MD5: f5961eda9923a1fd713e9acf9706cc71
SHA1: 741129598d99c8b376f472942daa129b33e439f5
SHA256: 1dbde0c848dec7e6957edf39d01afc37894d6a1bba105deaa3c3b3de9e2b8022
SSDeep: 6144:DM/in98C/WvBJIzvGO8QC2VR8nVG2CPRgLXM 1mq7kycl8dk3LNr6XoRDae8N5Y2:6C98CQnmGl20 gL8 13gyc6EZou AVm
Size: 735336 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: Digital Pine, LLC
Created at: 2010-11-01 23:14:48
Analyzed on: WindowsXP SP3 32-bit

Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The Adware creates the following process(es):

SelectRebatesDownload.exe:256
SelectRebatesDownload.exe:728
ShopAtHome_Toolbar_Installer.exe:1524
regsvr32.exe:1964
%original file name%.exe:580
SelectRebates.exe:284

The Adware injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process SelectRebatesDownload.exe:256 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\toolbar5200_ff.cab (172089 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.cab (235057 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OPC19AEM.tmp (460 bytes)

The process SelectRebatesDownload.exe:728 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\SelectRebates\srtmpprfkdmajs13.tmp (25 bytes)
%Program Files%\SelectRebates\srtmpsqu248gbkri.tmp (460 bytes)
%Program Files%\SelectRebates\srtmpprf8c7e4i5a.tmp (1 bytes)
%Program Files%\SelectRebates\srtmpprfn3pks9vp.tmp (1 bytes)
%Program Files%\SelectRebates\srtmpgfib2aoeu40.tmp (117785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installstatus.tmp (72 bytes)

The process ShopAtHome_Toolbar_Installer.exe:1524 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\SelectRebates\FFToolbar\chrome\sahtoolbar.jar (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar (4 bytes)
%Program Files%\SelectRebates\FFToolbar\defaults\preferences\sahtoolbar.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar (4 bytes)
%Program Files%\SelectRebates\Toolbar\CashBack.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\GroceryCoupon.bmp (1 bytes)
%Program Files%\SelectRebates\SelectRebates.exe (6841 bytes)
%Program Files%\SelectRebates\Toolbar\ReviewSite.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\Scissors.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\logo_24.bmp (6 bytes)
%Program Files%\SelectRebates\FFToolbar\install.rdf (1 bytes)
%Program Files%\SelectRebates\Toolbar\logo_HotSpots.bmp (6 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-icons.bmp (8 bytes)
%System%\config\SOFTWARE.LOG (5347 bytes)
%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (5441 bytes)
%Program Files%\SelectRebates\Toolbar\logo.bmp (6 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-alert.bmp (1 bytes)
%Program Files%\SelectRebates\SelectRebatesApi.exe (673 bytes)
%Program Files%\SelectRebates\Toolbar\AddtoList.bmp (1 bytes)
%Program Files%\SelectRebates\FFToolbar\chrome.manifest (271 bytes)
%Program Files%\SelectRebates\Toolbar\i_magnifying.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\icons.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-wishlist.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.ini (2886 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-restaurant.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-grocerycoupons.bmp (1 bytes)
%Program Files%\SelectRebates\SRFF3.dll (673 bytes)
%Program Files%\SelectRebates\Toolbar\basis.xml (20 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-go.bmp (1 bytes)
%Program Files%\SelectRebates\SelectAlerts.dat (1 bytes)
%System%\config\software (3822 bytes)
%Program Files%\SelectRebates\SelectRebates.ini (12345 bytes)
%Program Files%\SelectRebates\SelectRebatesUninstall.exe (1425 bytes)
%Program Files%\SelectRebates\SelectRebatesDownload.exe (673 bytes)
%Program Files%\SelectRebates\Toolbar\Blank.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\Coupons.bmp (1 bytes)
%Program Files%\SelectRebates\SRebates.dll (673 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\M2BND7IQ.tmp (146 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebates_.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-wishlist.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_HotSpots.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\basis.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.cab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome\sahtoolbar.jar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-alert.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\icons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-go.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_24.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults\preferences\sahtoolbar.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome.manifest (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRebates_.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\ReviewSite.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\install.rdf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUninstall_.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Blank.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-icons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\ShopAtHomeToolbar_.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-grocerycoupons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\CashBack.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\SelectAlerts.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\i_magnifying.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesApi_.exe (0 bytes)
%Program Files%\SelectRebates\FFToolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults\preferences (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\GroceryCoupon.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\toolbar.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-restaurant.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRFF3_.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Coupons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Scissors.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\AddtoList.bmp (0 bytes)

The process %original file name%.exe:580 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebates_.exe (17138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-wishlist.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_HotSpots.bmp (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\basis.xml (1347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome\sahtoolbar.jar (3689 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\toolbar.ini (115 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\icons.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-go.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ShopAtHome_Toolbar_Installer.exe (189 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_24.bmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults\preferences\sahtoolbar.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\B9T84ARF.exe (173 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\GroceryCoupon.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome.manifest (271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRebates_.dll (3624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\ReviewSite.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUninstall_.exe (7104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Blank.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-icons.bmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\ShopAtHomeToolbar_.dll (13304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-grocerycoupons.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\CashBack.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\SelectAlerts.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.ini (4783 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRFF3_.dll (3553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesApi_.exe (2804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-alert.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-restaurant.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo.bmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\M2BND7IQ.tmp (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\i_magnifying.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Coupons.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Scissors.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\AddtoList.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUpdater.exe (2128 bytes)

The Adware deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\B9T84ARF.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installstatus.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ShopAtHome_Toolbar_Installer.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\OPC19AEM.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUpdater.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\M2BND7IQ.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar5200_ff.cab (0 bytes)

The process SelectRebates.exe:284 makes changes in the file system.
The Adware creates and/or writes to the following file(s):

%Program Files%\SelectRebates\srtmpprfkdmajs13.tmp (2 bytes)
%Program Files%\SelectRebates\srtmpsqu248gbkri.tmp (4 bytes)
%Program Files%\SelectRebates\SelectRebatesBT.dat (16 bytes)
%Program Files%\SelectRebates\SelectAlerts.dat (7 bytes)
%Program Files%\SelectRebates\SelectRebates.ini (169128 bytes)
%Program Files%\SelectRebates\SelectRebatesB.dat (6841 bytes)
%Program Files%\SelectRebates\srtmpprfn3pks9vp.tmp (2 bytes)
%Program Files%\SelectRebates\SelectRebatesA.dat (6 bytes)
%Program Files%\SelectRebates\srtmpgfib2aoeu40.tmp (7251 bytes)
%Program Files%\SelectRebates\srtmpprf8c7e4i5a.tmp (2 bytes)
%Program Files%\SelectRebates\srtmpsqusl3rrnu9.tmp (6 bytes)

The Adware deletes the following file(s):

%Program Files%\SelectRebates\srtmpprfkdmajs13.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpsqu248gbkri.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpprfn3pks9vp.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpgfib2aoeu40.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpprf8c7e4i5a.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpsqusl3rrnu9.tmp (0 bytes)

Registry activity

The process SelectRebatesDownload.exe:256 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B7 51 4E E0 E6 FD CB 87 97 9A A4 1E C1 A2 21 D1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SelectRebatesDownload.exe:728 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1E 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2D EA 97 8C C1 D5 06 5B 40 5C 63 A2 36 E4 D6 09"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process ShopAtHome_Toolbar_Installer.exe:1524 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "17 AA 8A 31 08 89 B2 A5 17 47 86 70 07 88 37 0D"

[HKCU\Software\ShopAtHome\Toolbar]
"TBHideFirst" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ShopAtHome_Toolbar_Installer.exe,"

[HKLM\SOFTWARE\ShopAtHome\SelectRebates]
"SelectRebatesLocation" = "%Program Files%\SelectRebates\SelectRebates.exe"

[HKCU\Software\ShopAtHome\Toolbar]
"TBShowOnce" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"UninstallString" = "%Program Files%\SelectRebates\SelectRebatesUninstall.exe"
"DisplayName" = "ShopAtHome.com Toolbar"

To automatically run itself each time Windows is booted, the Adware adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SelectRebates" = "%Program Files%\SelectRebates\SelectRebates.exe"

The Adware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"DisplayIcon"
"Publisher"
"HelpLink"
"URLUpdateInfo"

"URLInfoAbout"

The Adware disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SAHAgent"

The process regsvr32.exe:1964 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKCU\Software\ShopAtHome\Toolbar]
"EditWidthcombo1" = "1"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\TypeLib]
"(Default)" = "{462E4AEC-DB3B-4e69-AF61-4F300D76255C}"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\VersionIndependentProgID]
"(Default)" = "ShopAtHome.IEToolbar"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\InprocServer32]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll"

[HKCU\Software\ShopAtHome\Toolbar]
"KeepHistory" = "1"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0\HELPDIR]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\"

[HKCU\Software\ShopAtHome\Toolbar]
"RunSearchDragAutomatically" = "1"
"corruptedMsg" = "One of the XML files is corrupted or invalid. Press OK to uninstall."
"lastVersionMsg" = "You have the latest version of the ShopAtHome Toolbar."
"ShowExternalSearches" = "1"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\VersionIndependentProgID]
"(Default)" = "ToolBand.ShopAtHomeIEHelper"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}" = "00"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\ToolBand.ShopAtHomeIEHelper\CLSID]
"(Default)" = "{E8DAAA30-6CAA-4b58-9603-8E54238219E2}"

[HKCR\ToolBand.ShopAtHomeIEHelper.1\CLSID]
"(Default)" = "{E8DAAA30-6CAA-4b58-9603-8E54238219E2}"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\ProgID]
"(Default)" = "ShopAtHome.IEToolbar.1"

[HKCU\Software\ShopAtHome\Toolbar]
"PopStop" = "Untitled Toolbar has blocked a Pop-up window"

[HKCR\ToolBand.ShopAtHomeIEHelper]
"(Default)" = "ShopAtHomeIEHelper Class"

[HKCU\Software\ShopAtHome\Toolbar]
"autoUpdateMsg" = "New version of ShopAtHome Toolbar is available. Would you like to download and install new version?"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0\0\win32]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll"

[HKCR\ShopAtHome.IEToolbar\CLSID]
"(Default)" = "{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}"

[HKCU\Software\ShopAtHome\Toolbar]
"firstTime" = "1"
"ErrorMsg" = "Error"
"#EditWidthcombo1#" = "Widthcombo11"
"versionError" = "Can not find current version information."
"UpdateAutomatically" = "0"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\ProgID]
"(Default)" = "ToolBand.ShopAtHomeIEHelper.1"

[HKCU\Software\ShopAtHome\Toolbar]
"DescriptiveText" = "1"
"OpenNew" = "0"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}]
"(Default)" = "ShopAtHomeIEHelper Class"

[HKCU\Software\ShopAtHome\Toolbar]
"AutoComplete" = "1"
"closeAllWindowsForUpdate" = "All running IE Windows will be closed before updating the ShopAtHome Toolbar. Continue?"
"RunSearchAutomatically" = "1"
"toolbar_version" = "undefined"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}]
"(Default)" = "ShopAtHome.com Toolbar"

[HKCU\Software\ShopAtHome\Toolbar]
"updateMsg" = "This will try to update the ShopAtHome Toolbar from the server. Continue?"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "09 90 AB 9C 77 A9 65 14 FB 33 E0 35 A5 60 58 45"

[HKCU\Software\ShopAtHome\Toolbar]
"toolbar_id" = "{DBFF4555-D06C-4a2e-A23F-659E53AE00F9}"

[HKCR\ShopAtHome.IEToolbar.1]
"(Default)" = "ShopAtHome.com Toolbar"

[HKCU\Software\ShopAtHome\Toolbar]
"contextMenuItemName" = "ShopAtHome Toolbar search"

[HKCR\ShopAtHome.IEToolbar.1\CLSID]
"(Default)" = "{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}"

[HKCU\Software\ShopAtHome\Toolbar]
"ShowFindButtons" = "0"

[HKCR\ToolBand.ShopAtHomeIEHelper\CurVer]
"(Default)" = "ToolBand.ShopAtHomeIEHelper.1"

[HKCR\ShopAtHome.IEToolbar]
"(Default)" = "ShopAtHome.com Toolbar"

[HKCR\ToolBand.ShopAtHomeIEHelper.1]
"(Default)" = "ShopAtHomeIEHelper Class"

[HKCR\ShopAtHome.IEToolbar\CurVer]
"(Default)" = "ShopAtHome.IEToolbar.1"

[HKCU\Software\ShopAtHome\Toolbar]
"AlertMsg" = "Alert"
"uninstallMsg" = "This will remove the ShopAtHome Toolbar from your computer! Are you sure?"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0]
"(Default)" = "ShopAtHome Toolbar 1.0 Type Library"

[HKCU\Software\ShopAtHome\Toolbar\tb_items]
"Widthcombo11" = "1"

[HKCU\Software\ShopAtHome\Toolbar]
"connectionError" = "Can't establish a connection."

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\TypeLib]
"(Default)" = "{462E4AEC-DB3B-4e69-AF61-4F300D76255C}"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\InprocServer32]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\InprocServer32]
"ThreadingModel" = "Apartment"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}]
"(Default)" = "ShopAtHomeIEHelper"

The Adware deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations"

The process %original file name%.exe:580 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "73 62 5D 0C 07 98 A4 BE 67 73 32 F7 A6 49 20 CE"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process SelectRebates.exe:284 makes changes in the system registry.
The Adware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF B8 BD F5 9C 12 CB 6C A3 9B B5 55 00 D2 29 19"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"UninstallString" = "%Program Files%\SelectRebates\SelectRebatesUninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"DisplayName" = "ShopAtHome.com Toolbar"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Adware modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Adware modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Adware modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Adware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"DisplayIcon"
"Publisher"
"HelpLink"

[HKLM\SOFTWARE]
"test"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"URLUpdateInfo"
"URLInfoAbout"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version: 5, 2, 0, 0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 5, 2, 0, 0
File Description:
Comments:
Language: Russian (Russia)

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 71
20a9c88b33ce1d4ac5f1fe975a95b930
4406c6bcadd1cee036c9749629966b97
6937fe042ca203bbd8fa33826f2e73e2
0c76b5da4971bc7f0c81c137100e4022
c96e940631539bd75042797b4f5f6285
46c6ea0a5ac815f7f05cda541f7b3776
cd0c9c414280f4d5cf76b3908d34900e
cba77b3383ddfdbd7b89b8f060f4d608
cfa8ae875968b9b3c771b31315031aff
40062f3c4723149d1fe23f15c34c94d5
38a210e2f2334d9b0e228f5ba476da91
e2ef4c82792b9fd4f0232e7c46143a8f
95c770ef5b38174e1a7fdd14345526f9
bad9ecc19e18e8abe42b79279757b6b5
128a311c93b92c497887c40ccde3cbdd
5f83f54af0913b7f58d6ab61275cacea
8ce7b92aa0fb377514ebe8315142adc1
18ecbdd8b3b62e95bfd6616f83d4866f
ade50f4d96dd433fd0b90d7d32b0ae5e
b3e1b3b5f5f247f2cc12bab8ee8f6722
c264b7b5233e72a1cd871ead615a3437
f3130112414c50a407532855e3f53720
5986afbdf29f2e95d0d972f5118c94d1
d31fe3d13127234c24db8cf92629ebc0
f800b1369aa82fca7f794abff993e81e

URLs

URL	IP
hxxp://tbws.shopathome.com/RequestHandler.ashx?MfcISAPICommand=set&param= I-7cOM4DjEMHro-mFEESbqRzRRe6jzF6TSyknmmJRZ0V_Cs4c3zsf6E1_F38T2AEyfYMnTBYYzAEmuft8hQXCGwVwPCDX1yG62-2Ce-cg8g8YE_OCsHQQEFBk77I6TXMW1WVwgvIwKjXndeY14ykKwIAFBZgdbZfB2B8hRH_ng_uGHRIerg8bD3iHlEYg2lu4r5gfX6WN9gl8kSyrecH6JClqBPR00eXQmgjKiN_Kxe3z9EFU4EETkC-5HifJeQATKyPLYf7cHhvz2CQAxU5Ih5VCZtDdfBwmtD5OsW6oC8IDfcaU9bR8QJbpXtn5LCEK0entwtQyLZYowp0ePdnUG	74.63.145.160
hxxp://toolbar.shopathome.com/install/setup5200.cab	74.63.145.172
hxxp://toolbar.shopathome.com/install/toolbar5200_ff.cab	74.63.145.172
hxxp://www.shopathome.com/agent/agentprefs_.sah	74.63.145.186
hxxp://gs1.wpc.v2cdn.net/agent/toolbarprefs.sah
hxxp://tbws.shopathome.com/RequestHandler.ashx	74.63.145.160
hxxp://gs1.wpc.v2cdn.net/agent/bce_.sah
hxxp://tbws.shopathome.com/RequestHandler.ashx?MfcISAPICommand=installstatus&param=Ø frtXFiqIX4GbgcJxPRH7be0DduJjehBXcU_ijoe_Yk7184KcM5uMOzy6qgQ684qQN_n1tdMvaDCV_Cs4c3zsf6E1_F38T2AEyfYMnTBYYzAEmuft8hQXCGwVwPCDX1yG62-2Ce-cg8g8YE_OCsHQQEFBk77I6TXMW1WVwgvIwKjXndeY14ykKwIAFBZgdbZfB2B8hRH_ng_uGHRIerg8bD3iHlEYg2lu4r5gfX6WN9gl8kSyrecH6JClqBPR00eXQmgjKiN_Kxgu12qGVPEbnOQedwQ4tGWsNtxYBWjZ8t4jKmujQIbchIqO03nNT-DL3Adw1zlg0qGSmt8hP1_83dYlaQCboqTY72SdACDe2bNMutxUCt7MP1J4iY5N3cWM9HX9O1LJZA41LjPBA-jx9jDdUK6-pJEsQz9h-Fa6zRtAnvuFZJPQPdd6eSzushf05T9uTfaizXHtI2W9RfNE5uISbiHul1hOAMGTlCGxyOv2AjMdyeP2EDrf2Q5BkYStAKrcVhcLSCMQZnuVe7vJCWWsdr8dG-E_r17JxYpa3AWkH6T2txfAV6uq1yokmkTfG6mXmruj-9K6Nz7zwk_nIIv4PqBVkafyF9bQGd3nCnBVahN-MlL7iG	74.63.145.160
hxxp://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=	74.63.145.186
hxxp://googleadapis.l.google.com/css?family=Roboto:300,700,400|Fjalla One|Noticia Text:400italic
hxxp://e250.b.akamaiedge.net/js/rac/sli-rac.1.3.css
hxxp://svip-usa7.sli-systems.net/rac/sli-rac.css?rev=148249
hxxp://cs227.wac.edgecastcdn.net/Content/SiteCssWebformsBundle?v=42
hxxp://cs227.wac.edgecastcdn.net/js/html5shiv.js
hxxp://gstaticadssl.l.google.com/s/noticiatext/v6/dAuxVpkYE_Q_IwIm6elsKDoGYR7Z3iWH66EXnaJoKgg.eot
hxxp://gstaticadssl.l.google.com/s/fjallaone/v4/rxxXUYj4oZ6Q5oDJFtEd6lQlYEbsez9cZjKsNMjLOwM.eot
hxxp://cs227.wac.edgecastcdn.net/js/tipped/excanvas/excanvas.js
hxxp://gstaticadssl.l.google.com/s/roboto/v15/5YB-ifwqHP20Yn46l_BDhA.eot
hxxp://cs227.wac.edgecastcdn.net/js/CombinedJS_16C48997C531D7EDA08CDC195581896D.js
hxxp://www.shopathome.com/WebResource.axd?d=utXq0EopSmH_wSGx3BdZvDyYLpS5Ff55sDuYcl5aUvI_mXIJL5BpykW6xvZro8cCJWqYDkZtKLBu4ajxaGC76D-cQPk1&t=635418424260000000	74.63.145.186
hxxp://www-google-analytics.l.google.com/analytics.js
hxxp://e6640.g.akamaiedge.net/js/91114986.js
hxxp://cs145.wpc.edgecastcdn.net/images/background_sah_2014.jpg
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j37&a=189529769&t=pageview&_s=1&dl=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&dp=/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&sahusertype=nonauth&ul=en-us&de=utf-8&dt=Toolbar&sd=32-bit&sr=1276x846&vp=1256x669&je=0&fl=11.6 r602&cn=960115915&cm=91098&_u=QEAAAEAAK~&jid=1067047784&cid=1016185637.1433813056&tid=UA-2915199-1&_r=1&z=1209533970
hxxp://cs227.wac.edgecastcdn.net//js/browserdetection.js
hxxp://cs227.wac.edgecastcdn.net/js/jquery.browser.js
hxxp://cs227.wac.edgecastcdn.net//js/toolbar/toolbarutilities.js
hxxp://cs227.wac.edgecastcdn.net/js/jquery-ui-1.10.3/themes/smoothness/jquery-ui.min.css
hxxp://cs227.wac.edgecastcdn.net/js/jquery-ui-1.10.3/ui/minified/jquery-ui.min.js
hxxp://cs227.wac.edgecastcdn.net/styles/tbpi.css
hxxp://cs145.wpc.edgecastcdn.net/images/merchants-computer-screen.png
hxxp://cs145.wpc.edgecastcdn.net/images/circle-step-1.png
hxxp://cs145.wpc.edgecastcdn.net/images/chrome-example-window.png
hxxp://cs145.wpc.edgecastcdn.net/images/ie-example-window.png
hxxp://cs145.wpc.edgecastcdn.net/images/circle-step-2.png
hxxp://www.shopathome.com/images/bttn-claim-shopgold.png	74.63.145.186
hxxp://cs145.wpc.edgecastcdn.net/images/btn-continue-to-coupons-orange.png
hxxp://cs145.wpc.edgecastcdn.net/images/bttn_continueshopping.png
hxxp://cs145.wpc.edgecastcdn.net/images/button-continue-for-great-coupons.jpg
hxxp://cs145.wpc.edgecastcdn.net/Images/landing/machine-and-animation1.gif
hxxp://e54.g.akamaiedge.net/meter/www.shopathome.com/32.gif
hxxp://data.solvemedia.com/dapi/collect	8.20.87.8
hxxp://pagead.l.doubleclick.net/pagead/conversion.js
hxxp://data.solvemedia.com/dapi/data?type=html;sid=2wtw;ea=sm1;hema=H1:ab247113be1d2e88cf0f9ab5e5e83dcd5eb73b0e,H2:d6d94e6961b4fc3436f61093fc93e02baa21c969,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:f160d6c9d1e34e61ef6b28f1bb94821b,H5:2bd97d990602df657c9cc3e48770437e;_t=1433813056823	8.20.87.8
hxxp://pagead.l.doubleclick.net/pagead/conversion/1071192949/?random=1433813056995&cv=7&fst=1433813056995&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=46051092&utmhn=www.shopathome.com&utmcs=utf-8&utmsr=1276x846&utmvp=1256x669&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Toolbar&utmhid=189529769&utmr=-&utmp=/1394716560/goal&utmht=1433813057089&utmac=UA-2915199-5&utmcc=__utma=57828200.1016185637.1433813056.1433813057.1433813057.1;+__utmz=57828200.1433813057.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=2147369879&utmredir=1&utmu=DACAAAAAAAAAAAAAAAABAAAE~
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/1071192949/?random=2096830191&cv=7&fst=1433813056995&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&ocp_id=PUB2Vc6VMKWaigaWtIGYDg
hxxp://cs145.wpc.edgecastcdn.net/images/global-sprite2.png
hxxp://spdc-global.pbp.gysm.yahoodns.net/spp.pl?a=1000742424085&.yp=7164&js=no
hxxp://www.google.com/ads/user-lists/1071192949/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&random=1303519930	216.58.209.164
hxxp://data.solvemedia.com/dapi/data?type=html;sid=2wtw;ea=sm1;hema=H1:ab247113be1d2e88cf0f9ab5e5e83dcd5eb73b0e,H2:d6d94e6961b4fc3436f61093fc93e02baa21c969,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:f160d6c9d1e34e61ef6b28f1bb94821b,H5:2bd97d990602df657c9cc3e48770437e;_t=1433813056823;cm=1	8.20.87.8
hxxp://www.google.com.ua/ads/user-lists/1071192949/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&random=1303519930&ipr=y	216.58.209.195
hxxp://fd-world.ngd.gysm.yahoodns.net/pixel?id=2285230&t=2
hxxp://a1945.g.akamai.net/j/roundtrip.js
hxxp://c.global-ssl.fastly.net/nr-632.min.js
hxxp://adservers-users-3-834007807.eu-west-1.elb.amazonaws.com/pixel/77I5CH5ZEZFNVPMSE3MTAA/ONW3GFE3ZNGOPDPAXKOR5I?pv=5596272544.652253&cookie=&keyw=&adroll_external_data=customer_type=nonauth&registration_user=&refer_code=91098&source_code=REBATE&brand=ToolbarPostInstall
hxxp://a1945.g.akamai.net/pixel/77I5CH5ZEZFNVPMSE3MTAA/ONW3GFE3ZNGOPDPAXKOR5I/HR3E4M74MREKJACLTHVERQ.js
hxxp://bam.nr-data.net/1/eabd37c669?a=442317&pl=1433813054542&v=632.2b17625&to=YlVRZxFXX0VWVkMPDVsfcmAzGUVZWFlVBxBFX0BHClhCQlZZW0gDRkBL&ap=3&fe=2953&dc=2938&tt=61F4BF9060A68D2F&f=[]&jsonp=NREUM.setToken	50.31.164.166
hxxp://adservers-users-3-834007807.eu-west-1.elb.amazonaws.com/cm/r/out
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/0/?label=null&guid=ON&script=0&ord=964994172604412.5
hxxp://adservers-users-3-834007807.eu-west-1.elb.amazonaws.com/cm/f/out
hxxp://adservers-users-3-834007807.eu-west-1.elb.amazonaws.com/cm/b/out
hxxp://www.google.com/ads/user-lists/0/?label=null&script=0&random=1739067064	216.58.209.164
hxxp://www.google.com.ua/ads/user-lists/0/?label=null&script=0&random=1739067064&ipr=y	216.58.209.195
hxxp://adservers-users-3-834007807.eu-west-1.elb.amazonaws.com/cm/w/out
hxxp://ib.anycast.adnxs.com/seg?add=2518433&t=2
hxxp://star.c10r.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=MzYzMDJkODVhZjRhZDM2NThkZThiZjZhZmE5Nzk4YzM
hxxp://fd-world.ngd.gysm.yahoodns.net/pixel?id=2498203&t=2&piggyback=http://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1
hxxp://adservers-users-3-834007807.eu-west-1.elb.amazonaws.com/cm/x/out
hxxp://adservers-users-3-834007807.eu-west-1.elb.amazonaws.com/cm/l/out
hxxp://x.bidswitch.net/sync?dsp_id=44&user_id=MzYzMDJkODVhZjRhZDM2NThkZThiZjZhZmE5Nzk4YzM	23.251.139.154
hxxp://adservers-users-3-834007807.eu-west-1.elb.amazonaws.com/cm/o/out
hxxp://adservers-users-3-834007807.eu-west-1.elb.amazonaws.com/cm/g/out?google_nid=adroll5
hxxp://fd-world.ngd.gysm.yahoodns.net/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1
hxxp://ib.anycast.adnxs.com/bounce?/seg?add=2518433&t=2
hxxp://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MzYzMDJkODVhZjRhZDM2NThkZThiZjZhZmE5Nzk4YzM	23.251.139.154
hxxp://adservers-users-3-834007807.eu-west-1.elb.amazonaws.com/cm/r/in?xid=kmKYOF8EL9T06yKO9PEFfaBe
hxxp://prod-mkt-d.d.xx.openx.com.akadns.net/w/1.0/sd?id=537103138&val=36302d85af4ad3658de8bf6afa9798c3
hxxp://idsync-ext.rlcdn.com/377928.gif?partner_uid=36302d85af4ad3658de8bf6afa9798c3
hxxp://pug22000.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=2a99880d-fe09-4942-9d5c-3f458370b122
hxxp://prod-mkt-d.d.xx.openx.com.akadns.net/w/1.0/sd?cc=1&id=537103138&val=36302d85af4ad3658de8bf6afa9798c3
hxxp://idsync-ext.rlcdn.com/377928.gif?partner_uid=36302d85af4ad3658de8bf6afa9798c3&redirect=1
hxxp://images.sahcdn.com/images/global-sprite2.png	93.184.221.172
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/0/?label=null&guid=ON&script=0&ord=964994172604412.5	216.58.209.194
hxxp://images.sahcdn.com/images/btn-continue-to-coupons-orange.png	93.184.221.172
hxxp://images.sahcdn.com/images/button-continue-for-great-coupons.jpg	93.184.221.172
hxxp://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=36302d85af4ad3658de8bf6afa9798c3	1.117.192.17
hxxp://images.scanalert.com/meter/www.shopathome.com/32.gif
hxxp://c2.sahcdn.com/js/jquery-ui-1.10.3/themes/smoothness/jquery-ui.min.css	68.232.35.51
hxxp://j2.sahcdn.com//js/browserdetection.js	68.232.35.51
hxxp://cdn.optimizely.com/js/91114986.js
hxxp://ib.adnxs.com/bounce?/seg?add=2518433&t=2	68.67.153.34
hxxp://d.adroll.com/cm/x/out	79.125.23.223
hxxp://us-u.openx.net/w/1.0/sd?id=537103138&val=36302d85af4ad3658de8bf6afa9798c3	1.117.192.17
hxxp://images.sahcdn.com/Images/landing/machine-and-animation1.gif	93.184.221.172
hxxp://xml.sahcdn.com/agent/bce_.sah	93.184.221.133
hxxp://d.adroll.com/cm/b/out	79.125.23.223
hxxp://j2.sahcdn.com/js/CombinedJS_16C48997C531D7EDA08CDC195581896D.js	68.232.35.51
hxxp://j2.sahcdn.com/js/jquery.browser.js	68.232.35.51
hxxp://images.sahcdn.com/images/ie-example-window.png	93.184.221.172
hxxp://www.googleadservices.com/pagead/conversion.js	216.58.209.194
hxxp://xml.sahcdn.com/agent/toolbarprefs.sah	93.184.221.133
hxxp://www.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=MzYzMDJkODVhZjRhZDM2NThkZThiZjZhZmE5Nzk4YzM	31.13.93.3
hxxp://d.adroll.com/cm/o/out	79.125.23.223
hxxp://c2.sahcdn.com/Content/SiteCssWebformsBundle?v=42	68.232.35.51
hxxp://ads.yahoo.com/pixel?id=2285230&t=2	217.163.21.35
hxxp://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=2a99880d-fe09-4942-9d5c-3f458370b122	198.47.127.15
hxxp://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1	217.163.21.35
hxxp://d.adroll.com/pixel/77I5CH5ZEZFNVPMSE3MTAA/ONW3GFE3ZNGOPDPAXKOR5I?pv=5596272544.652253&cookie=&keyw=&adroll_external_data=customer_type=nonauth&registration_user=&refer_code=91098&source_code=REBATE&brand=ToolbarPostInstall	79.125.23.223
hxxp://images.sahcdn.com/images/bttn_continueshopping.png	93.184.221.172
hxxp://d.adroll.com/cm/g/out?google_nid=adroll5	79.125.23.223
hxxp://idsync.rlcdn.com/377928.gif?partner_uid=36302d85af4ad3658de8bf6afa9798c3	107.21.26.11
hxxp://images.sahcdn.com/images/background_sah_2014.jpg	93.184.221.172
hxxp://fonts.gstatic.com/s/roboto/v15/5YB-ifwqHP20Yn46l_BDhA.eot	216.58.209.163
hxxp://images.sahcdn.com/images/merchants-computer-screen.png	93.184.221.172
hxxp://c2.sahcdn.com/styles/tbpi.css	68.232.35.51
hxxp://j2.sahcdn.com/js/html5shiv.js	68.232.35.51
hxxp://d.adroll.com/cm/r/in?xid=kmKYOF8EL9T06yKO9PEFfaBe	79.125.23.223
hxxp://j2.sahcdn.com//js/toolbar/toolbarutilities.js	68.232.35.51
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.4&utms=1&utmn=46051092&utmhn=www.shopathome.com&utmcs=utf-8&utmsr=1276x846&utmvp=1256x669&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Toolbar&utmhid=189529769&utmr=-&utmp=/1394716560/goal&utmht=1433813057089&utmac=UA-2915199-5&utmcc=__utma=57828200.1016185637.1433813056.1433813057.1433813057.1;+__utmz=57828200.1433813057.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=2147369879&utmredir=1&utmu=DACAAAAAAAAAAAAAAAABAAAE~	216.58.209.206
hxxp://j2.sahcdn.com/js/jquery-ui-1.10.3/ui/minified/jquery-ui.min.js	68.232.35.51
hxxp://images.sahcdn.com/images/circle-step-2.png	93.184.221.172
hxxp://images.sahcdn.com/images/circle-step-1.png	93.184.221.172
hxxp://d.adroll.com/cm/w/out	79.125.23.223
hxxp://www.google-analytics.com/analytics.js	216.58.209.206
hxxp://www.googleadservices.com/pagead/conversion/1071192949/?random=1433813056995&cv=7&fst=1433813056995&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0	216.58.209.194
hxxp://sp.analytics.yahoo.com/spp.pl?a=1000742424085&.yp=7164&js=no	188.125.66.33
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071192949/?random=2096830191&cv=7&fst=1433813056995&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&ocp_id=PUB2Vc6VMKWaigaWtIGYDg	216.58.209.194
hxxp://j2.sahcdn.com/js/tipped/excanvas/excanvas.js	68.232.35.51
hxxp://a.adroll.com/j/roundtrip.js	194.146.191.104
hxxp://www.google-analytics.com/ga.js	216.58.209.206
hxxp://fonts.googleapis.com/css?family=Roboto:300,700,400|Fjalla One|Noticia Text:400italic	173.194.71.95
hxxp://d.adroll.com/cm/f/out	79.125.23.223
hxxp://js-agent.newrelic.com/nr-632.min.js	23.235.43.175
hxxp://ib.adnxs.com/seg?add=2518433&t=2	68.67.153.34
hxxp://idsync.rlcdn.com/377928.gif?partner_uid=36302d85af4ad3658de8bf6afa9798c3&redirect=1	107.21.26.11
hxxp://d.adroll.com/cm/l/out	79.125.23.223
hxxp://fonts.gstatic.com/s/fjallaone/v4/rxxXUYj4oZ6Q5oDJFtEd6lQlYEbsez9cZjKsNMjLOwM.eot	216.58.209.163
hxxp://d.adroll.com/cm/r/out	79.125.23.223
hxxp://assets.resultspage.com/js/rac/sli-rac.1.3.css	23.64.209.38
hxxp://images.sahcdn.com/images/chrome-example-window.png	93.184.221.172
hxxp://a.adroll.com/pixel/77I5CH5ZEZFNVPMSE3MTAA/ONW3GFE3ZNGOPDPAXKOR5I/HR3E4M74MREKJACLTHVERQ.js	194.146.191.104
hxxp://ads.yahoo.com/pixel?id=2498203&t=2&piggyback=http://ads.yahoo.com/cms/v1?esig=1~bf4e7dc4546a90c08591652d78a230d3f2ef5733&nwid=10001032567&sigv=1	217.163.21.35
hxxp://shopathome.resultspage.com/rac/sli-rac.css?rev=148249	64.27.64.227
hxxp://fonts.gstatic.com/s/noticiatext/v6/dAuxVpkYE_Q_IwIm6elsKDoGYR7Z3iWH66EXnaJoKgg.eot	216.58.209.163
cm.g.doubleclick.net	216.58.209.194
stats.g.doubleclick.net	74.125.143.156
analytics.twitter.com	1.115.192.22

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /s/fjallaone/v4/rxxXUYj4oZ6Q5oDJFtEd6lQlYEbsez9cZjKsNMjLOwM.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/eot

Last-Modified: Thu, 28 Aug 2014 18:23:59 GMT

Date: Tue, 19 May 2015 14:29:49 GMT

Expires: Wed, 18 May 2016 14:29:49 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Content-Length: 17801

Age: 1767262

Alternate-Protocol: 80:quic,p=0
..........|.UP.....a.........%.{....5.C...............i.j.<.......S
w.,..).......?........R`...........H..O............ .p.X....%....p....
..Z..=...s....@.?....8......p........3...........>i....2...j.....e.
.b....GXG...az9...Y....I...*jt,.....B....U.jj..e....(.)..<[email protected]
.{[email protected]?.....2j...a..%.....1r..<.....;........7....r....
.3...D.>.... [.Lw.&....Vp..([email protected]#,6U1.`.t..6~...T..
D.A....p....5..'..E.T.....Z..?...}..D.[..iyyA&8..3..W.V.....J.90.7 ...
......LQ.5.FN..~..X..d..j...y...)?.i......-}.qZ.H.. .R.x........AG..\8
(%|./.t......b-`......VM...%7...n..)....Ym......g.l. 1.u.7.]{Mje...Y.A
....y.%.aG...idV..so XD.ai....e7k..Y....v...iA(.......w...F..L..(...1.
Y.<..$...Y..\...c5.:/E.s.y..N!.|%...........,Xf.Y{.#...i.9.....N.&l
t;.M.W3.g.A!..^....5,j...{......(8...Q.i...=.....m:.. .a/FO....<.Y.
o..S.g\.%`._. . .;...r.0..L&]...A.R...N..>......Q:..).$..=....;P...
,..F$.>".9 .....:&j....e.p..z{.,.'Z9.(.."..c............?.7.......%
.x,.....7,.......o3<..v..U....(E_d..H.28.....G.a5....@*......g=...5
.......].>........z4..-..\[email protected].`fK.../'..ew...MiM.
..9.* >p.J.5.....N........B3..3.4...J.V..L.]../.....D...T...\.Qr...
p.......8l...n(.../...]s{.s.l.0e.v..K.S.o.....j..D..4Hl...B..c..Uh-...
.tu].j.0.W..C.-..B.U.4..$..T.....Oq...s...t^.:&....-|b."4.]H...E.."e7k
U......2X.j.<.....s.....N.......H..N...9...%\...?.{4...$......x..m.
.....Fv.3..A....s.....(_....m..W..v.s0.\c.......T....C..D.%..v...... .
...W^y.c...E...(.tr......|r.<.!...>.6Q.~4....VM .!mN.G.[...d
<<< skipped >>>

GET /s/roboto/v15/5YB-ifwqHP20Yn46l_BDhA.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/eot

Last-Modified: Wed, 14 Jan 2015 22:47:37 GMT

Date: Fri, 24 Apr 2015 17:01:16 GMT

Expires: Sat, 23 Apr 2016 17:01:16 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

Content-Length: 16223

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 3918175

Alternate-Protocol: 80:quic,p=0
..........m.UT...=83.3....N...-....K....!..w...5h A........uO...].....
,>..9....?..............?T.^..@...~)..(....$......4.......?..0....6
./.#..................._1n.;..?p....".......OE.@RSV.....`j.. .pl...qf.
.',6uPl...:.Sp...X2.=.;.......h..P...*...YSc.vj.....J........yyN].8.z(
.......E...&.. ..mP...4....^....h...ww........^`.5C.(.....y.5.|.nT/6s.
^.*.G..ny.`.-..`..|....|(R.\...l,A<'...T..cp...U......zb.t........^
.6...>.9.;.W-.&......W...:...m".I.....%...K/B....~4..#Z...k.E......
 ..pSz...1I.:......"...D.....#.2U.5..I..I...Zh...D.Q.0.I'.nn..m{.~R.|.
."2.........]_x.(J....(...(.&.!.....$..YS. S..RU.f'....5..~=.Gj..!.9(.
......WqU`{ic....9...]...|v......j.k..s3....N.......S.Fb.W2..X...u9o..
Q|^D<G. .9.../...z .BB.zm..$.*.g4....:..*........{{Q,5..uw.....'.h?
~.....BSI4s....0.....0.h.^...v......^...7........1^;i.....rqF...d.....
x.fRf....#x.v......-|..]..|x........Jf....;.}...E. yx...9.....t.{[;"..
.~.qz.T.[.x...C....K-9...l.........@F.;[email protected]."......<89.....
........`....?...Wq...k....B..J.N\.X.......k......E.......A*?..{q.Y.YR
.<..sM.,.5..@..)..-1..r.%..Nr..aR]*..du*.n..w.....R....HUT..\.F6...
0e...t*G...L.Ki.'Y........$...hG..k..C...5$..g.!.<#..$)HB...^..d.ye
[..f.]...... ..V..g:..5.....N...K.q.~o.n..E/"...A7Mx)...w....#..j..R.V
.Y....ij.Z<[email protected][..L...Tr....B.lq........[.9..Y.......y..".
>J..M.-..m..M.. ...>3Ru.{..N..g]....a..wf.......*.o...=#%d.. .B.
. 7.l.}.KO..Z...K....&!..O .. .~.:...5W...p.0/C.:.K...'.)i...f'......,
......}.0..[...$.W?B..V'.....>U.......`.aL...........l..):.:VL8
<<< skipped >>>

GET /js/html5shiv.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Tue, 09 Jun 2015 01:24:11 GMT

Etag: "e49e9127f65d01:0"

Expires: Tue, 16 Jun 2015 01:24:11 GMT

Last-Modified: Mon, 23 Mar 2015 15:36:04 GMT

Server: ECS (fcn/9F8E)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web03

X-UA-Compatible: IE=edge

Content-Length: 2812
............ks.6.{~..........~.I.....1..S.. ...S..@.}.....A.......<
c.....}....C....^}E...!./._O?#.yB.T^PE...i.E........<.l. ?.|....W..
W<c.b99H.....*.\T.K^..rBr..W..cr. =x..^i.6.<.r.p.!....U2.4.5.Vv}
Ce.pF,.i.W.W.i.............^.Z.y.<2.............6...;..5..Y..Q...F.
 M%.....g..t....~-.X.....%.....e.......JQ.[."/. .-..n.3|..#..m.M&r..|.
,8 s.DS|...7..M.eS|.._7.)...M..Q6u.g.jZ5JKQ-...d..s......y..F.f]v.~.4.
.\.L.L.. s).....u-$.!g...5..6.#Az.....y...."ba.. `0........C].. .u.Z.P
DH...S.v..i.....H-.....IK.5..9Y.{"...........Q.....PXN55h.<...9...V
x.....J\V...A~..?8..=......-.._.......4......%4....t...I.{.......=M.3.
@i.......B...... .W.E...d...R@..\P=|.9U<...XLKk....QbI'.Atl....I...
iV.2...IMKV-.....g..ve.O...%.!.Z*Fj....0..........h.hX.....n .,w...=..
.FO.}.....(Z.._..|..MM|.....u...!.$p..{.....;lo_.):.v4vO[0...#..0.z..'
=.]e..-...c\[email protected]`)&".M0.Y&.../.h*....`.!.%..sp....G......|.
....dCn.z......4.n...r.%.. `.^#i..|xPkP....sd}k..Y\D..........Q.....U.
.......Gu2....'0....d......t.i.B..y2~s..=...K..r......Ss.o.r....b`...=
9......d.{.)...iI.~.Qf...\.%c......I.........._S..f...FQ)...i..{.0[..A
#6.L...6RaH.@\[email protected]...^B.k....9..$crLbD[.5...c./.b.q...
...*[email protected]...{..../$..C....<..~.U-..ai
..'..yo....D8$..h.j...f/5.7:_vYe...:.C`Os ..3.....p.k.Wq1iI.]...L.~..M
[email protected]..^<4Z..Z.....E.A..........)......w..7.[.=F....].E..w2...
x.oc.&>Y.....f....K2....)...P....h....p.%.....Q1b.....M..6M.X.&.0.-
\..\.xJ...1.k.<[email protected]./...C..].a,.a.]A...&..iV.j.V,..}/v..
<<< skipped >>>

GET /js/tipped/excanvas/excanvas.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Tue, 09 Jun 2015 01:24:11 GMT

Etag: "e79030137f65d01:0"

Expires: Tue, 16 Jun 2015 01:24:11 GMT

Last-Modified: Mon, 23 Mar 2015 15:36:05 GMT

Server: ECS (fcn/41BB)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

X-UA-Compatible: IE=edge

Content-Length: 4297
...........:.s.......l].....m......o...y.....O..`...`@....~.3.........
T..t.......a<......h^iG..[.C.E......a<....8`i.Bm.....9.Nr......7
V.q.jG.D3p..Q..".:[j.ZkiVi......f1..... -N. [.IL..i....u$..D..42..0...
.z3u.F .....*w...jeQ.....8.............,..3MXYj.{\..l..5..K.........hT
0.U...*.*N#....Z..!.0.."..UOb...ou.....~r.]\.......A"._\....k...._O../
.../_../.././.\B.W...F.....Dc /X....w.l.(K.r.]1.ca.......,.`ki........
).H.Y..K<.....L./..V.../..0....VVP0Z...a....>.R7..UgYZ.u..2[..R2
.....Ag..N.j>..XU..;...).;.7...n...A5.54&b^.%YQ.y..n.........7.7_^.
j-.<[email protected]{f0...L.......w....O.&..(.C..h.....q.......C...h...
........5N........S`(./.e.7.V-.......[..[!..L.`Y. ...j~g..rn<....g.
bV.-.'v..$....[kl....q.v..9..Q...B.....IZ...y.o.7..;~V...D.......h... 
.t..2...J$WU.0q.pu..&.....D....~..j....?.8.tP[V(..h..p.*...O..^4...$.i
r..s.....QW.,..U.....}.?...._..Zq.@\p)...9...N..s......w.C.n..l...8.Y.
a...Q..N.2K...p4`.X....$...{`.=..V.R.......l.....t..tK0...[..;......g.
.t....lE..=.)..`1u'd3.L.f..o....m".g......F.u..P.\...L...yz......Dc.U.
/[email protected].$3O%. .L....'I..A.t~.Qsw#....]..e......cv.M..;...Fp.....
i....F....%.f..Ss.....K...37S.O(*..(B......r.h..Uh4.6-..w..M..]*d...r.
..A5..0[.&....vZ.....x..}..JV..be.........]u.....O....(-U:..F...I.....
.N....0.h..F.BP..1...2...:.7..8..Go.)..8.hz..n.}6.f.i......}...[.L.dJn
'.....*.-.<.....]rQ....V..P..L...T...V...Z.3\..Jc@... ...K.`..p&t.o
>..*.8..d.Y.~...5,vA.a.W.._Y.m.... .......B!/`...rS.TM....$.-".%Jrd
...)1..p.....9.X..V..|.3...n..r8kw....^.V......3.}.x..H.M.......-f
<<< skipped >>>

GET /js/CombinedJS_16C48997C531D7EDA08CDC195581896D.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Tue, 09 Jun 2015 01:24:11 GMT

Etag: "64e4b269369ad01:0"

Expires: Tue, 16 Jun 2015 01:24:11 GMT

Last-Modified: Fri, 29 May 2015 17:39:28 GMT

Server: ECS (fcn/418A)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web09

X-UA-Compatible: IE=edge

Content-Length: 108487
.............v.H.0....B.JD1EQ.rw5(..-.....k.]..V..d.D...X$.%.3.1..=...
3.2/0.0.....E...{...........X.......~.....<..\........o.........'..
0..(......?..Y.G.l.1.A.d]...K:.ky.l.L.&.'...n~..2...5|...~.M.h......e3
h.......L..:T...e...-..,.B~sC.#..~Fy..L.....L/.X$R....l......u....n...
...L.<..lk.U.....` F.3.r...%.,....nv.........GY.....iv......9....u.
<.q?....u.t-,e1k.....8M...*.X....X.2.e.....T1.Z..O.0..&...G..z.s...
r.............?.!.f.............K..t....j'..;.j;..{"..`.\..8....\H-e].
...*..)|WT..>...C.m...9..k'.....;.... o....u.Q..7....nP....={..s...
...._`DQ1M8wb.k&........;i2uw...w.e.....7.=k..W./.....m..Y....z.w..eo.
...(...$......m'c.....m9.p..8.]F.g...gr.|..r..g....'G^..6..l..r..\...n
n.O..CS.'4.~B...g.f.6..G...,...)...4....R.....\.S...e..p...<.d.3.=.
.[....8.1.....$..\XVo.?...V/.Y.......P....;....f.~..y...6..........f.q
.wJ..m..Vr.l.-MoP.>AQ..u....=.....5..v...us.[.C....../..A.."u""H.9.
.&.r(.=.:4...v..Rg{....<8.X...S........a..X........f...,.s.......@E
..C....~.....G......j[..0.X.BC....v.p/[email protected]..!.u
.7....r<..%.> ......{..u}.%...*CZ..M.....'........._....Mz..(.&.
.. ......%{..;..Kw.(.S.q.YfGcTD.4_...KL.?......G....W.t...v......i..^.
y.....3 .g.;4 n...6.i..........Y...,....w...s:..O~U.8j.4\.l.k.=b2....U
..)I..]u.W)F....k.k;.z..va.H.E..1.q...#.(..s.'.. ..-.........!...@..!#
F.CN......._A.Q.-....i<.n$.......z..N...R..T)...Gz.......4.....{...
7...Ff..~.._..5u..l{[email protected]......>..%.h.5.c.?...8..E..!0R
1.S...S.......F......CZ.q.:KRN...O..$J.~.......(NbV...2..q....OG1\
<<< skipped >>>

GET //js/browserdetection.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Tue, 09 Jun 2015 01:24:12 GMT

Etag: "2745e4127f65d01:0"

Expires: Tue, 16 Jun 2015 01:24:12 GMT

Last-Modified: Mon, 23 Mar 2015 15:36:04 GMT

Server: ECS (fcn/41B9)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

X-UA-Compatible: IE=edge

Content-Length: 4789
...........<ks.F..S..0a.Eb....AR...8.E.-.,.... .H.EX [email protected].
r.Wu.T4.~LOOOw.Lc......|..pH~..p...,....I..).%x.n.Y.....q.ZY....0..c..
..._...-.E.R.:.l.q...@..=..N...m....6a.... .......6.$..d..E.........1.
....w.....=X.I......M....).8.)%s.%...`<"?....4..t..0..:..........2&
gt;...Q....|..IV.U.......uJ....#?'.j.!..oo?.R...:'#..\$YF..S{....-....
.....8g..H.d..G..R2.........][email protected].?..5 .k2..]N...).'Ib}......Ye.\DS
@I0..k@..(.....:..c2."..........Qr....t8......Z$.~...p.....#.`...}..`.
..h]]...eR....^.w..a....r....i|............w...I..>...IN..7....w...
T6..(.\.(.<....r|1)).....}[email protected]"...F...k.....m.E..TkZ6ge
so...46a(l...D....i..9O..]...v...I.y.........Y......nro~<.L.>...
...m..i....{....].9....=..z......7aFW.8.T.M........<...z...\..W.!..
...)......|BX..KQ.....<...Z........C....(........P...O.y_'.....;..h
f..M..7.?....O@..>%[....)';....dG.y.-...O.C.l...Rd..%XeA.....X.Ez.y
../..P!...vQ.K]m....B@[email protected]..$..x...`HK.H..S.h..._.J0..T).o......
`.uR.4X{G..G .. [email protected]>.X../Y....9.&..S9.Au..YJK8.BJ.........'...
*J..{J>.m..:.k.....hI..c.O6.#$.4.5....u...Mp...........q.......b...
..)......k...8.a$.. .A.5P..l.yeK...........&,...P.....l:e.-.....[.<
.cG.. ..l........{...?..V...NO.Tm..g....'..x....6.P..1"....k....U....'
[q......~.E....e.....cs./d<.............;.r... ..l.S...,.s#...Z..:.
r.l.T..../.._[6.......Da,...d g..2..M..<G.h.."...%....X...(..K...:.
....... "..v; ,f.kI....?....w..h8...............\..9.....<0$A<..
..`.yhN..f.Yp..~p...sK..'..`.]&.Q..'...............{.6....b..zy..d
<<< skipped >>>

GET /js/jquery.browser.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Tue, 09 Jun 2015 01:24:12 GMT

Etag: "426ceb127f65d01:0 gzip"

Expires: Tue, 16 Jun 2015 01:24:12 GMT

Last-Modified: Mon, 23 Mar 2015 15:36:04 GMT

Server: ECS (fcn/9F97)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

X-UA-Compatible: IE=edge

Content-Length: 1198
.....2.U...Umo.6......W ..D..t[.{Y..k.6..%[email protected]"U......;R.$w.0$A.{
y..9.)>x.....?**...)..J..W...>.;...TLp8.^..I..x..........t.|....
y9.L.r....,Z.3.fKFU..".....5U.d.F..<...FS>S....j.Z.HII.,g......8
........h-..-......-0...U.3!.pM4...".T.,. ..4#..&|..sx/8..._S.;..Q>
H....;.....]{...&^....m...%.,.\.:..7..#.m...c.5)0g9.......J6g)....A...
..5..7ez...........'...OO0.........e^)....z...:c..Z.......W..J......{.
.......&.[.4.Cg@B.\.......^..\.....^..P.8........ueh....O.E9.......!.o
..$Jd$i......MF.....x....W[.5......~.!.I....OQ.E.y..M,N.$..}...M}..10.
B.&.FC...7.....zM......U3....v.6HS.../&[.6G..VT..f~...H....9tx?.wI....
..D...G....hQJ....u....b.E'....o.3I....x..)..L.`}....RKjI..orA..*C8N..
.p...f.E~..nl....</.T5UZ.Ih...6[..A.]...|..v7|..4Rb..-...T.sMVlApG.
\;t.h>3.~...4...a.mv.........&.\l...._k.p.[`I..-M..|...^!.8.b&a....
p......:..f.-B.k...&.N..a..T \..l....."-........4..o.....e...>..;..
..!.$.~J...I].f.p...f.....|c........[[email protected].?"G....q4&g
t;[email protected]_f....XG ...(....YM3.u.
llR.9.....&.,c`.-p[.8... K.v......5.. ....6FU\(.D..)..Lp.........:....
....K\l.....C..5.^..>...m.){....."2.]...G6k7.a...so......6..5.D..q.
./.? v.5..|.z.W(z...Y..._.B....{.B........
<<< skipped >>>

GET //js/toolbar/toolbarutilities.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Tue, 09 Jun 2015 01:24:12 GMT

Etag: "489cb643468fd01:0"

Expires: Tue, 16 Jun 2015 01:24:12 GMT

Last-Modified: Fri, 15 May 2015 19:35:14 GMT

Server: ECS (fcn/41A4)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web05

X-UA-Compatible: IE=edge

Content-Length: 3333
...........\.n.8......Xm..QWIz.."Y."u...m......CAK..V..".'.....=.....H
.$...f..g..%.....g.C......q.....8} hL.%.y..8~1:..'[email protected].>....&\
.8&.!.dI(([email protected]..^#...........9j6.=.....M.{...N. J
..wdK"?{{(..........e..N._...$..........Oev".HM......X.3..4m.R.^/.. ..
.l....?....%....D.S.F...?KS..^...{......H..>...Y.YL..M.....q..KA...
.........o$.`....E.......Y.......,es...f.".1%.0L.bJaJ.{........W7_...I
.,R@..<'Bq...&.s..9L..)J...x..'.v1MqD..~1P.9.^._.....o......f....3_
....F.,...o..^..x...,I,[email protected]....^S.. p [email protected]
...~!=_.w..\)-....N.Z[j......N[...[.C./[j.....{.5A.....A........9..0.T
.h....b..n......O.....:eu.[[email protected].|...l..?.
1.G..l...y..`.....3.......\.M.........Rq*....y........*6...Y...(.Vr...
(...q...i."...X..<.s...'.....A].1I......m5;.~e...y..%.........p..3Z
.....i.H1B.S}5.%D.K..!.....P....."oI.xA.r..=.|q.3(`......i..w....<.
^.......=........`.C..r%.~.$..Lf.2{r4c~....B3.....[~2.........x5(...A.
...vK..b..i.j..h........z......dC..i..B....._..%....J.U...OiY{...E[Y..
...*.OUgRYW.8..u>..Z#..V\l..(.<M..lu.X....7.*.....]..3.7.Uac....
...c|.d.A..Bj...J...m..vf...{.m=...p......q.bt.:..z...57....pS......}.
.V_....G.$..o..VI.KW\w.s.9...................$.Jr.i..D....}.Q.... pp..
$.~..*/_....9a.~.....>...l....2.."....m.;..5..s.....-...0..F....[&1
..cioR._[..hk.f........tD|..8B3.D1Ac&f.gb....A.K....V.o.)5....HK\...\.
.U.X.6.3.l..yVR}[email protected]..~..t...7..x).M.m.G..
7..ZY..t..a^5]9..D ..U..z...I...)....Y...]....k.H..u.5.z ....Q.h..
<<< skipped >>>

GET /js/jquery-ui-1.10.3/ui/minified/jquery-ui.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: application/x-javascript

Date: Tue, 09 Jun 2015 01:24:12 GMT

Etag: "d1cb81f93b88d01:0"

Expires: Tue, 16 Jun 2015 01:24:12 GMT

Last-Modified: Wed, 06 May 2015 20:33:56 GMT

Server: ECS (fcn/41D4)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web03

X-UA-Compatible: IE=edge

Content-Length: 60616
............{{...0..~..m...R..t[0...v6y6.....}...LB"..`... r?.o....Jr.
..mv-../s..............?.|......t<................=:Y..69;..?..../.
kH..\nv..IN8cL9u>.{..I7..*o...j...Wuvu...t.....^.M.OOz.o.e...j_r~y.
...l.SY.U.............].v...6.......(.Mu......(W=Y..\.g0Zn..?.......n.
UO..YoN......Zo..[..v.i.....f.m....O}Y..o.m...eg...r.$m..h..... ...]..
A.v..EYvR...7..6-....g..c.KF.N../`..z`L'Y.:..u^.,.......nf'_...l...7_.
9yt.o.%.....8.n..I..q......2..,..|\....].0.....~.5y......e..y..iZ....o
..l..*q.......x]......ip.m.t...<..6.....8.P8.M0..."..&.x0.NO.0..d0.
...(..v..y...Z......z.wH>..y..u4..p..<..$......ERD.t...j..-O....
........f..h.h.....Z.#&...8[...-.._\Z/.l-X..U^.....i.v][email protected]...
.v}..H'..g....b5.q5......H..........\......AB.I.x:...?>..On......~.
.........|.4......._.x."...../..6..$~.....g...........gO_.H..G...o^$O.
.....7........WO..}..y2..../.}......t...........L..O.(.....7_.........
..?.....7.......|..................z....$.............q.....?.X...C.ku
Y.......&Q[.w\%.q.6..]..k....6..O.9n.8..ks.q....fM..)..j....d..0....1`
..B...C...l..|d.....5.Wt8.4x....u...".K.....q ").....i.Q,.u.....H.....
b .[.E.....j.k.c.x.4....Y({..f....|..a...}.6^.{...t..~..n.h.K.}......I
...N.....W.&>..9.?...I..p. [email protected]..?h...^\.. M.H"4.$....fP......
.C..&.. .a...f.(.8...Y...:j...m..r...5.} .A~..........&..l...g.Oay.E.m
.mXB..._Fr^....y... R'.xW.p.~.J:;z.=..X...P.J.F...d8,a..q._..}... cS..
...Gcn.i..p....`t.P;.A.A.,.[...D.JK....U..V.....Eo2i0h..........c...by
.\<Y.*[email protected]|..T'.K}U.2...I...~....XJ...u..
<<< skipped >>>

GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=2a99880d-fe09-4942-9d5c-3f458370b122 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: simage2.pubmatic.com

HTTP/1.1 200 OK

Date: Tue, 09 Jun 2015 01:24:15 GMT

Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6

Set-Cookie: KRTBCOOKIE_466=8233-2a99880d-fe09-4942-9d5c-3f458370b122&KRTB&14401-2a99880d-fe09-4942-9d5c-3f458370b122&KRTB&15149-2a99880d-fe09-4942-9d5c-3f458370b122&KRTB&16533-2a99880d-fe09-4942-9d5c-3f458370b122; domain=pubmatic.com; expires=Mon, 07-Sep-2015 01:24:15 GMT; path=/

Set-Cookie: PUBRETARGET=dummy; domain=pubmatic.com; expires=Tue, 09-Jun-2015 01:24:15 GMT; path=/

Set-Cookie: PUBMDCID=3; domain=pubmatic.com; expires=Mon, 07-Sep-2015 01:24:15 GMT; path=/

X-lat: Pug22030:0:223

Content-Length: 1

P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Connection: close

Content-Type: text/html; charset=utf-8
 ..

GET /pagead/conversion.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 2208107221249631878

Date: Tue, 09 Jun 2015 01:24:13 GMT

Expires: Tue, 09 Jun 2015 01:24:13 GMT

Cache-Control: private, max-age=86400

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 4040

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=1
...........Z.r.8.....PS.1b(..3uH#.$..$........u.$D2.H.II.#....x.i.9U[.
..F.q......:v.0.5.c.....A..7..s....v%.E...B#..M.9a..P.....8.y."..4..4.
.:......y.......8....X.I...F.|..0...G..%'0S3.}.c/..a&^9Z1........H.^:"
.J.$#......Y..X...H.n.VQ...Za. ...o.3.,R.D...n...F....&.[...|;..../M.E
..*O..E..^A...c.I......hM...xx(.a..iG-=.f.G.x........j.z..=u..X$.&....
..=%.xv../.....{t0pTe..^o...7.=.S5L..R.de...:..........a..X...$.X..I-h
.s...u0hU..b2D.j..Z;....&.B81.....Dl...T..6?.&X..bk=......M...=.(.o?.&
lt;...7..].usH"d....zz...]B..#@.....}A..........t.....1.Z...@!@I'...9.
b.M.ke.>.l}.G?.E.N..M.ep~T.M.DFo0(y.o,..g.v.T,..h E'Usu_..cx...G..R
.`...... P'W.X.17...l..L..%<o.Q.}........N....-..l.F#cc..P.{Q6ag...
....k....E.SYp..B......,w6..n.d.#....y..;{.v..{i.3...a1H.E...W...~....
c....u..?5........1..9..^k..,..X../>....|..bH.e....E....g...2...MB.
....!O.'[.....h5^.....-{= ....a.o.... "sv...[...tsei..\Q{>.....td..
.-"..`PO......6......./...mj.2v.......Q.......0..W.......6._........*.
.F..........4...UU]....;.1...3g....Ej?p..K.4.oax.....).bY..x.*....e6t.
...>.M5e.o[[email protected].>s.s....{......
..7u.~..4._.v.. nY&x.K.'.<{......F.!.-5Zx5.ZT.-N........b..}...|.Q.
fR[.A.MoWyb.".$......4......|...d.|.......8.k...I."J`...%.....p.Xc.qe}
.?./]S.f.Z....u...............qT.8.............0....>m6..R...7.*f\M
eO...;.##~.....I.._...'.:-y...........EE........3.......{......eu....K
V.%iI...a.5B.<H....M.$yz#r...$.n... .....t...b.U.u.'.k0m. 6....kw.e
..[v].{0..{........U~..a{.}....K.a&.:.....FD...[{......C=.a..rbD.h
<<< skipped >>>

GET /pagead/conversion/1071192949/?random=1433813056995&cv=7&fst=1433813056995&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 302 Found

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Date: Tue, 09 Jun 2015 01:24:13 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: image/gif

Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071192949/?random=2096830191&cv=7&fst=1433813056995&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&ocp_id=PUB2Vc6VMKWaigaWtIGYDg

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=1
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV P
SA PSD IVA IVD OTP OUR OTR IND OTC"..Date: Tue, 09 Jun 2015 01:24:13 G
MT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Co
ntrol: no-cache, must-revalidate..Content-Type: image/gif..Location: h
ttp://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071192
949/?random=2096830191&cv=7&fst=1433813056995&num=1&fmt=3&value=0&labe
l=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=81
8&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=htt
p://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3be
f25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&E
rrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A1
1D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupg
uid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991
&cid=52113991&refer=960115915&disabler=-1&tbstatus=1%2
6tbcode=1&tbtext=&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_presen
t=false&convclickts=0&ocp_id=PUB2Vc6VMKWaigaWtIGYDg..X-Content-Type-Op
tions: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protection: 1;
 mode=block..Alternate-Protocol: 80:quic,p=1..GIF89a.............!....
...,...........D.;..
<<< skipped >>>

GET /images/background_sah_2014.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/jpeg

Date: Tue, 09 Jun 2015 01:24:12 GMT

Expires: Tue, 16 Jun 2015 01:24:12 GMT

Last-Modified: Sat, 06 Jun 2015 09:27:52 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/876A)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web05

Content-Length: 1198
......Exif..II*.................Ducky.......<..... hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c061 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" 
xmpMM:InstanceID="xmp.iid:3295104FD23211E3AE07B2FBA6D740AA" xmpMM:Docu
mentID="xmp.did:32951050D23211E3AE07B2FBA6D740AA"> <xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:3295104DD23211E3AE07B2FBA6D740AA" stRe
f:documentID="xmp.did:3295104ED23211E3AE07B2FBA6D740AA"/> </rdf:
Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
r"?>....Adobe.d....................................................
......................................................................
.......................................d..............................
..................................Q.....U.......................R.....
[email protected]...'r..W.U...H.w..t>....
<<< skipped >>>

GET /images/merchants-computer-screen.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Tue, 09 Jun 2015 01:24:12 GMT

Expires: Tue, 16 Jun 2015 01:24:12 GMT

Last-Modified: Tue, 02 Jun 2015 22:12:36 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/871A)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web09

Content-Length: 46289
.PNG........IHDR...l...5.............tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:F1C3EB54EE9111E4B362
9A61F0848031" xmpMM:DocumentID="xmp.did:F1C3EB55EE9111E4B3629A61F08480
31"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F1C3EB52EE9111
E4B3629A61F0848031" stRef:documentID="xmp.did:F1C3EB53EE9111E4B3629A61
F0848031"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>v..u...AIDATx........=~F]...........lS.
.-.... y@H..{.._^..).!!!@B ...c.b...7.{o.........4.V i.-n....FS...9..s
.{...;..h4......q#...p.E.a..%.......g..n..............UU.(...-...k.5h.
.....B.>..#.....m....w~....m..u...w.....7............ki.v..!2.D>
.....n......yV..%..".. .&z.;r........#.4&..;r.h..U.N...u...<...<
.y.9533.......;.........;..........l.$$$$$..L....8z.h..&....%$$$N.X}..
.....C.-.[BBB.4 m..*  %aKHHH....p8p..II.....g;..a.f...=".[BBB....f.p..
$l....s...i...-!!!q...6G.TUUI.....8WH;^..$l...........=".[BBB.,.{.N.S.
v..-.[BBB.,..K.!..i.G...m..n0........]c6...;.uf.m .m....O..h#!q&2.
<<< skipped >>>

GET /images/chrome-example-window.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Tue, 09 Jun 2015 01:24:13 GMT

Expires: Tue, 16 Jun 2015 01:24:13 GMT

Last-Modified: Tue, 02 Jun 2015 22:12:36 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/873F)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

Content-Length: 22552
.PNG........IHDR...x.........~..G....tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:AD09A042EFF211E4AA0D
A4E090660B49" xmpMM:DocumentID="xmp.did:AD09A043EFF211E4AA0DA4E090660B
49"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AD09A040EFF211
E4AA0DA4E090660B49" stRef:documentID="xmp.did:AD09A041EFF211E4AA0DA4E0
90660B49"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>......T.IDATx...........}{.........w.`.
.!p...I...p.....$$.r)..IHh..^C.qo......w.... iW..V..}a>..%.......7o
.(B...f.r.Go.JH.oo.../..L......R.)..........E...W.Gd.]..(...E.......}.
..A......G.|_.U..g.......}....,Q..2O.........H!.#.S...W4*'.....K......
O'.....x....N..2Q..r.(..b..S..az.\...&.....I.wEyG....I.x............T.
K"e.(.....U..V..T...>..^Qt. ....L. T..,...>..'....B...o../...(..
..[...`.<3..p..Y*..s..e.\E....<eH...5h.T..*.M.&...P..T.....i..F%
....b.g....@....<..r..(...M[..EyI..I....$.x.._}..,..3..^..9"...e.(.
T.W/..H..'..8.*J..........Q]......uz.G6.)B..gDy..{!...x...\...1...
<<< skipped >>>

GET /images/circle-step-2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Tue, 09 Jun 2015 01:24:13 GMT

Expires: Tue, 16 Jun 2015 01:24:13 GMT

Last-Modified: Tue, 02 Jun 2015 22:12:35 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/8713)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

Content-Length: 2461
.PNG........IHDR...2...2......?......tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:58E5D815EFF211E48631
C9E642D8E5EA" xmpMM:DocumentID="xmp.did:58E5D816EFF211E48631C9E642D8E5
EA"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:58E5D813EFF211
E48631C9E642D8E5EA" stRef:documentID="xmp.did:58E5D814EFF211E48631C9E6
42D8E5EA"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>...N....IDATx..Zkl.U.>..n....l.BK...
..........".Rh..>Bb.F...Gl.ocb0i.~h.. ..P.b.D..)..i-........n.e..z.
.w.m;....m{./..........;.....I..(e.d,b.2nb.1,...?F.....8..2cr.A"..jF%c
q.c41.3.0..l"...0.eXM.h....MFc.7..D.c7.,..D....r..r......]-}>Yb.s..
9M#.`|.8.....,9....!"n.....:yF..N...q.QFS/eR.W.D..).C.G..!-7.i....F3..
.....Rn]M..n.........._7..nd._3....@...,.1VL..Y/[email protected]{....$
[..d.Le,..1v..IQxd.O.SO....2...~2.b&YJ....y.R..A..fJ....9...~.\9LC...}
Vyx%..#.=...CC=...1......E.==)6p..9rJ..Y......;YCA.q..5u...V...s......
.*..~.$...TF........c.f....k.0......VAF....b..\[email protected]..
<<< skipped >>>

GET /images/btn-continue-to-coupons-orange.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Tue, 09 Jun 2015 01:24:13 GMT

Expires: Tue, 16 Jun 2015 01:24:13 GMT

Last-Modified: Sun, 07 Jun 2015 15:42:33 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/876A)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web03

Content-Length: 5203
.PNG........IHDR.......Z.....^..|....tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:DB924A22EF4C11E4B6EB
96B91323C4C3" xmpMM:DocumentID="xmp.did:DB924A23EF4C11E4B6EB96B91323C4
C3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB924A20EF4C11
E4B6EB96B91323C4C3" stRef:documentID="xmp.did:DB924A21EF4C11E4B6EB96B9
1323C4C3"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>...`....IDATx...{.......{{..px..w<..
....A.1*F........x. ..R11..RA..DJJ#..F..(R..*ZjTJ....D...D.A...>...
........fo....j......Mw......99..4..p..cD.-B........a...ExF....=&...a.
..D..n.......X.."../.L......F...j...."TQ..S.k./.....k.."....gE.....{..
.?.....`...p.\._."0.....W2.E..v...WR."..;... .......b ................
..............................................G=...U.........*K....>
;.'........5...@...@.......|........7..Q..../......\....i_q1..4.:v....
.B!:&..'z.]_..X!.....$..............}.....K......ch..[)..C....B.......
D... .-...[.....7v2yJJ).e.5<1..........}.G...1! .........>..
<<< skipped >>>

GET /images/button-continue-for-great-coupons.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/jpeg

Date: Tue, 09 Jun 2015 01:24:13 GMT

Expires: Tue, 16 Jun 2015 01:24:13 GMT

Last-Modified: Sat, 06 Jun 2015 16:11:06 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/87F3)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

Content-Length: 25359
......Exif..II*.................Ducky.......d..... hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
1 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmp
MM:InstanceID="xmp.iid:D760254037FE11E381E48C3E8E0381AF" xmpMM:Documen
tID="xmp.did:D760254137FE11E381E48C3E8E0381AF"> <xmpMM:DerivedFr
om stRef:instanceID="xmp.iid:D760253E37FE11E381E48C3E8E0381AF" stRef:d
ocumentID="xmp.did:D760253F37FE11E381E48C3E8E0381AF"/> </rdf:Des
cription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?
>....Adobe.d.......................................................
......................................................................
....................\.E...............................................
.....................................................Qa!1.....W...X..A
....".q.e..2BRb#$..Cd..r3sTE.............................!.1AQ".T..V.a
.....q.2b#...Br.....Rcs$..t..3CSD.u.............?.....P.:.....Tud.E5..
......H..i...3..UE.\g0..&.1..5...2.{...t.{.U=.....<..k.`......3....
.{......-..y.n...8.........=....c..?....y...m..hpjiJJ.m.........7C...k
...@.?...K.....oUz-5U....zJ_4..*}&Jf'.U*|Lq.....F.M..b.ol...r\..T.
<<< skipped >>>

GET /images/global-sprite2.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Tue, 09 Jun 2015 01:24:13 GMT

Expires: Tue, 16 Jun 2015 01:24:13 GMT

Last-Modified: Tue, 02 Jun 2015 18:36:32 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/873A)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

Content-Length: 143785
.PNG........IHDR...............Y.....tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com
/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:
stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http
://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocum
entID="xmp.did:5B7E35C1E28FE1119A6689FFA9306BF0" xmpMM:DocumentID="xmp
.did:542F4543401B11E48C33ABD4ACF981FE" xmpMM:InstanceID="xmp.iid:542F4
542401B11E48C33ABD4ACF981FE" xmp:CreatorTool="Adobe Photoshop CS5.1 Wi
ndows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:b96b1c62-fa
b0-5e46-8d4a-56729bd03ca9" stRef:documentID="xmp.did:5B7E35C1E28FE1119
A6689FFA9306BF0"/> </rdf:Description> </rdf:RDF> </x
:xmpmeta> <?xpacket end="r"?>.m8(..-.IDATx..}.|T...yo.-.. !@.
..D.du.*.X[.....Z.U.V.."...Z.[[email protected]$....$.....=w.L&..d..
2I..s..[....r.....$...n...d%e!).H.&%......`..iPSS.}D.I....)[...g....=.
.....R...1.lr.X....y..g.......*..7...").......o.....|N...z.4....?X..K.
d..../.....*j[..z.x8...i5*H.. #...U........).j.U..j.Ag ..J.>.\..p$.
...W.C/M.8.....k..M#j...L..,C..SG.. 3:..=l2.D...YA.5..P.. ^..%I..^.~..
5G.G.% ...M...#...s.........v.DQ...hC... .<.!...`0...._....LN.q
<<< skipped >>>

GET /RequestHandler.ashx?MfcISAPICommand=set¶m=

I-7cOM4DjEMHro-mFEESbqRzRRe6jzF6TSyknmmJRZ0V_Cs4c3zsf6E1_F38T2AEyfYMnTBYYzAEmuft8hQXCGwVwPCDX1yG62-2Ce-cg8g8YE_OCsHQQEFBk77I6TXMW1WVwgvIwKjXndeY14ykKwIAFBZgdbZfB2B8hRH_ng_uGHRIerg8bD3iHlEYg2lu4r5gfX6WN9gl8kSyrecH6JClqBPR00eXQmgjKiN_Kxe3z9EFU4EETkC-5HifJeQATKyPLYf7cHhvz2CQAxU5Ih5VCZtDdfBwmtD5OsW6oC8IDfcaU9bR8QJbpXtn5LCEK0entwtQyLZYowp0ePdnUG HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: tbws.shopathome.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Connection: close

Date: Tue, 09 Jun 2015 01:23:51 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: -1

Content-Type: text/html

Content-Length: 460
.....'...P.I:..C.JUd[."%i..>rP..w...M..H..D...p...!....../..u......
.~6)Ko.u.\JX....C..,e...xa...k.($j%....u$....3:u .]....48e..w.. <j.
...v.U..Y..6wS]M..(.X;...b.c.....g.....:I....G./......[KL....^..hA..GT
..W-...H}..c3x.HY....W!....g.n..m....C..&..)....m.X|......J..W..Y....`
....y..~..~UX.V.f....Z.....-R.......*..m.~.S*.*.....<.]....D..@.|-.
.}.Y%...V@&O..... ....yb..B.%...W.d...U.c,-..c..#.. .Fq...O.R.......|1
...:.i...2.|[email protected]... I."..

GET /pagead/viewthroughconversion/1071192949/?random=2096830191&cv=7&fst=1433813056995&num=1&fmt=3&value=0&label=FQpPCJHS2wIQ9bbk_gM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=0&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&vis=0&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&ocp_id=PUB2Vc6VMKWaigaWtIGYDg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: googleads.g.doubleclick.net

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Tue, 09 Jun 2015 01:24:13 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/user-lists/1071192949/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&random=1303519930

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Set-Cookie: test_cookie=CheckForPermission; expires=Tue, 09-Jun-2015 01:39:13 GMT; path=/; domain=.doubleclick.net

Alternate-Protocol: 80:quic,p=1
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Tue, 09 Jun 2015 01:24:13 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/user-lists/107119294
9/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=f
alse&cv=7&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.asp
x?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessP
I&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5D
C5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsour
ce=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538%7
D&setupcid=52113991&cid=52113991&refer=960115915&disable
r=-1&tbstatus=1&tbcode=1&tbtext=&random=1303519930..Cont
ent-Type: image/gif..X-Content-Type-Options: nosniff..Server: cafe..Co
ntent-Length: 42..X-XSS-Protection: 1; mode=block..Set-Cookie: test_co
okie=CheckForPermission; expires=Tue, 09-Jun-2015 01:39:13 GMT; path=/
; domain=.doubleclick.net..Alternate-Protocol: 80:quic,p=1..GIF89a....
.........!.......,...........D.;....
<<< skipped >>>

GET /seg?add=2518433&t=2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Location: hXXp://ib.adnxs.com/bounce?/seg?add=2518433&t=2

Content-Type: text/html; charset=utf-8

Set-Cookie: sess=1; Path=/; Max-Age=86400; Expires=Wed, 10-Jun-2015 01:24:15 GMT; Domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=2044876041257863843; Path=/; Max-Age=7776000; Expires=Mon, 07-Sep-2015 01:24:15 GMT; Domain=.adnxs.com; HttpOnly

Date: Tue, 09 Jun 2015 01:24:15 GMT

Content-Length: 0
....


GET /bounce?/seg?add=2518433&t=2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: sess=1; uuid2=2044876041257863843

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Access-Control-Allow-Credentials: true

Access-Control-Allow-Origin: *

Location: hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=2044876041257863843

Content-Type: text/html; charset=utf-8

Set-Cookie: anj=dTM7k!M40eCxrEQDgEREg75_Hiwi<H#uqzhcs@!mIJZ>xcq.jcDQ44/8<D. I.:i9(:BN@Ic*)$; Path=/; Max-Age=7776000; Expires=Mon, 07-Sep-2015 01:24:15 GMT; Domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; Path=/; Max-Age=86400; Expires=Wed, 10-Jun-2015 01:24:15 GMT; Domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=2044876041257863843; Path=/; Max-Age=7776000; Expires=Mon, 07-Sep-2015 01:24:15 GMT; Domain=.adnxs.com; HttpOnly

Date: Tue, 09 Jun 2015 01:24:15 GMT

Content-Length: 0
HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, private..Pragma
: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="ht
tp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo 
OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Acc
ess-Control-Allow-Credentials: true..Access-Control-Allow-Origin: *..L
ocation: hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=2044876
041257863843..Content-Type: text/html; charset=utf-8..Set-Cookie: anj=
dTM7k!M40eCxrEQDgEREg75_Hiwi<H#uqzhcs@!mIJZ>xcq.jcDQ44/8<D. I
.:i9(:BN@Ic*)$; Path=/; Max-Age=7776000; Expires=Mon, 07-Sep-2015 01:2
4:15 GMT; Domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; Path=/; Max
-Age=86400; Expires=Wed, 10-Jun-2015 01:24:15 GMT; Domain=.adnxs.com; 
HttpOnly..Set-Cookie: uuid2=2044876041257863843; Path=/; Max-Age=77760
00; Expires=Mon, 07-Sep-2015 01:24:15 GMT; Domain=.adnxs.com; HttpOnly
..Date: Tue, 09 Jun 2015 01:24:15 GMT..Content-Length: 0..
<<< skipped >>>

GET /spp.pl?a=1000742424085&.yp=7164&js=no HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sp.analytics.yahoo.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Date: Tue, 09 Jun 2015 01:24:14 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Set-Cookie: B=efvlv8dancg1u&b=3&s=td; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.yahoo.com

TS: 0 535 spdc0027.pbp.ir2

Location: hXXp://ads.yahoo.com/pixel?id=2285230&t=2

Pragma: no-cache

Expires: Tue, 09 Jun 2015 01:24:15 GMT

Cache-Control: no-cache, private, must-revalidate

Accept-Ranges: bytes

Tracking-Status: site tracked

Content-Length: 43

Content-Type: image/gif

Age: 0

Connection: keep-alive

Server: ATS
GIF89a.............!.......,...........D..;HTTP/1.1 302 Moved Temporar
ily..Date: Tue, 09 Jun 2015 01:24:14 GMT..P3P: policyref="hXXp://info.
yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi I
VDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FI
N COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"..Set-Cookie: B=efvlv8da
ncg1u&b=3&s=td; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=
.yahoo.com..TS: 0 535 spdc0027.pbp.ir2..Location: hXXp://ads.yahoo.com
/pixel?id=2285230&t=2..Pragma: no-cache..Expires: Tue, 09 Jun 2015 01:
24:15 GMT..Cache-Control: no-cache, private, must-revalidate..Accept-R
anges: bytes..Tracking-Status: site tracked..Content-Length: 43..Conte
nt-Type: image/gif..Age: 0..Connection: keep-alive..Server: ATS..GIF89
a.............!.......,...........D..;..

GET /cm/f/out HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=36302d85af4ad3658de8bf6afa9798c3

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Tue, 09 Jun 2015 01:24:14 GMT

Location: hXXp://VVV.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=MzYzMDJkODVhZjRhZDM2NThkZThiZjZhZmE5Nzk4YzM

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.6.2

Set-Cookie: __adroll=36302d85af4ad3658de8bf6afa9798c3; Version=1; Expires=Fri, 08-Jul-2016 01:24:14 GMT; Max-Age=34128000; Path=/

Content-Length: 112

Connection: keep-alive
Go to hXXp://VVV.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=M
zYzMDJkODVhZjRhZDM2NThkZThiZjZhZmE5Nzk4YzM....


GET /cm/w/out HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=36302d85af4ad3658de8bf6afa9798c3

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Tue, 09 Jun 2015 01:24:15 GMT

Location: hXXps://analytics.twitter.com/i/adsct?p_user_id=MzYzMDJkODVhZjRhZDM2NThkZThiZjZhZmE5Nzk4YzM&p_id=823423

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.6.2

Set-Cookie: __adroll=36302d85af4ad3658de8bf6afa9798c3; Version=1; Expires=Fri, 08-Jul-2016 01:24:14 GMT; Max-Age=34128000; Path=/

Content-Length: 109

Connection: keep-alive
Go to hXXps://analytics.twitter.com/i/adsct?p_user_id=MzYzMDJkODVhZjRh
ZDM2NThkZThiZjZhZmE5Nzk4YzM&p_id=823423....


GET /cm/l/out HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=36302d85af4ad3658de8bf6afa9798c3

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Tue, 09 Jun 2015 01:24:15 GMT

Location: hXXp://idsync.rlcdn.com/377928.gif?partner_uid=36302d85af4ad3658de8bf6afa9798c3

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.6.2

Set-Cookie: __adroll=36302d85af4ad3658de8bf6afa9798c3; Version=1; Expires=Fri, 08-Jul-2016 01:24:14 GMT; Max-Age=34128000; Path=/

Content-Length: 85

Connection: keep-alive
Go to hXXp://idsync.rlcdn.com/377928.gif?partner_uid=36302d85af4ad3658
de8bf6afa9798c3....


GET /cm/g/out?google_nid=adroll5 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=36302d85af4ad3658de8bf6afa9798c3

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Tue, 09 Jun 2015 01:24:15 GMT

Location: hXXps://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=NjAtha9K02WN6L9q-peYww&google_ula=1535926

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.6.2

Set-Cookie: __adroll=36302d85af4ad3658de8bf6afa9798c3; Version=1; Expires=Fri, 08-Jul-2016 01:24:14 GMT; Max-Age=34128000; Path=/

Content-Length: 118

Connection: keep-alive
Go to hXXps://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&goo
gle_hm=NjAtha9K02WN6L9q-peYww&google_ula=1535926HTTP/1.1 302 Moved Tem
porarily..Cache-Control: no-store, no-cache, must-revalidate..Date: Tu
e, 09 Jun 2015 01:24:15 GMT..Location: hXXps://cm.g.doubleclick.net/pi
xel?google_sc&google_nid=artb&google_hm=NjAtha9K02WN6L9q-peYww&google_
ula=1535926..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Pragm
a: no-cache..Server: nginx/1.6.2..Set-Cookie: __adroll=36302d85af4ad36
58de8bf6afa9798c3; Version=1; Expires=Fri, 08-Jul-2016 01:24:14 GMT; M
ax-Age=34128000; Path=/..Content-Length: 118..Connection: keep-alive..
Go to hXXps://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&goo
gle_hm=NjAtha9K02WN6L9q-peYww&google_ula=1535926..

GET /pagead/viewthroughconversion/0/?label=null&guid=ON&script=0&ord=964994172604412.5 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: googleads.g.doubleclick.net

Connection: Keep-Alive

Cookie: test_cookie=CheckForPermission

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Tue, 09 Jun 2015 01:24:14 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/user-lists/0/?label=null&script=0&random=1739067064

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Set-Cookie: id=2249754f0e02005c||t=1433813054|et=730|cs=002213fd4871e29ca8317e60bb; expires=Thu, 08-Jun-2017 01:24:14 GMT; path=/; domain=.doubleclick.net

Set-Cookie: test_cookie=; domain=.doubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GMT

Alternate-Protocol: 80:quic,p=1
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Tue, 09 Jun 2015 01:24:14 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/user-lists/0/?label=
null&script=0&random=1739067064..Content-Type: image/gif..X-Content-Ty
pe-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protectio
n: 1; mode=block..Set-Cookie: id=2249754f0e02005c||t=1433813054|et=730
|cs=002213fd4871e29ca8317e60bb; expires=Thu, 08-Jun-2017 01:24:14 GMT;
 path=/; domain=.doubleclick.net..Set-Cookie: test_cookie=; domain=.do
ubleclick.net; path=/; Max-Age=0; expires=Mon, 21 Jul 2008 23:59:00 GM
T..Alternate-Protocol: 80:quic,p=1..GIF89a.............!.......,......
.....D.;..
<<< skipped >>>

GET /j/roundtrip.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: a.adroll.com

Connection: Keep-Alive

HTTP/1.1 200 OK

x-amz-id-2: ZaeMSdCBfqIK1iZ fBH2wejaECeWH17sf/PY2zFIqEMTYPqO45uBVZcAeDLInRO1ofvkFXOisAA=

x-amz-request-id: DFC38EFFFABD8C08

x-amz-replication-status: REPLICA

x-amz-version-id: pU_8g55jeJdK9jEgv17oTDDM35uKrMhL

Cache-Control: max-age=300, must-revalidate

Last-Modified: Thu, 30 Apr 2015 20:10:50 GMT

ETag: "ec8062a85123bd253d9a7dcfda673ccd"

Accept-Ranges: bytes

Content-Type: text/javascript

Server: AmazonS3

Vary: Accept-Encoding

Content-Encoding: gzip

Date: Tue, 09 Jun 2015 01:24:14 GMT

Content-Length: 6422

Connection: keep-alive
...........;ks.F... H...sD.$.. ..sv]I.{.SW[...cD.....%kE.._.....l.^.%.
..GwO..1.o...xa [...[.-7.}.,.O.'..0.......@%....V.^.f%.^d.n....;...?..
^..:...J..C...........m..C...{<F.|.vH....L....>Tq_.....Y..9Ft...
<E49F..M.C<.L.L.^.[..0...........G.zn...4Hz....)>.........T.p
...NK.y.,.....]v.>Vw}sS.D.!.pu.`E0.>t)....N.K.......l..y.x.%^%..
./.m..Uv.b.s...]9.Lg ....zFfZ...-..".............o.J.=|.....bk.\..p.e`
......"..\......)......,`7s..B..6*...%.....F.bN.....~?....l......x)..{
....s....?..Y...?v^........<...^...b~......O.&].*./W..Aeq.S..X..%4N
dd........[.l.Gy....k.vg<..GJWv...i.}}..q<.u....6>.|.9.. Lb.J
n.FyrLWve...qe.#.P@.\].....ppyK,[email protected].?..%..O..v_.FOV...m...
.O.{..*...`....5m.s..~.......l.g."[..[..m.p..\...t2...............r8..
..h...0.[q..`....cM.M...(..aoa...`....h0..U.\.....6...t:.T...~m...T..5
.c..R.'[email protected]:T*.."zm2Q..H.j....k..T.t].T.k*'@...a.......T].
..*zm......p<...?...*.MS..z==.H....3.F......c0..`.$.D.Vd.....l<.
T.`'P.............`'R.....>...5.......A.r8......S..........k.U.#.gd
8..*...}.._...>...ET......S.L.i..3.>.Ou.N0.!...k.)...[.?....d8..
.Z......q.!.H.1.........'U.........W.O.zm.....T..z.....84..u$..?......
..(.)...;.......4r9...M.H&.G.|.E..P......:TG...a.`.$..b0.4..:...u24F..
.3.%.N..H....t..n.d... #}6a.Z#[email protected].:5.....9!
09.h...N...1....6....1v.}...O'u"P.H.>...h.._.....,[email protected]...#
.~98 ?g..P..A*|A9......t...#..x....7Z.>S.}....w.S.n..F...)A..=.....
J..Q..7..H.C5.PXH.:.F.a.....T n...U..2.`..\..Y.?c1.7... z..8.>.
<<< skipped >>>

GET /pixel/77I5CH5ZEZFNVPMSE3MTAA/ONW3GFE3ZNGOPDPAXKOR5I/HR3E4M74MREKJACLTHVERQ.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: a.adroll.com

HTTP/1.1 200 OK

x-amz-id-2: DlbX5MuUoFqqNst/4onYIjv3zceUmZkfBovYr6rmAfPpHlyp977B29Bv9fSWdMIJ892fV0ZdcRQ=

x-amz-request-id: F9F9D60BC6954648

x-amz-replication-status: REPLICA

x-amz-version-id: 28VLHWV8L8O1DKl3bXgkeQG2jozWt1hV

Cache-Control: max-age=300, must-revalidate

Last-Modified: Tue, 05 May 2015 05:49:34 GMT

ETag: "74ad9288c3acd9b7b015ddf26eea2ae2"

Accept-Ranges: bytes

Content-Type: text/javascript

Server: AmazonS3

Vary: Accept-Encoding

Content-Encoding: gzip

Date: Tue, 09 Jun 2015 01:24:14 GMT

Content-Length: 902

Connection: keep-alive
...........Vm..8.....g..z4......N.J.^.U.U.lW.c..Uc...XU.....ei.Z.KA...
g<..$.., ..4.......5...9..,H......S.X.ax...Be8.1aa.3.....4HJ.....lW
cBo.D........ .am..Y..@...)`"e....`.,...D.Jy.7....<.z.\...b..{:}...
&2=dq.....63(r..n.9.P...*..i...tw.n.F...[...bK.:[email protected]..
.DO.........\e...Y....d2...j..,u.... .>m-L...i.c.]..............".]
.F)...."...!4.....S..<mz.i...6..i.S.M..6..../3c2......d..........;.
...._Mr...K.!5.KM.Y.XS._L'....|:.=.=.M.q.e...m#...J..u|1.:.^]_....Wo&g
t;^~..~.pX......,\....7...?.e...T...$n..\T..=.Z....TY.[...%J..._*....u
....V.r...c...-eSt,F{....f..L|g....M.....N..1.......q..|..c.<ny.._o
...6.?.$I..7...R.4....=$_i#Y....J.!e.Y.V...s..J.4..u.....3..U..5:d.X..
..../.*a7$.V...G........~w.....@..;.d... ..Z..;...xt.yyP..;.-.#.!.>
..L>.F...;.!..M.....a..kC.M?..^.u.{.Q.~xmt.[.V3..l....>.5...Wo..
z.~.$.."...(@.W.T".5.... .,..e}.lA%..*....Q -`.ZPxy.(4h..^'R....../...
5.^wg.`........%.....

GET /ads/user-lists/1071192949/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&random=1303519930&ipr=y HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: VVV.google.com.ua

HTTP/1.1 200 OK

Content-Type: image/gif

Date: Tue, 09 Jun 2015 01:24:14 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Typ
e: image/gif..Date: Tue, 09 Jun 2015 01:24:14 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_
server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate
-Protocol: 80:quic,p=0..GIF89a.............!.......,...........D.;nt>....


GET /ads/user-lists/0/?label=null&script=0&random=1739067064&ipr=y HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com.ua

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Date: Tue, 09 Jun 2015 01:24:14 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Typ
e: image/gif..Date: Tue, 09 Jun 2015 01:24:14 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_
server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate
-Protocol: 80:quic,p=0..GIF89a.............!.......,...........D.;..

GET /agent/toolbarprefs.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: xml.sahcdn.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Date: Tue, 09 Jun 2015 01:24:04 GMT

Etag: "03fdc21499dd01:0"

Expires: Wed, 10 Jun 2015 01:24:04 GMT

Last-Modified: Tue, 02 Jun 2015 15:31:02 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/8760)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

Content-Length: 1008
.|..A...k}......@1......$L..X:u.F5..m..h.v..A~..}.C..pi...."H.........
..i.g9.u.tI.{YE(...6.h6b........0)._..al...eZ.e...S.....W....7.1.....i
.......Y.t..|._..o4......E......Z........Z#..R._.?..].~..m1V.....F=...
Q....!..r..\j........h..\..7...L.P...!8f."......S'.}V..b...&...p.5OW.h
.q. @J.T'......t....iN.:......].R{.d..Puw..D...o....._.P....0..z..!...
...I....3....kb.N....rC....V.GiM.$.....G....Sx.:......."..."...>A..
.?4..w.fq=.`...%..k......p`3:./n.....C..0Wx.K.ZX........K..%...... ...
.......9k..OI..*A....m....G:..[Z..m........Z.?.. }.'....[....I........
a..r...... ..|. ..a5..1..?..-#...D...........G. rt.&....}gA...o..!....
.Kl..:.qe....%y\?.9]&.by....t-.i...d..W.:e2!8.....u....&O...m..[.WCRB.
.Z..K.......cZF....... ....P....D..|5F6.....].G7.8^s.qi..z...s.Q...E?]
.......QA........Wf<...P.|.`f_...>S..u...]U...{`[.>..a...t...
......41..S....eDJ.~.`...H.C.....!H..G.......hRc$..}....].....[Y..T..s
q.*..K{.~...&..N.].Y......._...']..V.5.>. & ...>T.......vJ...U..
z.{.Y,D..?X.....N...3..l..W>.<.3.N.-.....xqDh.HTTP/1.1 200 OK..A
ccept-Ranges: bytes..Cache-Control: max-age=86400..Content-Type: appli
cation/octet-stream..Date: Tue, 09 Jun 2015 01:24:04 GMT..Etag: "03fdc
21499dd01:0"..Expires: Wed, 10 Jun 2015 01:24:04 GMT..Last-Modified: T
ue, 02 Jun 2015 15:31:02 GMT..P3P: CP="NON DSP COR CURa ADMa OUR NOR P
UR"..Server: ECAcc (frf/8760)..X-Cache: HIT..X-Powered-By: ASP.NET..X-
Server: Web06..Content-Length: 1008...|..A...k}......@1......$L..X:u.F
5..m..h.v..A~..}.C..pi...."H...........i.g9.u.tI.{YE(...6.h6b.....
<<< skipped >>>

GET /agent/toolbarprefs.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: xml.sahcdn.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Date: Tue, 09 Jun 2015 01:24:05 GMT

Etag: "03fdc21499dd01:0"

Expires: Wed, 10 Jun 2015 01:24:05 GMT

Last-Modified: Tue, 02 Jun 2015 15:31:02 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/8760)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

Content-Length: 1008
.|..A...k}......@1......$L..X:u.F5..m..h.v..A~..}.C..pi...."H.........
..i.g9.u.tI.{YE(...6.h6b........0)._..al...eZ.e...S.....W....7.1.....i
.......Y.t..|._..o4......E......Z........Z#..R._.?..].~..m1V.....F=...
Q....!..r..\j........h..\..7...L.P...!8f."......S'.}V..b...&...p.5OW.h
.q. @J.T'......t....iN.:......].R{.d..Puw..D...o....._.P....0..z..!...
...I....3....kb.N....rC....V.GiM.$.....G....Sx.:......."..."...>A..
.?4..w.fq=.`...%..k......p`3:./n.....C..0Wx.K.ZX........K..%...... ...
.......9k..OI..*A....m....G:..[Z..m........Z.?.. }.'....[....I........
a..r...... ..|. ..a5..1..?..-#...D...........G. rt.&....}gA...o..!....
.Kl..:.qe....%y\?.9]&.by....t-.i...d..W.:e2!8.....u....&O...m..[.WCRB.
.Z..K.......cZF....... ....P....D..|5F6.....].G7.8^s.qi..z...s.Q...E?]
.......QA........Wf<...P.|.`f_...>S..u...]U...{`[.>..a...t...
......41..S....eDJ.~.`...H.C.....!H..G.......hRc$..}....].....[Y..T..s
q.*..K{.~...&..N.].Y......._...']..V.5.>. & ...>T.......vJ...U..
z.{.Y,D..?X.....N...3..l..W>.<.3.N.-.....xqDh.HTTP/1.1 200 OK..A
ccept-Ranges: bytes..Cache-Control: max-age=86400..Content-Type: appli
cation/octet-stream..Date: Tue, 09 Jun 2015 01:24:05 GMT..Etag: "03fdc
21499dd01:0"..Expires: Wed, 10 Jun 2015 01:24:05 GMT..Last-Modified: T
ue, 02 Jun 2015 15:31:02 GMT..P3P: CP="NON DSP COR CURa ADMa OUR NOR P
UR"..Server: ECAcc (frf/8760)..X-Cache: HIT..X-Powered-By: ASP.NET..X-
Server: Web06..Content-Length: 1008...|..A...k}......@1......$L..X:u.F
5..m..h.v..A~..}.C..pi...."H...........i.g9.u.tI.{YE(...6.h6b.....
<<< skipped >>>

GET /agent/bce_.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: xml.sahcdn.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Date: Tue, 09 Jun 2015 01:24:05 GMT

Etag: "805c826499dd01:0"

Expires: Wed, 10 Jun 2015 01:24:05 GMT

Last-Modified: Tue, 02 Jun 2015 15:31:09 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/874B)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web01

Content-Length: 245264
...v.a.5uq,:..=w2..b....M..T>.!..UU.}...W.&...W?C'..w. .C........!.
...G.'........P....p(bPA.;.x..l. .}3#..5......h......lc6hIb....f......
~...?=.K...u..".B..8.u$.,>z..*I.H.yP...J...9..P..x.........z[]..7&g
t;.U6...y......[.&w)..q.j.Y7.E.0uT........`n'!/,.*.......>.?.i.....
........{....;......R.....f.kuy.t.<..F.:.K..."....s.o....5q.&.....*
/64..}.T..4D...q..|.#0..(.._..u.b4(...Lo..E..o20xh.^c.xby}...|!.Nd.n..
.\.`..K7.;..w............'@.`. ....<..{.....8...n..2...H..lX...y..q
u....t.6..|..^.I3m`.....S{..._=v.....a.....A.A.ga?....AAFM.=....H..._.
.U..e .`.....j1...Q...I....O...4(:..c)Q*....RA....|=A`}mW.xf. .....r..
PhH..S..7o._...0Ey...>..;.l..L)7PS.,...S.Y'.W.........c<s\#. ...
..E........RX.<U...A....,.e..............u.iS......7.].5......#.'..
>...........=U.Kc5..d..?.EbO....i...x..z.....vRu..[.4Y..F..".X.....
...3T.5a.N/.N.C&....9.%Y..&..N........ ..xc`..=n...QB.....A$.S87......
.8~*E!..yU.."k...9.OX..K....YH....<..;.{..4hg.J..*..eS...l. .....W.
Z..2..3L.1..X...H....p.G.Kq...l.[...W.z)85...S].&..Z....mX.1'~&.<=.
tR...a.:..vL.-W..r.v..i=VsBoVs.8U..M..'.p....e....ak.$...-....2p...#.|
W;.R.A8P..ju...N.........)..8.:I.....?.....r......2....G4\.a.....I..m.
....o.o.%u4D..R...Ak...._.7.....n..n....f...1....L...l0....t7..{.....@
.Y.........U.=.......W....]...u...Y..*{L.a....f.G4*.YF.^d...C.G].* v5.
...*.iL;.QO...3....j.,......P.z..Ob2y=....b...<.].^K.&'...B.K(...a.
da.p6....o..;m.,..$.1..7.D....!KX..........p..x61naN.MKZ-.7.UWV.2I.j..
<..k./.p.....E.....!......%. .....ZJOC.;.....8.u9\.m...t...C)..
<<< skipped >>>

GET /w/1.0/sd?cc=1&id=537103138&val=36302d85af4ad3658de8bf6afa9798c3 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: us-u.openx.net

Connection: Keep-Alive

Cookie: i=0a91a494-bd0c-4c00-8a66-8553ecd45a8a|1433813055

HTTP/1.1 200 OK

Server: OXGW/10.92.20

Pragma: no-cache

P3P: CP="CUR ADM OUR NOR STA NID"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Date: Tue, 09 Jun 2015 01:24:15 GMT

Content-Type: image/gif

Content-Length: 43

Cache-Control: private, max-age=0, no-cache

Connection: close
GIF89a.............!.......,...........D..;..

GET /pixel/77I5CH5ZEZFNVPMSE3MTAA/ONW3GFE3ZNGOPDPAXKOR5I?pv=5596272544.652253&cookie=&keyw=&adroll_external_data=customer_type=nonauth®istration_user=&refer_code=91098&source_code=REBATE&brand=ToolbarPostInstall HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Tue, 09 Jun 2015 01:24:14 GMT

Location: hXXp://a.adroll.com/pixel/77I5CH5ZEZFNVPMSE3MTAA/ONW3GFE3ZNGOPDPAXKOR5I/HR3E4M74MREKJACLTHVERQ.js

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.6.2

Set-Cookie: __adroll=36302d85af4ad3658de8bf6afa9798c3; Version=1; Expires=Fri, 08-Jul-2016 01:24:14 GMT; Max-Age=34128000; Path=/

X-Conversion-Currency: 

X-Conversion-Value: 0

Content-Length: 0

Connection: keep-alive
....

GET /1/eabd37c669?a=442317&pl=1433813054542&v=632.2b17625&to=YlVRZxFXX0VWVkMPDVsfcmAzGUVZWFlVBxBFX0BHClhCQlZZW0gDRkBL&ap=3&fe=2953&dc=2938&tt=61F4BF9060A68D2F&f=[]&jsonp=NREUM.setToken HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bam.nr-data.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Set-Cookie: JSESSIONID=f865de08b04364fd;Path=/

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Content-Type: text/javascript;charset=ISO-8859-1

Content-Length: 41
NREUM.setToken({'stn':1,'err':1,'ins':0})HTTP/1.1 200 OK..Set-Cookie: 
JSESSIONID=f865de08b04364fd;Path=/..Expires: Thu, 01 Jan 1970 00:00:00
 GMT..Content-Type: text/javascript;charset=ISO-8859-1..Content-Length
: 41..NREUM.setToken({'stn':1,'err':1,'ins':0})..

GET /RequestHandler.ashx?MfcISAPICommand=installstatus¶m=Ø

frtXFiqIX4GbgcJxPRH7be0DduJjehBXcU_ijoe_Yk7184KcM5uMOzy6qgQ684qQN_n1tdMvaDCV_Cs4c3zsf6E1_F38T2AEyfYMnTBYYzAEmuft8hQXCGwVwPCDX1yG62-2Ce-cg8g8YE_OCsHQQEFBk77I6TXMW1WVwgvIwKjXndeY14ykKwIAFBZgdbZfB2B8hRH_ng_uGHRIerg8bD3iHlEYg2lu4r5gfX6WN9gl8kSyrecH6JClqBPR00eXQmgjKiN_Kxgu12qGVPEbnOQedwQ4tGWsNtxYBWjZ8t4jKmujQIbchIqO03nNT-DL3Adw1zlg0qGSmt8hP1_83dYlaQCboqTY72SdACDe2bNMutxUCt7MP1J4iY5N3cWM9HX9O1LJZA41LjPBA-jx9jDdUK6-pJEsQz9h-Fa6zRtAnvuFZJPQPdd6eSzushf05T9uTfaizXHtI2W9RfNE5uISbiHul1hOAMGTlCGxyOv2AjMdyeP2EDrf2Q5BkYStAKrcVhcLSCMQZnuVe7vJCWWsdr8dG-E_r17JxYpa3AWkH6T2txfAV6uq1yokmkTfG6mXmruj-9K6Nz7zwk_nIIv4PqBVkafyF9bQGd3nCnBVahN-MlL7iG HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: tbws.shopathome.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Connection: close

Date: Tue, 09 Jun 2015 01:24:07 GMT

Server: Microsoft-IIS/6.0

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Farm01

Etag:

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: -1

Content-Type: text/html

Content-Length: 72
...;.E......n.R...[:.4. .|"^..:.0.....I..-.X......].w...w{.....P......
....

GET /ads/user-lists/1071192949/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&random=1303519930 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: VVV.google.com

HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/user-lists/1071192949/?label=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie_present=false&cv=7&frm=0&url=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&random=1303519930&ipr=y

Cache-Control: private, max-age=43200

Date: Tue, 09 Jun 2015 01:24:14 GMT

Expires: Tue, 09 Jun 2015 01:24:14 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 842

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/1071192949/?lab
el=FQpPCJHS2wIQ9bbk_gM&fmt=3&bg=ffffff&num=1&ct_cookie
_present=false&cv=7&frm=0&url=http://VVV.shopathome.com/
ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3
fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel%
3D1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&so
urce=91098&subsource=2_6671049&setupguid={b027095d-d727-45
f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer
=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&a
mp;random=1303519930&ipr=y">here</A>...</BODY></
HTML>......
<<< skipped >>>

GET /ads/user-lists/0/?label=null&script=0&random=1739067064 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/user-lists/0/?label=null&script=0&random=1739067064&ipr=y

Cache-Control: private, max-age=43200

Date: Tue, 09 Jun 2015 01:24:14 GMT

Expires: Tue, 09 Jun 2015 01:24:14 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 295

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/0/?label=null&a
mp;script=0&random=1739067064&ipr=y">here</A>...</
BODY></HTML>..HTTP/1.1 302 Found..Location: hXXp://VVV.google
.com.ua/ads/user-lists/0/?label=null&script=0&random=1739067064&ipr=y.
.Cache-Control: private, max-age=43200..Date: Tue, 09 Jun 2015 01:24:1
4 GMT..Expires: Tue, 09 Jun 2015 01:24:14 GMT..Content-Type: text/html
; charset=UTF-8..X-Content-Type-Options: nosniff..Server: adclick_serv
er..Content-Length: 295..X-XSS-Protection: 1; mode=block..Alternate-Pr
otocol: 80:quic,p=0..<HTML><HEAD><meta http-equiv="cont
ent-type" content="text/html;charset=utf-8">.<TITLE>302 Moved
</TITLE></HEAD><BODY>.<H1>302 Moved</H1>
.The document has moved.<A HREF="hXXp://VVV.google.com.ua/ads/user-
lists/0/?label=null&script=0&random=1739067064&ipr=y">h
ere</A>...</BODY></HTML>....
<<< skipped >>>

GET /Content/SiteCssWebformsBundle?v=42 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: public

Content-Type: text/css; charset=utf-8

Date: Tue, 09 Jun 2015 01:24:11 GMT

Expires: Wed, 08 Jun 2016 00:01:26 GMT

Last-Modified: Wed, 27 May 2015 17:53:35 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECS (fcn/405E)

Vary: Accept-Encoding

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web09

X-UA-Compatible: IE=edge

Content-Length: 46001
...................Wx...u.I.."..17...,... .......Z.nZ$.f......... Q,v.
......&....H$2.lV.....v...ut.-.z....V.v?j.. 2..o......bIVuK.....dgeP4N
.n..VdX....k./..v.X.V.v.l6..aG.........5.s.k....l..M.i...'..w.m.......
.r.T.OcZ@.........]...r..}..k.....,..m.........f..l..F.(.....Y...i..mp
._......M...O.v.X.hwTw.U..!...5........m.#d3(6.......&....}^.....4.~yI
...?.'q.=.i>..b.|V...:`.$.~.M......M]...[M${[email protected]..
.......,...4....U...8..0.....z...~.........-...;..D..(..&.............
0:....jV...j:..).!#92.8#....>.y..G2.b..O..........uqK.q[.U.f\5k...&
./../I.O....>{9.7..k.`G.......}...Qtb.~T#5."...\...p...J....kT.."..
./{: .fW...W.Mu..4..Y...;..w.$..$.4&hN....=..b.....O..a._R......9.Y...
.....$8ZS.4^5....~....v.....ln.>K.$......]..%..*....*.....$...hLK.h
.5....)jY...&.....9....&.5.6.n].N..P2...%.s...e.W.X@I.....~GW......?k.
........v\.{r....&..-9.6c..D/...s.....Q.=..i.vGW....`.G.\..5[[7...]x..
...%...N..........x..b.....O....[...t.l..vP...[............].{5.....8.
'.g.?F7z....i.8.V.a.<..P.1.i.~..JwHb...nG...#.....vW.KJ....!#2...Y.
....V.......,...._....;..Y.y..$.l...R./.3F....-...k..i.> W..`D..l(?
.wAO.....} ....Z.. .._:i.............,p.J..-...?.M..)[...(vI.\dQ......
...0.5..bo...6..Y.l....h....Zog....X-o7........h.Gv.x..q.j.b5j.;..&...
..B.`.c.Z.F)...#...8...;Z..."....E.2>.|.e..c {.s......7...h..qR..-.
....$.z.T.pv{ ...h.&..d.....".....Y.c..wL#.....Y.....vr.h{?...y....<
;f.......RQU.\UE{7b.....S..%.&rl.9jN..-...MP.m.Z..."/&9Q/..E.#.Dm.....
...y...-...*Zow....UM..../.._J..]K..j1.....LFK..f..$6S.....3.7.K.g
<<< skipped >>>

GET /js/jquery-ui-1.10.3/themes/smoothness/jquery-ui.min.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Cache-Control: max-age=604800

Content-Type: text/css

Date: Tue, 09 Jun 2015 01:24:12 GMT

Etag: "24ba4ff93b88d01:0 gzip"

Expires: Tue, 16 Jun 2015 01:24:12 GMT

Last-Modified: Wed, 06 May 2015 20:33:56 GMT

Server: ECS (fcn/41CE)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

X-UA-Compatible: IE=edge

Content-Length: 5293
.....zJU...=ko.F...Wp7. ..6EI.%cpp....r.m.w_.....S$..........~T7. 8.3#
6....../.....~.......|.....z.\/.S.,.q.....}........./.y.........>.d
.F..5{...|....,...j...il.TW..A.....(..tU.Dz.M....n=..d.u}...0.2..4W_.]
.p3...#..........m.......Xu..t.[.}..s.5Etl..|..C5._.H...P..p.0...k...{
Y......?./.....M.|.AC...5C<..*.....i.cV. ...v@..`.@._..:..V.......n
..H.B....4.F^.SOD....j.3~..r....._.,..W.q.~... .N-c?..\<...]....&..
'?..H..C.~&VT{.....&..U. .l&.v..........}_g.`.!..l..bI.....f?.......ai
?.....j..Z].x.5..m.~.H..tA...`..5..]?.c..8. .....[.w...A<...f.....}
(w...M~....z.6.0Q.A..........>..../.....}...JR...$..e..o.6x[^$YB.a&
lt;...V../0Bu.*U.:...[.....lX&......}vH.f..hW..3....?5..E.=...,.2..v.-
...&....Ai......{..8..%..?.S.i.....-..>...}.9.....*'.@..??..}..A9&g
t;..#}|...4...:...i...y.C~.a*H.g>v..!..n.C...........m....1..U...g.
Le.>o9... .......`.|o!k..i$..U1.(...HZd<......iOc]5.>..b....a
.1...*e.b.>.....!....[...q|.....&Y_V/..)!._a..r$.9.qs...>Hm.t*..
s.\Y7....v#h....F..:..F...._.K.A*.T..<....X..wa....j`a.Xw..;a......
..!._..)....Z..j..........m.-x..Ku..~....R.V............Y\Flf..O...:XC
G..FJ|btA.=.....Y...!.)<. FE.q........[.....|?..'.( |...i.).$..zM..
...9>8#....o8.R1.(.N.1......w..?.{.=....k..CP...5...L.#...W.|n.....
...=(..U:'....W...f..yE...jX0...........T)...[Z......U..q......M .0_.-
..).........W..-...?.2..z.....2V........8n..U.&n0b...[......b. PB...A)
..).._....B`..*....h...b]...i#...L.I.g.W`J.n..0 R.>...tSw....".N...
.S.<......&.L....N......}B.1t..2U.......x.g(fze:3.ih....Z..>
<<< skipped >>>

GET /styles/tbpi.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: text/css

Date: Tue, 09 Jun 2015 01:24:12 GMT

Etag: "d559cf93b88d01:0"

Expires: Tue, 16 Jun 2015 01:24:12 GMT

Last-Modified: Wed, 06 May 2015 20:33:56 GMT

Server: ECS (fcn/419C)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

X-UA-Compatible: IE=edge

Content-Length: 870
...........W.n.0....w.ZUm.8..Y3z.U...]..../.F..4..d..#..f...P...vS..p.
}......?.M/... L*D.....~N.^#.Kh..z....)p."..AL...l.>...G@_..\......
......g.&('t......e..2|..%y.......t.I...0.rDk.%....\.4;r$R...%..^-U.A[
.P.....Zi..w...R.1.hO...Z..leN3.b,l.1..E..6N....H.2.7D.2.|.bh..EQ.X...
.4..&.v.^..W......J!.S.b...P...........|.;..YY.pITk..8..'...._!W......
...m..4...W...h......._n"./........j1g.>...[xp............#........
S..t<..,.._6).H7...m ...... -{.Q.......~...A..J0..J......a......O.7
i.vg.V.^.LI.R,.).!.P..(<..,=.........:D./[email protected].#.<Z.B
.n..;.fL-.].{.\.B....9...........n......7.*.h..BO............B...dQ"5.
..j<.@.^..vR....a}...".4.V..J.....F .;9..mB.b.B*.......PBI.[.....g.
...S....S.N.].%.o..X..0..`..-...F...o#.m..0b......F.N....C....6s...].Y
5d.W[K..ds.#w.....>&.G..@gf..._.H..w.W}=.`[email protected].
.d...W}...3.l..4].6..X..v..Fk.6......y........%1...HTTP/1.1 200 OK..Co
ntent-Encoding: gzip..Accept-Ranges: bytes..Cache-Control: max-age=604
800..Content-Type: text/css..Date: Tue, 09 Jun 2015 01:24:12 GMT..Etag
: "d559cf93b88d01:0"..Expires: Tue, 16 Jun 2015 01:24:12 GMT..Last-Mod
ified: Wed, 06 May 2015 20:33:56 GMT..Server: ECS (fcn/419C)..Vary: Ac
cept-Encoding..X-Cache: HIT..X-Powered-By: ASP.NET..X-Server: Web07..X
-UA-Compatible: IE=edge..Content-Length: 870.............W.n.0....w.ZU
m.8..Y3z.U...]..../.F..4..d..#..f...P...vS..p.}......?.M/... L*D.....~
N.^#.Kh..z....)p."..AL...l.>...G@_..\............g.&('t......e..2|.
.%y.......t.I...0.rDk.%....\.4;r$R...%..^-U.A[.P.....Zi..w...R.1.h
<<< skipped >>>

GET /meter/VVV.shopathome.com/32.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.scanalert.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Cache-Control: public

Expires: Tue, 09 Jun 2015 01:32:40 GMT

Content-Encoding: gzip

Content-Type: image/png; charset=UTF-8

Content-Length: 3038

Vary: Accept-Encoding

Date: Tue, 09 Jun 2015 01:24:13 GMT

Connection: keep-alive
.............8..PNG........IHDR...s..........)!b....IDATx..[yTU...)L..
..)....3.f....9....sj.....=..B..h,.D...^D .0.A.y.AF%......;{..y.M.e...
............=........~A..x.j.:... pxa.......Uz.f....fcS.*..._T...,D.&"
 <.>[email protected]...%e..-....\$.e!>...R3
.$..r .).9H..Fbz&b.....I._...W@.~..C`d............k0}C"..KB....VQ.....
..m...................;..B[.dgg...[...d^]]...h....544.....o.v..e...!  
.M..y....vvETB...55.1^...=.._`.l....yyy.....W(a....;~.8.....hU....(.g.
..Os9......n.j.`Z9....t..m..q....>..........z#~Z............ .....l
...u._..63.....p[....F..Y...nPP.x..'Of... E....Z=.I.&.\...1r.H.?l.0...
..U...<.(...e.......>.....H.jC:m!.M.'l.......|.....f...x8.j....p
T.........H..`.vvv"p}..Auu5.".....\bb"..[...Gc.... --e.....E...|AA....
..{w^#~qq1...0q.D.....x...|.....;.S.N...g...N....d......^..?........;E
9.-.pW....KD^....U..................D*.....A.3f._%...A.....;....=Y....
9..,...WWW..;w..7nD..]..Q.FAOO..V.^......8}.4..m........4..L.._.......
....{.....9..........V..D.K.........U}...............}E.e...!R.BW...d1
].t.....5yL..g.}.|CCC......./.5MMM.O4w.\1.....|..M.1c....>..[...:$.
Tb\....#.'U..`z.....(W.[....Fit......S=...A....`.;d......(Q.,...,EMM..
.G..HKKC.^..5...3...}......_.~.;...A.z...........1.M.6.....7.|.[[[...0
......a...]p....N1.....9/...Pv..jZ(..."/S|...AU........?.v..qRY.....?z
..d...ymm-...={.......p...x}..A.....D...Y.....,.]*mh......q......|....
;..<.......K.,a>.Z.?..`.f..j.v.f.p..f.P....S.6.~.u.=x.........,.
u."..RQ.....*....Sp...8)$G....mn......o.=w.......v.Z.'wG.HW.-[.`..
<<< skipped >>>

GET /dapi/data?type=html;sid=2wtw;ea=sm1;hema=H1:ab247113be1d2e88cf0f9ab5e5e83dcd5eb73b0e,H2:d6d94e6961b4fc3436f61093fc93e02baa21c969,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:f160d6c9d1e34e61ef6b28f1bb94821b,H5:2bd97d990602df657c9cc3e48770437e;_t=1433813056823 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: data.solvemedia.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Date: Tue, 09 Jun 2015 01:24:13 GMT

Server: Apache

X-AC-Origin: ccsphl-prod-82

P3P: CP="NOI ADM DEV PSA PSD UNI COM NAV OUR STP"

Set-Cookie: _sscn_a=4-2o-LlvrdedAcKufnywH3KFc2HYc7t2; domain=.solvemedia.com; path=/; expires=Fri, 06-Jun-2025 01:24:13 GMT

Location: hXXp://data.solvemedia.com/dapi/data?type=html;sid=2wtw;ea=sm1;hema=H1:ab247113be1d2e88cf0f9ab5e5e83dcd5eb73b0e,H2:d6d94e6961b4fc3436f61093fc93e02baa21c969,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:f160d6c9d1e34e61ef6b28f1bb94821b,H5:2bd97d990602df657c9cc3e48770437e;_t=1433813056823;cm=1

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=iso-8859-1
1eb..<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<HTML
><HEAD>.<TITLE>302 Found</TITLE>.</HEAD><
;BODY>.<H1>Found</H1>.The document has moved <A HREF
="hXXp://data.solvemedia.com/dapi/data?type=html;sid=2wtw;ea=sm1;hema=
H1:ab247113be1d2e88cf0f9ab5e5e83dcd5eb73b0e,H2:d6d94e6961b4fc343
6f61093fc93e02baa21c969,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c
0,H4:f160d6c9d1e34e61ef6b28f1bb94821b,H5:2bd97d990602df657c9cc
3e48770437e;_t=1433813056823;cm=1">here</A>.<P>.</BO
DY></HTML>...0..

GET /377928.gif?partner_uid=36302d85af4ad3658de8bf6afa9798c3 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: idsync.rlcdn.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: no-cache, no-store

Content-Type: image/gif; charset=ISO-8859-1

Date: Tue, 09 Jun 2015 01:24:15 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Location: hXXp://idsync.rlcdn.com/377928.gif?partner_uid=36302d85af4ad3658de8bf6afa9798c3&redirect=1

P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"

Set-Cookie: ck1=ck1;Domain=.rlcdn.com;Expires=Sun, 06-Dec-2015 01:24:15 GMT

Content-Length: 0

Connection: keep-alive
....


GET /377928.gif?partner_uid=36302d85af4ad3658de8bf6afa9798c3&redirect=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: idsync.rlcdn.com

Connection: Keep-Alive

Cookie: ck1=ck1

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Content-Type: image/gif; charset=ISO-8859-1

Date: Tue, 09 Jun 2015 01:24:15 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"

Set-Cookie: rlas3="JWGz1mVROMa2PMBjJZP0kNyF0aVdC42YYkcLJWXlUX6MyA9jEACu5w==";Version=1;Domain=.rlcdn.com;Expires=Sun, 06-Dec-2015 01:24:11 GMT;Max-Age=15551996

Set-Cookie: rtn1=e8542e9cb55f7be2f86b12932f97ce18;Domain=.rlcdn.com;Expires=Sun, 06-Dec-2015 01:24:12 GMT

Set-Cookie: dids469019338=4c819335e31b367d08a5e897352cba069d6466f72c0fa6ca7f9586d1c7a4482dde65ebf2a70d16c61ad2911ffafb98d5;Domain=.rlcdn.com;Expires=Sun, 06-Dec-2015 01:24:14 GMT

Content-Length: 43

Connection: keep-alive
GIF89a..............

GET /sync?dsp_id=44&user_id=MzYzMDJkODVhZjRhZDM2NThkZThiZjZhZmE5Nzk4YzM HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: x.bidswitch.net

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: nginx/1.7.10

Date: Tue, 09 Jun 2015 01:24:15 GMT

Content-Type: text/html; charset=UTF-8

Content-Length: 0

Connection: keep-alive

Set-Cookie: tuuid=2a99880d-fe09-4942-9d5c-3f458370b122; path=/; expires=Thu, 08-Jun-2017 01:24:15 GMT; domain=.bidswitch.net

P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Location: hXXp://x.bidswitch.net/ul_cb/sync?dsp_id=44&user_id=MzYzMDJkODVhZjRhZDM2NThkZThiZjZhZmE5Nzk4YzM

Cache-Control: no-cache, no-store, must-revalidate

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Pragma: no-cache
....


GET /ul_cb/sync?dsp_id=44&user_id=MzYzMDJkODVhZjRhZDM2NThkZThiZjZhZmE5Nzk4YzM HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: x.bidswitch.net

Connection: Keep-Alive

Cookie: tuuid=2a99880d-fe09-4942-9d5c-3f458370b122

HTTP/1.1 302 Moved Temporarily

Server: nginx/1.7.10

Date: Tue, 09 Jun 2015 01:24:15 GMT

Content-Type: text/html; charset=UTF-8

Content-Length: 0

Connection: keep-alive

Set-Cookie: tuuid=2a99880d-fe09-4942-9d5c-3f458370b122; path=/; expires=Thu, 08-Jun-2017 01:24:15 GMT; domain=.bidswitch.net

Set-Cookie: c=1433813055; path=/; expires=Thu, 08-Jun-2017 01:24:15 GMT; domain=.bidswitch.net

P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Location: //simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0NSZ0bD0xMjk2MDA=&piggybackCookie=2a99880d-fe09-4942-9d5c-3f458370b122

Cache-Control: no-cache, no-store, must-revalidate

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Pragma: no-cache
HTTP/1.1 302 Moved Temporarily..Server: nginx/1.7.10..Date: Tue, 09 Ju
n 2015 01:24:15 GMT..Content-Type: text/html; charset=UTF-8..Content-L
ength: 0..Connection: keep-alive..Set-Cookie: tuuid=2a99880d-fe09-4942
-9d5c-3f458370b122; path=/; expires=Thu, 08-Jun-2017 01:24:15 GMT; dom
ain=.bidswitch.net..Set-Cookie: c=1433813055; path=/; expires=Thu, 08-
Jun-2017 01:24:15 GMT; domain=.bidswitch.net..P3P: CP="NOI DSP COR NID
 CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"..Location: //si
mage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9Mjk0
NSZ0bD0xMjk2MDA=&piggybackCookie=2a99880d-fe09-4942-9d5c-3f458370b122.
.Cache-Control: no-cache, no-store, must-revalidate..Expires: Mon, 26 
Jul 1997 05:00:00 GMT..Pragma: no-cache..

POST /RequestHandler.ashx HTTP/1.1

Accept: */*

Content-Type: application/octet-stream

User-Agent: SelectRebates

Host: tbws.shopathome.com

Content-Length: 565

Cache-Control: no-cache

Cookie: SAHSessionID=3f4ceff9-b5d4-41d0-9ee4-2133816cf7a7; SAH=REFER=91098&SRC=REBATE; sahdsp=tbinstalldate=6/8/2015 7:24:09 PM; SolveMedia=H1:ab247113be1d2e88cf0f9ab5e5e83dcd5eb73b0e,H2:d6d94e6961b4fc3436f61093fc93e02baa21c969,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:f160d6c9d1e34e61ef6b28f1bb94821b,H5:2bd97d990602df657c9cc3e48770437e; SaagId=2b843fe1-f9ed-4d07-96b0-e065831d25ec; CookieCheck=Y; SAHtbpi=showconversion=false; _ga=GA1.2.1016185637.1433813056; _gat=1; optimizelySegments={"172491114":"direct","172437468":"false","172419741":"ie","172406886":"none"}; optimizelyEndUserId=oeu1433813055995r0.939980092456386

cmd=ar0&xml=<?xml version="1.0" encoding="utf-8" ?><AlertRequest><Cust><GUID></GUID><Id>52113991</Id></Cust><Dog><GUID>{FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}</GUID><Ver>5.2.0.0</Ver><TbVer>5.2.0.0</TbVer><Prefs>1</Prefs></Dog><Requests><Request><Type>Favorites</Type><Id>5</Id><Src></Src><String></String><LastFavorites>-1</LastFavorites><LRFav>-1</LRFav><OpenTime>1</OpenTime></Request><Request><Type>Checkin</Type><Id>6</Id&g
HTTP/1.1 200 OK

Connection: close

Date: Tue, 09 Jun 2015 01:24:13 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: -1

Content-Type: text/xml

Content-Length: 138
<?xml version="1.0" ?><AlertResponse xmlns:xsi="hXXp://VVV.w3
.org/2001/XMLSchema-instance" xmlns:xsd="hXXp://VVV.w3.org/2001/XMLSch
ema" />..

GET /s/noticiatext/v6/dAuxVpkYE_Q_IwIm6elsKDoGYR7Z3iWH66EXnaJoKgg.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/eot

Last-Modified: Wed, 27 Aug 2014 14:51:34 GMT

Date: Tue, 09 Jun 2015 01:24:11 GMT

Expires: Wed, 08 Jun 2016 01:24:11 GMT

Cache-Control: public, max-age=31536000

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0

Transfer-Encoding: chunked
3bcc............t{eP...........S(.................{qw......o...\2.7.{.
...C....A(.......... ........._........R.T...R`......w ..c..%.#..`.0./
L..j.,.^.U..T...h....Y........p./w.8..e.....s..X..o'......W.V..'.....x
..<...X......,.|Id..g.7.,....<i.).x.p...r...amYtF.B)$.(jK..9..M.
<-S&.......i.^.4.\.....\.Xs[C.a{..h.....V....O...57d...:.l.7....x..
....?.6.. .C.V.@..$X...J......b!..N..o.F...[]... ?G.E.e......N.|.....u
./ao...Ms... :v.p..x.EPw1.0.k..h....V......Q.b.73.g2..I.'....Gr$..)$`.
......S.6..}21IU..x.]..v....G.NG.'%;e].h.o.......}pr-.......QS ..J.wN.
a.e..N....U4...m....#....&<.ZQ...B1...."&.....%[..u..&.l=L !,a.... 
j).,..*.0..x.n..,fx..4.y.........Wd~;..vW..2......B6WK....2.-......,..
\......u...9vN~/v.V#zrXOT-.......^7....v......?OG.|...P|....u.....&LC.
V....d.JZ.?i.......8..k.s.{.O..\.m...h..9.s.;1.E..*.R.....H|..R.Vy..'R
...kF...M..$5N.I.~.-.^.:.....G..0;....*d.v..h.0Y.r.p$.e0:r...F...OX...
SX'W..Gj..w...$..5J.._*(.Y.P%.."..,......A..6.'"].f ..2=VV.....Qk.x.lA
.7o!K.T...u1..p?7H&...%2..E/./9.#.pZ..T...@&c.....w.Y..>...6W.Q.!X.
..."|..y.....aH.9P7.a.L..L-..Biw. SY._Z...s.2.6`w-.....V...z..sXKzHI..
V...&.... . ....qd.............1...p.L.i..D.T....*.]..E}E$.8...{(.....
.F..`.l.1..6....._P.....i.GG.Pu....6.O.Yj....L.1S...v...h.z.._.....f..
...h  .v.....N..[.B.......!......].......g..V.@.".qt.N.T.5.b1. 8./....
...T.......ox-.b6j.e.......17/........./......tD....~.......:..\.q....
.ye.I,...N.B...........,..>.I..1...A..@E1nF..............]u_'q..b."
....|G_..Pd.............x3.nhZ.LZ.......E....)......J..fn.Hy... ..
<<< skipped >>>

GET /agent/agentprefs_.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: VVV.shopathome.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Last-Modified: Tue, 12 May 2015 17:09:39 GMT

Accept-Ranges: bytes

ETag: "80bfe6dd68cd01:0"

Server: Microsoft-IIS/7.5

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web09

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Tue, 09 Jun 2015 01:24:02 GMT

Content-Length: 1080
..1....?"[email protected]&d../....=d;....]z.`.*.... .....d..(..$%..R]......
...8w-..n. ...Up.Z.TKOX.p..P....=9..M..?.."...$j.H..;..gw..f.U........
pf..[\.....r......hE.....a=.o.]P,..f.5..6...D.;5BP.wTH.....Z..P,:....&
gt;..4.8...3...jg.$...n.....3]...l.T<....3.S."...2.[...k.~.NB...=..
....j.YFcJ[..%...Y...ES<........'..dh.S...A}R.oa<.M9.m.. ...(..t
...O.k..T22j........-3j,...b...(m=.14.."..mO.n.>[email protected]...
.U..-.Nu. .^..0.S........Q...$!4.....:..p.!......s...wo..f.....n?Ft..?
..O.cP......{.I.,..m.Pd,.V........."..c.....v..s..%.....l...2j........
._....._1-...U........i ......>.k&([email protected].?....{.}......ei-..
&].`.-U. s.....V..^............I..E}.A_.b1.X!.Zy..Ig.G....^.TJ7.?.l..V
..<.KZ....|.....dDZ.f....U;.s.2...='Cw......I......G.....s@>....
K....1.t..rH.8k....q.... .{.q>.....88.....S..TH.O..<!....u].....
...<.w......(l.(.......%D...].....o....Y.:...E..g9.....x.....].K{.Q
....u.d..u..R "n}kVCC .;.b2d..W (........k.1.&.......f.9..^.V`.l...IN.
.>.C.{.0.D.J%.?......'! 7z..........4Q@;.. ..8|..............I....{
.:.H.Z#.b.<.~.k....S.....6.=3.B........5.y.'.VD..-~UJ.....s.hZA...H
TTP/1.1 200 OK..Cache-Control: max-age=86400..Content-Type: applicatio
n/octet-stream..Last-Modified: Tue, 12 May 2015 17:09:39 GMT..Accept-R
anges: bytes..ETag: "80bfe6dd68cd01:0"..Server: Microsoft-IIS/7.5..P3P
: CP="NON DSP COR CURa ADMa OUR NOR PUR"..X-Server: Web09..X-Powered-B
y: ASP.NET..X-UA-Compatible: IE=edge..Date: Tue, 09 Jun 2015 01:24:02 
GMT..Content-Length: 1080....1....?"[email protected]&d../....=d;....]z.
<<< skipped >>>

GET /install/setup5200.cab HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: toolbar.shopathome.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: application/octet-stream

Last-Modified: Mon, 01 Nov 2010 21:15:16 GMT

Accept-Ranges: bytes

ETag: "0a19e197acb1:0"

Server: Microsoft-IIS/7.5

Set-Cookie: SAHSessionID=f2b0de03-8df4-4671-9ab1-2ce291f4a99a; domain=shopathome.com; path=/

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web09

X-Powered-By: ASP.NET

Date: Tue, 09 Jun 2015 01:23:50 GMT

Content-Length: 485875
MSCF.....i......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /install/toolbar5200_ff.cab HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: toolbar.shopathome.com

Cache-Control: no-cache

Cookie: SAHSessionID=f2b0de03-8df4-4671-9ab1-2ce291f4a99a

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Mon, 01 Nov 2010 21:15:04 GMT

Accept-Ranges: bytes

ETag: "0fcf1d997acb1:0"

Server: Microsoft-IIS/7.5

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web09

X-Powered-By: ASP.NET

Date: Tue, 09 Jun 2015 01:23:53 GMT

Content-Length: 358086
MSCF.....v......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /w/1.0/sd?id=537103138&val=36302d85af4ad3658de8bf6afa9798c3 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: us-u.openx.net

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Set-Cookie: i=0a91a494-bd0c-4c00-8a66-8553ecd45a8a|1433813055; Version=1; Expires=Wed, 08-Jun-2016 01:24:15 GMT; Max-Age=31536000; Domain=.openx.net; Path=/

Server: OXGW/10.92.20

P3P: CP="CUR ADM OUR NOR STA NID"

Location: hXXp://us-u.openx.net/w/1.0/sd?cc=1&id=537103138&val=36302d85af4ad3658de8bf6afa9798c3

Date: Tue, 09 Jun 2015 01:24:15 GMT

Content-Length: 0

Connection: close

GET /css?family=Roboto:300,700,400|Fjalla One|Noticia Text:400italic HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css

Timing-Allow-Origin: *

Expires: Tue, 09 Jun 2015 01:24:11 GMT

Date: Tue, 09 Jun 2015 01:24:11 GMT

Cache-Control: private, max-age=86400

Content-Encoding: gzip

Content-Length: 288

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=0
[email protected]...."....A.4K........h...*..cb<.;.g....4
V"...Z".sJ..:..I.R...(.....J8DC.ruLs!.%:...}f..!.L.,.W....S..r.a5.....
.....4 .....0c^.......<..s#^..Y20.ar3..U.xZ/...?..`.Irr'..&/. ..E^.
.qG..F..u..z....zy/eB.A......B>v.s...a............................k
....^6.~.#.Z.....HTTP/1.1 200 OK..Content-Type: text/css..Timing-Allow
-Origin: *..Expires: Tue, 09 Jun 2015 01:24:11 GMT..Date: Tue, 09 Jun 
2015 01:24:11 GMT..Cache-Control: private, max-age=86400..Content-Enco
ding: gzip..Content-Length: 288..X-Content-Type-Options: nosniff..X-Fr
ame-Options: SAMEORIGIN..X-XSS-Protection: 1; mode=block..Server: GSE.
.Alternate-Protocol: 80:quic,[email protected]...."....
A.4K........h...*..cb<.;.g....4V"...Z".sJ..:..I.R...(.....J8DC.ruLs
!.%:...}f..!.L.,.W....S..r.a5..........4 .....0c^.......<..s#^..Y20
.ar3..U.xZ/...?..`.Irr'..&/. ..E^..qG..F..u..z....zy/eB.A......B>v.
s...a............................k....^6.~.#.Z.......

GET /fr/u.php?t=2592000&p=443937282305007&m=MzYzMDJkODVhZjRhZDM2NThkZThiZjZhZmE5Nzk4YzM HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.facebook.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: public, max-age=0

Expires: Mon, 08 Jun 2015 18:24:15 PDT

Date: Mon, 08 Jun 2015 18:24:15 PDT

X-XSS-Protection: 0

Content-Type: image/gif

X-Content-Type-Options: nosniff

Pragma: public

X-UA-Compatible: IE=edge,chrome=1

Vary: Accept-Encoding

Content-Encoding: gzip

X-FB-Debug: 2NEZVt1tgi0Ppup lGtY5oL8dOkMEH3NL0XNsaK4UoMv/mtTPrfZiu9zog4MNbLGPNHw IeHLgUmwt474Xtzpg==

Transfer-Encoding: chunked

Connection: keep-alive
2f............r.t..Ldd`dh`....,. Z.D.d...\...........a....v.h. .....0.
.HTTP/1.1 200 OK..Cache-Control: public, max-age=0..Expires: Mon, 08 J
un 2015 18:24:15 PDT..Date: Mon, 08 Jun 2015 18:24:15 PDT..X-XSS-Prote
ction: 0..Content-Type: image/gif..X-Content-Type-Options: nosniff..Pr
agma: public..X-UA-Compatible: IE=edge,chrome=1..Vary: Accept-Encoding
..Content-Encoding: gzip..X-FB-Debug: 2NEZVt1tgi0Ppup lGtY5oL8dOkMEH3N
L0XNsaK4UoMv/mtTPrfZiu9zog4MNbLGPNHw IeHLgUmwt474Xtzpg==..Transfer-Enc
oding: chunked..Connection: keep-alive..2f............r.t..Ldd`dh`....
,. Z.D.d...\...........a....v.h. .....0..

GET /dapi/data?type=html;sid=2wtw;ea=sm1;hema=H1:ab247113be1d2e88cf0f9ab5e5e83dcd5eb73b0e,H2:d6d94e6961b4fc3436f61093fc93e02baa21c969,H3:05c3ae107b3d826b7d00ff4a81e06c9fbcfbb6c0,H4:f160d6c9d1e34e61ef6b28f1bb94821b,H5:2bd97d990602df657c9cc3e48770437e;_t=1433813056823;cm=1 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: data.solvemedia.com

Connection: Keep-Alive

Cookie: _sscn_a=4-2o-LlvrdedAcKufnywH3KFc2HYc7t2

HTTP/1.1 200 OK

Date: Tue, 09 Jun 2015 01:24:14 GMT

Server: Apache

X-AC-Origin: ccsphl-prod-151

P3P: CP="NOI ADM DEV PSA PSD UNI COM NAV OUR STP"

Set-Cookie: _sscn_b=2@b2@zjc1iocNcreR5tBgMqGPmrjxaLx4k6Sl7GfJ-N1GG0J9BzrUEtld9XGhTwz9YSD-hyjhPqC1RI8M03WYcesAL6LrUXX.oDgIcdCWD6cQOJMOr4xoLzytra13EjDD7gpac9M0RiIgyB-7.216ERNCvhY64uh0gqshq5wzV.adB2vRko4YvQjNJjgn-0tY.1MQTBZB02YzXxZF5ciNe9MHfAYf73BQkLPyqxLkeOVjmlQ; domain=.solvemedia.com; path=/; expires=Thu, 09-Jul-2015 01:24:14 GMT

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=utf-8
46 ..........<html><head></head><body>.<scr
ipt>..</script>.</body></html>....0..

GET /js/91114986.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.optimizely.com

Connection: Keep-Alive

HTTP/1.1 200 OK

x-amz-id-2: nLv3bpNUZCYqDVcfskoNHKq1qSogZwuG4twenY0nXgeWY4Wz U73zuK1JJ1zXxdYVVC cBQ4Cu0=

x-amz-request-id: 3D13FF5AE160D537

Content-Encoding: gzip

ETag: "15d3545a333cef4d6e80c918d626baca"

Accept-Ranges: bytes

Content-Type: text/javascript

Content-Length: 105852

Server: AmazonS3

Cache-Control: max-age=120

Date: Tue, 09 Jun 2015 01:24:12 GMT

Connection: keep-alive

Vary: Accept-Encoding

Timing-Allow-Origin: *
......uU...}k{...... [email protected].}z.......'.EB6.ITI*.WW....)^$R...
d.^{......`.....?.....g.'........?........)...../[email protected]....
[email protected].$&.....G...............G?;=......
~...........h.D.B..}zp.......<....#.d..lG........o...g...........q~
r~..........zp........o.........wx...l,&Q...w......<.E\..0=...<.
...O.G..O....<..k......_.y...O..<.px....{GP`.....0.......it=....
_~I..k.j.._~yx.......................N...?.O9.QP.....s......lf.x.28../
......... .>t.....Og....,...=..h.G%........S..........M...<8z"..
......._/D.b$.c....}..=...X...w..\......AN...[J....N.M#x-4.4..A$>D'
......\....s......9u..0..Z.......c..zA.=..F...<.a;....{............
.|.......F...K?.....~v.........Go..i .......}@..[.j.........(...<&g
t;99..........Mx.O.......O:??..BD.?....f...'..........9...............
.]/t.......=q._..*......Qt~....Z...P*.8n...uf......uvF.....w.....?....
........~.y.w.........f.w...0y.........D..n..|G......&#.v.D..5S1....O"
xN,.e.w..B._.......t.....Vj..%.].8.<T.....{N.........aQ*.~.g..Q,...
c..C......7Rfj.....o.....y...3,n....mO....{/...[..y.^....\.4]>.vK%M
.[..j..xPCp.^..#..^.V..4......4..CeP/........3.e.{Ba...\w:e<yXl.0..
.......E.D..m......... ......r..P.)UL.\[email protected] ..Yj,.f...oA.
St=.x.Y.eO..5..oe.O..iR..E...R.P.3nPJ.1...N.......Q.P...S..:-..7L...N.
.H..3..............C-.n.[y.%u.R..p..F.....[.".0j(.......p..|:.n<q..
.T.i....U..\...o....cY..X...d...,j.ZJ.....s."p;...[eF.?DU-E.y,._..Tq..
.......'.J-..K....I...){../.i...f.x...-s...2....... .#OR1...J...fa
<<< skipped >>>

GET /images/circle-step-1.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Tue, 09 Jun 2015 01:24:12 GMT

Expires: Tue, 16 Jun 2015 01:24:12 GMT

Last-Modified: Wed, 03 Jun 2015 01:57:43 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/8732)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

Content-Length: 2302
.PNG........IHDR...2...2......?......tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:7B6DFDEEEFF211E4BF4D
CBB8829BA22F" xmpMM:DocumentID="xmp.did:7B6DFDEFEFF211E4BF4DCBB8829BA2
2F"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7B6DFDECEFF211
E4BF4DCBB8829BA22F" stRef:documentID="xmp.did:7B6DFDEDEFF211E4BF4DCBB8
829BA22F"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>.)jb...nIDATx..Z]lTE.>..vw.nK..1-..M
I.Z..........P....6.}2..k.1.......6D..> 1.....!."D.V..Z.-..ve......
;w.....{{w..I....;s.9sf.......d.T2....ZF5c...aax.......>F/c.....|..
..he..([&......9.!...%..X.Z.....q..$..._1.f.M..T..`t1~a..HB..E..%.J...
9....O.Xd...M...3>bt3J)sR*..#uX.."..F;eO..:..%.b...a.%.R.W.D.e/l..#
...D.,.:.>.......\k.!.c)........_..f....?. ^.WAs.cf.... .P.g..Z>
....*Z.. 1....Y....^ZKV.......%M...3.Z.Y......5...F.!........a..w....s
......&{.j......>Q.roPV...dsU....'.,...;..D ...'.....P..=..A.(.F...
..B.(.\.-.|..V..I.......rx...n*.....a...vQ...dj|.x2..B...c........
<<< skipped >>>

GET /images/ie-example-window.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Tue, 09 Jun 2015 01:24:13 GMT

Expires: Tue, 16 Jun 2015 01:24:13 GMT

Last-Modified: Tue, 02 Jun 2015 22:12:36 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/876D)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

Content-Length: 71837
.PNG........IHDR...x.........~..G....tEXtSoftware.Adobe ImageReadyq.e&
lt;...&iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CC 2014 (Windows)" xmpMM:InstanceID="xmp.iid:0560E718F02411E48589
C5FE8DA4E7BF" xmpMM:DocumentID="xmp.did:0560E719F02411E48589C5FE8DA4E7
BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0560E716F02411
E48589C5FE8DA4E7BF" stRef:documentID="xmp.did:0560E717F02411E48589C5FE
8DA4E7BF"/> </rdf:Description> </rdf:RDF> </x:xmpmet
a> <?xpacket end="r"?>|.......IDATx.....\Wu5.n.>.w..w....e
..wc.....K...@.!../...G.!...0.36..c..^%.Y......3...>3w4o........h..
...{..Y{.}..Gq].......y.t.^fR.S(..4P./.F*.T.TB...T....da[..I...tQ.Eeg.
[email protected].......$x..I......*[email protected]*..T^..]..$x.....:...T..r.....'
.%..<G..*ORy..?...$x..I.y......r:....C.C1..(:...oT}P..\;.8...Xq....
..~...<O.~*.PyQ*|I...'..W...T.B...}..'."n-<.jp&.`..R.P.7.g5P.s.o
...:Y".~..>8..8..*.a...I......J...N*.R.5.>.}Z~.$.KHL7R..H.O.\I%0
....lh...G.A.,.E.4O.}8.....`..l....0....n~C.........%$$.2.....R..Jd..&
lt;..b.u.@.;.F....';.l'...a........G.4T~L..D..J.....*.....T.C..a..
<<< skipped >>>

GET /images/bttn_continueshopping.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Tue, 09 Jun 2015 01:24:13 GMT

Expires: Tue, 16 Jun 2015 01:24:13 GMT

Last-Modified: Fri, 05 Jun 2015 02:14:43 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/8759)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

Content-Length: 4797
.PNG........IHDR.......J......t.<....tEXtSoftware.Adobe ImageReadyq
.e<....PLTE(\..!c.=.#H..C........c.......v...K.......0R.h...,......
.....;..6.(M..C................i}..6..........$P.....9....q..<]....
.........Dd.EX...........0.Ki.Zv...."T..6.yyyc}.. .h|..0.G`.Sq..4....0
e.,\.....7..0.Qn.}...=.Rk.*Y.$S.y...6..3.....2../.\p....4V..8....5P..2
....7Y..........eu..4.(V._y.Uf.Hf.A_..7..>.0Dy/`.......u..=Y.n...N.
Yu.......v..$@....'X..3.......7X.9Q.......9Y..........\ 6.....IDATx...
._.H..... ..... ...j-6F..hi.....)b...S..<..b..gfv......<w.....f7
;_ff7.D.."........`..0..'.....-j... .........!.6.'....ZJ......P2..E.&n
....;&..`.N..o............xG0..i...m.)w"b0...C...$m..M...:....b.~r.I#.
.D...U.2....1.&!Ot.p#.. ..A...{.>...........&..p..l.k.....g.L.v=<
;.S .(....5..8.7....c]s....m.<...T&!O=...H.3...~(.J..,..W-.5."%jL.&
lt;Q-.]s =...A..<..(t.n..DY..^Z../?.~>.........e.>`WI:....N.2
*...I...Jss.8.(..[,.?....{..5..uw..5.......................V....H4.S%R
.b..!...)e2s.l......g........p9y..:.B...0..?.......h...V.ei."..K...&l!
.1 ....X.................V.!.8d4,.8.gf....w.]....Y.d..,..U$..C=.C.-.e.
... .r/.I,%.....a@2?s.T>..,[email protected]...(..A;.9.....q...G.<
;d*.....H%..........md.P..ry..e..H....33.c{.x\\tvv..@*....`.|ZaH..j..x
.xB^.b.F.aJ.D... .a...2sL`Z_3.*[email protected])....p..o....:5fL|..
.I...p.r.~^...b.......v.......<..p.B.p ." ..Hd..8.$....>.x......
.... ..|..bpp.2.0radZ\.O.A8.?8.A. [email protected]'.!.J.."[email protected].!q..........F
.u..9.cO.......r*..ai...l.6Ar.....R.<.s.4.z(..*..r...4D..E]..
<<< skipped >>>

GET /Images/landing/machine-and-animation1.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/gif

Date: Tue, 09 Jun 2015 01:24:13 GMT

Expires: Tue, 16 Jun 2015 01:24:13 GMT

Last-Modified: Fri, 05 Jun 2015 02:03:06 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (frf/8752)

X-AspNet-Version: 4.0.30319

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web03

Content-Length: 126390
GIF89a........p........y'..gW..........D555l-.ccc.K...3FFF..$..[VVV%%%
........nnL..s..e...p....{...5.Rs..6,.............v.S$./*Q....B..#....
.......E..O........(.....6..H..t....uOW&...F...c.u..7.Jh..s.i-........
...h.......{......B..h....{......u.....Z..(...........5../..N.."..U..U
.....e.....k.. g...\[..j........F....x............$.."..xuoF..Y.B]..).
.U......=...ly.....T..4...K}t.....F....h.H...Rk........k.].)OO..D0 .Si
M........4.....g..%.k.....h...v.........q8......*..F.cx...#Yc.SeN9..&g
t;...2....Ys......}OE.r.62#......JRt........[.>@.x~.....1......@SD^
W:.......................E...6c].....V..>..70)...8|..L4O....Ja..)..
...8...8?b.....s..{..Q........R........{..*..)..Z.....N.Z|..!.....^..{
..[...........R..............r........!..O.....,........b..W..Z<ZNT
J-..........{..........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket b
egin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="a
dobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-
19:44:00        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02
/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="
hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/
1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM
:OriginalDocumentID="xmp.did:a7ba2afb-8184-944a-9d3c-a10ac86d2a77" xmp
MM:DocumentID="xmp.did:0F5430A018D611E4B3BEE4ECA4D565FE" xmpMM:Instanc
eID="xmp.iid:0F54309F18D611E4B3BEE4ECA4D565FE" xmp:CreatorTool="Adobe 
Photoshop CC 2014 (Windows)"> <xmpMM:DerivedFrom stRef:insta
<<< skipped >>>

GET /nr-632.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js-agent.newrelic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

x-amz-id-2: yWgugdxWrLnRwLb6GwW6gRo6PNydo9tpyD27uavniTfQM90rZNj6UZx4J2hDWJFu

x-amz-request-id: 7525EE751B89A3AE

Last-Modified: Mon, 23 Mar 2015 23:49:49 GMT

ETag: "f9cdcb1e4b2be3825b6dfcbd33deff25"

Content-Type: application/javascript

Server: AmazonS3

Content-Length: 22469

Accept-Ranges: bytes

Date: Tue, 09 Jun 2015 01:24:14 GMT

Via: 1.1 varnish

Connection: keep-alive

X-Served-By: cache-ams4128-AMS

X-Cache: HIT

X-Cache-Hits: 372

X-Timer: S1433813054.387059,VS0,VE0

Vary: Accept-Encoding

Cache-Control: public, max-age=3600
!function(e,n,t){function r(t,i){if(!n[t]){if(!e[t]){var a="function"=
=typeof __nr_require&&__nr_require;if(!i&&a)return a(t,!0);if(o)return
 o(t,!0);throw new Error("Cannot find module '" t "'")}var u=n[t]={exp
orts:{}};e[t][0].call(u.exports,function(n){var o=e[t][1][n];return r(
o?o:n)},u,u.exports)}return n[t].exports}for(var o="function"==typeof 
__nr_require&&__nr_require,i=0;i<t.length;i  )r(t[i]);return r}({1:
[function(e,n){n.exports=function(e,n){return"addEventListener"in wind
ow?addEventListener(e,n,!1):"attachEvent"in window?attachEvent("on" e,
n):void 0}},{}],2:[function(e,n){function t(e,n,t,o){d("bstAgg",[e,n,t
,o]),m[e]||(m[e]={});var i=m[e][n];return i||(m[e][n]=i={params:t||{}}
),i.metrics=r(o,i.metrics),i}function r(e,n){return n||(n={count:0}),n
.count =1,c(e,function(e,t){n[e]=o(t,n[e])}),n}function o(e,n){return 
n?(n&&!n.c&&(n={t:n.t,min:n.t,max:n.t,sos:n.t*n.t,c:1}),n.c =1,n.t =e,
n.sos =e*e,e>n.max&&(n.max=e),e<n.min&&(n.min=e),n):{t:e}}functi
on i(e,n){return n?m[e]&&m[e][n]:m[e]}function a(e){for(var n,t={},r="
",o=0;o<e.length;o  )r=e[o],t[r]=u(m[r]),t[r].length&&(n=!0),delete
 m[r];return n?t:null}function u(e){return"object"!=typeof e?[]:c(e,fu
nction(e,n){return n})}function s(e,n){"undefined"==typeof n&&(n=(new 
Date).getTime()),p[e]=n}function f(e,n,r){var o=p[n],i=p[r];"undefined
"!=typeof o&&"undefined"!=typeof i&&t("measures",e,{value:i-o})}var c=
e(1),d=e("handle"),l=e(2),m={},p={};n.exports={store:t,take:a,get:i,ma
rk:s,measure:f},setTimeout(function(){l("bstAgg",function(){})},1e
<<< skipped >>>

GET /pxj?bidder=172&seg=802787&action=setuid('MzYzMDJkODVhZjRhZDM2NThkZThiZjZhZmE5Nzk4YzM') HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Content-Length: 43

Content-Type: image/gif

Set-Cookie: sess=1; Path=/; Max-Age=86400; Expires=Wed, 10-Jun-2015 01:24:15 GMT; Domain=.adnxs.com; HttpOnly

Date: Tue, 09 Jun 2015 01:24:15 GMT
GIF89a.............!.......,[email protected]..;HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Content-Length: 43..Content-Type:
 image/gif..Set-Cookie: sess=1; Path=/; Max-Age=86400; Expires=Wed, 10
-Jun-2015 01:24:15 GMT; Domain=.adnxs.com; HttpOnly..Date: Tue, 09 Jun
 2015 01:24:15 GMT..GIF89a.............!.......,[email protected]..;..

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 23:36:34 GMT

Expires: Tue, 09 Jun 2015 01:36:34 GMT

Last-Modified: Wed, 27 May 2015 21:02:55 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11093

Age: 6458

Cache-Control: public, max-age=7200

Alternate-Protocol: 80:quic,p=0
...........}iW....w~E\'.U..e...6.^.L$.I.l.,.$......!....~...28.......j
k...,ux2..i.4.......21C5........x44..8I..C=...d_NO[...7*."..33.e.{2>
;..I..W..[......2....ZNe ...\N.i ~.$...i fI.2#.....S....$....t.......T
.g......M..A..>I..HI.&...9......l46.....l4..%*.$.....F.g..H...bJ.h.
.8........x<.f.Tx6.Z...%....Lh..ht..43..ht...4..i..!........`.Q.f.{
..vDW4.3.M...<..~b.B.....Wc*8.\5..z>.5....NeFH.......c..zi..S.zN
....!r...H...~ONGY ^&..Q.....F{.K.....ZX..*........I|....Nw...:..1...2
..M*u_.n....NFY..-.tE..[...x.m..j.....j(;..d0.*i.a.Mn}.klm..~....mK.f$
....Ov.>{......{...o..;z....._..T...N.?......g6.....]..7.76.<|..
...A.Ne.=....M=j...y... ...'.3..t24.......Z.40E.9J....p|.T.f.TS....F..
$'^h...h............-&.d.P...S..#..5jKZ. BN.Q...nn.U]7..5.F.[...}z.[..
xXQ.L...&.j....1r....<(H.......gK.vF.......L^u..!.c_MGG..;;..B.....
..{....W.$ruu...........sP.E.Li-m...{k.\ .....L..di?.-;oU7.}..O...z.z.
...z..j..\L.......h..s.C ./q....N.0sr..Dz4.s1...5.......R...T.P...]f..
..k......N.-L_(..lgW.2.Z?. ....L..d...0. JT*:jR.t*.)....|....*5...8Bh.
k...h>.....1..P,.&*....N.6....i......2..j....41.R"(*&.B....d.......
[email protected]<.....a....Y..:e&.bh..ty...=.N..&m....n.Yw.~-,...AP..s
..`......8.hC=.......Z.ibb\&.L."4..q...q..V.w....a.o...A.V..b6E......$
Q77..o..I......F"......m.K? ...}O.>...K...P.WD.....B.:..{...O......
.$N%......}j.Z.6D..3D...n."u...6M.`E=:#..?......Y:=PI.....$....`b..f3\
BR.-..!.....c.vf.&D([.q.a`Bs.........Yq.K.t..L.m.u..U..i..j..-.n.j7T..
f.5..F.4..<.......st.........KK..`%*ji...H1..........t.}.\.8..d
<<< skipped >>>

GET /r/collect?v=1&_v=j37&a=189529769&t=pageview&_s=1&dl=http://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&dp=/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=&sahusertype=nonauth&ul=en-us&de=utf-8&dt=Toolbar&sd=32-bit&sr=1276x846&vp=1256x669&je=0&fl=11.6 r602&cn=960115915&cm=91098&_u=QEAAAEAAK~&jid=1067047784&cid=1016185637.1433813056&tid=UA-2915199-1&_r=1&z=1209533970 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, de
HTTP/1.1 302 Found

Location: hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2915199-1&cid=1016185637.1433813056&jid=1067047784&_v=j37&z=1209533970

Access-Control-Allow-Origin: *

Date: Tue, 09 Jun 2015 01:24:12 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

Content-Type: text/html; charset=UTF-8

Server: Golfe2

Content-Length: 368

Alternate-Protocol: 80:quic,p=0
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXps://stats.g.doubleclick.net/r/collect?v=1&aip=1
&t=dc&_r=3&tid=UA-2915199-1&cid=1016185637.1433813056&
amp;jid=1067047784&_v=j37&z=1209533970">here</A>...&l
t;/BODY></HTML>..HTTP/1.1 302 Found..Location: hXXps://stats.
g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-2915199-1&cid=1
016185637.1433813056&jid=1067047784&_v=j37&z=1209533970..Access-Contro
l-Allow-Origin: *..Date: Tue, 09 Jun 2015 01:24:12 GMT..Pragma: no-cac
he..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, n
o-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT
..Content-Type: text/html; charset=UTF-8..Server: Golfe2..Content-Leng
th: 368..Alternate-Protocol: 80:quic,p=0..<HTML><HEAD><
meta http-equiv="content-type" content="text/html;charset=utf-8">.&
lt;TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>
;302 Moved</H1>.The document has moved.<A HREF="hXXps://stats
.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=U
A-2915199-1&cid=1016185637.1433813056&jid=1067047784&_v=j3
7&z=1209533970">here</A>...</BODY></HTML>..font>....
<<< skipped >>>

GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 08 Jun 2015 23:31:22 GMT

Expires: Tue, 09 Jun 2015 01:31:22 GMT

Last-Modified: Wed, 27 May 2015 21:02:55 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16075

Age: 6771

Cache-Control: public, max-age=7200

Alternate-Protocol: 80:quic,p=0
...........}.W........_/.>.!aj..f....--....Y.!MHB.0....o..-'.......
{K..y.....d.Wig.....r.H.P.. ............"..a?..;..P2...C.R.&..e....o.e
x"...e.....[..C.K...G:....de...d.F.,..|.=..Fn..9..//5$X...Co..=..'z2..
.`0..%[email protected]...#.^a.......Kh.'.C.....I.]......tp..:.sO...x..
.8...t0<....\b;=. .z.e>.1..#.v.j......<q...#[email protected]...}H1.C..
.R.5...z..XWb.2.t.......B.....[(i.....P...x.....9.nM...."...^.....c.. 
R......t...Z..q.hl......;.c.....9.@g_.(..n.hO....|......t`.|.)H..Z....
.l..f .j......J...%._.KN......Tf..g.^.b....r.I..z...UK.\^^.m....}..DA/
.......g.A........0.........".c0.....$~I....D#......{...}.=..j...m....
@.....k.?$....J..Q......}.g......~...6.l<]..x...d?.\...w.3].._.X@..
|....}.C..$0.|.53...Q.8.....i.0=Vr.h.........<.a>.....4.:...ttg.
.....f....'.T.`=..........a...oB...Q.q......3N5 ..<....R....4......
....K..I.i#..C..$#i....`Ja..:..z.*...O...?..41.!.w}......T............
.........y..pE^r..n....A..............q..`.i>;........ .).......m..
P61I.jK.nG..Vj......9.....2....Tv. ^. ........OZ....U.9399].).,.p..\..
\YW..j3..H%...........e.c.....[[email protected].=...R...
.]....xz.`.<..7........r1..87.....7.iL}u..Yu;T. X..d.GT L Uy.....q}
......./...=. ..<#u%..4h...mZJ......p.m...,,<..4.,o$..E.a&.-qy9Z
^6i-,@...".6.7.......-f;.`..f.2...?./.S<[email protected].%.|.
.:.J5.Vy...........%5....... ..g.*..v..".......K..e0....H.....n..6a...
q..I..8..:.q1`......Z*'[email protected]... X.1.....
.B.km._.Uzr..2.D..2..n..}8.wu.O....38..}5.c.`.. ....`...MC.....#A[
<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.4&utms=1&utmn=46051092&utmhn=VVV.shopathome.com&utmcs=utf-8&utmsr=1276x846&utmvp=1256x669&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Toolbar&utmhid=189529769&utmr=-&utmp=/1394716560/goal&utmht=1433813057089&utmac=UA-2915199-5&utmcc=__utma=57828200.1016185637.1433813056.1433813057.1433813057.1;+__utmz=57828200.1433813057.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=2147369879&utmredir=1&utmu=DACAAAAAAAAAAAAAAAABAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 09 Jun 2015 01:24:13 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 09 Jun 2015 01:24:13 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0..GIF89a..........
...,...........D..;..

GET /js/rac/sli-rac.1.3.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: assets.resultspage.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Wed, 27 May 2015 19:44:14 GMT

ETag: "ed6-5171577ba3f80"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 943

Content-Type: text/css

Cache-Control: max-age=1804726

Expires: Mon, 29 Jun 2015 22:42:57 GMT

Date: Tue, 09 Jun 2015 01:24:11 GMT

Connection: keep-alive
...........W.n.0.}[email protected]..%.I6F.....`..:6.&i...wl !.H...[..5.3..3.J1..
.iiT.....O...*W..(Ih..(....\.7".......W..._(@._.7...[Z. .,.)c S\%J...s
2...aD...P.d~..*.(I.0R...A.....F..&........3.....%..g.3..8..<z.3$2t
.F....2(5.g....f..p...I#q0...o}..90 ..t...=A......._...y<.ah#..|*T.
*._.O...8....= [email protected]..(.. .4
Ym.#.q9....2........>....:..{t..'..p['"...:...96R..p .M.'.|?..n;~..
.....'..N<7..o....Z..F...]Q...I..3....... ...V..%s1D.k.`.....)...LF
...{..Qk=..E..............9.Um....Z].x.`.).j..=P].....E....|Nm.ri..HN.
...gT^/j.L...E.?...`2zZ#.z|.b......b...'.l.....bn ....y.........m..2M.
....^."4.j@/............o.k.a...V..R,..^...nU..[.3.U..~...-}.,....30..
..mg..4.....J{..c\....6...k...=.P..m..{....i.k .;w........&.W.....\?G.
... .M............^.6q.. ....RN....X/.Mr_...Z...Ng.......Z............
...@.;.|Jl.C....>v.....\...b.H#.8..g......u}.*8..5.9w..`S..ao......
..K....w.!.p))...c|...3ZO......f..q.....-xd.....HTTP/1.1 200 OK..Serve
r: Apache..Last-Modified: Wed, 27 May 2015 19:44:14 GMT..ETag: "ed6-51
71577ba3f80"..Accept-Ranges: bytes..Vary: Accept-Encoding..Content-Enc
oding: gzip..Content-Length: 943..Content-Type: text/css..Cache-Contro
l: max-age=1804726..Expires: Mon, 29 Jun 2015 22:42:57 GMT..Date: Tue,
 09 Jun 2015 01:24:11 GMT..Connection: keep-alive.............W.n.0.}.
[email protected]..%.I6F.....`..:6.&i...wl !.H...[..5.3..3.J1...iiT.....O...*W..(I
h..(....\.7".......W..._(@._.7...[Z. .,.)c S\%J...s2...aD...P.d~..*.(I
.0R...A.....F..&........3.....%..g.3..8..<z.3$2t.F....2(5.g....
<<< skipped >>>

GET /ToolbarPostInstall.aspx?oldsessionid=d3bef25c-9314-4811-977f-f14d3fa1e98b&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={FD8F5DC5-6C65-495C-9C38-375A11D7A9B2}&ae=no&source=91098&subsource=2_6671049&setupguid={b027095d-d727-45f2-bbff-ebf0ae8f1538}&setupcid=52113991&cid=52113991&refer=960115915&disabler=-1&tbstatus=1&tbcode=1&tbtext= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache