..
..[...`.<3..p..Y*..s..e.\E....<eH...5h.T..*.M.&...P..T.....i..F%
....b.g....@....<..r..(...M[..EyI..I....$.x.._}..,..3..^..9"...e.(.
T.W/..H..'..8.*J..........Q]......uz.G6.)B..gDy..{!...x...\...1...
<<< skipped >>>

GET /images/circle-step-2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Mon, 22 Jun 2015 06:47:50 GMT

Expires: Mon, 29 Jun 2015 06:47:50 GMT

Last-Modified: Wed, 17 Jun 2015 00:34:33 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/8713)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web05

Content-Length: 2461
.PNG........IHDR...2...2......?......tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:58E5D815EFF211E48631
C9E642D8E5EA" xmpMM:DocumentID="xmp.did:58E5D816EFF211E48631C9E642D8E5
EA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:58E5D813EFF211
E48631C9E642D8E5EA" stRef:documentID="xmp.did:58E5D814EFF211E48631C9E6
42D8E5EA"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>...N....IDATx..Zkl.U.>..n....l.BK...
..........".Rh..>Bb.F...Gl.ocb0i.~h.. ..P.b.D..)..i-........n.e..z.
.w.m;....m{./..........;.....I..(e.d,b.2nb.1,...?F.....8..2cr.A"..jF%c
q.c41.3.0..l"...0.eXM.h....MFc.7..D.c7.,..D....r..r......]-}>Yb.s..
9M#.`|.8.....,9....!"n.....:yF..N...q.QFS/eR.W.D..).C.G..!-7.i....F3..
.....Rn]M..n.........._7..nd._3....@...,.1VL..Y/[email protected]{....$
[..d.Le,..1v..IQxd.O.SO....2...~2.b&YJ....y.R..A..fJ....9...~.\9LC...}
Vyx%..#.=...CC=...1......E.==)6p..9rJ..Y......;YCA.q..5u...V...s......
.*..~.$...TF........c.f....k.0......VAF....b..\[email protected]..
<<< skipped >>>

GET /images/btn-continue-to-coupons-orange.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Mon, 22 Jun 2015 06:47:50 GMT

Expires: Mon, 29 Jun 2015 06:47:50 GMT

Last-Modified: Sun, 21 Jun 2015 17:19:42 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/876A)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

Content-Length: 5203
.PNG........IHDR.......Z.....^..|....tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:DB924A22EF4C11E4B6EB
96B91323C4C3" xmpMM:DocumentID="xmp.did:DB924A23EF4C11E4B6EB96B91323C4
C3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB924A20EF4C11
E4B6EB96B91323C4C3" stRef:documentID="xmp.did:DB924A21EF4C11E4B6EB96B9
1323C4C3"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>...`....IDATx...{.......{{..px..w<..
....A.1*F........x. ..R11..RA..DJJ#..F..(R..*ZjTJ....D...D.A...>...
........fo....j......Mw......99..4..p..cD.-B........a...ExF....=&...a.
..D..n.......X.."../.L......F...j...."TQ..S.k./.....k.."....gE.....{..
.?.....`...p.\._."0.....W2.E..v...WR."..;... .......b ................
..............................................G=...U.........*K....>
;.'........5...@...@.......|........7..Q..../......\....i_q1..4.:v....
.B!:&..'z.]_..X!.....$..............}.....K......ch..[)..C....B.......
D... .-...[.....7v2yJJ).e.5<1..........}.G...1! .........>..
<<< skipped >>>

GET /images/button-continue-for-great-coupons.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/jpeg

Date: Mon, 22 Jun 2015 06:47:50 GMT

Expires: Mon, 29 Jun 2015 06:47:50 GMT

Last-Modified: Sat, 20 Jun 2015 19:11:54 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/87F3)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web01

Content-Length: 25359
......Exif..II*.................Ducky.......d..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
1 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmp
MM:InstanceID="xmp.iid:D760254037FE11E381E48C3E8E0381AF" xmpMM:Documen
tID="xmp.did:D760254137FE11E381E48C3E8E0381AF"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D760253E37FE11E381E48C3E8E0381AF" stRef:d
ocumentID="xmp.did:D760253F37FE11E381E48C3E8E0381AF"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
....................\.E...............................................
.....................................................Qa!1.....W...X..A
....".q.e..2BRb#$..Cd..r3sTE.............................!.1AQ".T..V.a
.....q.2b#...Br.....Rcs$..t..3CSD.u.............?.....P.:.....Tud.E5..
......H..i...3..UE.\g0..&.1..5...2.{...t.{.U=.....<..k.`......3....
.{......-..y.n...8.........=....c..?....y...m..hpjiJJ.m.........7C...k
...@.?...K.....oUz-5U....zJ_4..*}&Jf'.U*|Lq.....F.M..b.ol...r\..T.
<<< skipped >>>

GET /images/global-sprite2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Mon, 22 Jun 2015 06:47:50 GMT

Expires: Mon, 29 Jun 2015 06:47:50 GMT

Last-Modified: Tue, 16 Jun 2015 19:05:09 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/873A)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

Content-Length: 143785
.PNG........IHDR...............Y.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com
/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:
stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http
://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocum
entID="xmp.did:5B7E35C1E28FE1119A6689FFA9306BF0" xmpMM:DocumentID="xmp
.did:542F4543401B11E48C33ABD4ACF981FE" xmpMM:InstanceID="xmp.iid:542F4
542401B11E48C33ABD4ACF981FE" xmp:CreatorTool="Adobe Photoshop CS5.1 Wi
ndows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:b96b1c62-fa
b0-5e46-8d4a-56729bd03ca9" stRef:documentID="xmp.did:5B7E35C1E28FE1119
A6689FFA9306BF0"/> </rdf:Description> </rdf:RDF> </x
:xmpmeta> <?xpacket end="r"?>.m8(..-.IDATx..}.|T...yo.-.. !@.
..D.du.*.X[.....Z.U.V.."...Z.[[email protected]$....$.....=w.L&..d..
2I..s..[....r.....$...n...d%e!).H.&%......`..iPSS.}D.I....)[...g....=.
.....R...1.lr.X....y..g.......*..7...").......o.....|N...z.4....?X..K.
d..../.....*j[..z.x8...i5*H.. #...U........).j.U..j.Ag ..J.>.\..p$.
...W.C/M.8.....k..M#j...L..,C..SG.. 3:..=l2.D...YA.5..P.. ^..%I..^.~..
5G.G.% ...M...#...s.........v.DQ...hC... .<.!...`0...._....LN.q
<<< skipped >>>

GET /pagead/conversion.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 3202894901213924526

Date: Mon, 22 Jun 2015 06:47:50 GMT

Expires: Mon, 22 Jun 2015 06:47:50 GMT

Cache-Control: private, max-age=86400

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 4135

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=1
...........Z.r.8.....PS21b(..3uD.*'.d2...8.......H...!).N.w.n.W....:U*
.........j.U.dA.i...'.9.. .oYY.U........n.s...w.d.1.B.h....4...dgI..i"
.U....b..\H&9Q..p...Zc..Y.c.Y.9K..3...0..`.$.|."[email protected]&..T.-.V.[$
P(.d.".2..#.... ...V..2...X ...Iv.6=..".v......(f.>\.R............$
....*v..D..N^....:.U(kI.*...5E...b.wr.....S.!3.....,U.jj.z.j=u.....&..
.....%.yz............Ua..ng...;.].S5L.6R.da...:...w......A..H$..U...].
..).....^.Q...H.....j..Z... .`...... ....LD"`................6..b. ...
....v..E...v._E.l...... ...LlF.....<...?"......{..z..? ..:...B.....
K.........]...a.n&_.<].5u...Q].5...^......3...6............R/l..5.8
h..b.)..,..[.:9.....nl.gK...u...fGA.....vk.p..S>...b.ak.....B......
...l..,Y._.F&R.e.....t.cXN$9..X..K67"..<......j._...*.......W...{e.
...`..3F..).oQ.gf...`..............dN`N.~........*...J.0.,/}...... ...
..........}... .......*.K...#.......f..e{...3\.7......X....Z.>.....
.C..'...{.J..........6.W.. .......M.t:........7a..2`~...xg.hM.9....:_^
L /[email protected]!D..[0b.9.g.....1.....ZJ.......D.(.`............
....8..ah.)c........Mg.|...R..l6.]..O......O\.....0-...l.6...._.......
...{aL..E`......T=..d...TNIE0......G...G....1.X...5P.W..Ce.QW.%...y...
.*.u$..B@.(=0..~"g..M.........."}n|..H#[B..B.((./.C....rp..a...d5.....
.<....$..v.A.U.8A7\L...._.(3_H.......I..Ylx".$;...J...N.....8>..
....6.v..k.....y..v._..Hg..p...q......7OS;.8.;.m,W.......Z ..2.=..Q.A.
..v:....;0...8q....3j-4.!z}.\.R....l....xq....8..{.v.........!YKu...ig
.B._q....7...Y%.....&.K.8.m.[.m..0N.z7H.8. ...$^y~..a.'."..q.G.}[=
<<< skipped >>>

GET /pagead/conversion/1071192949/?random=1434955671364&cv=7&fst=1434955671364&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 302 Found

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Date: Mon, 22 Jun 2015 06:47:50 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: image/gif

Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071192949/?random=624130316&cv=7&fst=1434955671364&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&ocp_id=lq-HVbPIMMOJ8wPCx4GABg

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=1
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV P
SA PSD IVA IVD OTP OUR OTR IND OTC"..Date: Mon, 22 Jun 2015 06:47:50 G
MT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Co
ntrol: no-cache, must-revalidate..Content-Type: image/gif..Location: h
ttp://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071192
949/?random=624130316&cv=7&fst=1434955671364&num=1&fmt=3&value=0&label
=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818
&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http
://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd
136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&Er
rorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-362381
0093BF}&ae=no&source=91125&subsource=4666&setupguid=
{a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid
=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcod
e=1&tbtext=&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=fals
e&convclickts=0&ocp_id=lq-HVbPIMMOJ8wPCx4GABg..X-Content-Type-Options:
 nosniff..Server: cafe..Content-Length: 42..X-XSS-Protection: 1; mode=
block..Alternate-Protocol: 80:quic,p=1..GIF89a.............!.......,..
.........D.;..
<<< skipped >>>

GET /ads/user-lists/1071192949/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&random=1295422861 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: VVV.google.com

HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/user-lists/1071192949/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&random=1295422861&ipr=y

Cache-Control: private, max-age=43200

Date: Mon, 22 Jun 2015 06:47:51 GMT

Expires: Mon, 22 Jun 2015 06:47:51 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 837

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/1071192949/?lab
el=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie
_present=false&cv=7&frm=0&url=http://VVV.shopathome.com/
ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195
c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel%
3D1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&so
urce=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae
44-83c121316f71}&setupcid=40336643&cid=40336643&refer=96
0117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=&ra
ndom=1295422861&ipr=y">here</A>...</BODY></HTML&
gt;......
<<< skipped >>>

GET /ads/user-lists/0/?label=null&script=0&random=799290124 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/user-lists/0/?label=null&script=0&random=799290124&ipr=y

Cache-Control: private, max-age=43200

Date: Mon, 22 Jun 2015 06:47:52 GMT

Expires: Mon, 22 Jun 2015 06:47:52 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 294

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/0/?label=null&a
mp;script=0&random=799290124&ipr=y">here</A>...</B
ODY></HTML>..HTTP/1.1 302 Found..Location: hXXp://VVV.google.
com.ua/ads/user-lists/0/?label=null&script=0&random=799290124&ipr=y..C
ache-Control: private, max-age=43200..Date: Mon, 22 Jun 2015 06:47:52 
GMT..Expires: Mon, 22 Jun 2015 06:47:52 GMT..Content-Type: text/html; 
charset=UTF-8..X-Content-Type-Options: nosniff..Server: adclick_server
..Content-Length: 294..X-XSS-Protection: 1; mode=block..Alternate-Prot
ocol: 80:quic,p=0..<HTML><HEAD><meta http-equiv="conten
t-type" content="text/html;charset=utf-8">.<TITLE>302 Moved&l
t;/TITLE></HEAD><BODY>.<H1>302 Moved</H1>.T
he document has moved.<A HREF="hXXp://VVV.google.com.ua/ads/user-li
sts/0/?label=null&script=0&random=799290124&ipr=y">here
</A>...</BODY></HTML>....
<<< skipped >>>

GET /cm/f/out HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=de19e91ac24a5e520ea6137aeddd7125

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Mon, 22 Jun 2015 06:47:52 GMT

Location: hXXp://VVV.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZGUxOWU5MWFjMjRhNWU1MjBlYTYxMzdhZWRkZDcxMjU

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.6.2

Set-Cookie: __adroll=de19e91ac24a5e520ea6137aeddd7125; Version=1; Expires=Thu, 21-Jul-2016 06:47:51 GMT; Max-Age=34128000; Path=/

Content-Length: 112

Connection: keep-alive
Go to hXXp://VVV.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=Z
GUxOWU5MWFjMjRhNWU1MjBlYTYxMzdhZWRkZDcxMjU....


GET /cm/w/out HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=de19e91ac24a5e520ea6137aeddd7125

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Mon, 22 Jun 2015 06:47:52 GMT

Location: hXXps://analytics.twitter.com/i/adsct?p_user_id=ZGUxOWU5MWFjMjRhNWU1MjBlYTYxMzdhZWRkZDcxMjU&p_id=823423

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.6.2

Set-Cookie: __adroll=de19e91ac24a5e520ea6137aeddd7125; Version=1; Expires=Thu, 21-Jul-2016 06:47:51 GMT; Max-Age=34128000; Path=/

Content-Length: 109

Connection: keep-alive
Go to hXXps://analytics.twitter.com/i/adsct?p_user_id=ZGUxOWU5MWFjMjRh
NWU1MjBlYTYxMzdhZWRkZDcxMjU&p_id=823423....


GET /cm/l/out HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=de19e91ac24a5e520ea6137aeddd7125

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Mon, 22 Jun 2015 06:47:52 GMT

Location: hXXp://idsync.rlcdn.com/377928.gif?partner_uid=de19e91ac24a5e520ea6137aeddd7125

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.6.2

Set-Cookie: __adroll=de19e91ac24a5e520ea6137aeddd7125; Version=1; Expires=Thu, 21-Jul-2016 06:47:51 GMT; Max-Age=34128000; Path=/

Content-Length: 85

Connection: keep-alive
Go to hXXp://idsync.rlcdn.com/377928.gif?partner_uid=de19e91ac24a5e520
ea6137aeddd7125....


GET /cm/g/out?google_nid=adroll5 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=363dd136-de52-4600-8c6a-80195c49479e&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={01049F0F-5795-4B5D-935C-3623810093BF}&ae=no&source=91125&subsource=4666&setupguid={a28c91ae-0a30-4c61-ae44-83c121316f71}&setupcid=40336643&cid=40336643&refer=960117215&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=de19e91ac24a5e520ea6137aeddd7125

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Mon, 22 Jun 2015 06:47:52 GMT

Location: hXXps://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=3hnpGsJKXlIOphN67d1xJQ&google_ula=1535926

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.6.2

Set-Cookie: __adroll=de19e91ac24a5e520ea6137aeddd7125; Version=1; Expires=Thu, 21-Jul-2016 06:47:51 GMT; Max-Age=34128000; Path=/

Content-Length: 118

Connection: keep-alive
Go to hXXps://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&goo
gle_hm=3hnpGsJKXlIOphN67d1xJQ&google_ula=1535926HTTP/1.1 302 Moved Tem
porarily..Cache-Control: no-store, no-cache, must-revalidate..Date: Mo
n, 22 Jun 2015 06:47:52 GMT..Location: hXXps://cm.g.doubleclick.net/pi
xel?google_sc&google_nid=artb&google_hm=3hnpGsJKXlIOphN67d1xJQ&google_
ula=1535926..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Pragm
a: no-cache..Server: nginx/1.6.2..Set-Cookie: __adroll=de19e91ac24a5e5
20ea6137aeddd7125; Version=1; Expires=Thu, 21-Jul-2016 06:47:51 GMT; M
ax-Age=34128000; Path=/..Content-Length: 118..Connection: keep-alive..
Go to hXXps://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&goo
gle_hm=3hnpGsJKXlIOphN67d1xJQ&google_ula=1535926..

GET /install/setup5200.cab HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: toolbar.shopathome.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: application/octet-stream

Last-Modified: Mon, 01 Nov 2010 21:15:16 GMT

Accept-Ranges: bytes

ETag: "0a19e197acb1:0"

Server: Microsoft-IIS/7.5

Set-Cookie: SAHSessionID=53b4701d-9744-407d-ba15-6822f08576f3; domain=shopathome.com; path=/

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web05

X-Powered-By: ASP.NET

Date: Mon, 22 Jun 2015 06:47:27 GMT

Content-Length: 485875
MSCF.....i......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /install/toolbar5200_ff.cab HTTP/1.1